“Best XenForo plugins 2026” is a search people type when they want a shopping list. This is not that list. It is a landscape: official add-ons XenForo actually sells, then the community-named tools that keep showing up in 2.3 operations threads, then the things you should not install because a core screen or another article on this site already owns the job. There is no ranking. There is a job, a 2.3 compatibility bar, and an add-on tax you will pay on every upgrade.
This is not the credits / shop article. DragonByte Credits is already documented there. It is not a 2026 must-install. This is not a news ticker buyer’s guide — stock notices first. It is not the later streamer / server-listing comparison. It is not how to customize a style. Stay here until you can say why a row is on your board.
Official names below come from xenforo.com and the public manuals. Community names come from the XenForo community-practice notebook we use on this site: Redis Cache by Xon, Font Awesome Manager by Kirby, LiteSpeed Cache for XF2, Spaminator (Ozzy47), CleanTalk, Moderator Panel by Andrew, XFOptimize, XenPorta 2. That notebook does not vet DragonByte (beyond the credits article we already wrote), s9e, or a long tail of RM resources. If a favourite is missing, it is missing on purpose.
The 2.3 bar, before any zip
XenForo 2.3 removed jQuery, shipped style variations, and turned icons into SVG sprites. The upgrade article is the staging checklist. Apply this filter to every add-on, official or not:
| Question | If the answer is no |
|---|---|
| Is there a build that names 2.3 (not “should work”)? | Do not install it on production |
Does it still call $('selector'), Select2, or SwiftMailer? |
It will fail after upgrade. Leave it off |
| Does its CSS survive both style variations? | You will ship a dark-mode ticket |
Does it fork PAGE_CONTAINER instead of a template modification? |
You bought a merge queue |
| Has the author shipped an update in the last year? | Treat it as unmaintained |
| Can you restore last night’s backup in an hour? | You are not installing anything this afternoon |
Cloud plans include the official suite. Self-hosted extras are purchased separately. This article will not invent 2026 dollar prices. If you need a number, open xenforo.com/purchase and read the page — license, extension, Cloud Starter / Standard / Business, and add-on list prices change and VAT applies. Previous public figures on this site (license, Cloud monthly bands) are snapshots, not a quote.
Add-on tax is real: every extra is another 2.3.x to watch, another outdated template, another thing that can break css.php. The scaling article is the architecture. This one is the shopping filter.
Official first: three add-ons XenForo names
The official extras that matter on a self-hosted 2.3 board are XenForo Media Gallery (XFMG), XenForo Resource Manager (XFRM), and XenForo Enhanced Search (XFES). The community-practice notebook we queried does not name these three. The official website and manuals do. Use them when the job is a gallery, a catalogue, or search that outgrew MySQL full-text.
Media Gallery (XFMG)
A gallery is not a thread with six attachments. It is albums, media items, and a permission model that is not “can post in General.” Install XFMG when members are supposed to publish images as a first-class library — a photography club, a livery dump, a screenshot archive — and you want that library to survive a style change.
Official 2.3 image path still applies: EXIF is preserved before resize; the gallery uses the WebP conversion path when you have it on. The performance article owns WebP and the pixel-count cap. Do not install XFMG to get WebP. Do not install it because you wanted a prettier attachment list in a support forum.
Permissions are normal XenForo permissions on gallery categories. Staff who moderate images need View. A private album is not a permission you invent with extra.less.
Resource Manager (XFRM)
XFRM is a catalogue: a download, a version string, a discussion thread, reviews if you turn them on. It is the honest official tool for “our mods / our maps / our briefing PDFs.” It is not a live FiveM query and it is not a server listing of connect strings. The listing article already told you to start with prefixes and custom thread fields. Buy XFRM when the file is the product and you want version history, not when you wanted a green online dot.
Index page route can point at the resource manager (resources/ or whatever you set). That is a portal decision — portal article — not a reason to install a third-party CMS.
Enhanced Search (XFES)
XFES replaces MySQL full-text with Elasticsearch. Official path: Setup → Enhanced Search. Docs require Elasticsearch 2.0+. Most shared hosts do not ship Elasticsearch. If you cannot SSH to a box that runs ES, or you cannot pay for a hosted ES, XFES is not a plugin you “just turn on.” It is a hosting decision.
What the official feature is for: stop words, stemming, accent removal, a search index you rebuild after you change those options. After config, rebuild the search index. Do not enable XFES on Friday night on the live board and leave the index half-built.
