The plugins your managed WordPress host won't let you use

Why managed WP hosts ban plugins

Managed WordPress hosts (WP Engine, Kinsta, Pressable, Flywheel, GoDaddy Managed WP, Bluehost Managed WP) ship their own platform features: object caching, page caching, CDN, backups, staging, redirects, image optimization, and security. When a customer installs a WordPress plugin that duplicates these features, conflicts happen — double caching, failed redirects, broken CDN invalidation.

Legitimate operational reasons for plugin bans:

• Caching plugins conflict with edge caching ("this page should not be cached, but the plugin caches it")
• Backup plugins compete with the host's snapshot system and consume server I/O
• Security plugins block the host's own monitoring traffic
• Performance plugins (like lazy-load) duplicate what the CDN already does

Less legitimate reasons:

• Migration plugins (All-in-One WP Migration) are banned because they make outbound migration easy
• Revenue-protecting: if the host sells "CDN acceleration" as an upsell, they ban competitor CDN plugins

Banned-plugin lists by host

Documented bans, April 2026:

Sample bans on WP Engine include: UpdraftPlus, BackupBuddy, BackWPup, VaultPress, WP Super Cache, W3 Total Cache, WP Rocket, WP Fastest Cache, Wordfence (partially — some features blocked), All-in-One WP Migration, Duplicator, Migrate Guru, iThemes Security (some features).

The plugin categories most affected

Backup plugins. UpdraftPlus, BackWPup, BackupBuddy, Duplicator Pro, VaultPress, WPvivid. Rationale: duplicates host's snapshot system.

Caching plugins. WP Super Cache, W3 Total Cache, WP Rocket, WP Fastest Cache, LiteSpeed Cache, Autoptimize. Rationale: conflicts with edge caching.

Migration plugins. All-in-One WP Migration, Duplicator (migration mode), Migrate Guru, WP Migrate DB Pro. Rationale: "performance impact during migration" and, cynically, making outbound migration harder.

Security plugins (partial). Wordfence firewall module, iThemes Security 2FA in some configurations, Sucuri scanner. Rationale: conflicts with host's WAF.

Performance plugins. Smush, Imagify (in some cases), EWWW Image Optimizer. Rationale: conflicts with host's image CDN.

Database plugins. WP-Optimize's database cleanup, Advanced Database Cleaner. Rationale: I/O impact on shared database servers.

If you need a banned plugin

Realistic paths:

1. Check if the host's built-in replaces it. If WP Engine's snapshot backup works for your needs, you do not need UpdraftPlus. Verify backup frequency and retention before assuming.
2. Request exception. Some hosts (Kinsta, Pressable) have a process to request a plugin be allowed case-by-case. WP Engine is stricter. Approval is case-specific.
3. Accept the loss. For most casual bans (caching, optimization), the host's built-in is usually as good. Live with it.
4. Use a different host. Traditional shared hosts (LaunchPad Host, SiteGround, A2) do not ban WordPress plugins. Pick one if plugin freedom matters to you.

Why traditional shared hosting allows them

Traditional shared hosts (LaunchPad Host, SiteGround, A2, Hostinger, Namecheap EasyWP) sell a generic LAMP/LEMP stack with cPanel. The customer is responsible for WordPress configuration including caching, backups, and security. The host does not ship alternatives, so there is nothing to conflict with.

Tradeoff: you configure more yourself. A managed-WP host ships opinionated defaults; a traditional shared host gives you choices.

At LaunchPad Host, we ship LiteSpeed with LSCache available by default (no plugin conflict because LSCache is the WordPress-aware caching), but if you prefer W3 Total Cache or WP Rocket, you install them and they work. No ban list, no "managed" restrictions. SSH and full wp-config.php control are standard.