Useful WordPress must-use (MU) plugins are small, deliberately always-on pieces of PHP: host integrations that your provider requires, site-specific bootstrap code that must run before ordinary plugins, tightly scoped security or maintenance functions, and Multisite behavior that belongs across the network. They are not a universal list of third-party plugins to install. Put code in wp-content/mu-plugins only when accidental deactivation would be a real operational problem and you have an owner and update process for it.
WordPress loads MU files automatically, before normal plugins, and does not offer an activation switch in wp-admin. That makes MU placement powerful for genuine bootstrap requirements, but it also makes mistakes harder to spot and recover from. The safest approach is to decide by behavior, document every file, test changes on a staging copy, and keep optional features as ordinary plugins.
As an Amazon Associate I earn from qualifying purchases.
What a WordPress must-use plugin is
WordPress defines a must-use plugin as a plugin installed in a special directory inside the content folder and automatically enabled for the installation. The default path is wp-content/mu-plugins. MU files appear under a separate “Must-Use” section in the Plugins screen, not in the regular list, and administrators cannot deactivate them through wp-admin. Removing or renaming the relevant file from that directory stops it from loading. See the WordPress Must-Use Plugins handbook for the current behavior.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →The name is historical: WordPress core merged handling for the MU directory on March 7, 2009. Today the practical distinction is loading and management, not a special plugin API. An MU plugin can use normal WordPress hooks, but its file is discovered and included automatically.
#1 Best Overall
“Must-use plugins are useful for code that should always run and should not be disabled accidentally from wp-admin.”
WordPress Developer Resources, Must-Use Plugins
How MU loading differs from an ordinary plugin
WordPress scans PHP files directly inside wp-content/mu-plugins and loads them in alphabetical order before ordinary plugins. It does not automatically search subdirectories. If you organize a project in its own folder, you must place a small loader PHP file at the MU directory root that includes the real entry point.
| Question | Must-use placement | Ordinary plugin placement |
|---|---|---|
| Should it always run? | Designed for code that must not be accidentally disabled. | Better for optional features administrators may turn off. |
| When does it load? | PHP files load alphabetically before normal plugins, so they can provide bootstrap behavior or affect later hooks. | Loads through the normal plugin system after MU files. |
| Can wp-admin activate or deactivate it? | No. Remove or rename the file to disable it. | Yes, through the normal Plugins screen. |
| Are activation, deactivation and uninstall hooks available? | WordPress cautions that activation hooks are not executed for MU plugins; packages depending on those lifecycle events may fail. | These lifecycle workflows are supported and are the usual choice when setup or teardown is required. |
| How are updates presented? | MU code does not appear in regular update notifications or show update status on the plugin screen. An owner must track and apply updates. | Normal dashboard update controls and notices are available. |
| How is a multi-file project discovered? | Only root-level PHP files are discovered automatically; use a root loader for a subdirectory. | Standard plugin packages can use their normal directory structure and header file. |
Because MU code runs early and cannot be switched off in the dashboard, a syntax error or incompatible change can affect the whole site. Treat every file as production infrastructure rather than as a convenient hiding place for an ordinary plugin.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →A decision test: should this code go in mu-plugins?
Use MU placement when all of the following are true:
- The behavior is required for the site or network to operate as intended, rather than being a user-selectable feature.
- Accidental deactivation would be more harmful than the operational cost of always loading the code.
- The code has a named maintainer, a documented source, and a repeatable update and rollback method.
- The code does not depend on activation, deactivation or uninstall hooks to create tables, migrate settings or clean up data.
- You have tested its interaction with the current WordPress and PHP versions and with ordinary plugins that it may affect.
If any answer is no, package it as an ordinary plugin unless a hosting or platform requirement says otherwise. The official handbook’s categories describe possible uses, not a certification of every snippet or package that someone labels “MU.”
Useful MU categories, with the right boundaries
Host or platform integration
Managed hosts sometimes place caching, monitoring, platform-compatibility or environment-integration code in the MU directory so customers cannot accidentally disable a service the platform expects. This is a strong fit only when the provider documents the requirement. Before deleting or changing a host-supplied file, ask the provider what depends on it; removing it can break caching, deployment or other platform behavior.
Where it lives: usually a provider-created PHP file in wp-content/mu-plugins (or a root loader and a provider subdirectory).
Free tools Windows power users keep installed
One-click scans. No signup required.
Why ordinary behavior is insufficient: a customer could deactivate an ordinary plugin while the host still assumes the integration is present.
