wp.org search vs our merit ranking: “secrets management”
wp.org orders by popularity, so a plugin a host bundled onto millions of sites, or a big-brand one that's slow and mediocre, can sit at the top. Our ranking is built to answer a different question: which of these is actually worth installing. How this works →
For “secrets management”, we and wp.org disagree on the top plugin, and our order differs from theirs on 10 of the top 20. 5 plugins are pushed down for signals wp.org ignores: errors, a host-installed base, or removal risk.
wp.org search ranks on
Install count (uncapped), the raw star average, freshness, and support. Popularity dominates, so the biggest install base usually wins regardless of how it got there.
We add
A cap on the install boost, volume-weighted ratings, and signals wp.org can't see: whether it throws errors on current PHP, whether the install base is organic or host-pushed, and its risk of being pulled.
Ranked above its merit
BF Secret File Downloader shows at wp.org #6 but places #21 on merit, a gap of 15 places. Its 100+ installs carry it up the search order; its 0.0★ average from 0 reviews, plus freshness and upkeep, place it lower on our volume-weighted scale.
Buried gem
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection places #8 on merit, 4.6★ from 3992 reviews, but shows at wp.org #20. A smaller install base keeps it further down the default search order than its quality signals alone would.
MainWP Dashboard: Self-hosted WordPress Management for Agencies 20K+ · 4.9★ (2354) not PHP-current
wp.org #2 1 too low 2 
EventPrime – Events Calendar, Bookings, Tickets & AI 7K+ · 4.4★ (85) throws errorsnot PHP-current
wp.org #1 1 too high 3 
VikRentCar Car Rental Management System 4K+ · 4.8★ (30)
wp.org #3 4 
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker 5K+ · 3.8★ (187)
wp.org #4 5 
WPVibe – MCP Server for WordPress, works with Claude, ChatGPT & other AI MCP agents 100K+ · 5.0★ (195)
wp.org #9 4 too low 6 
Cookie Compliance for WordPress – Cookie Consent, GDPR & CCPA 800K+ · 4.8★ (3026)
wp.org #12 ↓1 6 too low 7 
Paymattic – Secure, Simple Payment & Donation with Subscription Payments, Recurring Donations, Customer Management 3K+ · 4.8★ (44)
wp.org #8 1 too low 8 Kadence Security – Password, Two Factor Authentication, and Brute Force Protection 700K+ · 4.6★ (3992)
wp.org #20 ↓1 12 too low 9 
Newsletter – Send awesome emails from WordPress 200K+ · 4.6★ (1205) throws errorsnot PHP-current
wp.org #13 ↑4 4 too low 10 
License Manager for WooCommerce 6K+ · 4.6★ (147)
wp.org #14 ↑2 4 too low 11 
Back In Stock Notifier for WooCommerce | WooCommerce Waitlist Pro 20K+ · 4.7★ (122) throws errorsnot PHP-current
wp.org #10 ↑5 1 too high 12 
Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App 300K+ · 4.7★ (528)
wp.org #21 9 too low 13 
Event Tickets and Registration 90K+ · 3.5★ (236) heavy footprint
wp.org #11 ↓1 2 too high 14 
hCaptcha for WP 70K+ · 4.6★ (88)
wp.org #15 ↓3 1 too low 15 
Two Factor 100K+ · 4.7★ (209)
wp.org #24 9 too low 16 
EventAdmin – Volunteer Management 50+ · 5.0★ (5) thin reviews
wp.org #5 11 too high 17 
Enable Abilities for MCP 5K+ · 5.0★ (17) thin reviews
wp.org #17 ↓3 18 
Multi Location Product & Inventory Management for WooCommerce 100+ · 5.0★ (6) throws errorsnot PHP-current thin reviews
wp.org #7 11 too high 19 
CF7 Apps – Addons for Contact Form 7 (Honeypot, Database, Redirection, Webhook, etc.) 300K+ · 3.8★ (135) throws errorsnot PHP-current
wp.org #19 20 
Pay with Vipps and MobilePay for WooCommerce 5K+ · 4.8★ (13) throws errorsnot PHP-current thin reviews
wp.org #16 ↓3 4 too high 21 BF Secret File Downloader 100+ · 0.0★ (0) thin reviews
wp.org #6 15 too high 22 
Cocoon Media Management 100+ · 0.0★ (0) thin reviews
wp.org #18 4 too high 23 
Ndizi Project Management 10+ · 3.5★ (4) thin reviews
wp.org #23 ↓1 24 
YLabs AI Site Manager with ChatGPT and Claude 5K+ · 5.0★ (1) thin reviews
wp.org #22 ↓2 2 too high Merit ranking caps the install boost at 1M (wp.org leaves it uncapped), replaces the raw star average with a volume-weighted Bayesian score and a Wilson lower bound, and keeps wp.org's own freshness and compatibility decays. Method from the plugin-directory source; see Meta Trac #8298. Positions are tracked daily from the first visit to a keyword, so the small arrows show movement since tracking began.