The scaling article already called XFES the next lever after PHP-FPM, InnoDB, and Redis — not the first. A 20,000-post board on a decent VPS searches fine with stock MySQL. A multi-million-post board with members who search all day does not. Measure. Then buy.
Cloud includes the suite. Self-hosted: you purchase XFES separately and you bring ES. There is no ACP checkbox that installs Elasticsearch for you.
Community-named tools (SF-2)
These names appear in XenForo community operations write-ups. That is a stronger signal than a random RM screenshot. It is still not a XenForo warranty.
Redis Cache by Xon
Official 2.3 cache docs talk about cache providers. They do not walk “install Xon’s Redis add-on.” Community boards that hurt on xf_css_cache and the data registry do. Claimed wins in those write-ups: compiled CSS in RAM, fewer MySQL hits on the registry. High-availability note from the same sources: Redis Sentinel is supported; multi-master clustering is not. If Redis flaps, they disable persistence so a disk write does not block PHP.
Operational order, already in the speed article:
phpredisin PHP.php -mlists it.- Configure the adapter. Restart PHP-FPM.
- Hit the homepage as a guest twice.
- Change a style property. Confirm the front-end updates after a cache rebuild.
Do not enable Redis for the first time during a permission rebuild. Do not invent core S3 as a substitute. Redis is cache. Object storage is data/. Different jobs.
LiteSpeed Cache for XF2 (LSCache)
Community guest-cache path when the web server is LiteSpeed: the XF2 LSCache add-on serves flat HTML and skips PHP-FPM for guests, then bypasses for cookies that mean “logged in.” Official XenForo also has $config['pageCache'] with a dedicated page context. Pick one owner. Two guest caches stacked is how you spend a Saturday purging.
If you are not on LiteSpeed, this row is not for you. Nginx FastCGI cache and a careful Cloudflare rule are the cousins. The speed article owns the CWV version. This article only says: LSCache is the named community add-on, and it is a host choice.
XFOptimize
Community-named application-layer optimizer. The same write-ups that recommend it tell you not to also turn on Cloudflare Auto Minify (HTML/CSS/JS). Double-minify breaks script compilation. XenForo 2.3 already ships deferred, modular JS and compiled Less. An optimizer is a second compiler. If you add one, turn the CDN rewriter off. The mistakes article already has Auto Minify as a fake bug.
Font Awesome Manager by Kirby
Community threads still push FAM. That advice is from the 2.1 / 2.2 era, when the board loaded the entire Pro webfont. XenForo 2.3 already ships an Icon Usage Analyzer that walks templates, modifications, phrases, and JS and keeps the SVG names you use. Official materials describe the index payload dropping from hundreds of kilobytes to tens.
Start with the stock analyzer and a cache rebuild. Add FAM only if you have measured that you still ship a webfont you do not want. Do not install it because a 2021 checklist said so. The upgrade article said the same thing. A 2.2 content: "\f019" in extra.less is still invisible to the analyzer — fix the Less, do not buy a subsetter to hide the bug.
Spaminator (Ozzy47) and CleanTalk
Stock XenForo already has registration approval, a spam cleaner, CAPTCHA / login limits after four failures, and a discouraged-user hammer. The security article is the baseline. You add a third-party spam product when the baseline is on and the queue is still a part-time job.
Spaminator and CleanTalk are the two names the community-practice notebook actually uses. They are different products (one is an add-on culture, one is a service with an API). This article will not invent a feature matrix or a 2026 price. Read the resource pages. Turn them on in staging. Confirm a legitimate registration still lands in Registered as primary. Confirm two-step still works. Confirm they do not silently drop a payment callback.
Do not install both “to be safe.” Two classifiers on one registration is how you debug a false positive at 23:00 with two vendors.
Akismet is not stock XenForo. Do not write it into a 2026 checklist as if it were.
Moderator Panel by Andrew
Community name, with Protected Users as the feature people cite. Large boards use it so a tired moderator cannot action a protected account the way they action a random spammer. Stock XenForo already has super-admin versus admin, staff tools, and a permission model. This add-on is for the moment your mod team is big enough that “please don’t ban the owner” is not a sufficient control.
If you have two moderators who eat lunch together, you do not need it. If you have a queue and a junior bench, read the resource and test Protected Users on staging before you need it during an incident.
