How this site works, and what it refuses to do
Methodology
Everything published here must be checkable by someone who does not work here. This page says where the data comes from, what is claimed, what is deliberately not claimed, and how to argue with any of it.
Where the data comes from
One primary source, read once a day, stored permanently.
| source | The public WordPress.org plugin API (api.wordpress.org/plugins/info/1.2/). No authentication, no private feed, no scraping of pages behind a login. |
| cadence | One full pass every 24 hours, spread over roughly six and a half hours at about three requests a second, with a descriptive user-agent and a contact address. This is a free community endpoint and is treated as one. |
| coverage | 71,892 plugins, 2,590,511 observations across 37 days (02 Aug 2026 – 07 Sep 2026). |
| storage | Snapshots are append-only. A snapshot row is never updated and never deleted; a correction is a new row alongside the old one. The full API response is retained, including fields nothing currently uses. |
| absence | A plugin missing from three consecutive passes is recorded as a closure. Three, not one, so a transient API failure cannot manufacture an event. |
What this registry does not say
These are constraints on what may be published, not editorial preferences.
| no intent | Records report published facts and observable changes. Nothing here asserts that a plugin is malicious or unsafe, or that an owner acted in bad faith. “The author field changed on 4 August” is publishable. “This plugin is unsafe” is not, and will not appear on this site. |
| what “owner” means | Throughout this site, owner means the wordpress.org account currently associated with the plugin, and nothing more. It is not a claim about legal ownership, about who wrote the code, about who employs the developers, or about who benefits commercially. When that account changes, this registry records that the account changed. It does not establish that the plugin was sold, acquired, or transferred as property, because the directory does not publish that and we cannot observe it. |
| no false precision | active_installs is rounded by WordPress.org to the first significant digit and stops at 10,000,000. It is rendered as a band (“90,000+”) everywhere, never as an exact number, and only band transitions are recorded. The difference between two rounded figures is not a measurement. Two plugins both showing the ceiling cannot be compared with each other at all. |
| two kinds of gap | Plugin pages separate what is not known yet from what cannot be known, because the two mean opposite things. A plugin with no ratings gets one the moment somebody leaves it. The reason a plugin was closed is never published by WordPress.org, so that line will read the same in five years. Two limits are permanent: this registry reads published metadata and never plugin source, so it cannot speak to code quality or safety; and rounded install figures cannot be un-rounded. Two are work not yet done: security advisory data is not ingested, and daily observation only knows what it has watched. Earlier history is being recovered from the public release record where it exists, and is labelled as reconstructed wherever it appears. |
| no ratings | No plugin on this site carries a score, grade, star or risk band, and no owner page carries a verdict about a person or company. See why there is no score. |
| nothing for sale | No payment, from any party, will change what a record says or where it appears in any list. There is no process by which to request it, and offers are declined and may be published. |
How transfers are detected
A transfer is recorded when the wordpress.org account behind a plugin differs between two consecutive daily observations. What is recorded is the change itself: which account it moved from, which account it moved to, and the date. The registry does not investigate or characterise the transfer beyond that, and it draws no conclusion from the presence or absence of an announcement.
Detection keys on the wordpress.org account URL, not the display name. In the first full run, 27 raw display-name differences resolved to only 8 genuine account changes; the other 19 were owners renaming themselves or fixing capitalisation. Publishing those as transfers would have been false statements about real businesses. Renames are recorded separately, on the plugin’s own timeline, as what they are.
Why there is no score
This registry does not rate, grade, rank or star plugins, and it does not carry a risk band. That is a deliberate choice, and it is worth explaining because most sites in this space do the opposite.
| the problem | A score is an opinion wearing the clothes of arithmetic. Deciding that an unannounced transfer matters four times as much as a version lag is a judgement about people and their businesses. No amount of published methodology turns it into a measurement. |
| the conflict | A registry that marked one plugin down while promoting a competitor on the same page would have a conflict it could not argue its way out of, however transparent its weights. This site avoids the conflict by not grading anything. |
| what we do instead | Report what was observed, with dates and evidence, and let you decide. “The plugin moved between these two accounts on this date” is a fact you can check. “Elevated risk” is a verdict you would have to take on trust. |
| what we still keep | An internal priority score exists so we know which of ~69,000 plugins to research first. It is never shown, never sold, and never changes what appears on a page. The ordering of every list on this site comes from observable facts such as install band and recency. |
Signal coverage
Not every weight above has a detector yet. Listing which do is part of not claiming more than the data supports.
| Event type | Recorded |
|---|---|
| dormancy_start | 38,721 |
| dormancy_break | 369 |
| owner_renamed | 304 |
| closure | 300 |
| custody_change | 75 |
| portfolio_transfer | 48 |
| reopen | 48 |
| diff_anomaly | detector not yet live |
| advisory | detector not yet live |
| support_collapse | needs a longer series |
diff_anomaly compares a release’s size against its changelog, expressed as a percentile of the repo-wide distribution. No release will be called unusual until that distribution has actually been computed. A claim that something is “fourteen times normal” is meaningless without a published definition of normal.
Anything on a record can be disputed from the form at the foot of that record. A person reads every submission, and corrections get a reply within 5 business days. The record is never silently edited.