Tried-and-tested selection of the best WordPress plugins for key tasks: multiple languages, backup and restore, image compression, SEO, website security, and speed optimization. The following plugins are featured: WPML, UpdraftPlus, ShortPixel, SEOPress, Yoast SEO, Wordfence, WPS Hide Login, and WP Rocket. After trying many popular plugins, I opted for the listed selection. Further, my favorite plugins are described in short and a bit of practical advice is given. In conclusion, I provide an overview of all recommended plugins in a table.
WPML: multi-lingual website plus connection of domains
WPML ↗ is the WordPress Multilingual plugin, which won first place at the WP Awards 2024 ↗ in the category “Content & Output Tools”. The plugin makes it very straightforward to build multilingual sites, allowing to translate pages, posts, custom post types, media, tags, categories, custom taxonomies, menus, and any other front-end text. WPML is compatible with all the popular themes, plugins and page builders. You can have different languages in sub-directories, display the language as a URL parameter, and a very powerful feature – you can place different languages in completely independent domains or sub-domains, thus managing several websites from a single standard WordPress installation. And, there are three translation options: manual, automatic, and a connection to the translation service.
WPML pricing plans, competitors, and transferring renewals to clients
The most interesting of the WPML pricing plans is Multilingual CMS, which includes full functionality, is valid for 3 production and 9 development sites, and costs €99 for the first year and then €74 for yearly renewals. The cheapest Multilingual Blog option, which costs €39 for the first year and €29 for renewals, allows to translate posts, pages, taxonomies, menus and media manually. What is really missing in this plan – is the string translation module, without which you cannot translate texts coming from the theme and plugins. The Multilingual Blog is valid for 1 production and 3 development sites. The Multilingual Agency plan costs €199 for the first year and €149 for renewals, includes full functionality, and it is valid for an unlimited number of sites. Along with quite affordable pricing plans, WPML has a 30-days “no questions asked 100% refund” policy, so you can try the plugin for free.
All the free multilingual WordPress plugins I tried so far have relatively basic functionality, which, most often, is not enough for a commercial website. For instance, you cannot translate URL slugs or duplicate posts across languages. Here ↗ you can find a comparison of WPML with its main alternatives. When considering paid versions of the plugins, WPML is the most economical solution, since the Multilingual CMS plan is valid for 3 production sites. In addition, you can transfer the renewal payments to your clients. For every transferred renewal, you receive €20 credit, additional production site, and even will get paid by WPML if your credit gets higher than your yearly renewal cost. Your client will pay €39 per year for a single site, which includes the setup with connected domains. To be able to transfer renewals, you should have the Multilingual CMS or the Multilingual Agency plan.
WPML feature to display languages in different domains
WPML allows you to display different languages in completely independent domains, for example, the English version of your site at https://yourcompany.com and the German version – at https://yourcompany.de. For this you will need: the required domains, one hosting, corresponding number of SSL certificates or a multi-domain one, and a WPML license for one site. Such a setup, with different domains per language, is very beneficial for SEO and ranking of your secondary languages.
My advice is: inform you client about this option in advance, and make the English language the default one thus assigning it to your primary domain, which is normally .com or .org. At the development stage, place other languages into subfolders, e.g. https://yourcompany.com/de/. In this case, if your client decides to switch to the multi-domain setup in the future, you will not need to update the internal links iteratively, and you will not have to switch the default language of the site. The latter can cause minor issues as some site components and features coming from other plugins, your theme or builder might not switch. The multi-domain configuration settings, which worked for me in all the projects, are displayed in the first screenshot below.
Final remarks and code to auto-select the "Minor edit..." flag
The main thing I do not like about WPML is that recently, less than a year ago, they embedded the Translation Management into the core WPML Multilingual CMS plugin. So now you need to install three plugins, WPML Multilingual CMS, WPML Media and WPML String Translation, to use all WPML features. Before it was four plugins, plus WPML Translation Management.
If you redesign the site and have all the translations, you do not need the Translation Management part. However, now even after you switched off the “Translation Editor” entirely and pressed the “Translate Independently” button for the specific page, you still have the “Minor edit − don’t update translation” flag above the Update button for this page in the default language. You have to select this flag before updating, otherwise something is sent to Translation Management for secondary languages. To solve this issue, I ordered a small customization of WPML at the Codeable ↗ platform, where you can hire professional WordPress developers. The resulting code selects the aforementioned flag automatically right after the page is loaded for editing. The code is released under the GNU Public License. To reproduce the solution on your site, follow the next two steps:
Step 1: Save the following code as a separate JavaScript wpml-addon.js file and put it into your child theme’s folder.
window.addEventListener(‘load’, function () // Wait until the page is loaded
{
const minorChangeBox = document.querySelector(‘#icl_minor_change_box input’); // Look for WPML check-box
if (minorChangeBox) // if there is a check-box
{ minorChangeBox.click(); } // …click it, causing it to be selected automatically
});
Step 2: Paste the following code at the end of the functions.php file of your child theme. That’s it.