Owner and updates: the hosting provider should own source and release instructions. Record the provider’s support or documentation path in your inventory, and do not overwrite the file with a dashboard update.
Safe rollback: follow the provider’s procedure. If support confirms it is safe, copy the file for backup and rename the root PHP file so WordPress no longer discovers it; restore the original name to re-enable it.
Site-specific bootstrap code
A small bootstrap can register constants, compatibility shims or an early hook that another part of the site needs before ordinary plugins load. The dependency must be concrete: document which later code relies on the earlier hook and why changing load order would cause a failure.
Recommended Free Tools
Example environment: a custom site repository deployed to staging and production by the site’s engineering team. The owner is that team, not an individual administrator editing files in production.
<?php
// File: wp-content/mu-plugins/acme-bootstrap.php
// Owner: Acme web team; deployed from the site repository.
if ( defined( 'WP_DEBUG' ) && WP_DEBUG ) {
add_action( 'plugins_loaded', 'acme_register_compatibility' , 1 );
}
function acme_register_compatibility() {
// Narrow compatibility setup required before ordinary plugins run.
}
The example is intentionally narrow: replace the placeholder function with reviewed, site-specific code and test it against the production PHP version. The update path is the repository deployment, not a WordPress update button. To roll back, deploy the previous known-good commit or temporarily rename the root file after confirming that doing so will not remove a host dependency.
Always-on security, performance or maintenance behavior
A narrowly scoped function that administrators deliberately want active on every request can be an MU candidate. Examples include enforcing a site policy, adding a small maintenance guard, or registering a performance-related integration that must not be switched off during routine administration. Keep the scope small and observable. A broad “utility” file that accumulates unrelated features becomes difficult to review and increases the blast radius of a bug.
Ordinary plugin is preferable when: the feature has settings that users may disable, needs an activation migration, displays dashboard notices, or is distributed to multiple unrelated sites. Those needs belong in the normal plugin lifecycle.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Update and rollback: store the file in version control, record the expected hook behavior, test on staging, and keep a previous file or commit available. A rollback should remove only this behavior, not unrelated code in the same file.
Network-wide Multisite behavior
For Multisite, an MU file can enforce behavior across the installation when every site must receive it. This is appropriate for network policy or infrastructure code, not for a feature that individual site administrators should control. Verify the network-wide effect in a staging network: an early hook, capability check or URL assumption that works on one site can behave differently across domains and mapped paths.
Owner: the network administrator or platform team. Document whether the code is expected on every site, how new sites inherit the behavior, and which network settings it reads. Use an ordinary network-activated plugin when the project needs its activation and deactivation workflow.
Rank #4
How to install an MU plugin safely
- Back up first. Make a current database and file backup before adding, replacing or removing plugin code. WordPress’s plugin management guidance recommends a current backup before updates; the same precaution applies to always-loaded files. See Manage Plugins.
- Check the environment. Confirm the site’s WordPress and PHP versions, whether it is Multisite, and whether the host already supplies files in
wp-content/mu-plugins. Read the host’s documentation before touching those files. - Create the directory if needed. In the site’s content directory, create
wp-content/mu-plugins. The default content directory can be relocated, so use the site’s actualWP_CONTENT_DIRpath if it differs. - Choose a root-level entry file. A single-file MU plugin can be copied directly into the directory, for example
wp-content/mu-plugins/site-policy.php. WordPress discovers PHP files at that level; names determine alphabetical load order. - Use a loader for organized code. For a project stored in
wp-content/mu-plugins/site-policy/, add a root file such as:
<?php
// File: wp-content/mu-plugins/site-policy-loader.php
// Includes the reviewed entry point for the site-policy project.
require_once WPMU_PLUGIN_DIR . '/site-policy/site-policy.php';
The loader is the file WordPress sees. Keep the included path stable, and ensure the entry file cannot be loaded twice by another loader.
- Transfer with an appropriate method. A developer can deploy through version control or SFTP. Do not assume the built-in plugin installer will manage MU code; the ordinary installer is for normal plugins. WordPress documents directory installation, ZIP upload and manual SFTP transfer for ordinary plugins, with manual transfer described as an advanced route.
- Test before production. On staging, load the front end, wp-admin, scheduled tasks and the specific feature that depends on the file. Check the PHP error log and confirm that expected hooks run once and in the intended order.
- Verify discovery and document it. Open the Plugins screen’s Must-Use section, confirm the file is listed, and add it to an inventory with its purpose, owner, source revision, dependencies and rollback method.
- Deploy and monitor. Move the tested file through the normal deployment process. Watch error logs and critical user journeys after release, especially when the file runs before ordinary plugins.
