The read · 12 Oct 2026
WPS Hide Login owns the front door
This category has a clear owner. WPS Hide Login sits on 2M+ sites, roughly 37% of every install in the category, and it's being looked after: its last release landed 60 days ago and its ratings are among the best in the top dozen. Nothing below it comes within a factor of six. With downloads per plugin averaging around 900 a month, that's a moat, and nobody is close to crossing it.
The rest of the top tier is in decent shape too. LoginPress, User Switching and Advanced Google reCAPTCHA have all shipped within the last three months, the reCAPTCHA plugin just six days ago. A newcomer hoping to unseat any of them would need a better reason than being actively maintained.
The soft spot is at number two
Limit Login Attempts is the exception, and it's a big one. It holds 300K+ installs and hasn't shipped a release in 1,287 days, about three and a half years. Its users haven't left, which suggests brute-force protection is something people install once and stop thinking about. WPS Limit Login covers the same job on 100K+ sites and released 24 days ago. If any position in this category is open to a challenger, it's this one: a large installed base sitting on an unattended plugin.
Downloads are surging, installs aren't following yet
Category downloads rose 192% between mid-July and 12 October. The installed base hasn't visibly moved with them. The biggest names held their positions, and the climbers are small plugins edging up from double to triple digits, like Login Armor going from 100+ to 500+ installs. The surge is real, but the cause isn't visible in this data yet.
Temporary Login Without Password is the one top-dozen plugin heading the other way, slipping from 100K+ to 90K+ installs despite a release 11 days ago. It's a small drop, and nothing in the signals explains it.
Eight closures in a week
WordPress.org closed eight plugins in this category between 24 September and 1 October, none with a recorded reason. The largest was Login Designer, which had 30K+ installs when it closed on 30 September. Disable Users followed at 2K+ installs, closed on 28 September. The rest were tiny. Below the top dozen, upkeep thins out fast, and more than half the plugins we could assess look poorly maintained.
