How to Install a WordPress Plugin (Three Ways)

How to install a WordPress plugin is a two-minute job with a five-minute prerequisite, and the prerequisite is the part worth reading. WordPress documents three routes — searching the official directory from inside your dashboard, uploading a .zip file you bought or downloaded, and copying files onto the server yourself when the first two are blocked. All three are below as step-by-step procedures. The section before them is the one that keeps your site online.

Check four things before you install anything

Every plugin is somebody else's code running with full permission on your site. Two minutes on the listing page tells you most of what you need:

1. Last updated. Within the last three to six months is healthy. Over a year is a warning. Over two years is a decision to make consciously, not by accident.
2. Active installations. Not a quality score, but a proxy for how many people would notice a problem quickly. A plugin with 200,000 installs gets scrutinised; one with 40 does not.
3. Compatibility. Directory results carry either "Compatible with your version of WordPress" or "Untested with your version of WordPress." Untested is not fatal — it often just means the author has not re-flagged it — but combine it with a stale update date and you have your answer.
4. Support activity. Open the support tab and look at whether recent threads have replies from the developer. Silence there is the earliest reliable sign that a plugin has been quietly abandoned.

One more habit: take a backup before installing anything on a live site. Plugin conflicts are rare and inconvenient rather than catastrophic, but the recovery time difference between having a backup and not having one is measured in hours.

Method 1 — Install from the WordPress plugin directory

The route you will use ninety per cent of the time, and the only one that needs nothing but a browser.

1. In your dashboard, go to Plugins → Add New — labelled "Add New Plugin" in recent versions; the screen title itself reads "Add Plugins."
2. Use the search box at the top right. You can search by keyword, by author or by tag.
3. Click the plugin's title or More Details and run the four checks above before going further.
4. Click Install Now and wait for the button to change.
5. Click Activate. Installing does nothing on its own — an installed but inactive plugin is inert files. This is also why some plugins appear to "not work" after a successful install.

Method 2 — Upload a .zip file

For anything you paid for. Premium plugins are not in the public directory, so you download a .zip from the vendor's account area and bring it in yourself.

1. Download the .zip from the vendor and leave it zipped — do not unpack it.
2. Go to Plugins → Add New (again, "Add New Plugin" in recent versions).
3. Click Upload Plugin at the top of the screen.
4. Choose your .zip and click Install Now.
5. When the "Plugin installed successfully" message appears, click Activate Plugin, then enter your licence key wherever the vendor asks for it — otherwise updates will not reach you.

If the upload fails on a large file, you are hitting a server upload limit rather than a WordPress problem. Ask your host to raise it, or use method three.

Method 3 — The SFTP fallback

WordPress documents this as the route for advanced users and for servers that block automatic installation. You will also need it if the dashboard itself has stopped loading. Note the crucial difference from method two: here you do unzip the file first.

1. Download the plugin .zip to your computer and unzip it. You should end up with a single folder named after the plugin.
2. Connect to your server over SFTP, or open your host's file manager. Credentials come from your hosting control panel.
3. Navigate to wp-content/plugins and upload the extracted folder — the folder itself, not its contents loose in the directory.
4. Back in the dashboard, open the Plugins screen. The plugin will be listed. Click Activate.

Use SFTP rather than plain FTP if your host offers it, which every host in this category does. There is no reason to send credentials unencrypted in 2026.

Why the vetting step is the important one

Patchstack's State of WordPress Security in 2026 counted 11,334 new vulnerabilities disclosed across the WordPress ecosystem during 2025, up 42% on the previous year. Ninety-one per cent of them were in plugins and nine per cent in themes. WordPress core accounted for six, all rated low priority.

That distribution should change how you think about WordPress security. The software is not the exposure. Your plugin list is, and it is a list you personally control. The same report puts the weighted median time from public disclosure to a first exploit attempt at five hours, with around half of high-impact flaws weaponised inside a day. Patch windows are not measured in weeks any more.

Two more findings are worth carrying into the install screen. High-severity disclosures more than doubled year on year, and a large share of them attached to premium and freemium marketplace components — paying for a plugin does not make it safe. And defences underperform their reputation: hosting-level protections blocked 26% of total attacks, and traditional web application firewalls stopped just 12% of WordPress-specific vulnerability attacks. "My managed host handles security" is a partial truth at best.

CAUTION — abandoned plugins. A plugin whose author has stopped maintaining it does not announce itself. It keeps working, keeps sitting in your list, and stops receiving fixes. When a vulnerability is eventually found there is nobody to patch it, and the disclosure itself becomes the attack instructions. Audit your plugin list twice a year: anything untouched for over a year with no developer replies in its support forum should be replaced now, while you can choose the timing.

After installing: updates, and removal

Turn on auto-updates per plugin from Plugins → Installed Plugins, using the "Enable auto-updates" link in the rightmost Automatic Updates column. If you would rather update by hand, filter the list by "Update Available," tick the ones you want, then choose Update from Bulk Actions and click Apply. Either way, back up first.

Removing a plugin takes two steps, and most people only do the first. Deactivate leaves the files on the server, where an unpatched vulnerability can still be reachable. Delete removes them. Deactivate, then Delete — and if a plugin has no deactivate link at all, it is a must-use plugin living in wp-content/mu-plugins, which auto-activates and cannot be switched off from the dashboard. Managed hosts install those deliberately.

All of this is the part of WordPress ownership that hosted platforms simply do not have, and it is worth weighing honestly before you commit — our WordPress vs website builders comparison puts a number on what the routine costs in time and money. Fewer plugins, chosen deliberately, is the cheapest security measure available to you.