How we rank plugins

Methodology version 1.0 · page generated 23 Sept 2026

Every plugin in a category gets a 0–100 score from six components. Components are normalized within the category, weighted, and summed. Scores are computed daily; published rankings update weekly (Mondays, 06:00 UTC) so they don't jitter.

Components and weights

Component	Weight	What we measure
Adoption	20	log10 of WordPress.org active installs (a bucket lower bound, e.g. “10,000+”), scaled 0–1 within the category.
Momentum	20	Downloads in the last 30 days vs the 30 before, with release-day auto-update spikes removed; percentile rank within the category, clipped to the 5th–95th percentile.
Satisfaction	20	Bayesian average rating: pulls plugins with few ratings toward the category mean (prior weight 25 ratings), then maps 3–5 stars to 0–1. No ratings = missing, never guessed.
Maintenance	15	35% update recency, 45% compatibility (current WooCommerce, HPOS, Cart & Checkout Blocks), 20% support threads resolved in the last 2 months.
Security	15	Starts at 1 and subtracts a penalty per vulnerability disclosed in the last 36 months, weighted by severity and halving every 12 months.
Performance	10	Lab-measured added page time, queries and assets on WooCommerce storefront pages. Missing until our lab has tested the plugin.

Missing data

If a component has no data, its weight is redistributed across the others and the plugin's data completeness drops. Plugins below 60% completeness are labeled “Limited data” and cannot hold ranks 1–3. We never estimate a missing number.

Not ranked

Plugins are shown but not ranked if they are closed on WordPress.org, have a known vulnerability not patched in the current version, or have not been updated in 24 months.

Stable weekly ranks

Two neighbouring plugins swap places only if the score gap is more than 1.5 points, or the new order held for two weekly runs in a row.

How we test (lab)

Each plugin is installed on a fresh WooCommerce store (current WooCommerce, WordPress and PHP 8.3, the default block theme, High-Performance Order Storage on, 200 products, 100 orders). We first measure the store without the plugin, then with the plugin activated on default settings: 7 requests per page (shop, product, block cart, block checkout) as a guest and as a logged-in wholesale customer, after one warm-up request. We publish the median added server time, database queries, memory and front-end JS/CSS, plus any PHP warnings. Timing is published only when run-to-run variation stays under 20%; query, memory and asset counts do not vary between runs. A plugin that fails to activate is not ranked.

Evidence labels

Tested — verified in our lab.
Declared — read from the plugin's own code or header.
Documented — vendor docs or readme.
Claimed — marketing copy only.

Independence

Affiliate relationships never enter the scoring code; an automated test fails the build if they do. Plugins without an affiliate program get the same placement. See the disclosure.

Sources

WordPress.org Plugin Directory API (installs, ratings, support, versions, downloads), plugin source code from WordPress.org (compatibility declarations), Wordfence Intelligence (vulnerabilities, matched by exact plugin slug; © Defiant Inc., linked per record), NVD CVE API (cross-check), WooCommerce GitHub releases, WordPress.org core version API and php.net.

Changelog

v1.0 (23 Sept 2026) — initial methodology; lab performance inputs defined the same day.