How we rank plugins
By Raz Technologies · Methodology v1.2
Methodology version 1.2 · page generated 9 Nov 2026
Every plugin in a category gets a 0–100 score from six components. Components are normalized within the category, weighted, and summed. Scores are computed daily; published rankings update weekly (Mondays, 06:00 UTC) so they don't jitter.
Components and weights
| Component | Weight | What we measure |
|---|---|---|
| Adoption | 25 | log10 of WordPress.org active installs (a bucket lower bound, e.g. “10,000+”), scaled 0–1 within the category. Plugins sold only on CodeCanyon use log10 of CodeCanyon sales × 1.2 instead. |
| Momentum | 10 | Download growth from average daily downloads: half the last 30 days vs the last 90, half the last 90 vs the last 180, with release-day auto-update spikes removed. Mapped to 0–1 on a fixed scale (no growth = 0.5, ±25% ≈ 0.88 / 0.12), so it depends only on the plugin’s own downloads. CodeCanyon-only plugins use sales in the last 30 days vs the 30 before once 60 days of data exist. |
| Satisfaction | 25 | Bayesian average rating: pulls plugins with few ratings toward the category mean (prior weight 25 ratings), then maps 3–5 stars to 0–1. WordPress.org and CodeCanyon ratings are pooled by count. No ratings = missing, never guessed. |
| Maintenance | 15 | 35% update recency, 45% compatibility (current WooCommerce, HPOS, Cart & Checkout Blocks), 20% support threads resolved in the last 2 months. |
| Security | 15 | Starts at 1 and subtracts a penalty per vulnerability disclosed in the last 36 months, weighted by severity and halving every 12 months. Missing for plugins not on WordPress.org, because vulnerability databases are matched by WordPress.org slug. |
| Performance | 10 | Lab-measured added page time, queries and assets on WooCommerce storefront pages. Missing until our lab has tested the plugin. |
Missing data
If a component has no data, its weight is redistributed across the others and the plugin's data completeness drops. Plugins below 70% completeness are labeled “Limited data” and cannot hold ranks 1–3. We never estimate a missing number.
A top-3 place also needs at least 10 user ratings (WordPress.org and CodeCanyon combined), the same minimum G2 uses for its category grids. Plugins below it keep their score and are labeled “Few ratings”: a new plugin with a clean record and two 5-star reviews has not yet been tested by enough stores to be a top recommendation.
Not ranked
Plugins are shown but not ranked if they are closed on WordPress.org, have a known vulnerability not patched in the current version, or have not been updated in 24 months.
Stable weekly ranks
Rankings are built to move gradually, like the review-based rankings buyers already know: they rest on slow signals (installs, ratings over years, 90- and 180-day download averages), not on last week's downloads.
- Two neighbouring plugins swap places only if the score gap is more than 1.5 points, or the new order held for two weekly runs in a row.
- A plugin moves at most 3 places per weekly update, so a list can show a plugin above one with a higher score for a week or two while it moves. New plugins enter at their score.
- Serious news is not spread over weeks: a newly disclosed vulnerability is exempt from the 3-place limit at the next weekly update, and a plugin that is closed, has an unpatched vulnerability or has not been updated in 24 months is taken out of the ranking.
How we test (lab)
Each plugin is installed on a fresh WooCommerce store (current WooCommerce, WordPress and PHP 8.3, the default block theme, High-Performance Order Storage on, 200 products, 100 orders). We first measure the store without the plugin, then with the plugin activated on default settings: 7 requests per page (shop, product, block cart, block checkout) as a guest and as a logged-in wholesale customer, after one warm-up request. We publish the median added server time, database queries, memory and front-end JS/CSS, plus any PHP warnings. Timing is published only when run-to-run variation stays under 20%; query, memory and asset counts do not vary between runs. A plugin that fails to activate is not ranked.
Evidence labels
- Tested — verified in our lab.
- Declared — read from the plugin's own code or header.
- Documented — the vendor's own text: WordPress.org readme or CodeCanyon listing, quoted word for word. For premium plugins whose code we cannot read, compatibility can be vendor-documented; it is marked “(vendor)” and counts at 75% of a code declaration in the score.
- Claimed — marketing copy only.
Independence
Affiliate relationships never enter the scoring code; an automated test fails the build if they do. Plugins without an affiliate program get the same placement. See the disclosure.
Sources
WordPress.org Plugin Directory API (installs, ratings, support, versions, downloads), plugin source code from WordPress.org (compatibility declarations), Wordfence Intelligence (vulnerabilities, matched by exact plugin slug; © Defiant Inc., linked per record), NVD CVE API (cross-check), WooCommerce GitHub releases, WordPress.org core version API and php.net. CodeCanyon sales, ratings, prices and update dates come from the Envato API (Powered by Envato API), refreshed every 4 hours; they are shown only while less than 6 hours old, as Envato's API terms require.
Changelog
- v1.2 clarification (10 Oct 2026) — CodeCanyon's “Compatible with” field offers no WooCommerce 11 option yet. A listing that picks the newest option there (WooCommerce 10.x.x) now counts as partial support for current WooCommerce instead of failing; older picks still fail. Once any tracked listing shows WooCommerce 11.x.x, the normal rule applies again. Backtest: no #1 or top-3 changed in any category; 27 scores rose by up to 2.1 points.
- v1.2 (28 Sept 2026) — steadier rankings: momentum compares 30-, 90- and 180-day download averages on a fixed scale instead of ranking the last 30 days against the category, and its weight drops from 20 to 10 (adoption and satisfaction 20 → 25 each). Ranks move at most 3 places per week, except for security events. A top-3 place needs at least 10 user ratings. Fixes a bug where a release-day download spike in the first week of the comparison window was not removed, which could cut a plugin's score by up to 20 points overnight. Replaying the last 8 weeks of download data, the largest weekly move falls from 22 places to 3.
- v1.1 (25 Sept 2026) — premium plugins: compatibility stated in the vendor's CodeCanyon listing counts at 75% of a declaration found in code; features documented in the listing are shown with the quote; vulnerability records are matched to premium plugins only after a confirmed same-product check. Backtest: no top-10 position changed.
- v1.0 (24 Sept 2026) — CodeCanyon inputs: sales-based adoption and momentum for plugins sold only on CodeCanyon, WordPress.org and CodeCanyon ratings pooled by count, and security marked missing for plugins not on WordPress.org. No weight changed.
- v1.0 (23 Sept 2026) — initial methodology; lab performance inputs defined the same day.
See it applied
- Wholesale pricing and roles ranking (16 plugins)
- Request a quote ranking (22 plugins)
- Tiered and dynamic pricing ranking (30 plugins)
- Bulk order forms and product tables ranking (12 plugins)
- B2B registration ranking (15 plugins)
- Catalog mode / hide prices ranking (37 plugins)
- All-in-one B2B suites ranking (5 plugins)
- Product add-ons and options ranking (20 plugins)
- WooCommerce compatibility grid
- Download the data