The read · 2026-08-31
The top of this category stopped moving years ago
Nobody new is getting into WordPress security at scale. The four plugins above a million installs are all shipping, all well-reviewed, and none of them show a crack a challenger could get into. Wordfence and Akismet each sit above 5M installs, and the leader alone holds 19% of a 25.7M-install category. Really Simple Security shipped seven days ago and carries a 4.93 star average across 3M+ installs. That's not an incumbent coasting, that's an incumbent defending.
What makes this a moat rather than a duopoly is how healthy the whole top twelve is. Every one of the twelve largest plugins has released in the last two months, most within three weeks. Sucuri is the laggard at 55 days, and even that isn't abandonment. When the installed base is concentrated and the incumbents are all still actively maintained, there's no gap for a new entrant to walk into.
The new arrivals are real, and they're tiny
Growth exists, it's just happening three orders of magnitude below the top. ActiveLayer Anti-Spam went from around 700 installs to over 7K in the window, which is genuine tenfold growth and still leaves it at #99. Compromise Scanner for wp2shell did something similar, 200 to 3K. Everything else climbing is measured in dozens: a malware scanner going from 10 to 70 installs isn't a market event.
So the honest read is that the entry ramp works and the ceiling is low. You can get a security plugin noticed. Getting it past five figures of installs, against four maintained giants, is a different problem, and nothing in this window suggests anyone's solving it.
Two exits, one of them with real users
WPBruiser, an anti-captcha spam plugin with over 10K installs, was closed by wp.org on 2026-07-23 with no reason recorded. WatchMan-Site7 followed on 2026-08-20 at the author's own request, with barely a dozen installs. Only the first one leaves users needing a replacement.
Category downloads fell 26.6% over the three months, which is a large drop and the cause isn't visible in the data. Nothing at the top lost its installed base, so this looks more like update cadence than users walking away.
The top of this category stopped moving years ago
Nobody new is getting into WordPress security at scale. The four plugins above a million installs are all shipping, all well-reviewed, and none of them show a crack a challenger could get into. Wordfence and Akismet each sit above 5M installs, and the leader alone holds 19% of a 25.7M-install category. Really Simple Security shipped seven days ago and carries a 4.93 star average across 3M+ installs. That's not an incumbent coasting, that's an incumbent defending.
What makes this a moat rather than a duopoly is how healthy the whole top twelve is. Every one of the twelve largest plugins has released in the last two months, most within three weeks. Sucuri is the laggard at 55 days, and even that isn't abandonment. When the installed base is concentrated and the incumbents are all still actively maintained, there's no gap for a new entrant to walk into.
The new arrivals are real, and they're tiny
Growth exists, it's just happening three orders of magnitude below the top. ActiveLayer Anti-Spam went from around 700 installs to over 7K in the window, which is genuine tenfold growth and still leaves it at #99. Compromise Scanner for wp2shell did something similar, 200 to 3K. Everything else climbing is measured in dozens: a malware scanner going from 10 to 70 installs isn't a market event.
So the honest read is that the entry ramp works and the ceiling is low. You can get a security plugin noticed. Getting it past five figures of installs, against four maintained giants, is a different problem, and nothing in this window suggests anyone's solving it.
Two exits, one of them with real users
WPBruiser, an anti-captcha spam plugin with over 10K installs, was closed by wp.org on 2026-07-23 with no reason recorded. WatchMan-Site7 followed on 2026-08-20 at the author's own request, with barely a dozen installs. Only the first one leaves users needing a replacement.
Category downloads fell 26.6% over the three months, which is a large drop and the cause isn't visible in the data. Nothing at the top lost its installed base, so this looks more like update cadence than users walking away.
