# Active Installs Reward Existing Winners The "active installs" metric used to rank plugins on WordPress.org is structurally biased toward plugins that already have lots of active installs — and that bias is specifically intentional, because active installs is the one ranking signal the directory can't be gamed into faking. Luke Carbis (longtime WordPress contributor and plugin developer) names the design choice and its consequence directly: "one thing it's really, really hard to game is active installs. And that is one of the big, big ranking factors. So if you have a plugin, if your plugin has risen to the top, then yeah, it's going to rank better. And that kind of makes sense from my perspective. But then again, if you know what you're looking for and you search specifically for the exact word and it comes up second or third or 10th in the search results because it doesn't have very many active installs, that's a hard problem to solve" (Source: [[3. Resources/Readwise/Snipd/Data/WP Tavern/_218 – Luke Carbis on the Future of WordPress Plugins_ AI, Ethics, and New Directory Standards]]). The non-gameability that makes active installs a good signal for incumbent quality is the same property that makes it a bad signal for new entrants — there is no path for a high-quality new plugin to demonstrate its quality through this metric without first acquiring the installs the metric rewards. <!-- atomicity: 1 idea ✓ --> The pattern is general: any marketplace whose ranking algorithm uses a metric that genuinely reflects user adoption will, by construction, advantage products users have already adopted. The non-gameable property is exactly what produces the incumbency moat. Gameable metrics (review counts, keyword density, vanity badges, paid placement, recency) all have their own pathologies — review fraud, SEO arms races, pay-to-play distortion — but they at least offer mechanisms by which a new entrant can compete without first becoming an incumbent. The trade-off is structural: anti-gaming protection and new-entrant fairness are in tension, and a marketplace that prioritizes one necessarily sacrifices some of the other. Carbis offers a concrete data point that sharpens the urgency. AI-driven plugin submissions to the WordPress.org directory have quadrupled in twelve months — "in the last 12 months something like four times the amount of plugin submissions than 12 months ago isn't that nuts" (Source: ibid). The plugin review queue is approximately a week's wait time, manageable from the operations side. But the post-publication discoverability problem compounds. New plugins arrive at four times the historical rate, all start with zero active installs, and all face a ranking algorithm that requires installs to surface. The aggregate result is a marketplace that takes in unprecedented volume of new product but distributes attention to a comparatively static set of incumbents. The likely outcome Carbis names: developers stop submitting and "vibe code your own solution" instead — abandoning the directory rather than competing inside it. ## Why This Matters The implication for **plugin ecosystem evaluation** is that "1 million active installs" advertised on a plugin page reflects the plugin's history of being ranked highly, not necessarily its current quality. The headline number is a survivorship-bias artifact, not an independent verification. A user assuming that high install count signals current best-in-class is making the same mistake as an investor treating high market cap as current best-in-class — both numbers report past success at acquiring the resource that ranking algorithms reward, not current product superiority. The implication for evaluation is to weight active installs as one signal among several rather than as a quality proxy: pair it with recent update cadence, support-forum responsiveness, last-30-day download trend, and direct testing. The implication for **plugin discoverability strategy** — for developers trying to build new plugins on WordPress.org — is that the algorithmic structure favors workarounds over direct competition. The successful new-entrant patterns Carbis hints at in the episode are not "build a better plugin and let active installs catch up"; they are "establish off-platform distribution (newsletter, YouTube, podcast appearances, sponsorships), drive directly to the plugin's page, accumulate the installs that unlock the algorithm." This shifts the developer's time allocation from product development toward marketing and audience-building. The marketplaces where directly-shipping-quality-as-strategy works are the marketplaces where the ranking algorithm uses something other than installs as primary signal. WordPress.org doesn't (intentionally), so the strategic implication for developers shipping on it is to accept the audience-building cost or pick a different distribution channel. The implication for **directory design** — which is the topic Carbis is making proposals about in the episode — is that fixing the new-entrant penalty without sacrificing the anti-gaming property requires introducing additional ranking dimensions that aren't install-count-derived. Carbis's specific proposal is account-connect features: let WordPress.org users link their accounts to their actual WordPress installs and see personalized recommendations based on their tag preferences, prior installs, and stated needs. This adds a per-user-discovery layer that doesn't depend on aggregate install counts, and the user-account anchoring makes it harder to game than open-search ranking. The general design principle: when one ranking signal has favorable properties that produce structural problems, the fix is usually composition with additional signals rather than replacement of the problematic one. The implication for **the broader [[Default-On AI Activation Inflates Adoption Metrics at the Cost of Consent]] critique** is that the active-installs metric problem and the default-on-activation metric problem are two sides of the same measurement gap. Default-on activation produces high install counts that overstate user adoption. Install-count-based ranking then surfaces those overstated counts as "popular plugins." A vendor that can both default-activate at host level (SiteGround's pattern) and benefit from install-count ranking enjoys a compounding advantage — they're rewarded by the algorithm for distribution capacity they had independent of plugin merit. Carbis's "hard to game" claim is correct as a description of the metric's properties; what it misses is that some incumbents have already secured the distribution that produces high install counts without competing in the metric's intended sense. The non-gameability protects against synthetic gaming but not against pre-existing structural advantage. ## Counterpoints to Hold - The alternative ranking algorithms (review-based, keyword-relevance, recency-weighted) have empirically worse failure modes than install-count ranking. WordPress.org has tried versions of these and reverted; the choice to prioritize install count reflects accumulated evidence about which failures are more tolerable. The incumbent-advantage problem is real but may be the least-bad of available trade-offs. - The directory's ranking is not the only discovery channel. Plugin recommendation lists in WordPress publications, theme-bundled plugin selections, hosting-provider one-click installs, and direct vendor distribution all bypass the install-count ranking. The incumbent-advantage critique applies most strongly to users who discover plugins by searching wordpress.org directly; for users with other entry points, the directory's ranking matters less. - New plugins can and do break through. The data point that matters is not "average new plugin's chance of climbing the rankings" but "for plugins whose quality is genuinely best-in-class for their niche, does the ranking eventually update?" Carbis's implicit answer is "slowly and unreliably" but the question is empirical. Some longitudinal study of new-plugin trajectories would sharpen the claim either direction. - The structural-advantage critique applies cleanly to any marketplace ranking algorithm that rewards a non-gameable adoption signal. The same critique works for the App Store, Google Play, npm, PyPI, Steam, and so on. Calling it specifically a WordPress.org problem understates the generality — the pattern is universal to install-count-ranked marketplaces. The WordPress-specific feature is the AI-submission-flood overlay that makes the long-standing structural problem acutely urgent right now. ## Links - [[3. Resources/Permanent Notes/Zet · Block themes are overtaking classic themes in install share]] — constrains: bundled defaults and accumulated distribution can place block themes in the top install tier without proving broad non-default adoption - [[3. Resources/Permanent Notes/Supply-Chain Defense Tracks Bad Actors Not Bad Code]] — applies-in: the distribution advantage of a high-install plugin becomes the attacker's inherited blast radius after an ownership or account compromise - [[An Open Marketplace Turns Extensibility Into Liability Without an Owned Security Layer]] — contrasts: marketplace ranking rewards established adoption while an owned security layer must evaluate the risk that popularity alone cannot reveal. - [[3. Resources/Permanent Notes/Default-On AI Activation Inflates Adoption Metrics at the Cost of Consent]] — adjacent measurement critique; default-on activation produces install counts that then compound through install-count ranking - [[3. Resources/Permanent Notes/Platform-Level Defaults Beat Site-Level Optimization for the Same Audiences]] — same structural-advantage observation in adjacent territory (CDN/edge-config defaults vs site-specific tuning) - [[3. Resources/Permanent Notes/The Recommend Layer Is Where Vendor Markets Make Their Real Decisions]] — the discoverability claim that makes ranking-algorithm design strategically central - [[3. Resources/Permanent Notes/Open Source Project Market Share Tracks Founder Trust]] — adjacent claim about which non-functional properties dominate ecosystem-share over time - [[3. Resources/Permanent Notes/Casual Contributors Are Users Not Community Members]] — parallel-shape critique: metric (contributor count, install count) measures something different than the term implies - [[3. Resources/Permanent Notes/Default-Off Feature Flags Decouple Shipping Speed From Production Risk]] — contrasts: default-off release preserves a clean distinction between shipped code and actual activation, preventing exposure from masquerading as chosen adoption. - [[3. Resources/Permanent Notes/The Four Objectives Framework Replaces Vanity Metrics in DevRel]] — the underlying methodological commitment (don't trust headline numbers; map metrics to actual objectives) - [[3. Resources/Permanent Notes/Enterprise Adoption Validates a Platform Through Authority Transfer]] — extends: marquee adoption supplies social proof that install and ranking systems then compound into incumbent visibility. - [[3. Resources/Permanent Notes/Ranking Anomalies Trigger Investigation, Not Attribution]] — applies-in: install-driven rankings make data-integrity anomalies consequential without making the beneficiary the proven cause. - [[3. Resources/MOCs/AI Agent Safety MOC]] — applies-in: the MOC lists this note under Capability & economics context. ## Open Questions - What's the actual empirical relationship between install-count ranking and new-plugin success? A study following 1,000 plugins from submission through year 3 of publication would settle a lot of currently-speculative discussion. The data exists inside WordPress.org's analytics; it isn't published. - Can a hybrid algorithm preserve the anti-gaming property of install counts while introducing a new-entrant adjustment (decayed weighting, niche-relative ranking, explicit "rising plugins" surface)? Carbis's account-connect proposal is one approach; the design space is wider than the current debate covers. - For developers shipping new plugins today: what's the empirically-best audience-building pipeline? The conventional wisdom (newsletter list → social media → product hunt launch → directory submission) hasn't been tested rigorously against the alternative (skip the directory, ship paid premium directly). The answer probably varies by plugin category. - Does the AI-submission flood Carbis describes have any quality signal hiding inside it? If 4× the submissions are 80% noise plus 20% genuine new value, the noise problem is acute but the underlying quality discovery is still possible. If 4× the submissions are 99%+ noise, the right intervention is different. The AI-vs-human submission distribution isn't published. - How does this generalize to other plugin/theme/extension marketplaces facing AI-generated-submission floods (Chrome Web Store, npm, Roam Plugin marketplace, Obsidian plugin marketplace, etc.)? Cross-marketplace comparison of which directories handle the flood better and why would be useful. ## Source - [[3. Resources/Readwise/Snipd/Data/WP Tavern/_218 – Luke Carbis on the Future of WordPress Plugins_ AI, Ethics, and New Directory Standards]] — Luke Carbis with Nathan Wrigley on WP Tavern (May 2026): primary articulation of the active-installs ranking dynamic, the 4× AI-submission spike, the week-long review wait time, and the account-connect feature proposal - See also: [[WordPress Hosting Security Stack MOC]] for the broader hosting-ecosystem context this directory dynamic sits inside - See also: [[Open Source Governance MOC]] for the governance-of-shared-infrastructure questions this episode raises (who decides directory ranking algorithms, with what accountability)