Every extension is code running on every page load.
BEFORE INSTALLING ANYTHING
Ask whether the shop genuinely needs it, or whether it would be nice to have Check when it was last updated. Anything untouched for a year is a risk Read recent reviews, particularly the critical ones Check it supports your WooCommerce version
WHERE TO GET THEM
The official WooCommerce marketplace, the WordPress plugin repository, or the developer's own site.
Never from a site offering premium plugins free. Nulled extensions are the most common source of compromised shops, and the compromise is usually a card skimmer on your checkout.
HOW MANY
Fewer is faster and safer. A shop with forty extensions is slow, fragile and difficult to update.
Review periodically and remove what you no longer use. Deactivating is not enough; delete it.
BEFORE ACTIVATING ON A LIVE SHOP
Back up. Then test checkout immediately after activating. An extension that breaks checkout costs every sale until you notice.
THE ONES USUALLY WORTH IT
A caching plugin, an image optimiser, an SMTP plugin, a backup plugin, and your payment gateway. Most shops need little else.