// Adding the hook to automatically select the "Minor edit − don't update translation" flag of WPML
function specific_enqueue( $hook )
{
if( 'post.php' != $hook )
if( 'page.php' != $hook )
return;
wp_register_script( 'some-js', get_stylesheet_directory_uri().'/wpml-addon.js', array('jquery-core'), false, true );
wp_enqueue_script( 'some-js' );
}
add_action( 'admin_enqueue_scripts', 'specific_enqueue' );
And to conclude, what I like about WPML: the plugin is very reliable and stable, incorporates all the needed functionality for a top quality multilingual website, and is supported by most of the WordPress themes, builders and plugins. Apart from this, there is an extensive documentation and a support forum with lots of resolved tickets openly published. And last but not least, there is a very helpful live support, which responds quickly via online chat, and, if your issue takes longer, proceeds via email.
UpdraftPlus: backup and migration, Free, Premium
UpdraftPlus ↗ is my favorite backup plugin for WordPress and the second most popular “Backup Migration Plugin” according to the WP Awards 2024. UpdraftPlus allows to restore, fast and easy, all the website components after unlucky updates, tests, hacking, or from a clean WordPress install. The Free version creates backup of everything in WP’s content directory: database, plugins, uploads, themes, etc. The storage locations are: the “wp-content/updraft” folder by default, non-encrypted FTP, and popular cloud storages. You can perform backups manually, choose a predefined schedule, select website components, and migrate via backup and restore. The Premium version includes absolutely everything related to WordPress backup and migration: all directories on your server, site-to-site connection, backup to multiple locations, manual schedules, automatic and incremental backup, and much more. The Personal plan costs $70 per year and covers 2 sites. To summarize, I use UpdraftPlus already for many years in different setups, and it did not fail to restore the site even once.
ShortPixel: image optimization, free, package, subscription
ShortPixel ↗ is my favorite image optimization plugin due to its extensive features, powerful optimization algorithms and user-friendly interface. The plugin allows to: compress JPG, PNG and GIF formats as well as PDF; generate next generation WebP and AVIF image versions and deliver them in the front-end; apply lossy, glossy or lossless compression; optimize images in bulk, automatically on upload, or manually one-by-one; restore optimized images and re-optimize; exclude images and thumbnails from optimization; and much more. ShortPixel is fully compatible with most gallery, slider and image plugins, including WPML Media. The free ShortPixel plan includes 100 credits per month. For a rough estimate, if you have 4 thumbnails for an image and use the WebP option, then this image will cost you: the original image (1 credit) + 4 thumbnails (4 credits) + WebP versions of all (5 credits) = 10 credits. Hence, for free, you can optimize 10 images per month.
ShortPixel pricing plans and some tips for saving your credits
If you need more than 100 credits per month, ShortPixel offers a wide variety of pricing plans: different credits packages, which are one-time payment options, and unlimited monthly and yearly subscriptions. Most often, I purchase the 30K package for $19.99. In general, packages are better value because the credits never expire and you can use them on an unlimited number of sites.
To spare your credits, I advise to disable the “Optimize media on upload” option on the ShortPixel’s Advanced tab, and to only optimize the final versions of your images one-by-one. To save more, it is possible to exclude specific (wrt size) thumbnails from optimization on the same Advanced tab. By the way, the displayed there full list of all the image thumbnails, generated by your theme, plugins and WordPress, is a very useful information, which is sometimes hard to find. Apart from this, no credits are used for the images that are optimized less that 5%, which is relevant if you select the Lossless compression type, as I often do, not to lose even a little bit in quality. Besides, Lossless works very good with PNG-8 and PDF, compressing them by 30%-60%.
