The WordPress plugin directory has a trust problem hiding in plain sight. Its most visible number, the active-install count, is also the one number anyone with distribution can manufacture. I pulled the whole directory apart to measure how often that happens, and the pattern is bigger and more recent than I expected.
Install count is how the directory sorts winners from also-rans. It shapes search position, it anchors the “featured” and “popular” lists, and it’s the first thing a site owner reads when deciding whether to trust a plugin. “1 million active installs” tells you a million people looked at this, chose it, and kept it. That’s the whole reason the number carries weight.
It only works if installs come from people choosing the plugin. When they come from somewhere else, the number still shows up and still ranks, but it’s measuring distribution rather than adoption.
What the data shows
I looked at every plugin in the directory with more than 10,000 active installs. There are 2,226 of them, accounting for 311 million installs between them. Then I checked each one against the simplest sanity signal there is: how many people who installed it left a rating.
A plugin people actually pick up gathers reviews as it grows. The typical plugin above 10,000 installs sits north of ten ratings per 10,000 installs. That’s the honest baseline: some fraction of real users come back to say something.
96 of those 2,226 plugins have fewer than one rating per 10,000 installs. Not ten times fewer, more than ten times fewer than normal. Together they hold 17.5 million installs. And 35 of them crossed the 10,000 line only since the start of 2024, so this isn’t old history, it’s an accelerating pattern.
The most extreme case in the set: three million active installs, thirty-nine ratings. A plugin with the reach of a small country and the review count of a weekend side project.
What it looks like when it happens
One plugin made the mechanism obvious. It sat flat at 10 installs for four months, the kind of dead listing that just doesn’t move. Then, over about ten weeks, it went from 10 to 10,000 installs in a clean, near-vertical line. Not one new review appeared the whole way up.
Ten thousand people don’t discover an unknown plugin in ten weeks and all decline to rate it. That curve is a switch getting flipped: the plugin got bundled into something with distribution, and every install of that something now counts as an install of the plugin. The publisher is a theme company.
Once you know the shape, you see who’s producing it. Sorted by who publishes these low-engagement, high-install plugins, they fall into three groups.
- Hosts preinstall on every site they provision. One host’s companion plugin sits at a million installs with five ratings. Others in the same bracket come from hosting brands whose plugins land on a site the moment it’s created, before the owner has chosen anything.
- Plugin suites bundle companions. A major page builder ships several helper plugins that ride along with the main install, each showing tens of thousands of installs and a rating or two.
- Theme shops ship plugins inside themes. Activate the theme, get the plugin, and its install count climbs on the back of the theme’s distribution.
I’m not naming individual plugins here to pillory their authors. As a business practice this is theirs to make: a host can preinstall what it likes, a theme shop can bundle its own tools, a suite can ship companions. But the three don’t sit on the same footing. Someone who activates a theme has at least chosen the theme. A host preinstall lands on every site it provisions before the owner has chosen anything, and often sits there untouched, yet each one still registers as an active install. That’s the hardest version to call adoption, and it’s the hosts producing it.
The part worth arguing about
Bundling is theirs to do. The damage is what that install count does once it’s sitting in a public directory next to everyone else’s.
Install count on wp.org is a shared trust signal. It means the same thing to a shopper whether the number was earned one download at a time or delivered wholesale through a hosting panel. The directory doesn’t distinguish, so it ranks and recommends both the same way. Distribution buys the exact prominence that merit is supposed to earn.
That lands on two people. The site owner reading “500,000 installs” as a proxy for “trusted and widely chosen,” when a large share of that number is preinstalls from people who never evaluated it. And the independent developer competing for the same directory real estate, who has no host, no theme, and no suite to ride, and has to earn every single install by being good enough that someone picks it on purpose. They’re graded on the same scale as a plugin that skipped the test entirely.
One honest distinction, so this doesn’t read as a blanket accusation. A handful of low-review, high-install plugins in the data are promoted through official or core-adjacent channels, the WordPress performance-lab plugins being the clearest example. Those are low-review for a different reason, and I’d separate them from commercial bundling. The pattern I’m describing is the commercial kind: a company using its own distribution to inflate a public number that everyone else is being measured against.
Where this goes
I don’t think the answer is to ban bundling or shame the companies doing it. The answer is that install count, on its own, has stopped meaning what people still read into it. If you pick plugins by it, you’re trusting a number that increasingly reflects who has distribution rather than who built something worth choosing.
The fix is to read installs alongside the signals that distribution can’t fake: whether the people using it actually came back to review it, whether the install curve looks like discovery or like a switch, whether real support and real updates sit behind the number. Those are harder to manufacture, because they require people to actually want the thing.
I’ve spent fifteen years watching this directory. It’s still the front door to the ecosystem for millions of sites. It deserves a trust signal that measures what it claims to.
Related
Leave a Reply