Honest rankings: “security”
WordPress.org search rewards raw install count with no ceiling, so the biggest install bases float to the top regardless of quality signals. Here's what searchers actually see, next to a merit ranking that caps the install factor and weights ratings by review volume. How this works →
Install-weight distortion
CloudSecure WP Security sits at wp.org #16 but earns only #24 on merit , 97% of its ranking comes from install count alone, on 100K+ installs at just 5.0★.
Buried gem
Anti-Malware Security and Brute-Force Firewall deserves #6 on merit but wp.org shows it at #24 , 4.9★ from 784 reviews, buried by lower-quality plugins with bigger install counts.
Merit ranking caps the install boost at 1M (wp.org leaves it uncapped), replaces the raw star average with a volume-weighted Bayesian score and a Wilson lower bound, and keeps wp.org's own freshness and compatibility decays. Method from the plugin-directory source; see Meta Trac #8298.