I shipped a plugin to the WordPress.org directory. It got zero installs.
That is not a complaint, it is the normal outcome. Roughly 19% of all plugins in the directory never pass zero installs, which is more than 10,500 of them. But I wanted to know why, and whether the answer was "your plugin is bad" or something structural.
So instead of reading marketing advice, I queried the directory API and counted.
Everything below is reproducible. The API is free, needs no key, and every query I used is in the article.
The short version
- Search is a two phase system, and phase one is a hard filter, not a ranking. If a single word of the user's query is missing from your listing, you are excluded from that search entirely.
- Phase two is where you lose, and it is ranked partly on active installs. That is the cold start trap.
- Of the plugins that broke out recently, 88% had distribution before they started.
- The two behaviours that actually correlate with breaking out from nothing are release cadence and resolving support threads, which are two of the five phase-two ranking inputs and the only two a plugin with no installs can move.
- WordPress.org gives plugin authors no analytics whatsoever. No listing views, no impressions, no click-through. Anyone who tells you confidently what makes people click install is guessing.
How search actually works
The best-documented account traces to WP Tavern's 2017 coverage of the directory relaunch, quoting Greg Brown, the Automattic data engineer who built it. It runs on Elasticsearch, and it has two phases.
Phase one builds the candidate pool. It matches against title, excerpt, description, tags, slug, author name and contributor names. Critically: all search keywords must appear somewhere, or the plugin is excluded from the result set. Not ranked low. Excluded.
Phase two sorts that pool by last update date, compatibility with the current core version, active installs, percent of support tickets resolved, and average rating.
That split matters more than anything else in this article, because phase one is entirely yours and phase two mostly is not.
Testing the hard filter on my own plugin
I took my live plugin and measured its actual position for terms it should rank for, then checked which query words appear in its listing.
| rank | term | missing words |
|---|---|---|
| 14 | disposable email blocker | none |
| 46 | block disposable email | none |
| 50 | disposable email | none |
| 146 | temporary email | none |
| >300 | email validation | none |
| >300 | spam registration | "spam" |
Two failures, two completely different causes.
"spam registration" fails because the word spam appears nowhere in the listing. That is phase one. It is a hard exclusion, and it is free to fix.
"email validation" fails even though every word is present. That is phase two: the term is owned by WP Mail SMTP and CleanTalk on install count, and no amount of rewriting changes it.
Being able to tell those two apart is the single most useful thing I learned. One is a typo-level fix. The other is not a copy problem at all.
Here is the query, if you want to check your own. Note the -g flag, without it your shell will try to glob the square brackets:
curl -g "https://api.wordpress.org/plugins/info/1.2/?action=query_plugins&request[search]=disposable+email&request[per_page]=100&request[page]=1"
Who actually breaks out
This is the part I expected to be discouraging, and it was worse than I expected.
I swept the entire directory for plugins with 1,000 or more active installs. That is 7,032 plugins. Then I filtered to those added in the last 18 months. That leaves 167. Those are the breakouts.
Then I looked at who published them.
| cause | share |
|---|---|
| Author already ran another plugin with real installs | 67% |
| Known commercial brand with an audience off WordPress | 17% |
| Cross-promoted from the author's own theme or membership site | 3% |
| Legacy plugin name revived by a directory insider | 1% |
| Company formed specifically to ride a trend | 1% |
| Unclear, possible genuine cold start | 10% |
88% had some form of pre-existing distribution.
The scale of the first group is worth spelling out. One vendor launched eight breakouts off the back of a two million install plugin. Another launched three off ten million. That is not a growth tactic you can copy, it is an asset you either have or do not.
The second group is the one that fooled me at first. It looks like cold starts, because those authors have no other WordPress plugins. But it is Visa. It is Sendcloud. It is a hosting company. These are businesses with a customer base off WordPress, shipping an integration to people who already pay them. Same advantage, different platform.
When I dug into the remainder, two out of sixty-nine survived as genuine unknown-author cold starts.
What those two did
They took opposite routes, and the difference is instructive.
