WordPress plugin search fails you twice, and only the first failure is yours to fix

A developer shipped a plugin to the WordPress.org directory, got zero installs, and then queried the free, keyless directory API to work out whether the fault was his listing or the system ^[1]. His count: roughly 19% of plugins in the directory never pass zero installs, more than 10,500 of them, which implies a directory of about 55,000 ^[2][3].

The mechanism is documented rather than mysterious. The best-documented account traces to WP Tavern's 2017 coverage of the directory relaunch, quoting Greg Brown, the Automattic data engineer who built it: search runs on Elasticsearch in two phases ^[4]. Phase one builds a candidate pool by matching against title, excerpt, description, tags, slug, author name and contributor names ^[5]. Every keyword in the user's query has to appear somewhere in that set, or the plugin is excluded from the result set entirely, not ranked low ^[6]. Phase two then sorts the survivors by last update date, compatibility with the current core version, active installs, percentage of support tickets resolved, and average rating ^[7].

That split is the whole practical finding, because it separates two failures that look the same from outside. On the author's own live plugin, the query "spam registration" returns nothing because the word "spam" appears nowhere in the listing; that is a phase-one exclusion and free to fix ^[8]. The query "email validation" fails even though every word is present, because the term is held by WP Mail SMTP and CleanTalk on install count, and no amount of rewriting moves it ^[9]. One is a typo-grade defect in copy. The other is not a copy problem at all.

The distribution data is bleaker. Sweeping the directory for plugins with 1,000 or more active installs returns 7,032; filtering to those added in the last 18 months leaves 167 ^[10][11], about 2.4% of the set ^[12]. Of those 167 breakouts, 88% had some pre-existing distribution ^[13]. One vendor launched eight of them off the back of a two million install plugin, another launched three off ten million ^[14]. Part of the remainder looks like cold starts only because the authors have no other WordPress plugins: the author names Visa, Sendcloud and a hosting company, businesses shipping an integration to customers they already had somewhere else ^[15]. Digging into what was left, he reports two out of sixty-nine surviving as genuine unknown-author cold starts ^[16]. Note that 12% of 167 is about 20, not 69, and the article does not reconcile the two denominators ^[17].

The two survivors are instructive in opposite directions. One is a floating WhatsApp button from an author with a single plugin and no brand, serving a very common low-friction search intent that directory search surfaces well ^[18]. The other is an llms.txt generator, which broke out because llms.txt did not exist before 2025, so no incumbent had an install-count advantage ^[19].

For a plugin at zero, the only levers inside phase two are release cadence and resolving support threads, two of the five ranking inputs and the two that correlate with breaking out from nothing ^[20].

What to watch: run the documented curl query against your own terms, using the -g flag so the shell does not glob the square brackets, and separate your absent-keyword failures from your install-count failures before rewriting anything ^[21]. Watch newly coined vocabulary, where incumbency has not formed yet ^[19]. And treat any confident claim about what makes users click install as guesswork, because WordPress.org gives authors no listing views, impressions or click-through data at all ^[22].