A plugin is an add-on that gives existing software a feature it did not have. On a website, it usually means an extension you install into your site platform, most commonly WordPress, to add things like a contact form, an online shop, a booking system or SEO controls without writing code.
How a website plugin hooks in
Platforms that support plugins expose places where outside code can attach itself. WordPress calls these hooks: points such as "when a post is saved" or "when the page head is printed" where a plugin can run its own code. Installing a plugin copies its files onto your server, and activating it tells the CMS to load it on every request. The plugin can then add admin settings pages, new page blocks, database tables or changes to every page's output.
That is the key difference from a widget: a widget is one block placed on a page, while a plugin changes how the whole site behaves. A theme controls how the site looks; plugins are meant to control what it does. Browsers use "extension" for the same idea, and Shopify calls its version "apps".
Example: WooCommerce
WooCommerce is a free plugin that turns a WordPress site into an online store. A florist who already has a WordPress site installs it and gains product pages, a cart, checkout and order management, then adds further plugins for payment providers and delivery date selection. The base site is unchanged; the plugins add the shop on top.
When plugins matter for your site
If your site runs on WordPress or a similar CMS, plugins are how you get most features, and your choice of plugins shapes the site's speed and security more than almost anything else. Hosted website builders and AI builders that generate the site's code usually do not use plugins in this sense; features are built in or added as code and embeds.
Plugin mistakes that cause trouble
- Never updating. Outdated plugins are one of the most common ways small sites get hacked and infected with malware. Turn on updates or check weekly.
- Installing from unofficial sources. "Free" copies of paid plugins downloaded from random sites often contain hidden backdoors.
- Piling them up. Each active plugin can add database queries and scripts to every page. Remove ones you no longer use rather than just deactivating them.
- Two plugins doing one job. Two SEO or two caching plugins frequently conflict and produce errors or duplicate tags.
- Updating live with no backup. A plugin update can break a page. Back up first, or test on a staging copy.