Plugins are employees

Your website has a staff. When did you last count them?

Every plugin is a hire. It shows up to do a job, it carries keys to the building, it expects ongoing attention, and it draws a salary paid in load time, update cycles, and attack surface. The rate looks like zero because nobody sends an invoice.

Nothing with access to your database works for free.

How the hiring happened

Now recall how the hiring happened. No interview, no references, no probation period. Somebody searched, skimmed a star rating, clicked install, and a stranger’s code walked in with more access than most of your actual employees will ever hold. We’ve met companies that background-check their interns and hand database credentials to software they vetted in four minutes.

To be clear, this isn’t a case against plugins. Some are model employees: reliable for a decade, maintained by developers who care, doing one job well and staying out of the way. A good plugin is a good hire, and good hires are the whole point of hiring. The case is against unmanaged headcount.

Because most rosters we audit look like this.

• A plugin hired for a campaign that ended three years ago, still on payroll.
• Two plugins doing the same job and quietly disagreeing about how.
• One that nobody remembers installing, holding administrator access.
• A deactivated plugin sitting in the corner, which everyone assumes is gone, though deactivated isn’t deleted; that’s a fired employee who kept a badge to the building.

Abandonment is its own category. A plugin whose developer walked away is an employee who stopped showing up but still has keys, and when a hole opens in that code, nobody is coming to patch it; the job of caring transferred to you the day the changelog went silent, whether you noticed or not.

The annual review

So we prescribe what any decent manager would: a performance review. Once a year, every plugin, no exemptions, calendar invite and all. Five questions do it.

• What’s your job here? One sentence. If nobody in the room can produce the sentence, that is the answer.
• When did you last actually do that job?
• Could someone already on staff cover it? Core and themes absorb old plugin duties all the time, and sometimes the replacement is six lines of code.
• What are we paying you? Check the load time, the queries, the update churn.
• Does your manager still work here? Meaning: is the developer active, patching, answering questions somewhere.

Then fire generously. Keeping a plugin feels safer than removing one, which is exactly backwards; the risk isn’t in the deletion, it’s in the years of unattended tenure. Export the settings, take a backup, and let it go. If the site doesn’t notice, you have your answer. And when it does notice, reinstalling takes four minutes, which, you’ll recall, is how long the hiring took.

The leanest sites we’ve audited run small crews. Each plugin has a clear job, a live developer behind it, and a reason to be there that someone can state out loud. That’s not austerity. It’s management.

Somewhere in your admin panel right now is an employee you’ve never met, holding keys you don’t remember handing out. Go introduce yourself.