How to serve WebP image versions in frontend
ShortPixel allows both, to create the next generation WebP and AVIF versions of your images, and to serve them in the front-end. The creation and serving are independent features. You can generate modern formats with ShortPixel, but deliver them using another plugin. The ShortPixel itself offers two options for serving: via the ‹picture› tag syntax thus altering the page code, and via .htaccess without touching the code. The first option can cause display problems depending on how your theme or image-related plugins use the ‹img› tags. The second option is much better, however, quite often you’ll see there “… that your server CAN’T serve the WebP or AVIF…” Don’t give up at once, most likely your hosting provider support can solve this. On my hosting, they just needed to transfer the processing of images on the server from NGINX to Apache. Important: before checking whether the word CAN’T has changed to CAN after efforts of your hosting support, clear your browser’s cache!
The optimal setup is to generate WebP using ShortPixel, but serve – via caching plugin. WP Rocket is the best caching plugin that includes this functionality. Final point: out of two, ShortPixel alone can serve the AVIF format as well.
SEOPress: search engine optimization, Free and Pro
SEOPress ↗ won bronze at the WP Awards 2024 in the SEO Plugins category. Having tried many SEO solutions for WordPress myself, I also settled on SEOPress. The reasons are: it is full of features and has clear interface without ads; it is integrated with many plugins and builders, including WPML and WP Rocket; it is lightweight and you can disable unused modules; plus the all-inclusive Pro version is the best deal on the market for $49 / year / 5 sites. SEOPress Free includes all the needed features for a solid SEO of your site: titles and metas, XML and image sitemaps, content analysis with unlimited keywords, redirections and canonical URLs, custom Facebook and X cards, and much more. The free version already allows to specify the general schema markup for your Google Knowledge Graph. However, if you need a more sophisticated structured data ↗ generator, with automatic and manual schemas, you should take a look at what SEOPress Pro offers.
Overview of SEOPress Pro features: schemas, AI, redirections, etc.
Manual schemas: In SEOPress Pro, a manual schema is applied to a page individually. You select the structured data type for the post in the corresponding list, and then fill in all the appeared fields, without the need to code. The available data types are: Local Business, Service, Article (WebPage), Event, Job, Product, FAQ, How-To, Review, Recipe, Video, Course, Software Application, and Custom. The last Custom option allows to add your own JSON-ld code within the ‹script› tags.
Automatic schemas: An automatic schema is defined independently of any page on the Schemas screen of SEOPress Pro, and then it is applied globally by publication type (e.g. to all posts). When creating an automatic schema, you first select the data type as with manual schemas, but then for each field you choose an option in the list, containing: many predefined variables (e.g. “Post Title”), then “Manual text”, and “Manual text on each post“ at the end. All the “Manual text on each post” fields will be editable per publication, while the rest of the fields will be hidden and generated automatically from publication data.
AI: Integration of artificial intelligence into SEOPress Pro is the newest feature, which is still under active improvement. Currently, you can automatically generate meta title and description for a post, page, or custom post type based on its content, individually and in bulk, and generate alt texts for your images. To use AI, you will need an OpenAI account and a certain credit balance on it.
Redirections: SEOPress Free already includes decent redirection functionality allowing to redirect post, page, taxonomy and post type to another URL, as well as attachment pages to the post parent or to the file URL. The Pro version offers a full scale redirect manager with 301, 302, 307… redirects, regular expressions, automatic and conditional redirects, and importing.
Other features: In addition to those described above, SEOPress Pro includes a great deal of other premium tools: robots.txt and .htaccess editor, Local SEO and WooCommerce SEO, video and news sitemaps, keywords from Google and internal linking suggestions, broken links checker and 404 monitoring, GA stats in the dashboard, breadcrumbs, white label, and a lot more.
A quick comparison of SEOPress and Yoast SEO
SEOPress Free vs Yoast SEO Free: Free versions of both plugins cover all the essential SEO functionality, however, there are some differences in extra features. SEOPress allows to optimize for multiple keywords; free Yoast SEO ↗ – just for one. None of the Yoast versions includes Google Tag Manager, always available in SEOPress. On the other hand, breadcrumb navigation and robots.txt / .htaccess editor, included in Yoast, are provided only by SEOPress Pro. Remark: Yoast edits your actual robots.txt, while SEOPress creates a virtual file, which does not bypass the real one if you have it. Both plugins configure your Google Knowledge Graph, yet, Yoast includes a bit more structured data functionality. You can select a page type and an article type in two lists for each publication; after that, the rest of your schema is generated automatically and invisibly, hence, you cannot customize the markup (via API you can). Lastly, there are no ads in SEOPress, and quite a lot – in the free version of Yoast.
