wp.org search vs our merit ranking: “wp config”
wp.org orders by popularity, so a plugin a host bundled onto millions of sites, or a big-brand one that's slow and mediocre, can sit at the top. Our ranking is built to answer a different question: which of these is actually worth installing. How this works →
For “wp config”, we agree with wp.org on the top plugin, and our order differs from theirs on 12 of the top 20. 3 plugins are pushed down for signals wp.org ignores: errors, a host-installed base, or removal risk.
wp.org search ranks on
Install count (uncapped), the raw star average, freshness, and support. Popularity dominates, so the biggest install base usually wins regardless of how it got there.
We add
A cap on the install boost, volume-weighted ratings, and signals wp.org can't see: whether it throws errors on current PHP, whether the install base is organic or host-pushed, and its risk of being pulled.
Ranked above its merit
WP SAML Auth shows at wp.org #10 but places #23 on merit, a gap of 13 places. Its 7K+ installs carry it up the search order; its 4.5★ average from 8 reviews, plus freshness and upkeep, place it lower on our volume-weighted scale.
Buried gem
All-In-One Security (AIOS) – Security and Firewall places #12 on merit, 4.7★ from 1720 reviews, but shows at wp.org #17. A smaller install base keeps it further down the default search order than its quality signals alone would.
WP Super Cache 1M+ · 4.3★ (1346)
wp.org #1 ↑2 2 
UpdraftPlus: WP Backup & Migration Plugin 4M+ · 4.8★ (8706)
wp.org #2 ↓1 3 
All-in-One WP Migration and Backup 5M+ · 4.5★ (7676)
wp.org #3 ↓1 4 
WP Encryption: Easy HTTPS / SSL & Free SSL certificate, HTTPS redirect 50K+ · 4.9★ (1146)
wp.org #7 ↑4 3 too low 5 
FluentSMTP – WP Mail SMTP Plugin with Amazon SES, SendGrid, Mailgun, Postmark, Cloudflare, toSend, Gmail and Any SMTP 700K+ · 4.8★ (410)
wp.org #6 1 too low 6 
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN 1M+ · 4.8★ (6053)
wp.org #9 ↑5 3 too low 7 
Hide My WP Ghost – Security & Firewall 100K+ · 4.5★ (373)
wp.org #8 ↑8 1 too low 8 
WP Table Builder – Drag & Drop Table Builder 50K+ · 4.8★ (681)
wp.org #11 ↑1 3 too low 9 
Kadence Security – Password, Two Factor Authentication, and Brute Force Protection 700K+ · 4.6★ (3992)
wp.org #13 ↓4 4 too low 10 
WP Sitemaps Config 700+ · 5.0★ (12) thin reviews
wp.org #4 6 too high 11 
WP Debugging 10K+ · 5.0★ (21) throws errorsnot PHP-current thin reviews
wp.org #5 6 too high 12 All-In-One Security (AIOS) – Security and Firewall 1M+ · 4.7★ (1720)
wp.org #17 ↓7 5 too low 13 
WP ULike – Like Buttons, Voting & Engagement Analytics 60K+ · 4.8★ (283)
wp.org #19 ↓12 6 too low 14 
PDF Invoices & Packing Slips for WooCommerce 300K+ · 5.0★ (1865) throws errorsnot PHP-current
wp.org #16 ↓1 2 too low 15 
WP Downgrade | Specific Core Version 100K+ · 4.8★ (169)
wp.org #18 3 too low 16 
hCaptcha for WP 70K+ · 4.6★ (88)
wp.org #14 ↓6 2 too high 17 
WP Hide & Security Enhancer 50K+ · 4.3★ (275) throws errorsnot PHP-current
wp.org #12 ↑9 5 too high 18 
WP Offload SES Lite 10K+ · 4.3★ (36)
wp.org #15 ↑2 3 too high 19 
GTM4WP – A Google Tag Manager (GTM) plugin for WordPress 700K+ · 4.5★ (155)
wp.org #20 ↓1 1 too low 20 
Headers Security Advanced & HSTS WP 90K+ · 4.8★ (80)
wp.org #24 ↓4 4 too low 21 
WP Multilang – Translation and Multilingual Plugin 10K+ · 4.3★ (100)
wp.org #23 ↓5 2 too low 22 
WP fail2ban – Advanced Security 60K+ · 4.2★ (71)
wp.org #21 ↑2 1 too high 23 WP SAML Auth 7K+ · 4.5★ (8) thin reviews
wp.org #10 ↑3 13 too high 24 
Debug Log Manager Tool 3K+ · 5.0★ (22) throws errorsnot PHP-current thin reviews
wp.org #22 2 too high Merit ranking caps the install boost at 1M (wp.org leaves it uncapped), replaces the raw star average with a volume-weighted Bayesian score and a Wilson lower bound, and keeps wp.org's own freshness and compatibility decays. Method from the plugin-directory source; see Meta Trac #8298. Positions are tracked daily from the first visit to a keyword, so the small arrows show movement since tracking began.