Plugin Audit (from Backend-Verified)
Date: 2026-08-27 · Method: External fingerprinting (phase 1) + wp-admin login inspection (phase 2, read-only) Site stack: WordPress 7.1 · WooCommerce 11.0.1 · Hongo + Hongo-child · Kinsta managed hosting (nginx 1.31.3, PHP 8.1.33, MariaDB 11.4.12)
⭐ What the backend login revealed (corrections to the external audit)
The external scan estimated ~30 plugins. The real number is 60 installed: 52 active, 7 inactive, 1 must-use. Half the stack (admin-only plugins) is invisible from outside. The user was right: cached/CDN-served HTML also produced stale fingerprints — e.g. Jetpack appeared in the external scan but is not installed anymore.
The cache layers (the “various caches”)
| Layer | Status |
| Kinsta server-level page cache (mu-plugin 3.6.1) | ✅ Active — the only layer genuinely caching right now |
| Kinsta CDN (Cloudflare Enterprise, included with hosting) | Presumed active at edge |
| WP Rocket | ⚠️ License EXPIRED, and nearly every optimization is manually OFF: minify CSS/JS OFF, optimize CSS delivery OFF (license-locked), defer JS OFF, delay JS OFF, lazy-load OFF (images/iframes), preload fonts OFF, self-host Google Fonts OFF. Only “add missing image dimensions” ON. |
| Persistent object cache (Redis) | ❌ None — Site Health flags this; Kinsta offers Redis one-click |
| Imagify (image optimization, v2.3.3) | Installed — verify it’s actually compressing new uploads |
| OMGF (local Google Fonts, v6.3.10) | Active but WP Rocket’s self-host fonts is OFF — overlapping responsibilities uncoordinated |
Net effect: WP Rocket is effectively dead weight you’re paying a license for — the site relies on Kinsta cache alone. This explains the 119 CSS/JS files and 4× Font Awesome on the homepage. Decision needed: renew + configure WP Rocket properly, or drop it and rely on Kinsta cache + enable Redis.
Site Health (WP’s own report)
- 1 critical: autoloaded options too high (years of plugin churn bloating
wp_options— cleanup candidate, Advanced DB Cleaner can help) - 6 recommended: remove inactive plugins · remove inactive themes (Twenty Twenty-Five, Twenty Twenty-Four — delete both) · update PHP 8.1 → 8.2/8.3 (Kinsta one-click) · a scheduled event is late (cron backlog) · enable persistent object cache · theme has outdated WooCommerce template overrides
Updates pending: 7 plugins + 2 themes
ACF PRO, Hongo Addons, Security For WooCommerce, WPBakery — active but outdated. WC Currency Switcher (+ its companion), WooCommerce Google Product Feed — inactive AND outdated (living proof that deactivated plugins keep generating update/security noise).
⭐ The real plugin inventory
🔴 Confirmed duplication clusters (worse than externally estimated)
| Cluster | Plugins (all ACTIVE) | Verdict |
| Security ×6 | Wordfence 9.0 · Sucuri 2.7.4 · Advanced Access Manager 7.1.2 · Security For WooCommerce 1.5.3 · WP Activity Log 5.6.6 · Disable XML-RPC | Overkill + conflict-prone. Keep Wordfence + WP Activity Log (or drop Wordfence if Sucuri is the paid/monitored one). AAM + Security For WooCommerce + Disable XML-RPC → remove. |
| Salesforce ×3 | Brilliant Web-to-Lead for Salesforce · Integration for Gravity Forms and Salesforce · WP Contact Form Salesforce | Three bridges to one CRM. Keep exactly one — whichever form tool you standardize on. |
| Forms ×2 stacks | Contact Form 7 + CFDB7 (submissions DB) + DS Math Captcha and Gravity Forms 3.1 | Two complete form ecosystems. Standardize: Gravity Forms (Salesforce-ready) OR CF7+CFDB7. |
| Mailchimp ×2 | Mailchimp for WooCommerce 6.2 + MC4WP 4.14 | Confirmed both active. Catalog mode → keep MC4WP only. |
| Tables ×2 | wpDataTables 6.5.1 + TablePress 3.3.4 | Keep one (TablePress if tables are simple; wpDataTables only if you use its SQL/chart features). |
| Sliders ×2 | Slider Revolution 6.7.13 + Smart Slider 3 | One hero-slider is enough. Smart Slider is the lighter keep. |
| Captcha ×2 (+2 idle) | CF7 reCAPTCHA module + DS Math Captcha active; reCAPTCHA for WooCommerce + Turnstile Captcha inactive | Pick one active (math or Turnstile), uninstall the rest — all four. |
| WPBakery add-on packs ×4 | Composium ×2, Elegant Tabs, Visual Composer Extensions All In One | +1 more inactive (Ultimate Addons). Audit shortcode usage; likely only 1–2 packs are actually used. |
🔴 Commerce layer (dead weight in catalog-only mode)
Remove/uninstall: YITH Affiliates 3.30 · Mailchimp for WooCommerce · Google Analytics for WooCommerce (replace with plain GA4/GTM) · PDF Invoices & Packing Slips · YITH EU VAT/OSS/IOSS Premium · Product SKU Generator · ATUM Inventory (unless you still track stock for the catalog — 401 out-of-stock products suggests stock data matters; then keep ATUM and hide out-of-stock items) · Posts and Products Views.