SEOPress Pro vs Yoast SEO Premium: Premium version of Yoast, which costs €99 per year for one site, includes: optimization for multiple keywords, video and news sitemaps, internal linking suggestions, broken links checker, related keyphrases from Semrush, and redirect manager. To have Local SEO or WooCommerce SEO, you have to buy the corresponding separate plugin. Pro version of SEOPress costs $49 per year for 5 sites, and includes all the listed features (with keyword suggestions from Google) plus: advanced schemas, OpenAI, GA stats, PageSpeed Insights, Google Inspect URL, Dublin Core, white label…
Documentation and Newsletter: Yoast provides an extensive online documentation, though a bit messy, while their newsletter is bright, frequent, and – it is one of the best resources to learn SEO from the ground up. SEOPress online docs are well structured, no less comprehensive, and slightly easier to digest from my point of view. Their mailing comes once a week and contains overview of the latest changes in Google’s algorithm, SEOPress products news, and links to their featured blog posts, which are always worth reading. I recommend to subscribe to SEOPress newsletter even if you do not use the plugin itself.
Conclusion: The presented above three paragraphs are by far not an overall comparison of the two plugins; I just highlighted the most notable differences from my own experience. If you google for “SEOPress vs Yoast SEO”, you will find several articles completely dedicated to the topic. To add and sum up, Yoast gives much attention to text optimization, while SEOPress provides more diverse SEO instruments. I would advise to try free versions of both, and decide whose approach to WordPress SEO is more appealing to you. Take into account, that you can import data to SEOPress from Yoast SEO, but not vice versa.
Wordfence: website security and firewall, Free and Premium
Wordfence ↗, ranked #4 in the WP Awards 2024 across all categories and a long-time stable leader in the Security Plugins category, is widely recognized to be the best security solution for WordPress. Wordfence currently protects more than 4 million websites. The plugin provides: web application firewall, malware scanner, plugin and theme vulnerability monitoring, file change detection, intrusion alerts, rate limiting, brute force protection, and login security. Wordfence is easy-to-use, includes an onboarding wizard, and performs firewall optimization (via changing your PHP configuration) upon install to activate the “Extended Protection” mode. The latter means that the firewall will load on your site before the WordPress itself or any other PHP files that may be vulnerable. If you somehow declined the offer to optimize the firewall, you can do it on the “All Options” page, via clicking the “Optimize the Wordfence Firewall” button within the “Basic Firewall Options” toggle. All the aforementioned features are included in Wordfence Free, which, from my point of view, is absolutely sufficient for most personal blogs. However, websites using the free version receive the latest updates of firewall rules and malware signatures with a 30 day delay. Hence, for commercial websites, I’d recommend to use the premium version of the plugin.
Wordfence Premium: real-time firewall rules, malware signatures, IP blocklist...
Wordfence Premium costs $149 per year for one site, and includes: real-time updates of the malware signatures and firewall rules, continuously updated blocklist of the active malicious IP addresses, advanced country blocking options, ticket-based support, and additional scan checks: for reputation of your site (if it is on any blacklists), whether your site is “spamvertised” (the site is being included in spam emails), and whether your IP address is generating spam (e.g. when another site on a shared hosting is infected). To sum up, with Wordfence Premium, you can be completely sure that your website is well-protected.
Login security options: Wordfence and WPS Hide Login
Wordfence offers two login security options: two-factor authentication, i.e. 2FA, and reCAPTCHA, which can be used together. 2FA involves an additional gadget, e.g. mobile phone, and an installed on it authentication app, e.g. Google Authenticator. To log in with 2FA enabled, you need to enter your username and password as usual, but then you will be asked to enter the code from the authentication app. The code changes every 30 seconds. reCAPTCHA, on the other hand, doesn’t require to do anything different from usual. Google’s reCAPTCHA v3, implemented by Wordfence, automatically calculates a score for each user and decides whether it is a human based on the set threshold.
Yet, the main problem with WordPress login security is that the standard login URL is generally known. This makes brute-force attacks possible, which involve ‘guessing’ the credentials to access the dashboard. Wordfence Brute Force Protection module allows to set a limit on login failures and lock the user. But there is an even more reliable approach: a custom login address. I always use Wordfence in combination with WPS Hide Login ↗. This is a free plugin that lets you change your login URL and thus zero brute-force attacks completely. WPS Hide Login appends its tools at the bottom of the Settings ↦ General page. There you can specify a custom slug instead of wp-login.php, and set the Redirection url, whereto the wp-login.php and wp-admin will be redirected when not logged in. Based on my testing, WPS Hide Login is compatible with 2FA and reCAPTCHA of Wordfence.
