Every plugin is a decision you have to keep making
A plugin isn't a one-off decision. It's a subscription to someone else's release schedule, paid in your attention, on every site you ever shipped.
You install a plugin on a Tuesday afternoon. The client wanted a testimonial slider, the plugin does testimonial sliders, it takes four minutes and you move on. It feels like a completed task.
It isn't a task. It's a subscription, and you've signed the client up to it on your own account.
What you actually agreed to
From that afternoon on, someone has to notice when the plugin updates. Someone has to decide whether to apply the update. Someone has to notice when it stops updating, which is the more dangerous case and the one nobody watches for. Someone has to know what breaks if it's removed.
That someone is you, on a site that was signed off two years ago, for a client who is not paying you this month.
Multiply by the number of plugins on a typical build — fifteen at the lean end, forty is common — and then by the number of sites you've shipped. The number of standing maintenance relationships an agency accumulates is genuinely large, and none of them are on a project plan.
The three failure modes
Abandonment. The author stops. There's no announcement; the last release date just gets further away. The plugin keeps working until a platform update it hasn't been tested against, and then it doesn't. You find out from the client.
Interaction. Each plugin is fine. Two of them together are not. Both touch the same hook, or both load the same library at different versions, and a page that worked on Friday is blank on Monday. Debugging this is a process of elimination across forty variables.
Security. Most compromises on plugin-based platforms arrive through a plugin or a theme rather than the core software. The blast radius isn't one site: a compromised site sends mail, hosts phishing pages, and drags your other sites' reputation down with it if they share infrastructure.
"Just keep them updated" is not a plan
Automatic updates are a reasonable default and they close the security problem, partly. They open a different one: an update that changes behaviour now happens on a live client site, unannounced, on a schedule set by a stranger.
Manual updates mean someone has to do them, on every site, forever, and know enough about each site to judge whether an update is safe. Multiply by thirty sites and it's a job, not a habit. In practice most agencies do a bit of both and hope, and the hoping is where the Friday afternoons come from.
The honest framing: you don't have a plugin problem. You have a portfolio of small, unfunded, permanent obligations that you took on four minutes at a time.
What WordPress gets right here, to be fair
The plugin model is the reason WordPress won. Almost any client request has an existing answer. You can quote a job without knowing how to build half of it, because someone already built half of it. That's an enormous commercial advantage and nothing else in this market matches it.
If your clients keep asking for unusual things, that ecosystem is worth the maintenance cost, and this post isn't an argument for leaving.
The trade we make instead
Contentive ships a small set of apps we maintain: forms, analytics, memberships and SEO. They're not third-party code you evaluate and then own — they're part of the platform, updated by us, on our release schedule, with the same support surface as everything else.
The direct consequence is fewer answers. If a client wants something none of those cover, you model it yourself rather than installing it. That's more work up front than finding a plugin, and there will be requests where the plugin ecosystem simply wins.
What you get back is that the number of things that can break without you touching them is small and doesn't grow with every site you ship.
The decision worth making deliberately
Next time you reach for a plugin, ask the question that the four-minute install hides: am I willing to own this on this client's site in three years, unpaid?
Sometimes yes. A well-maintained plugin from a serious author doing something genuinely hard is a good trade. Often the honest answer is that you're saving forty minutes now and buying an obligation you'll resent.
Counting them is a useful hour. Open your last five builds, list the plugins, and for each one note the last release date and whether you'd know if it stopped. Most agency owners find at least one site standing on something abandoned two years ago.