The WordPress plugin directory has a trust problem hiding in plain
sight. Its most visible number, the active-install count, is also the
one number anyone with distribution can manufacture. I pulled the whole
directory apart to measure how often that happens, and the pattern is
bigger and more recent than I expected.
Install count is how the directory sorts winners from also-rans. It
shapes search position, it anchors the “featured” and “popular” lists,
and it’s the first thing a site owner reads when deciding whether to
trust a plugin. “1 million active installs” tells you a million people
looked at this, chose it, and kept it. That’s the whole reason the
number carries weight.
It only works if installs come from people choosing the plugin. When
they come from somewhere else, the number still shows up and still
ranks, but it’s measuring distribution rather than adoption.
What the data shows
I looked at every plugin in the directory with more than 10,000
active installs. There are 2,226 of them, accounting for 311 million
installs between them. Then I checked each one against the simplest
sanity signal there is: how many people who installed it left a
rating.
A plugin people actually pick up gathers reviews as it grows. The
typical plugin above 10,000 installs sits north of ten ratings per
10,000 installs. That’s the honest baseline: some fraction of real users
come back to say something.
96 of those 2,226 plugins have fewer than one rating per 10,000
installs. Not ten times fewer, more than ten times fewer than normal.
Together they hold 17.5 million installs. And 35 of them crossed the
10,000 line only since the start of 2024, so this isn’t old history,
it’s an accelerating pattern.
The most extreme case in the set: three million active installs,
thirty-nine ratings. A plugin with the reach of a small country and the
review count of a weekend side project.
What it looks like when it
happens
One plugin made the mechanism obvious. It sat flat at 10 installs for
four months, the kind of dead listing that just doesn’t move. Then, over
about ten weeks, it went from 10 to 10,000 installs in a clean,
near-vertical line. Not one new review appeared the whole way up.
Ten thousand people don’t discover an unknown plugin in ten weeks and
all decline to rate it. That curve is a switch getting flipped: the
plugin got bundled into something with distribution, and every install
of that something now counts as an install of the plugin. The publisher
is a theme company.
Once you know the shape, you see who’s producing it. Sorted by who
publishes these low-engagement, high-install plugins, they fall into
three groups.
Hosts preinstall on every site they provision. One host’s companion
plugin sits at a million installs with five ratings. Others in the same
bracket come from hosting brands whose plugins land on a site the moment
it’s created, before the owner has chosen anything.
Plugin suites bundle companions. A major page builder ships several
helper plugins that ride along with the main install, each showing tens
of thousands of installs and a rating or two.
Theme shops ship plugins inside themes. Activate the theme, get the
plugin, and its install count climbs on the back of the theme’s
distribution.
I’m not naming individual plugins here to pillory their authors,
because the behavior itself is legitimate. A host can preinstall what it
likes. A theme shop can bundle its own tools. A suite can ship
companions. That’s their product and their business, and in most cases
the bundled plugin is perfectly fine.
The part worth arguing about
The bundling itself is fine. The damage is what that install count
does once it’s sitting in a public directory next to everyone
else’s.
Install count on wp.org is a shared trust signal. It means the same
thing to a shopper whether the number was earned one download at a time
or delivered wholesale through a hosting panel. The directory doesn’t
distinguish, so it ranks and recommends both the same way. Distribution
buys the exact prominence that merit is supposed to earn.
That lands on two people. The site owner reading “500,000 installs”
as a proxy for “trusted and widely chosen,” when a large share of that
number is preinstalls from people who never evaluated it. And the
independent developer competing for the same directory real estate, who
has no host, no theme, and no suite to ride, and has to earn every
single install by being good enough that someone picks it on purpose.
They’re graded on the same scale as a plugin that skipped the test
entirely.
One honest distinction, so this doesn’t read as a blanket accusation.
A handful of low-review, high-install plugins in the data are promoted
through official or core-adjacent channels, the WordPress
performance-lab plugins being the clearest example. Those are low-review
for a different reason, and I’d separate them from commercial bundling.
The pattern I’m describing is the commercial kind: a company using its
own distribution to inflate a public number that everyone else is being
measured against.
Where this goes
I don’t think the answer is to ban bundling or shame the companies
doing it. The answer is that install count, on its own, has stopped
meaning what people still read into it. If you pick plugins by it,
you’re trusting a number that increasingly reflects who has distribution
rather than who built something worth choosing.
The fix is to read installs alongside the signals that distribution
can’t fake: whether the people using it actually came back to review it,
whether the install curve looks like discovery or like a switch, whether
real support and real updates sit behind the number. Those are harder to
manufacture, because they require people to actually want the thing.
I’ve spent fifteen years watching this directory. It’s still the
front door to the ecosystem for millions of sites. It deserves a trust
signal that measures what it claims to.
Related
Leave a Reply