Almost every WordPress website we take over has the same drawer of plugins. A slider nobody uses. Two SEO plugins fighting each other. A contact form plugin from 2017, plus the one that replaced it. A security plugin, a backup plugin, a caching plugin, and an add-on pack that loads on every page.
The usual advice is to keep the count low. That's close but not quite right. Thirty well-maintained plugins can run fine. Five bad ones can sink a website. What matters is what each plugin does, how much it loads, and whether anyone still maintains it.
Step one: list what's there
Go to Plugins in the dashboard and write down every one, active and inactive, with a single sentence about what it does. If you can't write that sentence, you've found your first candidate for removal.
Deactivated plugins can go. Their code still sits on the server, and it adds nothing. Delete them.
Step two: check who maintains each one
Open each plugin's page in the WordPress plugin directory. Look at when it was last updated and whether it's been tested with the current version of WordPress. A plugin with no update in over a year is a risk, because when a security hole turns up there may be nobody to fix it. A plugin that's been pulled from the directory entirely is worse. WordPress flags it, and the reason is often a security problem.
Premium plugins bought once and never renewed fall into the same bucket. When the license lapsed, the updates stopped.
Step three: look for overlap
Most bloated websites run two or three plugins doing the same job. Two SEO plugins. A page builder plus a separate add-on pack plus a third widget library. A caching plugin on top of hosting that already caches. Pick one per job and remove the rest, one at a time.
Step four: find the heavy ones
Some plugins load scripts and styles on every page even when they're used on only one. A form plugin that loads on the blog. A slider that loads on pages with no slider. A free page speed test will show what each page pulls in, and the Query Monitor plugin goes further for anyone comfortable with it. Those plugins are often the reason a website feels slow even on good hosting.
Step five: remove carefully
Take a full backup first, and test on a staging copy if your host provides one. Deactivate one plugin, check the pages that might depend on it, then delete it. Some plugins leave shortcodes behind, those bits of text in square brackets, which show up as stray text on the page once the plugin is gone. Search for them before you call it done.
Make it a habit
Run this audit twice a year and before any redesign. Once the list exists it takes about twenty minutes, and it's the cheapest speed and security improvement available on WordPress.
If the audit turns up a website held together by add-ons, the theme was probably the wrong starting point. A custom WordPress build handles most of this in the theme itself, with a short list of plugins that each earn their place.