These are the plug-ins I install when building a new WordPress web site.
BackWPup – Create routine and automatic back ups. Via mail, FTP and in the cloud.
BulletProof Security – WordPress Website Security Protection. Website security protection against: XSS, RFI, CRLF, CSRF, Base64, Code Injection and SQL Injection hacking…
Google Publisher Plugin – The official Google plugin for publishers, written by Google. Supported products include AdSense and Webmaster Tools.
Growmap Anti Spambot Plugin – Defeat automated spambots (even the new ‘learning’ bots with dynamically named hidden fields) by adding a client side generated checkbox.
iq Block Country – Block visitors from visiting your website and backend website based on which country their IP address is from.
WordFence – Wordfence Security is a free enterprise class security and performance plugin that makes your site up to 50 times faster and more secure.
WP Remote – Monitor and update all of your WordPress‐powered sites.
See also 20 essential WordPress plugins at econsultancy.com.