List of not-used core modules that can be turn off with no harm

Here's a list of what I think the modules do, it might help knowing what you can try to disable.

Important note: please check the module dependencies when disabling modules because some dependencies may be breaking.

  • AdminNotification: can be disabled. But it's useful to get the last security information.
  • AdvancedPricingImportExport: I reckon this one can be disabled if you don't use the Import/Export feature or the advanced pricing.
  • Authorization: cannot be disabled it's the module that handles the ACL
  • Authorizenet: can be disabled if you don't use Authorize.net
  • Backend: cannot be disabled it handles the backend.
  • Backup: can be disabled if you don't use the Magento backup feature.
  • BrainTree: can be disabled if you don't use BrainTree
  • Bundle: can be disabled if you don't use bundle products.
  • BundleImportExport: can be disabled if you don't use bundle products via Import/Export
  • CacheInvalidate: can be disabled if you don't use Varnish cache (but you should!)
  • Captcha: can be disabled if you don't use captchas
  • Catalog: well I reckon it can be disabled but why would you ?
  • CatalogImportExport: can be disabled if you don't use Import/Export for the catalog
  • CatalogInventory: cannot be disabled
  • CatalogRule: I reckon it could be disabled if you don't use catalog price rules
  • CatalogRuleConfigurable: can be disabled if you don't use catalog price rule with configurable products
  • CatalogSearch: keep it ;)
  • CatalogUrlRewrite: same for this one
  • CatalogWidget: this one can be disabled if you don't use the catalog widget product list
  • Checkout: keep it
  • CheckoutAgreements: can be disabled if you don't use the checkout agreements.
  • Cms: ain't sure if it can really be disabled if you don't use CMS features to be honest.
  • CmsUrlRewrite: see above
  • Config: cannot be disabled it handles the System Configuration feature.
  • ConfigurableImportExport: can be disabled if you don't use configurable with the Import/export feature
  • ConfigurableProduct: can be disabled if you don't use configurable products
  • Contact: can be disabled if you don't use the contact page
  • Cookie: keep it ;)
  • Cron: same here
  • CurrencySymbol: I think it can be disabled if you don't use multiple currencies
  • Customer: well ^^
  • CustomerImportExport: can be disabled if you don't use the Import/Export feature with customers
  • Deploy: I reckon it depends on your deployment methods but this is the module that handles the deploy CLI commands
  • Developer: can be disabled in production I reckon, it provides several CLI commands for developers.
  • Dhl: can be disabled if you don't use DHL
  • Directory: I reckon it cannot be disabled as it handles the management of countries and regions.
  • Downlodable: can be disabled if you don't use downloadable products.
  • DownlodableImportExport: can be disabled if you don't use downlodable products with the Import/Export feature.
  • Eav: cannot be disabled
  • Email: cannot be disabled
  • EncryptionKey: should not be disabled because it handles the advanced encryption model to protect passwords/sensitive data.
  • Fedex: can be disabled if you don't use FedEx.
  • GiftMessage: can be disabled if you don't use gift messages.
  • GoogleAdwords: can be disabled if you don't use Adwords.
  • GoogleAnalytics: can be disabled if you don't use Analytics (who does that ?)
  • GoogleOptimizer: can be disabled if you don't use Google Experiment (A/B testing) with Google Analytics
  • GroupedImportExport: can be disabled if you don't use grouped products with the Import/Export feature.
  • GroupedProduct: can be disabled if you don't use grouped products.
  • ImportExport: can be disabled if you don't use the Import/Export feature at all.
  • Indexer: keep it
  • Integration: pretty sure it can be disabled if you don't use the web API.
  • LayeredNavigation: can be disabled if you don't use the Layered navigation.
  • Marketplace: can be disabled it displays partners of Magento in the backend.
  • MediaStorage: keep it
  • Msrp: I reckon it can be disabled if you don't use the MSRP feature of Magento.
  • Multishipping: can be disabled if you don't use the "ship to multiple addresses" feature.
  • NewRelicReporting: can be disabled if you don't use NewRelic.
  • Newsletter: can be disabled if you don't use the newsletter feature of Magento.
  • OfflinePayments: can be disabled if you don't use the following payment methods: bank transfer, cash on delivery, check/money order and purchase order.
  • OfflineShipping: can be disabled if you don't use the following shipping methods: free shipping, flat rate, table rates and store pickup.
  • PageCache: keep it
  • Payment: same
  • Paypal: can be disabled if you don't use PayPal.
  • Persistent: can be disabled if you don't use the persistence feature of Magento.
  • ProductAlert: can be disabled if you don't use the product alerts feature.
  • ProductVideo: can be disabled if you don't use videos for your products.
  • Quote: keep it
  • Reports: I reckon it can be disabled if you don't use the Magento reports.
  • RequireJs: keep it
  • Review: can be disabled if you don't use the review system.
  • Rss: can be disabled if you don't use RSS
  • Rule: it's the abstract module extended by the sales rule, catalog rule etc.. Theorically if you don't use any of the rules you can disable it
  • Sales: keep it
  • SalesRule: can be disabled if you don't use the shopping cart rules.
  • SalesSequence: should be kept. It's responsible for the sequences processing in Sales module.
  • SampleData: can be disabled if you don't use the sample data
  • Search: keep it
  • Security: keep it
  • SendFriend: can be disabled if you don't use the send to friend feature.
  • Shipping: keep it
  • Sitemap: you can disable it if you don't want to manage the sitemap.
  • Store: keep it
  • Swagger: I think it can be disabled if you don't want to check the Magento REST API in a user friendly format.
  • Swatches: can be disabled if you don't use the swatches
  • SwatchesLayeredNavigation: can be disabled if you don't use the swatches in your layered navigation
  • Tax: keep it except if you live in a tax free world. In that case, send me an invite to your world.
  • TaxImportExport: can be disabled if you don't use the Import/Export feature with taxes.
  • Theme: keep it
  • Translation: theorically you can disable it if you don't need translations
  • Ui: keep it
  • Ups: can be disabled if you don't UPS
  • UrlRewrite: keep it
  • User: keep it
  • Usps: can be disabled if you don't use USPS
  • Variable: can be disabled if you don't use the custom variables feature.
  • Vault: can be disabled if you don't use Vault.
  • Version: should be disabled because it allows anyone to check your Magento version by accessing /magento_version
  • Webapi: can be disabled if you don't use the REST and SOAP web services.
  • WebapiSecurity: should not be disabled if you do use REST and SOAP web services.
  • Weee: can be disabled if you don't wee/fixed product taxes
  • Widget: can be disabled if you don't use widgets
  • Wishlist: can be disabled if you don't use the wishlist feature.

Theoretically you should be able to disable any module if you also disable the module's dependencies.
You should be able to see all dependencies by running the cli command bin/magento info:dependencies:show-modules. It will generate a csv file with all dependencies between the modules.
Ideally this would be a tree like structure, and disabling one branch completely should work, but this is real life, it does not work like that.
There are some modules that have circular dependencies. "A depends on B which depends on C which depends on A" (this is still a small scenario. You can get chains bigger than that).
Here you cannot disable a module unless you disable the full circle.
But you cannot do that from the UI when installing the module. You have to do it manually before installing it.
You can check all circular dependencies using this command bin/magento info:dependencies:show-modules. Again, you will get a csv file with all the circular dependencies explained.
but even if you disable the full circles, you might still get problems because of some undeclared dependencies and/or some dependencies declared in the wrong modules.
I made a presentation about disabling core modules about a year ago for MagetTitansIT. You can find the slides here.
It may be a little outdated because some things got fixed in the past year, but the idea and the main problem still remain.