One is a floating WhatsApp button. Its author has exactly one plugin in the entire directory and no brand at all. It serves an extremely common, low-friction search intent that the directory's own search surfaces well.
The other is an llms.txt generator. It broke out because llms.txt did not exist before 2025. There were no incumbents with an install-count advantage, so phase two was level and phase one decided.
That second one is the only mechanism I found that beats the cold start loop rather than enduring it. When the need is new, nobody has installs yet.
The grind that does work
I filtered the breakouts down to solo developers shipping security and blocking utilities, which is my own category, and looked at their behaviour rather than their marketing.
| plugin | installs | age | releases | support resolved |
|---|---|---|---|---|
| Advanced IP Blocker | 2,000 | 14 mo | 124 | 12 of 12 |
| Vigilant | 2,000 | 6 mo | 64 | 15 of 15 |
| BotBlocker | 3,000 | 9 mo | 25 | 4 of 4 |
| Geo Blocker | 1,000 | 15 mo | 2 | 0 of 1 |
Advanced IP Blocker shipped 124 releases in 14 months. That is roughly nine a month. Vigilant shipped 64 in six. Both resolved every single support thread they received, both have the most ratings in the group, and both had shipped within days of when I measured.
Geo Blocker is the control case. Two releases, never touched again, one support thread left unanswered. Still at the bottom.
This is not just correlation. Last update date and percent of support tickets resolved are two of the five documented phase-two ranking inputs. The third input, active installs, is the one you cannot move. So shipping often and answering everything are not merely habits of successful plugins, they are literally the only two ranking levers available to a plugin with no users.
One more thing I noticed and cannot prove causal: those breakout readmes run 39,000 to 42,000 characters. Mine were 8,000.
Things that are simply not true
"0 active installs" does not mean zero. A WordPress core issue confirms the label really means "fewer than 10". If you are sitting at zero, you may well have users.
You cannot measure your funnel. WordPress.org exposes no listing views, no search impressions, no click-through rate, nothing comparable to App Store Connect or the Play Console. So when someone tells you that a better banner or a shorter description improves conversion, ask where the number came from. The platform does not hand anybody that data.
Do not pay for reviews or installs. It is Guideline 9. The penalty is removal of all your reviews, then removal of the plugin on a repeat. There is a real enforcement case.
An API trap that cost me an hour
request[browse]=popular silently ignores request[tag].
I confirmed it across four different tags, all returning identical results. There is no error and no warning. If you are trying to sweep a category by popularity, you cannot do it in one call. Sweep by tag without browse, or sweep browse=popular globally and filter client-side.
Also useful: query_plugins returns the added date in the bulk response, so you can find recently-published plugins without a detail call per plugin.
What I actually changed
I stopped treating this as a marketing problem.
I audited every listing for phase-one coverage, checking that every word of each target search literally appears. That found a real gap: one of my plugins says "blocklist" everywhere, while merchants type "blacklist". Free to fix, and it was excluding me from those searches entirely.
I built a rank tracker, because installs are the last thing to move and search position is the first. Without it I was editing copy blind. If rank improves after a wording change, that is phase one responding. If it refuses to move, that is phase two, and no rewrite will fix it.
And I stopped picking categories with entrenched incumbents. The llms.txt case is the whole lesson: when a requirement is brand new, everybody starts at zero installs together.
The honest conclusion
If you have an audience, use it, because that is what 88% of successful launches did.
If you do not, the directory is not going to discover you on its own. The two levers you own are shipping often and answering every support thread. Both are slow. The most rigorously documented zero-audience case I could find took about a year to reach a thousand installs, at roughly a hundred a month, and the developer says plainly it was never exponential.
The alternative is to be early to something new enough that nobody has an install-count advantage yet. That is the only shortcut in the data.
This came out of building four plugins for WordPress.org, one of which is live so far and sitting at the install count this article is about, which is rather the point. The one that prompted the research is Email Guard, a local disposable-email blocker for WooCommerce that bundles its domain list and makes no outbound requests. Every number above is reproducible from the public plugin API.
Top comments (0)