XenPorta 2
A third-party portal / magazine layer. Community sources warn it fights lazy-load: the slider initializes before the image exists, or never initializes. Test the first screen after any lazy-load change. The portal article’s position is still: decide the first-screen job, use stock index route + widgets + featured + article forums, install a CMS only if the door is already boring and correct.
XenPorta 2 is not “best 2026.” It is the named portal add-on you will be asked about, and the named conflict you will hit if you also bought a lazy-load trick. If you install it, keep your CSS in the child style, do not customize its templates on the vendor parent, and do not also dump a ticker onto the same first screen.
Already documented, not a 2026 must-install
DragonByte Credits (and the matching Shop) lives in the points / credits / shop article. Official user upgrades sell a group for real money. Credits are a second ledger. If nobody would pay for the thing, do not print points. That is the whole decision. It is not a must-install for 2026, and the community-practice notebook we queried does not otherwise vet the DragonByte catalogue. Do not read this landscape as a DragonByte endorsement.
s9e (Media Sites and friends) is not named in that notebook. Plenty of boards use it. This article will not pretend we vetted it here. If you need a host BB-code the core media sites list does not know, read the resource, confirm 2.3, test both variations. That is as far as we go.
Tickets: Help Desk (Naz) is the named product when stock private nodes and conversations are not a queue. Same rule: job first.
[8WR] XenRio is the named live-stream directory in the streaming article. Not a 2026 “everyone needs this.”
What you should not install
| Temptation | Why not | What to use instead |
|---|---|---|
| Third-party dark-mode switcher | 2.3 has variations | Theme switcher |
| Second dark style SKU | Two merge queues | One style, two palettes |
| News ticker add-on on day one | Stock scrolling notices | Ticker pattern, newsroom |
| Stats widget add-on | Core forum_statistics |
Widgets |
| Portal CMS before a first-screen sentence | Second homepage | Portal |
| FAM “because 2021” | 2.3 analyzer exists | Measure first |
| Credits “for engagement” | Second ledger nobody spends | User upgrades, ranks |
| Anything that still needs jQuery | 2.3 removed it | Wait for a 2.3 build or replace the job |
| Two guest caches | Purge theatre | Page cache or LSCache |
| Cloudflare Auto Minify + XFOptimize | Double compiler | One optimizer, CDN as cache |
| Random “SEO add-on” | Most of it is core + habits | SEO |
| Nulled zips | Compromise | Security |
Stacks by job, not by “top 10”
Pick the row that matches the board you run. Install that row. Stop.
Small public board, Default style, one admin.
Nothing. Registration approval if you are a magnet. That is it. Style work is a child, not an add-on.
Growing board on a VPS you SSH into.
Redis Cache (Xon) once CSS compile or registry shows up in the slow log. Official $config['pageCache'] or LSCache if the host is LiteSpeed. Not both. WebP on. Debug off.
Search is the product (huge archive, members search for old threads as a job).
XFES + Elasticsearch 2.0+ on a box that actually runs ES. Rebuild the index. Shared hosting: do not buy XFES yet; change host first.
Members publish files as a catalogue.
XFRM. Permissions. Versions. Do not also invent a second download forum.
Members publish images as a library.
XFMG. Permissions. WebP path. Do not also dump the same files into a discussion forum as 20 MB attachments.
Spam is a shift, not a bad afternoon.
Stock approval + spam cleaner first. Then one of Spaminator or CleanTalk. Staging. Watch payment and 2FA.
Junior moderators can reach founder accounts.
Moderator Panel (Protected Users). Plus the mod team article, because software will not fix a culture.
The first screen is a magazine and stock widgets are not enough.
Prove the door with stock tools. Then XenPorta 2 if you still need it. Test sliders against lazy-load. Child-style CSS only.
You sell access.
Official user upgrades. Credits only if the shop article said yes.
Hygiene after every install
The 2.3 upgrade already told you to stage add-ons. Repeat it as a 2026 habit:
- Backup. Database +
data/+internal_data/. - Staging. Install there. Click the new ACP. Load guest, Registered, staff.
- Both style variations. Add-on CSS with a hard hex will fail one half.
- Appearance → Template modifications and Outdated templates. Bind new TMS to the add-on ID.
- Permissions: Analyze as a throwaway. Private nodes still private. Guests do not see staff tiles.
- One week of quiet logs. Then production.
Uninstall is a feature. If you cannot uninstall on staging without leaving phrases, widgets, or a widget position behind, you do not understand the add-on yet. Do not learn that on live.
