Plugin Pulse Beta
← Rankings

wp.org search vs our merit ranking: “phishing”

wp.org orders by popularity, so a plugin a host bundled onto millions of sites, or a big-brand one that's slow and mediocre, can sit at the top. Our ranking is built to answer a different question: which of these is actually worth installing. How this works →

For “phishing”, we agree with wp.org on the top plugin, and our order differs from theirs on 7 of the top 20.

wp.org search ranks on

Install count (uncapped), the raw star average, freshness, and support. Popularity dominates, so the biggest install base usually wins regardless of how it got there.

We add

A cap on the install boost, volume-weighted ratings, and signals wp.org can't see: whether the install base is organic or host-pushed, and its risk of being pulled.

Ranked above its merit

Advanced Passkeys for Secure Login shows at wp.org #14 but places #20 on merit, a gap of 6 places. Its 40+ installs carry it up the search order; its 5.0★ average from 1 reviews, plus freshness and upkeep, place it lower on our volume-weighted scale.

Buried gem

Wordfence Security – Firewall, Malware Scan, and Login Security places #11 on merit, 4.7★ from 5040 reviews, but shows at wp.org #22. A smaller install base keeps it further down the default search order than its quality signals alone would.

merit plugin wp.org
1 AntiVirus 30K+ · 4.1★ (23) wp.org #1 2 BBQ Firewall – Fast & Powerful Firewall Security 100K+ · 4.9★ (160) wp.org #3 ↓1 1 too low 3 miniOrange 2FA – Two Factor Authentication for WordPress (Passkey, OTP, SMS, Email, Google Authenticator) 10K+ · 4.5★ (385) wp.org #4 1 too low 4 Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning 30K+ · 4.8★ (1039) wp.org #7 3 too low 5 WebAuthn Provider for Two Factor 2K+ · 4.6★ (11) wp.org #2 ↑1 3 too high 6 MalCare WordPress Security Plugin – Malware Scanner, Cleaner, Security Firewall 100K+ · 4.4★ (559) wp.org #8 ↑1 2 too low 7 LukasApps CAPTCHA tools for Contact Form 7 100K+ · 4.1★ (48) wp.org #5 2 too high 8 Secure Passkeys 2K+ · 4.8★ (19) wp.org #6 2 too high 9 SecuPress with Simple SSL – Simple and Performant Security 40K+ · 4.1★ (106) wp.org #10 ↓2 1 too low 10 My Private Site – Make Your Whole Site Private, Force Login & Block Registration Spam 10K+ · 4.5★ (82) wp.org #11 1 too low 11 Wordfence Security – Firewall, Malware Scan, and Login Security 5M+ · 4.7★ (5040) wp.org #22 11 too low 12 FluentAuth – Login Security, Two-Factor Authentication, Passkeys & Social Login 10K+ · 4.1★ (35) wp.org #9 ↑1 3 too high 13 U Urvanov Syntax Highlighter 3K+ · 4.5★ (19) wp.org #13 14 WebDefender Security – Protection & AntiSpam 1K+ · 4.0★ (18) wp.org #18 4 too low 15 PressedMail – Email Client, Inbox & Webmail 100+ · 5.0★ (3) wp.org #12 3 too high 16 Rapls Passkey – Passwordless Login with WebAuthn 40+ · 5.0★ (2) wp.org #15 ↑1 1 too high 17 2-Step Verification by BestWebSoft – WordPress Anti-spam and Anti Hacker Plugin 200+ · 5.0★ (2) wp.org #16 ↓2 1 too high 18 MUTE – Contact Form Spam Blocker Without CAPTCHA 20+ · 5.0★ (2) wp.org #23 5 too low 19 Sentryvine — Antivirus & Anti-Phishing Security — · 0.0★ (0) wp.org #17 2 too high 20 Advanced Passkeys for Secure Login 40+ · 5.0★ (1) wp.org #14 ↑1 6 too high 21 InboxAuth – Email Security, Setup SPF / DKIM, DMARC & Check Email Authenticity 20+ · 0.0★ (0) wp.org #20 ↓1 1 too high 22 ThreeWay Login 30+ · 0.0★ (0) wp.org #24 ↓1 2 too low 23 WhoKnew Shield — Email, Phone & Address Security 30+ · 5.0★ (1) wp.org #19 ↑2 4 too high 24 Nexura Security — Malware Scanner, Firewall, 2FA & WordPress Security 20+ · 3.0★ (2) wp.org #21 ↓1 3 too high

Merit ranking caps the install boost at 1M (wp.org leaves it uncapped), replaces the raw star average with a volume-weighted Bayesian score and a Wilson lower bound, and keeps wp.org's own freshness and compatibility decays. Method from the plugin-directory source; see Meta Trac #8298. Positions are tracked daily from the first visit to a keyword, so the small arrows show movement since tracking began.