the best free wordpress plugins of 2026: a complete guide

a curated guide to the free wordpress plugins we’d install on any new site in 2026 — organised by what they do, not by who made them. every plugin on this list lives on the wordpress.org repository, gets active updates, and has been battle-tested on tens of thousands of sites.

i write wordpress plugins for a living (since 2012), and a few on this list are mine — i’ve flagged those clearly so you can take that into account. the rest are recommendations because i actually install them.

tl;dr — the 10 we always install

#	plugin	category	active installs
1	contact form 7	forms	5,000,000+
2	akismet anti-spam	security	5,000,000+
3	site kit by google	analytics	4,000,000+
4	gutenberg	editor	2,500,000+
5	redirection	seo	2,000,000+
6	all in one wp security	security	1,000,000+
7	duplicate post	productivity	1,000,000+
8	secure custom fields	dev	800,000+
9	safe svg	media	400,000+
10	query monitor	dev	300,000+

each of these is detailed below alongside 20+ more, sorted by use case.

how we picked these

four rules for getting on this list:

actively maintained — last update within the last twelve months.
wordpress.org hosted — free to install from the admin, free to keep.
enough scale to trust — at least one of: high install count, high rating, or sustained reputation in the wordpress community.
we’d use it ourselves — every plugin here has either been installed on a site we run, recommended to a customer, or built by us.

i’ll flag plugins built by plugpress so there’s no ambiguity. you can install them or skip them — the rest of the list stands on its own.

page builders & editor enhancements

gutenberg

what it does: the official block editor, shipped as a plugin so you get the latest features ahead of wordpress core.
why it’s here: if you write content for wordpress, you’re using the block editor. running the plugin gives you new blocks and patterns months before core ships them.
stats: 2,500,000+ installs · 4.8★
install: wordpress.org/plugins/gutenberg

generateblocks

what it does: four foundational blocks (container, headline, button, grid) that let you build almost any layout inside gutenberg without page-builder weight.
why it’s here: the lightest performant way to build custom layouts in the block editor. agencies love it because the markup is clean.
stats: 300,000+ installs · 4.7★
install: wordpress.org/plugins/generateblocks

coblocks

what it does: a generous library of design-forward blocks for gutenberg — pricing tables, food menus, click-to-tweet, image galleries.
why it’s here: good middle ground when generateblocks is too minimal and a full page builder is overkill.
stats: 200,000+ installs · 4.6★
install: wordpress.org/plugins/coblocks

divi carousel free (plugpress)

what it does: lightweight carousel module for the divi page builder — slides, autoplay, responsive controls, accessibility-aware navigation.
why it’s here: the most-installed free divi carousel plugin on the repo. we built and maintain it; it’s the free version of divi carousel pro inside the divipeople suite.
stats: 30,000+ installs · 4.8★
install: wordpress.org/plugins/wow-carousel-for-divi-lite

divi torque lite (plugpress)

what it does: a foundational set of divi modules and add-ons — animations, advanced typography, image effects, layout helpers.
why it’s here: the free version of divitorque. installed on 50,000+ divi sites; the most-used set of free divi extras in our category.
stats: 50,000+ installs · 4.7★
install: wordpress.org/plugins/addons-for-divi

forms & conversion

contact form 7

what it does: the original, dependable form plugin for wordpress — flexible markup, email handlers, integrations with most spam and validation services.
why it’s here: five million active installs for a reason. it has no marketing layer, no upsell wizard, just forms. pair it with a styler if you want a polished look.
stats: 5,000,000+ installs · 4.0★
install: wordpress.org/plugins/contact-form-7

cf7mate (plugpress)

what it does: a styler and ux layer for contact form 7 — proper layouts, custom design controls, ajax handling, and divi-aware presets.
why it’s here: contact form 7 is powerful but raw. cf7mate gives it the styling it never shipped with. we built it; the free version sits at 20,000+ installs.
stats: 20,000+ installs · 3.9★
install: wordpress.org/plugins/cf7-styler-for-divi

very simple contact form

what it does: exactly what the name promises — a single shortcode that drops a clean form on any page, with anti-spam built in.
why it’s here: for sites that need one contact form and nothing more. it’s faster to set up than configuring cf7 templates.
stats: 50,000+ installs · 4.5★
install: wordpress.org/plugins/very-simple-contact-form

seo & redirects

redirection

what it does: manage 301/302/307 redirects from the wordpress admin, log 404s automatically, set up regex rules.
why it’s here: the redirect plugin. two million active installs, 4.7★. no other free plugin in this category comes close.
stats: 2,000,000+ installs · 4.7★
install: wordpress.org/plugins/redirection

