Data
Data sources
Every signal and score on PluginCanary comes from public sources. Every alert links back to the source and the stored snapshot behind it.
| Source | What we take | Refresh |
|---|---|---|
| wordpress.org Plugins API | Plugin details: name, author, contributors, versions, requirements, tested up to, active installs, ratings, support threads, closure status and reason | Daily for plugins on customer sites or with 10,000+ installs, weekly for 1,000 to 9,999 installs, monthly for the rest |
| wordpress.org Plugins API, catalog | New and recently updated plugins | Daily at 00:30 UTC |
| Closure re-check | Closed status of plugins on customer sites and popular plugins | Every 6 hours |
| Plugins Trac and SVN log | Who committed to each plugin and when, used for ownership change signals | Hourly |
| wordpress.org download stats | Daily downloads | Weekly, Sunday 02:00 UTC |
| wordpress.org reviews feed | New reviews: rating, date and title | Daily for popular plugins, weekly for 1,000 to 9,999 installs |
| Wordfence Intelligence | Vulnerabilities: id, CVE, affected versions, patched version, CVSS, published date | Every 6 hours |
| WordPress core version check | The current WordPress version, for the tested up to signal | Daily |
| php.net supported versions | Supported PHP branches, for compatibility signals | Updated by hand twice a year |
The Canary Score is recomputed daily at 04:00 UTC. A plugin added to any customer site is refreshed within 15 minutes.
Attribution
- Plugin data from wordpress.org. PluginCanary is not affiliated with or endorsed by WordPress.org or the WordPress Foundation.
- Vulnerability data from Wordfence Intelligence, used under its terms. Vulnerability details belong to Wordfence and the original researchers.
What we do not use
We do not copy plugin descriptions or readme text, and we do not scan customer sites. Paid vulnerability databases and marketplace listings are not used today.
How we collect
Our crawler identifies itself as PluginCanary, makes at most 3 requests per second to wordpress.org, backs off when asked, and caches responses so the same page is not fetched twice.
Errors
If you find wrong data, use “Report a data issue” on the plugin page or email [email protected]. See the methodology for how each source feeds the score.