The read · 26 Oct 2026
A crowded summit with no single owner
No one plugin owns WordPress security. Akismet and Wordfence both sit at 5M+ installs, Really Simple Security follows at 3M+, and the leader holds only 19% of the category's 25.7M+ installs. That kind of split usually invites challengers. Here it doesn't, because the incumbents keep shipping. Every one of the twelve biggest plugins has released an update in the last 70 days. Disable Comments shipped yesterday and Wordfence 26 days ago, while the two slowest, Akismet and Antispam Bee, are both spam filters that last updated about two months back.
Downloads across the category rose 4.4% over the quarter. That's steady demand flowing to plugins that are already installed, and it gives a new general-purpose suite very little room to take share from a well-kept leader.
Specialists are doing the climbing
The real growth is happening one layer down. Patchstack grew from 50K+ to 100K+ installs, the biggest move by any plugin with meaningful scale. It could mean site owners are adding a dedicated layer alongside the firewall they already run, but the data shows the jump without showing the cause.
Spam protection is the other active front. ActiveLayer grew from 4K+ to 10K+ installs even with Akismet and Antispam Bee holding millions between them, which suggests buyers will still switch spam tools when something new fits better. Atlant Security's move from 100+ to 700+ is small in absolute terms, but it shows a newcomer can still get noticed.
The tail is where the neglect sits
Below the leaders, upkeep falls away. Of the plugins we can assess, 274 score poorly on maintenance and safety signals, about double the 134 that score well. That's a weak record for software people install to protect their sites. The losers this quarter came from older, single-purpose tools: Block List Updater fell from 4K+ to 2K+ installs and Passwords Evolved from 1K+ to 500+.
Eight security plugins were closed in the window. Most were tiny, and for six of them no reason was recorded. The one with real scale was Wordfence Login Security, closed at its author's request on 2026-08-17 with 60K+ installs.
The top of this category is a moat held by several plugins at once. The opening is lower down, where a well-maintained specialist faces neglected competition, and Patchstack and ActiveLayer are the proof this quarter.
