The average inherited WordPress site we take on has 47 plugins. We usually leave with 9. Here's the list of the ones that always stay, why, and what we replace the rest with.
Keep: WP Super Cache (or LiteSpeed equivalent), Yoast SEO (or Rank Math, pick one), Wordfence (or WP Firewall — pick one), UpdraftPlus for backup belt-and-braces alongside our host backups, ManageWP for fleet patching, Limit Login Attempts Reloaded, WP Mail SMTP, Better Search Replace, and a custom theme of our own building.
Remove: page builders (Elementor, Divi, WPBakery — every one of them; we rebuild as a custom theme), the dozen redundant analytics/tracking plugins, half a dozen "performance" plugins that fight each other, every plugin abandoned for more than 18 months, every plugin loading jQuery globally.
The rule we apply: every plugin must justify its weight monthly. We re-audit at quarter boundaries.