Remark 1: If you use WPS Hide Login and WP Rocket, you do not have to do anything, since the plugins are fully compatible. However, if you use another caching plugin, you should add the custom login URL to the list of pages not to cache.
Remark 2: The only problem with WPS Hide Login is that the Redirection url setting quite often doesn’t function properly. In some setups it works for the wp-admin directory, but the wp-login.php page is always redirected to some default 404 address. Thereto, depending on how your 404 is made, WPS Hide Login might pull a badly rendered page. In such a case, I manually redirect wp-login.php to proper 404 via .htaccess. Sub-remark: don’t do the same to wp-admin, since it is used when working in the dashboard. To redirect wp-login.php, add the following code to your .htaccess right below the # END WordPress line:
Redirect 301 /wp-login.php https://yoursite.com/your-page-404
Final remark: If you forgot your custom login URL, just go to /wp-content/plugins/ directory on your web server and delete the wps-hide-login folder; don’t forget to remove the 301 redirect from your .htaccess file if you had to add one. After that you will be able to log in through the standard wp-login.php path and reinstall the WPS Hide Login plugin.
WP Rocket: speed and performance, premium
WP Rocket ↗, which won gold at the WP Awards 2024 ↗ for best performance plugin and has over 4,5 million installations, is consistently rated to be the No.1 caching plugin for WordPress. WP Rocket is very easy to use and set up, it applies 80% of web performance best practices upon activation, and is compatible with most themes and plugins such as WPML, SEOPress and Wordfence among others. Included features go beyond the standard caching plugin. In particular, WP Rocket provides: page and browser caching, cache preload, eCommerce optimization, WebP serving, automatic CSS and JS minification and combination, self-hosted Google fonts, database cleanup, and a lot more. In short, the plugin will definitely improve your PageSpeed ↗ score to a large degree. In addition, PageSpeed Insights automatically detects whether WP Rocket is installed on your website and offers specific recommendations for plugin settings.
WP Rocket pricing and licenses: Single, Plus, Multi
WP Rocket is a premium plugin, that is, there is no free version available. At the same time, the cost is quite affordable and there are different pricing plans depending on how many websites you need to speed up. The Single plan costs $59 per year and includes product updates and support for one site. The Plus plan for $119 a year covers three sites. Whereas Multi licenses for ≥50 sites start at $299 per year. Besides, WP Rocket offers a 100% money-back guarantee within 14 days, and, periodically, 20% discount.
About the persistent object cache and when not to use it
Persistent object caching is in fact storing the results of frequently repeated database queries in an object store. This might greatly reduce the load on the database thus decreasing the server response time. If you run a large-scale, high-traffic, and dynamic website, you must use object caching based on a proper hosting configuration. WP Rocket doesn’t create this type of cache, so you’ll need an additional plugin to implement it: details here ↗. However, if you are on a shared hosting, most often the best option in terms of site speed is not to use the object cache at all. Hence, in such a case, WordPress will still display the “You should use a persistent object cache” recommendation on your Site Health screen. To disable this health check and get the “Great job!” smile back, add the following code to your functions.php file:
// Remove the WP site health check for persistent object cache
function prefix_remove_php_test( $tests )
{ unset( $tests['direct']['persistent_object_cache'] ); return $tests; }
add_filter( 'site_status_tests', 'prefix_remove_php_test' );
Recommended setup of must-have WordPress plugins
To conclude, I summarize in a table my favorite must-have WordPress plugins. All the plugins are compatible with each other, and supported by most WordPress themes and builders. Hope this post helps you choose the perfect combination to meet your budget and requirements.
| Plugin | Features | Plan | Cost | Sites |
|---|---|---|---|---|
| WPML ↗ | Multiple languages | Multilingual CMS | €99 / year | 3 websites |
| UpdraftPlus ↗ | Backup and migration | Premium Personal | $70 / year | 2 websites |
| ShortPixel ↗ | Image optimization | One-time 30K | $19.99 one time | unlimited |
| SEOPress ↗ | SEO and schemas | SEOPress PRO | $49 / year | 5 websites |
| Wordfence ↗ | Website security | Wordfence PREMIUM | $149 / year | 1 website |
| WP Rocket ↗ | Speed optimization | WP Rocket Single | $59 / year | 1 website |
In addition, I advise to reinforce Wordfence with the free WPS Hide Login ↗ plugin. And, last but not least, if you need customization of the CMS itself, any theme or plugin, Codeable ↗ is the best platform to hire vetted WordPress developers for a project of any complexity. ■