Keep an inventory page only staff can see: add-on ID, vendor, why it exists, date last updated, who will remove it if the vendor disappears. An inventory is how a 2027 admin does not inherit twelve mysteries.
XFES, in the ACP, without romance
If search really is the next lever, the official path is narrow.
- Confirm Elasticsearch 2.0+ is running on a box you control, or a hosted ES you can point at.
curlthe cluster from the web node. If that sentence is already a problem, stop. Shared hosting that cannot run ES will not grow ES because you bought XFES. - Install XFES. Setup → Enhanced Search. Point it at that cluster. Save.
- Turn on the options you actually understand: stop words, stemming, accent removal. Do not tick every box because a blog said “more is better.” Each option changes how the index is built.
- Rebuild the search index. Wait until the job finishes. A half-built index looks like “Enhanced Search is broken.”
- Search for a phrase you know exists, a stemmed variant, and an accented name. Then search as a guest on a private node — permissions still apply. XFES is not a way around View.
The scaling article is when this row is worth the ops. A quiet 20,000-post board should spend the Saturday on Redis or WebP instead.
XFMG versus “we already have attachments”: if the library is the product (albums, a livery dump, a screenshot museum), XFMG. If images are evidence in a support thread, attachments stay in the thread. Installing both and dumping the same file twice is how you lose the original.
XFRM versus a download forum: if you need versions, a discussion per resource, and a catalogue URL, XFRM. If you post a zip once a season, a thread with an attachment is enough.
Three boards, one quarter
Hobby board, one admin, Default style.
This quarter: nothing new. Registration approval if spam started. Child style, not an add-on. Revisit next quarter.
Game hub, VPS, weekend traffic spikes.
Redis Cache (Xon) if CSS compile or registry shows in the slow log. One guest cache. WebP already on. Spaminator or CleanTalk only after stock approval is on and the queue is still a shift. No XenPorta until the portal sentence exists. No ticker add-on.
Big archive, members search for old threads as a job.
Host that can run ES. XFES. Rebuild. Then stop adding “search add-ons.” XFRM only if the catalogue is real. Moderator Panel only if junior staff can reach founder accounts.
Write the quarter on the inventory page. An add-on that is not in this quarter is a no.
Cloud versus self-hosted, one paragraph
XenForo Cloud includes the official add-on suite on the plans that say so. You still do not automatically get Xon’s Redis add-on, CleanTalk’s service, or XenPorta. You also do not get Elasticsearch on a shared Cloud box just because XFES is in the suite — read your plan’s search story before you assume. Self-hosted: you buy XFMG / XFRM / XFES on the purchase page, you bring ES if you bought XFES, you bring Redis if you want Xon. Do not mix “Cloud includes it” into a VPS runbook.
Checklist
- Every installed add-on has a 2.3 build and an author who still ships
- Official jobs first: XFMG / XFRM / XFES only if the job is gallery / catalogue / ES search
- XFES: Setup → Enhanced Search, Elasticsearch 2.0+, index rebuilt; shared host usually cannot
- Cache: Redis (Xon) and/or one guest cache (pageCache or LSCache)
- FAM only after you measured; 2.3 analyzer is the default
- One spam product, not two; stock approval already on
- Moderator Panel only if protected accounts are a real risk
- XenPorta only after a stock door; sliders tested against lazy-load
- DragonByte Credits: already documented; not a must-install
- No third-party theme switcher, no ticker-on-day-one, no nulled zips
- Inventory page exists; uninstall tested on staging
- Three sessions after every install
Takeaways
- Official 2026 extras are XFMG, XFRM, and XFES. XFES needs Elasticsearch 2.0+; most shared hosts do not have it.
- Community-named operations tools: Redis Cache (Xon), LSCache, XFOptimize, FAM (measure first), Spaminator, CleanTalk, Moderator Panel (Andrew), XenPorta 2 (slider/lazy-load conflict).
- This site already covered DragonByte Credits. It is not a 2026 must-install. SF-2 did not vet the rest of DragonByte or s9e.
- The 2.3 bar — no jQuery, variations-safe CSS, maintained author — kills more add-ons than taste does.
- Install to a job. Uninstall is a feature. A short inventory beats a “best of” list you cannot restore.
A good 2026 board is under-plugin’d on purpose. The expensive part was never the zip. It was the upgrade after the zip.