wp.org search vs our merit ranking: “secure wp”
wp.org orders by popularity, so a plugin a host bundled onto millions of sites, or a big-brand one that's slow and mediocre, can sit at the top. Our ranking is built to answer a different question: which of these is actually worth installing. How this works →
For “secure wp”, we agree with wp.org on the top plugin, and our order differs from theirs on 11 of the top 20. 4 plugins are pushed down for signals wp.org ignores: errors, a host-installed base, or removal risk.
wp.org search ranks on
Install count (uncapped), the raw star average, freshness, and support. Popularity dominates, so the biggest install base usually wins regardless of how it got there.
We add
A cap on the install boost, volume-weighted ratings, and signals wp.org can't see: whether it throws errors on current PHP, whether the install base is organic or host-pushed, and its risk of being pulled.
Ranked above its merit
SiteGuard WP Plugin shows at wp.org #6 but places #24 on merit, a gap of 18 places. Its 600K+ installs carry it up the search order; its 4.3★ average from 15 reviews, plus freshness and upkeep, place it lower on our volume-weighted scale.
Buried gem
WP Encryption: Easy HTTPS / SSL & Free SSL certificate, HTTPS redirect places #7 on merit, 4.9★ from 1146 reviews, but shows at wp.org #12. A smaller install base keeps it further down the default search order than its quality signals alone would.
WP Mail SMTP by WPForms – SMTP for Reliable Email Delivery with Gmail, Outlook, Amazon SES, Brevo, Other SMTP & More 4M+ · 4.8★ (5209)
wp.org #1 2 
UpdraftPlus: WP Backup & Migration Plugin 4M+ · 4.8★ (8706)
wp.org #2 ↑1 3 
All-in-One WP Migration and Backup 5M+ · 4.5★ (7676)
wp.org #3 ↓1 4 
WP Fastest Cache – WordPress Cache Plugin 1M+ · 4.9★ (4228)
wp.org #4 ↑1 5 
Secure Custom Fields 100K+ · 4.8★ (69) heavy footprint
wp.org #5 ↑1 6 
All-In-One Security (AIOS) – Security and Firewall 1M+ · 4.7★ (1720)
wp.org #9 ↑2 3 too low 7 WP Encryption: Easy HTTPS / SSL & Free SSL certificate, HTTPS redirect 50K+ · 4.9★ (1146)
wp.org #12 ↑5 5 too low 8 
WP Activity Log 300K+ · 4.7★ (490)
wp.org #11 ↓2 3 too low 9 
WP Content Copy Protection & No Right Click 100K+ · 4.8★ (1138)
wp.org #14 ↑1 5 too low 10 
WP Reset 300K+ · 4.8★ (1014)
wp.org #15 ↑1 5 too low 11 
BackWPup – WordPress Backup & Restore Plugin 400K+ · 4.0★ (1323) not PHP-current
wp.org #10 ↑2 1 too high 12 
FluentSMTP – WP Mail SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP 700K+ · 4.8★ (410)
wp.org #13 ↑1 1 too low 13 
Wordfence Security – Firewall, Malware Scan, and Login Security 5M+ · 4.7★ (5039) heavy footprint
wp.org #17 ↑4 4 too low 14 
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection 700K+ · 4.6★ (3992)
wp.org #21 ↑1 7 too low 15 
WP All Import – Drag & Drop Import for CSV, XML, Excel & Google Sheets 100K+ · 4.7★ (1966)
wp.org #24 9 too low 16 
Hide My WP Ghost – Security & Firewall 100K+ · 4.5★ (373)
wp.org #19 3 too low 17 
Secure Passkeys 2K+ · 4.8★ (19) thin reviews
wp.org #8 ↑2 9 too high 18 
WP Umbrella: Security Backup Restore & Monitoring 90K+ · 4.8★ (81)
wp.org #16 ↑2 2 too high 19 
Secure MCP Server for Claude, ChatGPT, Gemini and other AI Agents 8K+ · 5.0★ (10) thin reviews
wp.org #7 ↑6 12 too high 20 
Easy WP SMTP – WordPress SMTP and Email Logs: Gmail SMTP, Office 365, Outlook, Custom SMTP, and more 500K+ · 4.6★ (709)
wp.org #23 3 too low 21 
Advanced Custom Fields (ACF®) 2M+ · 4.5★ (1440) heavy footprint
wp.org #20 1 too high 22 
Secure Copy Content Protection and Content Locking 20K+ · 4.3★ (62)
wp.org #18 ↑2 4 too high 23 
WP Hide & Security Enhancer 50K+ · 4.3★ (275) throws errorsnot PHP-current
wp.org #22 1 too high 24 SiteGuard WP Plugin 600K+ · 4.3★ (15) throws errorsnot PHP-currenthost-installed base thin reviews
wp.org #6 ↑1 18 too high Merit ranking caps the install boost at 1M (wp.org leaves it uncapped), replaces the raw star average with a volume-weighted Bayesian score and a Wilson lower bound, and keeps wp.org's own freshness and compatibility decays. Method from the plugin-directory source; see Meta Trac #8298. Positions are tracked daily from the first visit to a keyword, so the small arrows show movement since tracking began.