How we score WordPress plugins

Every status, alert and score comes from fixed rules applied to public data. No AI decides a plugin's status. Every claim on a plugin page links to the data behind it. Current score version: v1.

Signals

A signal is a fact we detect, with a rule and a severity. Critical means act now. Warning means review this week. Info is context.

ID	Signal	Rule	Source	Severity
OWN-1	New committer	A username commits to the plugin's SVN for the first time, and the plugin is older than 90 days. Warning when at most one other username committed in the previous 12 months; Info when a team of two or more did (normal team growth)	Trac timeline + SVN log	Warning or Info
OWN-2	Author or contributors changed	author, author_profile or contributors differs from the previous snapshot	Plugins API	Warning
OWN-3	Likely ownership transfer	OWN-2 (author or contributor list changed), and none of the previous 12 months' committers has committed in the last 60 days, and a new release ships within 90 days of the change	Derived	Critical
OWN-4	Homepage domain changed	Plugin homepage or author URI moves to a different registrable domain	Plugins API	Warning
CLS-1	Closed on wordpress.org	API returns closed; record date and reason	Plugins API	Critical (security reason or unknown), Warning (any other stated reason)
CLS-2	Reopened	Previously closed plugin is available again	Plugins API	Info
MNT-1	No release in 12 months	last_updated older than 365 days	Plugins API	Warning (Critical after 24 months)
MNT-2	Not tested with current WordPress	tested is 2 or more major versions behind current WP	Plugins API + core API	Warning
MNT-3	Requires unsupported PHP only	The minimum PHP version the plugin requires is newer than every supported PHP release, so no supported setup can run it	Plugins API + PHP config	Warning
SUP-1	Support going unanswered	Resolved ratio below 20% with 10+ threads in the last 2 months, or ratio dropped 30+ points vs 6 months ago	Plugins API snapshots	Warning
SEC-1	New vulnerability affects your version	Published vulnerability covers the installed version	Wordfence feed	Critical if no patched version, Warning if a patch exists
SEC-2	Vulnerability unpatched 14+ days	SEC-1 with no fixed version after 14 days	Derived	Critical
SEC-3	Repeated security issues	3+ vulnerabilities in the last 24 months	Derived	Info
REP-1	Rating dropping	Average of last 90 days' reviews at least 1.0 star below lifetime average, with 5+ recent reviews	Reviews	Warning
REP-2	One-star spike after release	5+ one-star reviews within 7 days of a release	Reviews + versions	Warning
MOM-1	Installs falling	Active installs drop one bucket (e.g. 100,000+ to 90,000+) vs 12 weeks ago	Snapshots	Info
MOM-2	Downloads collapsing	4-week download average down 50%+ vs trailing 26-week average	Download stats	Info
CMP-1	Site PHP too old for plugin	Customer site PHP below plugin requires_php	Connector + API	Warning
CMP-2	New release raises requirements	New version raises requires or requires_php above a monitored site's version	Connector + API	Warning
UPD-1	Update available, high risk	An update exists and SEC-1 applies to the installed version	Connector + feed	Critical

Canary Score

One score from 0 to 100 per plugin, recomputed nightly from 5 weighted sub-scores. Each sub-score runs from 0 to 100.

20%

Ownership stability (O)

25%

Maintenance (M)

25%

Security (S)

15%

Support (P)

15%

Reputation and momentum (R)

Canary Score = round(0.20 O + 0.25 M + 0.25 S + 0.15 P + 0.15 R)

Then the overrides below apply.

Ownership stability (O), weight 20%

Start at 100.
Minus 40 per active OWN-3.
Minus 20 per active OWN-1 or OWN-2 opened in the last 180 days.
Minus 10 if 3 or more distinct new committers in 24 months.
Floor 0.

Maintenance (M), weight 25%

Days since last release d: 100 if d is under 90, 85 if under 180, 65 if under 365, 35 if under 730, else 10.
Minus 15 if MNT-2 is active.
Minus 10 if MNT-3 is active.
Plus 5 if 6 or more releases in 24 months (cap 100).

