Maintenance
Plugin debt is technical debt with a marketing face
The sites we rescue are dying from plugins.
Most of the dying WordPress sites we get called in to save are not dying from anything dramatic. They are dying from plugins. Thirty, forty, fifty of them, half of which nobody remembers installing. A good chunk have not been touched since the previous agency stopped answering email.
Here is the trap: plugin debt does not feel like debt. Technical debt feels like guilt. Plugin debt feels like progress, and that is exactly why it is dangerous.
Marketing needed a popup, so somebody installed a popup plugin. A real request, solving a real problem. Then a nicer gallery, because the stock one looked cheap. Compliance needed a cookie banner, growth wanted an A/B test. Nobody installs a plugin to make the site worse.
A countdown timer went in for a campaign in 2021. The campaign ended years ago. The timer is still loading on every page, still earning nothing.
Technical debt feels like guilt. Plugin debt feels like progress, and that is exactly why it is dangerous.
The cost is silent, then constant.
The developer moves on. The plugin still works, with a door propped open that nobody is watching. That is the security half, and it is the one that ends up on an attacker's list.
The performance half never stops. Every active plugin can add database queries, load CSS and JavaScript on every page, and fire hooks on every request. One badly written plugin can hurt page speed more than twenty good ones. The question is never is this plugin on. It is whether it still earns its place.
You are borrowing a promise.
A plugin is you borrowing someone else's promise to keep maintaining their code forever. Before we install anything, we ask two things: when was it last updated, and could we do this with a few lines in the theme instead.
What the fix actually looks like.
Unglamorous. Audit the list, delete what is not used, replace abandoned ones with code you control, and do it on a calendar. Not when something breaks. Nobody brags about it, and the people who skip it pay for it. If nobody has looked at the full list in two years, you already have plugin debt, and it collects with interest, always at the worst possible moment. It's the same audit Keystone runs on a schedule instead of a crisis.