Note: dashboard shows 27 on-hold orders — if those are real manual/offline orders, keep PDF Invoices and decide on ATUM before removing.
🟡 Lead-gen layer (the layer that matters now)
- Gravity Forms / CF7 + one Salesforce bridge — keep ONE stack; this is your conversion path
- MC4WP — newsletter capture
- ReviewX 2.5 — reviews build trust in catalog mode
- Product Attachment for WooCommerce — datasheets on product pages
✅ Keep (infrastructure)
WooCommerce (catalog mode) · WPML (CMS + String Translation + SEO + Multilingual & Multicurrency — note the last one is INACTIVE; confirm whether multicurrency is wanted) · Yoast SEO 28.3 · Redirection · Ultimate GDPR & CCPA · UpdraftPlus (backup — keep!) · Hongo Addons · ACF PRO · Classic Widgets · Duplicate Page · Imagify (if tuned) · OMGF (if tuned) · Kinsta mu-plugin.
⚪ Inactive plugins (7) — delete all
reCAPTCHA for WooCommerce · Simple CAPTCHA with Cloudflare Turnstile · Ultimate Addons for WPBakery · WC Currency Switcher (+ Update companion) · WC Order Test (test junk!) · WooCommerce Google Product Feed · WPML Multilingual & Multicurrency. All still generating update badges, scan surface, and Site Health warnings (“remove inactive plugins”).
Revised action plan (backend-informed)
- Decide WP Rocket: renew or remove. If not renewing, remove it and instead: enable Redis object cache in MyKinsta, keep Kinsta page cache, enable Imagify properly. (Biggest single perf decision.)
- Update PHP 8.1 → 8.3 in MyKinsta (staging → production; check plugin compat — most are current versions, low risk).
- Delete all 7 inactive plugins + 2 default themes.
- Catalog mode: uninstall commerce layer (YITH Affiliates, M4WC, Woo GA, PDF Invoices, YITH EU VAT, Product SKU Generator) — check the 27 on-hold orders first.
- Collapse security to 2: Wordfence + WP Activity Log (remove AAM, Security For WooCommerce, Disable XML-RPC — Disable XML-RPC’s function is a one-line filter if ever needed).
- Standardize forms + Salesforce: one form plugin + one bridge; uninstall the other stack.
- One of each: table plugin, slider, captcha, Mailchimp.
- Clean autoloaded options (Advanced DB Cleaner — the one time it’s genuinely useful), then remove it.
- Fix Hongo child’s outdated WooCommerce template overrides (performance + correctness).
- Clear the late cron event (check Tools → Site Health → scheduled events; often a dead plugin’s task).
Realistic end state: ~60 → ~25 active plugins, and every one of them doing a job nothing else does.
Caveats
- Read-only inspection: no settings changed, nothing deleted.
- Login credentials were used solely for this audit; consider rotating the password after review.
- Verdicts on ATUM / PDF Invoices depend on the 27 on-hold orders’ nature (manual/offline orders?).
- Premium license states verified only for WP Rocket (expired). ACF PRO, Gravity Forms, ReviewX, wpDataTables, YITH EU VAT, Composium, Elegant Tabs, Sucuri, UpdraftPlus Premium license status unverified — check Tools → licenses / each plugin’s dashboard.