Security (S), weight 25%

Start at 100.
Minus 60 if any open unpatched vulnerability.
Minus 10 per vulnerability in 24 months with CVSS 7 or higher, minus 5 per other vulnerability (history counts for at most minus 40).
Minus 10 if median days to patch is over 30.
Floor 0.

Support (P), weight 15%

Resolved ratio r over the last 2 months (0 to 1): 100 x r.
Minus 15 if SUP-1 is active.
Fewer than 5 threads in 2 months: 70 (neutral).

Reputation and momentum (R), weight 15%

Start at 70.
Plus 15 if the 90-day average rating is 4.5 or higher.
Minus 25 if REP-1 is active.
Minus 15 if REP-2 opened in the last 90 days.
Plus 15 if the install bucket rose in 12 weeks.
Minus 15 if MOM-1 is active.
Minus 10 if MOM-2 is active.
Clamp 0 to 100.

Status bands and overrides

Healthy 80 to 100Watch 60 to 79At risk 40 to 59Avoid 0 to 39Limited data

Closed plugin: status Avoid, score capped at 10.
Open unpatched vulnerability: score capped at 39.
Active OWN-3: score capped at 49 until a person reviews it.
Plugins with under 1,000 active installs and under 12 weeks of history show "Limited data" instead of a band.

Data sources and refresh

All data comes from public sources. Plugins are refreshed by tier, so anything a customer runs is checked daily, popular plugins weekly and the long tail monthly. All times UTC.

Source	What we use	Refresh
wordpress.org Plugins API	Versions, installs, ratings, support stats, author, contributors, closures	By tier: A daily, B weekly, C monthly. Closure re-check every 6 hours for Tier A
Plugins Trac and SVN log	Committer and date of every commit	Hourly
wordpress.org reviews	Dated reviews and ratings	Daily for Tier A, weekly for Tier B
wordpress.org download stats	Daily downloads	Weekly (Sunday) for Tier A and B
Wordfence Intelligence	Vulnerabilities, affected and patched versions, CVSS	Every 6 hours

Refresh tiers

Tier	Which plugins	Refresh
A	In any customer inventory or watchlist, or 10,000+ active installs	Daily
B	1,000 to 9,999 active installs	Weekly
C	Everything else, including closed plugins	Monthly

Job schedule

Job	Schedule (UTC)	Does
catalog-sync	Daily 00:30	Adds newly listed plugins
plugin-refresh	Continuous, paced by tier	Fetches plugin details, records a snapshot, detects closures
closure-check	Every 6 hours, Tier A	Re-checks closed status for monitored plugins
committer-log	Hourly	Records each commit's committer and date
downloads-stats	Weekly, Sunday 02:00	Daily download counts for Tier A and B
reviews-ingest	Daily 03:00 Tier A, weekly Tier B	New reviews
vuln-feed	Every 6 hours	Vulnerabilities mapped to plugins and version ranges
signal-eval	After each refresh, commit, review or vulnerability batch	Opens, updates or resolves signals
score-recompute	Daily 04:00	Sub-scores, Canary Score and status band
report-data	1st of the month 05:00	Monthly figures for the State of WordPress Plugins report

Score version history

Any change to weights or formulas bumps the score version and is listed here with its date.

v1 3 Nov 2026, current

Initial weights: Ownership stability 20%, Maintenance 25%, Security 25%, Support 15%, Reputation and momentum 15%. First public version of the signals and Canary Score.

Report an error

Plugin authors and users can report a data issue with the Report a data issue link on any plugin page, or by email to [email protected]. We reply within 5 working days and record the correction or explanation on the plugin page.

Independence

No plugin author can pay for a better score or placement. We have no sponsored listings and no affiliate links. We build plugins ourselves (WPFactory and WooBeWoo), and they are scored by the same rules as everyone else.

See the Radar for the events these rules detect.