Organizing files and controlling load order
Alphabetical loading is a dependency mechanism, not a substitute for architecture. If one MU file must initialize before another, give the relationship an explicit, readable name such as 00-platform-loader.php and 10-site-policy.php, then document why the order exists. Avoid relying on incidental names that nobody understands.
Keep each root file focused. A loader may include a subdirectory’s entry point, but the subdirectory itself will not be scanned automatically. If a file is renamed to an extension other than .php, WordPress will not load it; that can be a quick emergency disable, but preserve the original file and record the change so it is not mistaken for a permanent fix.
Maintenance practices that keep always-loaded code manageable
Maintain an inventory
Because MU files do not participate in normal update notices, maintain a simple register outside wp-admin.
| Record | What to capture |
|---|---|
| File and path | Exact root filename, subdirectory and loader relationship. |
| Purpose | The one operational problem the code solves and the sites or network on which it applies. |
| Owner | A team or provider responsible for reviewing and releasing changes. |
| Source and version | Repository, provider documentation or package source, plus the deployed revision and date. |
| Dependencies | Required WordPress/PHP versions, constants, hooks, host services and ordinary plugins. |
| Rollback | The tested previous revision and the safe procedure for disabling or restoring it. |
| Last review | When the code and its permissions were checked and who approved the review. |
Review updates deliberately
Read the source and change history before deploying. Confirm that the update still supports the site’s WordPress and PHP versions, inspect new hooks and external calls, and test on staging. A current backup is a prerequisite, not a substitute for code review.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Apply secure coding practices
For code you write or maintain, follow the WordPress Plugin Handbook’s security and privacy guidance, including validating input and escaping output. The handbook is the starting index for those topics: WordPress Plugin Handbook. WordPress.org’s directory guidance says, “All code in the directory should be made as secure as possible.” Its expectations around security and public source access are useful selection signals, but they do not guarantee that any particular plugin or snippet is secure; review remains your responsibility. See the Detailed Plugin Guidelines.
Limit permissions and visibility
Only the deployment or hosting accounts that need to change MU files should be able to write them. Keep backups of previous revisions, monitor file changes, and make the purpose obvious in comments. Always-loaded code that is compromised can persist across every request and may be less visible to administrators than an ordinary plugin update.
When an ordinary plugin is the better choice
Use a normal plugin when administrators need dashboard activation or deactivation, when installation must run migrations, when uninstall should remove settings or tables, when the feature is optional, or when users expect dashboard update notices. Ordinary plugins can be installed from the built-in WordPress directory, uploaded as ZIP files, or transferred manually by SFTP; WordPress describes SFTP as an advanced option for uncommon cases. They provide the normal activation and update controls and are easier to hand to another site owner.
Do not move an ordinary plugin into MU merely to hide it from a user’s deactivation list or to avoid managing updates. If its package assumes activation hooks, those hooks will not execute as they would for a normal plugin, and setup may be incomplete.
Troubleshooting common MU problems
The file does not appear under Must-Use
- Confirm the file is inside the active content directory’s
mu-pluginsfolder, not a similarly named folder elsewhere. - Check that it is a PHP file directly at the folder root. A PHP file only inside a subdirectory needs a root loader.
- Look for a parse error or fatal error in the PHP log and validate the file against the site’s PHP version.
The site shows a fatal error after deployment
- Use the backup or previous repository revision to restore the last known-good file.
- If the file is not host-supplied, temporarily rename the root PHP file so WordPress cannot discover it, then test recovery and inspect logs.
- For a host-owned file, contact the provider before removing it; disabling a platform integration can create a second failure.
A change seems to run in the wrong order
- Check alphabetical filenames and whether another loader includes the same entry point.
- Confirm the hook priority and whether the code truly needs to run before ordinary plugins. If it does not, moving it to a normal plugin may reduce risk.
An update is overdue
There is no ordinary dashboard update notice for MU code. Check the inventory’s owner and source, compare the deployed revision with the maintained source, schedule testing, and deploy through the recorded process. If nobody owns the file, treat that as an operational defect and assign ownership before making further changes.
Choosing with confidence
Place code in mu-plugins when it is genuinely infrastructure: required host integration, a narrowly defined early bootstrap, a site-wide function that must remain enabled, or a Multisite policy intended for the whole network. Keep it small, root-discoverable through a clear loader, reviewed for security, and backed by an owner, inventory and rollback plan. Choose an ordinary plugin for everything that needs lifecycle hooks, optional activation, dashboard updates or routine administrator control.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