404 to 301

what it does: automatically redirects 404s to a target page (usually home), with logging and email alerts for repeat 404s.
why it’s here: the lazier sibling of redirection — install, set the destination, forget. good for content sites with frequent url changes.
stats: 200,000+ installs · 4.5★
install: wordpress.org/plugins/404-to-301

external links

what it does: automatically adds target="_blank" and rel="noopener nofollow" (configurable) to all external links across your site.
why it’s here: removes the discipline cost of manually setting link attributes. helpful for editorial teams and any site with frequent outbound links.
stats: 50,000+ installs · 4.5★
install: wordpress.org/plugins/external-links

headingmap

what it does: shows the heading structure (h1–h6) of any page or post — useful for auditing semantic hierarchy and seo.
why it’s here: simple tool that fixes a quiet seo problem. especially useful when migrating content from another cms.
stats: 20,000+ installs · 4.6★
install: wordpress.org/plugins/headingmap

security & anti-spam

all in one wp security

what it does: comprehensive site hardening — login throttling, firewall rules, file system permission checks, ip blocking, database security.
why it’s here: the only all-in-one free security plugin we’d run on a production site without immediately reaching for the paid tier of something else.
stats: 1,000,000+ installs · 4.5★
install: wordpress.org/plugins/all-in-one-wp-security-and-firewall

akismet anti-spam

what it does: automattic’s spam filter — runs every comment and form submission through their service, marks the bad ones automatically.
why it’s here: ships with wordpress; just needs activation and a free api key. the de facto comment spam solution since the early 2000s.
stats: 5,000,000+ installs · 4.3★
install: wordpress.org/plugins/akismet

media & images

safe svg

what it does: lets you upload svgs to the media library safely — sanitises them on upload to strip xss vectors.
why it’s here: wordpress doesn’t allow svg uploads by default for a reason. safe svg is the right way to enable them.
stats: 400,000+ installs · 4.5★
install: wordpress.org/plugins/safe-svg

svg support

what it does: another approach to svg uploads — adds support for inline svg via shortcode and css class targeting.
why it’s here: if you need svgs styled with css (animations, fill changes), svg support is more flexible than safe svg.
stats: 300,000+ installs · 4.5★
install: wordpress.org/plugins/svg-support

regenerate thumbnails

what it does: rebuilds the thumbnail variants for your media library — essential after switching themes or changing image size definitions.
why it’s here: if you’ve ever changed an image size in functions.php and watched layouts break, this is your fix.
stats: 300,000+ installs · 4.4★
install: wordpress.org/plugins/regenerate-thumbnails

force regenerate thumbnails

what it does: like regenerate thumbnails, but additionally deletes the old files first.
why it’s here: lighter on storage when you’ve gone through a few theme migrations and have orphaned thumbnails piling up.
stats: 100,000+ installs · 4.5★
install: wordpress.org/plugins/force-regenerate-thumbnails

developer tools & custom fields

query monitor

what it does: the debug bar for wordpress — shows database queries, hooks, http calls, php errors, asset enqueues, all in one panel.
why it’s here: if you build wordpress sites for a living, you have query monitor installed. there’s no second-best option.
stats: 300,000+ installs · 4.8★
install: wordpress.org/plugins/query-monitor

wp crontrol

what it does: view, run, edit, and add wp-cron events from the admin.
why it’s here: anyone who’s debugged “why didn’t this scheduled task fire” needs this. half the time the bug is one click away from being visible.
stats: 100,000+ installs · 4.6★
install: wordpress.org/plugins/wp-crontrol

secure custom fields

what it does: the official fork of advanced custom fields maintained by wordpress.org — flexible custom field framework for posts, pages, blocks, and options.
why it’s here: custom fields are how serious wordpress sites are built. secure custom fields is the safe, free way to use them.
stats: 800,000+ installs · 4.9★
install: wordpress.org/plugins/secure-custom-fields

productivity & admin

duplicate post

what it does: clone any post, page, or custom post type with one click — including meta, taxonomies, and featured image.
why it’s here: when you publish anything semi-templated, duplication is the difference between a 20-minute task and a five-minute task.
stats: 1,000,000+ installs · 4.5★
install: wordpress.org/plugins/duplicate-post

site kit by google

what it does: connect search console, analytics, adsense, pagespeed insights, and tag manager from the wordpress admin.
why it’s here: the only tool that puts every google property a wordpress site cares about in one place, free, with the right security model.
stats: 4,000,000+ installs · 4.7★
install: wordpress.org/plugins/google-site-kit

