The read · 2026-08-10
One plugin, one third of the installs
Login and user management on WordPress is a category where the top spot was settled years ago and nobody's contesting it. WPS Hide Login sits above 2M installs and holds 37% of the category's entire installed base. The next plugin down, Limit Login Attempts, is at 300K+, and it hasn't shipped an update in over three years. That's a leader with a huge cushion and a runner-up that stopped running.
What's interesting is that WPS Hide Login isn't especially active either. Its last release was 210 days ago. In a category where the whole job is standing between attackers and the login form, seven months of silence from the plugin most sites depend on is worth noting. It hasn't cost it anything yet, and the download trend is up 6.4% over the window, so the market keeps rewarding the incumbent.
The middle is where the good work is
Below the leader, the picture flips. LoginPress, Advanced Google reCAPTCHA and User Switching all sit in the 200K range and all shipped in the last month or so. These are maintained tools with high ratings and no obvious drift. Advanced Google reCAPTCHA in particular scores near the top of everything we track for maintenance and user sentiment, and it's still an order of magnitude behind the leader on installs.
That gap is the story. Being better maintained clearly doesn't move you up here. Login security is a set-and-forget install, and site owners rarely revisit the choice, which likely explains why a three-year-stale plugin still holds 300K installs.
A crowded floor, not an open door
At 1,442 tracked plugins and roughly 1,000 downloads per plugin per month, this is a thin, heavily fragmented field. The climbers this window make the point: the fastest mover, Login Armor, went from 20 to 300 installs. That's real growth and it's nowhere near mattering. Only Auto Login for Sakura Rental Server, which crossed 7K to 10K, has anything like scale, and it serves one Japanese host.
AnsPress closed on 2026-07-23 with 3K+ installs and no reason recorded by wp.org. A smaller plugin, Custom Login Form and Logout Redirect, closed five days earlier, also unexplained.
This is a moat, not an opening. A newcomer can build something better than what's at the top, and the evidence says the installs still won't come.
One plugin, one third of the installs
Login and user management on WordPress is a category where the top spot was settled years ago and nobody's contesting it. WPS Hide Login sits above 2M installs and holds 37% of the category's entire installed base. The next plugin down, Limit Login Attempts, is at 300K+, and it hasn't shipped an update in over three years. That's a leader with a huge cushion and a runner-up that stopped running.
What's interesting is that WPS Hide Login isn't especially active either. Its last release was 210 days ago. In a category where the whole job is standing between attackers and the login form, seven months of silence from the plugin most sites depend on is worth noting. It hasn't cost it anything yet, and the download trend is up 6.4% over the window, so the market keeps rewarding the incumbent.
The middle is where the good work is
Below the leader, the picture flips. LoginPress, Advanced Google reCAPTCHA and User Switching all sit in the 200K range and all shipped in the last month or so. These are maintained tools with high ratings and no obvious drift. Advanced Google reCAPTCHA in particular scores near the top of everything we track for maintenance and user sentiment, and it's still an order of magnitude behind the leader on installs.
That gap is the story. Being better maintained clearly doesn't move you up here. Login security is a set-and-forget install, and site owners rarely revisit the choice, which likely explains why a three-year-stale plugin still holds 300K installs.
A crowded floor, not an open door
At 1,442 tracked plugins and roughly 1,000 downloads per plugin per month, this is a thin, heavily fragmented field. The climbers this window make the point: the fastest mover, Login Armor, went from 20 to 300 installs. That's real growth and it's nowhere near mattering. Only Auto Login for Sakura Rental Server, which crossed 7K to 10K, has anything like scale, and it serves one Japanese host.
AnsPress closed on 2026-07-23 with 3K+ installs and no reason recorded by wp.org. A smaller plugin, Custom Login Form and Logout Redirect, closed five days earlier, also unexplained.
This is a moat, not an opening. A newcomer can build something better than what's at the top, and the evidence says the installs still won't come.
