A plugin that almost nobody chose to install is sitting near the top of WordPress.org’s search results for “AI agent.” It has a 1.3-star rating. Fifty-nine of its first sixty-four reviews are one star. And it is still winning.
I have made my living on WordPress for two decades. The plugins I run took years to push past a hundred thousand installs the slow way, one real user at a time. So when I saw a brand-new, one-star plugin outranking tools that earned their place over a decade, I did the thing most people don’t bother to do. I went and read the code.
The WordPress plugin directory’s search ranking is open source. You can read exactly how it decides what shows up first. Once you do, the SiteGround situation stops looking like a glitch and starts looking like the system working as designed. The design just happens to reward the biggest players and work against everyone else.
What the ranking code actually does
Plugin search runs on Elasticsearch, through Automattic’s Jetpack Search layer, and the scoring lives in a file called class-plugin-search.php in the wordpress.org repository. I read it line by line. The final score for each plugin is a text-relevance score multiplied by a handful of factors: how recently it was updated, whether it claims compatibility with the current WordPress version, its active install count, its support resolution rate, and its rating.
Most of those are reasonable. The problem is how two of them are weighted, and one line that was deliberately removed.
The install count has no ceiling
Active installs enter the score as a logarithm, multiplied by a factor of 0.375. More installs always means a higher rank. That sounds fine until you notice what is missing. Elasticsearch lets you cap how much any single factor can contribute, through a setting called max_boost. The plugin directory explicitly removes it.
The code unsets max_boost. There is no ceiling. A plugin with ten million installs scores higher than one with one million, which scores higher than one with a hundred thousand, and it never stops. Install count keeps mattering all the way up.
There is a second twist. A separate decay function penalizes plugins under a million installs and gives plugins at exactly a million the full benefit. Cross the million-install line and your install score jumps by about 60 percent in a single step. That is the most valuable threshold in the entire directory, and it is reachable by anyone who can put a plugin on a million sites.
Ratings barely count, and the number of reviews counts for nothing
The rating factor is a quarter of the square root of the star rating. Work it out and the whole range, from a hated 2.5-star plugin to a perfect 5.0, moves the score by about 0.16. The jump from a hundred thousand to a million installs moves it by about 0.84. Install count outweighs quality by roughly nine to one at that threshold.
So a one-star plugin with a million forced installs beats a five-star plugin with a hundred thousand earned ones, by a wide margin.
The rating also ignores volume entirely. Two five-star reviews score exactly the same as two thousand. Nothing weights how many people actually rated the plugin. A brand-new plugin with five reviews from five friends gets the same quality signal as a plugin that earned 4.8 stars from two thousand real users over a decade.
The “popular” tab is just raw installs
If you browse the directory’s popular plugins instead of searching, there is no algorithm at all. The popular view sorts purely by active install count. No rating and no freshness check, just whatever sits on the most sites. A force-installed plugin with terrible reviews is indistinguishable from a long-loved one on that page.
The one tool that could catch this was removed
For years, every plugin page showed an active-install growth chart. You could see whether a plugin’s numbers grew steadily or spiked overnight. In 2022, WordPress.org removed those charts. The changeset that did it cited insufficient data obfuscation. The stated reason was that install counts could be gamed.
Sit with that. The directory removed the one public signal that let you tell organic growth from a manufactured spike, on the grounds that install counts can be gamed, while leaving in place an algorithm that rewards install counts above everything else and has no cap. The growth charts never came back. The ranking never got the memo.
How this favors the big players
Put the pieces together and the bias is structural, not accidental.
The only signal that really moves the needle is install count, and it has no ceiling. The one party that can manufacture installs at will is a company with a captive base: a host that can push a plugin to its customers, or a large plugin vendor that can suggest an add-on to its existing users. An independent developer cannot manufacture a million installs. A host with a million customers can do it in an afternoon.
It gets worse at the other end of the pipe. A first-time developer submitting a new plugin waits weeks for a manual review and often gets a terse rejection over a formatting detail. A hosting company with a million customers skips that queue entirely by installing directly. The small builder is made to crawl while the big partner walks to the front of the line.
This is not new. In 2014, GoDaddy bundled a plugin onto a wave of sites, the community pushed back, and the auto-installs were pulled. The precedent exists. The incentive to repeat it has only grown, because the prize, the top of the directory, is bigger than ever.
It is happening right now
Two examples, both live as I write this.
The first is the one that set this off. In late May, SiteGround auto-installed an AI plugin on more than a million of its customers’ sites. Nobody searched for it. Nobody clicked install. Customers logged in and found it already active. The reviews told the story at once: 59 of the first 64 were one star, making it one of the worst-rated plugins in the directory. It still spent weeks near the top of search for “AI agent,” because a million installs buried the rating penalty exactly the way the math says it should.
The second is quieter, and in a way more telling. There is an image-optimizer plugin published by Elementor sitting at a million installs with a 1.7-star rating. What stands out is not the rating, it is the engagement. A million installs, and only 76 reviews. Gutenberg has fewer installs and thousands of reviews. A plugin that almost nobody reviews yet still reaches a million installs is not being chosen on its merits. It is riding the install base of a much larger product. I can’t point to forced installs the way I can with SiteGround, but the fingerprint is the same: a huge install count that genuine engagement does not support.
That second pattern is the one to watch, because it is legal, low-profile, and available to every large vendor in the ecosystem. You do not have to force anything. You just have to already be big.
What would fix it
Fixing this does not require rebuilding the directory. The community has already filed the tickets.
Ticket 6511 on the meta trac, opened by Mark Zahra, asks for the install and growth data to be restored, so anyone can see whether a plugin’s numbers are real. Ticket 8298 proposes two specific changes to the ranking: cap how much install count can contribute, and weight ratings by how many people actually left them. Both are small edits to one file, and the team has re-tuned these exact weights before, in tickets like 2604.
Cap the install boost and a host can still install its plugin on a million sites, it just stops buying the top of search by doing so. Weight ratings by volume and five friendly reviews stop outscoring two thousand real ones. Bring back the growth charts and a manufactured spike becomes visible to everyone.
The directory is the front door to WordPress for millions of people deciding what to trust. Right now that door rewards whoever has the largest captive audience, and works against the independents who earned their installs one user at a time. That is the part worth fixing, and it is fixable this quarter if anyone with commit access decides it matters.
Related
Leave a Reply