Free Plugins

• 301 Redirects - Manage all your website redirects easily
• Elementor - A WIZZYWIG WordPress page builder

Paid Plugins

• Duplicator - Backup and import your WordPress site
• ElementsKit (optional) - Add tons of widgets to the Elementor framework
• TablePress - Add advanced tables to your site
• The SEO Framework - Manage your website's SEO easily
• Sticky Header Effects for Elementor - Add an option for a sticky navigation bar
• WPCode Lite - Easily add code to the header or footers of your pages
• WP Robots Txt - Manage the content of your Robots.txt file easily

Information below was sourced from this reddit post.

Google Analytics / GTM

You don't need a plugin to paste a tracking ID. It adds unnecessary PHP overhead.

add_action('wp_head', 'add_google_analytics');
function add_google_analytics() { ?>
	<?php }

SVG Support

This code restricts uploads to Admins or specific users, but it does not sanitize the files (like a plugin would). Only upload SVGs from 100% trusted sources, as a malicious SVG can still compromise the site.
This only allows admins to upload svgs:

add_filter( 'upload_mimes', 'enable_svg_for_admins' );
function enable_svg_for_admins( $mimes ) {
	if ( current_user_can( 'manage_options' ) ) {
		$mimes['svg'] = 'image/svg+xml';
	}
	return $mimes;
}

This only allows specific user ids to uploads svgs:

add_filter( 'upload_mimes', 'enable_svg_for_specific_users' );
function enable_svg_for_specific_users( $mimes ) {
    $allowed_user_ids = [ 1, 2, 3 ];
    if ( is_user_logged_in() && in_array( get_current_user_id(), $allowed_user_ids, true ) ) {
	    $mimes['svg'] = 'image/svg+xml';
	}
	return $mimes;
}

Hide Admin Bar for Non-Admins

Great for membership sites or subscriber logins.

if ( ! current_user_can( 'manage_options' ) ) {
	add_filter('show_admin_bar', '__return_false');
}

Disable XML-RPC

This is a common attack vector. You don't need Wordfence just to turn this specific door off.

add_filter( 'xmlrpc_enabled', '__return_false' );

Disable Guttenberg

If you never use the built-in block editor, stop loading its CSS on the front end.

add_filter('use_block_editor_for_post', '__return_false', 10);
// Prevent block styles from loading on frontend
add_action( 'wp_enqueue_scripts', function() {
	wp_dequeue_style( 'wp-block-library' );
	wp_dequeue_style( 'wp-block-library-theme' );
}, 100 );