database cleaner

what it does: remove post revisions, auto-drafts, transients, expired transients, spam comments, and other database clutter.
why it’s here: wordpress databases accumulate junk. running this once a quarter keeps queries fast and backups small.
stats: 100,000+ installs · 4.2★
install: wordpress.org/plugins/database-cleaner

content & comments

better comments

what it does: improves the default comment ui with threading, styling, and moderation tools without converting to disqus or similar.
why it’s here: the right plugin if you actually want comments on your site and want them to look like 2026.
stats: 100,000+ installs · 4.4★
install: wordpress.org/plugins/better-comments

reading time

what it does: computes and displays the reading time for any post — shortcode or template tag.
why it’s here: “5 min read” is one of the cheapest ux wins in editorial. reading time is the most reliable free implementation.
stats: 60,000+ installs · 4.7★
install: wordpress.org/plugins/reading-time

simple author box

what it does: drops a clean author bio box at the end of every post with photo, social links, and a short description.
why it’s here: good for multi-author sites and seo (author entity signals). less work than coding it into your theme.
stats: 50,000+ installs · 4.4★
install: wordpress.org/plugins/simple-author-box

widgets & small helpers

what it does: flexible recent-posts widget — filter by category, tag, custom post type, custom taxonomy, with thumbnails.
why it’s here: the default recent posts widget is too basic; this one is the drop-in replacement most theme builders reach for.
stats: 100,000+ installs · 4.3★
install: wordpress.org/plugins/recent-posts-widget-extended

what it does: simple sidebar widget that lets you drop an image with a caption and link.
why it’s here: still surprisingly useful for sidebars and footers, faster than wrangling block widgets.
stats: 200,000+ installs · 4.2★
install: wordpress.org/plugins/image-widget

full comparison table

every plugin in this guide, sortable by install count.

plugin	category	active installs	rating	maintainer
contact form 7	forms	5,000,000+	4.0★	takayuki miyoshi
akismet anti-spam	security	5,000,000+	4.3★	automattic
site kit by google	productivity	4,000,000+	4.7★	google
gutenberg	editor	2,500,000+	4.8★	wordpress.org
redirection	seo	2,000,000+	4.7★	john godley
all in one wp security	security	1,000,000+	4.5★	aios
duplicate post	productivity	1,000,000+	4.5★	yoast
secure custom fields	dev	800,000+	4.9★	wordpress.org
safe svg	media	400,000+	4.5★	10up
regenerate thumbnails	media	300,000+	4.4★	wordpress contributors
query monitor	dev	300,000+	4.8★	john blackbourn
generateblocks	editor	300,000+	4.7★	tom davies
svg support	media	300,000+	4.5★	bungeshea
coblocks	editor	200,000+	4.6★	godaddy
404 to 301	seo	200,000+	4.5★	joost de valk
image widget	widgets	200,000+	4.2★	jason griffith
force regenerate thumbnails	media	100,000+	4.5★	shortpixel
wp crontrol	dev	100,000+	4.6★	john blackbourn
recent posts widget extended	widgets	100,000+	4.3★	naveen sharma
database cleaner	productivity	100,000+	4.2★	sayan datta
better comments	content	100,000+	4.4★	matt biscay
reading time	content	60,000+	4.7★	renan cerpe
divi torque lite	editor	50,000+	4.7★	plugpress (fahim reza)
simple author box	content	50,000+	4.4★	themeisle
very simple contact form	forms	50,000+	4.5★	guido
external links	seo	50,000+	4.5★	joés legrand
divi carousel free	editor	30,000+	4.8★	plugpress (fahim reza)
cf7mate	forms	20,000+	3.9★	plugpress (fahim reza)
headingmap	seo	20,000+	4.6★	joés legrand

a note on the plugpress entries

three plugins on this list are ours — divi carousel free, divi torque lite, and cf7mate. they’re the free versions of products we sell at divipeople, divitorque, and cf7mate.com. i wrote them because i needed them on my own sites and the existing options either didn’t exist or didn’t fit. they’ve been on wordpress.org for years, get updated regularly, and have a combined 100,000+ active installs.

if you don’t use divi or contact form 7, you can skip those three and the list is still solid. if you do, they’re the most-used options in their category.

the rule we keep coming back to

the best wordpress site is the one with the fewest plugins it can get away with. every plugin is a surface area to maintain, a security consideration, and a performance cost. start with the ten in the tl;dr above; add the others only when you have a specific problem they solve.

that, more than any one plugin, is the through-line of every wordpress site that ages well.

— fahim