WP Manifestindependent plugin directory
manifest / about

About WP Manifest

A manifest is the list of everything a ship carries. This one lists the WordPress plugins their authors ship themselves.

Why

A growing number of plugin authors distribute their work themselves. Their plugins update through their own updaters, their readmes live in the repository, and nobody ranks them. WordPress.org cannot see them, and a forge's topic pages cannot tell a plugin from a tutorial or a re-upload of somebody else's work. WP Manifest fills that gap with an index that is crawled, verified and ranked automatically, covering only the plugins their authors ship themselves.

How plugins get in

  1. Hunt. GitHub, GitLab and Codeberg searches for repositories tagged wordpress-plugin (and neighbours), every Packagist package typed wordpress-plugin resolved back to its repository, plus GitHub code search for files carrying a Plugin Name: header. Every hit is a candidate.
  2. Confirm. The root of each candidate is read and every root-level PHP file is parsed for a WordPress plugin header the same way WordPress core does it. No header, no listing. Forks and boilerplates are rejected, and repositories that describe themselves as a mirror or copy are set aside.
  3. Refresh. Stars, activity and every release's asset download counts are re-read weekly, and each plugin is checked against the WordPress.org directory so anything published there drops out of the listings.
  4. Classify. AI agents read the header, GitHub topics, readme and release data and file each plugin into one of 24 fixed categories with a confidence and a written rationale. The same pass decides whether a repository is the author's primary home, a mirror of someone else's plugin (Composer copies, re-uploads of paid plugins), or a vendor's documentation repo whose installable build ships elsewhere. Only primary repositories are listed. Anything that fails validation is dropped rather than stored.
  5. Rank. One score per plugin, recomputed after every refresh.

Released, and everything else

Listings show plugins with at least two published releases — about 7.9k of the 38k repositories indexed. One release is a first tag; two is evidence the author ships and maintains a version history, and it is the same bar WP Registry uses to decide a build is worth auditing. What it holds back is overwhelmingly libraries, updater scaffolding, boilerplate and developer tools — real repositories, but not plugins anyone installs. Every listing that holds something back says so, and the Everything switch beside the sort options shows the full index. Category counts, the figures on the home page and the API always report the whole corpus.

Ranking

Every plugin gets one score, and every list on the site sorts by it. It is built in three steps, worked through below on a real plugin.

Minn Admin austinginder/minn-admin Stars 140 21.5 pts + Active sites 600 16.7 pts + Release downloads 9,006 11.9 pts + Composer installs 0 0.0 pts = 50.0 merit × Freshness now 4 years idle 1.0 0.7 1.00 last release Oct 2026 + 2 ships releases = 52.0 score
Four counts become points on a log scale, so ten times the stars adds ten points rather than multiplying the score. Stars weigh 10, active sites 6, release downloads 3 and Composer installs 2. Their sum is merit. Merit is multiplied by freshness, which is 1.0 for six months after the latest release and then eases toward 0.7, and two points are added for publishing real releases. Archived repositories are halved. The numbers are live.

In symbols: merit = 10·log₁₀(stars+1) + 6·log₁₀(active sites+1) + 3·log₁₀(release downloads+1) + 2·log₁₀(Composer installs+1), and score = merit × freshness + 2, where freshness = 0.7 + 0.3·e−(days since latest release − 180)/365, never above 1. Stars carry the most weight because every repository has them; release downloads only exist for authors who attach a zip to their releases, so they add on top instead of gating. Freshness multiplies rather than adds, so an abandoned plugin keeps at most 70% of what it earned and a brand-new repository gets no free points. Archived repositories are halved.

Active-site estimate

A self-hosted updater only ever serves the current release, so the download count of a release that has since been superseded is the number of distinct sites that updated during its reign. The largest such closed cohort in the trailing 30 days is a lower bound on the active fleet. While fewer than three closed cohorts exist in that window, the median of the last five closed releases stands in. The newest release is still accumulating and never counts. Only assets ending in .zip count as plugin downloads. This is the same estimator Minn Admin uses for its own numbers. GitLab does not publish asset download counts, so GitLab-hosted plugins have no estimate.

The method assumes the release asset is the update channel. When an author moves packages to their own server, to Freemius, or to WordPress.org, superseded releases collapse to a trickle of manual downloads and the cohort count would faithfully report that trickle as the fleet. So the estimate is withheld when recent cohorts fall below 2% of the plugin's best year (the highest yearly median of its older closed releases, over years with at least three releases and a median of at least 500 downloads). The plugin page says so, with both numbers, instead of showing a figure that is off by orders of magnitude. Lifetime release downloads stay visible; they are real, just historical.

Security grades

The shield on a plugin page is a letter grade from WP Registry, which audits the exact release zip by its hash. WP Manifest does not audit code itself; it turns the audit's two headline facts into a grade you can read at a glance.

Worst finding sets the row How many findings moves you along it → Clean no findings A audited, nothing found Low worst finding is low A- 1–2 findings B+ 3 or more Medium worst finding is medium B 1–2 B- 3–7 C+ 8–19 C 20 or more High worst finding is high C- 1 D+ 2–4 D 5 or more Critical or malware worst finding is critical D- 1 F 2 or more Disputed author contests the report I incomplete until resolved
Two inputs, read off a ladder: the worst severity in the audit picks the row, and the number of findings moves the grade along it. A single critical finding is already a D-. Plugins that WP Registry has not audited show no shield at all rather than a grade.

The grade describes the latest audited release, not the plugin's history, so a fix that ships in the next release lifts the grade as soon as that release is audited. A plugin with no shield has not been audited yet.

What is not here

Nothing is hosted. Every install command points at the author's own release. There is no vetting of code quality beyond the header check; the security grade above is the extent of it.

Plugins already in the WordPress.org directory

They are not listed here. Every confirmed repository is checked against WordPress.org, and a plugin published there is filtered out, because it already has a directory and an install button inside every WordPress admin. What is left is the part nobody indexes: the plugins an author distributes themselves. The check runs in the background and is never shown on a listing.

Numbers right now

37,501 listed · 11,595 with releases · 4,689 self-updating · 14,304 filtered out as wp.org listings · 8,899 mirrors · 398 docs-only · 0 awaiting confirmation · 39,288 rejected. See usage by category.

Not an official WordPress project

WP Manifest is an independent project by Austin Ginder. It is not affiliated with, endorsed by or sponsored by the WordPress Foundation, WordPress.org or Automattic. WordPress is a registered trademark of the WordPress Foundation. Plugin names, descriptions and statistics belong to their authors and are shown here to help people find their work.

Corrections

Everything here is crawled and classified automatically, so some of it is wrong. If a listing misrepresents your plugin, is filed under the wrong category, or should not be here at all, email feedback@wpmanifest.xyz and it gets fixed by hand.

API

Everything on the site is available as JSON at https://wpmanifest.xyz/wp-json/wp-manifest/v1/plugins with category, search, owner, sort, page parameters, plus /plugins/{owner}/{repo}, /categories, /stats and /usage.