Introducing WordPress Plugin Analyzer — Now Live on Tools.Town

WordPress Plugin Analyzer is live on Tools.Town — look up a directory slug, read a Tools.town health score, and see 30-day downloads from WordPress.org. No fake install trends. No site scan. Just the public directory data, scored and formatted.

It is the anchor tool in the new WordPress.org Ops cluster, which launched alongside it with nine other tools covering health, abandoned detection, plugin search, comparison, slug finding, download stats, zip URLs, core version checking, PHP compatibility, and wp-config salt generation.

The problem it solves

Finding a plugin to install is easy — there are roundup posts for everything. The hard part is reading the listing and knowing whether the plugin is worth trusting. Most developers scan three numbers (install count, star rating, last updated) and proceed. That is fine for obvious cases, but it misses a lot.

A plugin can have 100,000 installs, four stars, and a 2020 update date. That is either: (a) a stable utility that simply does not need frequent updates, or (b) an aging plugin that is slowly falling behind WordPress and PHP compatibility. The install count and rating do not distinguish those. The combination of last updated, tested-up-to, PHP requirements, support thread ratio, and download trend does.

That combination is what the analyzer surfaces in one view without requiring you to cross-reference multiple browser tabs.

What it does

Paste a WordPress.org plugin slug or a directory URL. The analyzer:

1. Fetches the full plugin listing from the WordPress.org info API (name, author, version, requirements, install bucket, ratings, support threads, last updated, versions map).
2. Fetches 30 days of daily download counts from the WordPress.org stats endpoint.
3. Fetches the current WordPress.org core version (once per hour, cached, shared) so it can compare the plugin’s “tested up to” field against what is actually current.
4. Scores the listing on five dimensions (0–100) and assigns an activity label.
5. Returns all of this in a tabbed layout — you do not need to make six separate requests.

What it does not do

It does not scan your website. It does not detect plugins via HTML fingerprinting. It does not hit /wp-json on a random domain. It does not install or activate anything. It does not read your wp-config.php. It does not check for known CVEs.

Every result comes from the public WordPress.org API for the slug you enter.

The health score

The health score is a 100-point number built from five equally-weighted slices:

A score near 100 means the listing looks well-maintained, widely used, well-reviewed, and well-supported. A score near 0 means the listing is old, untested against current WordPress, obscure, unrated, and has unresolved support threads.

It is not an official WordPress.org badge. It does not include vulnerability data. It is a decision-aid from public fields — one signal among several to read before installing.

Full explanation: WordPress Plugin Health Score Explained.

The activity label

Separate from the health score, each plugin gets an activity label:

• Likely active — recent update or strong install base with a reasonably recent update.
• Low activity — the listing is aging but the plugin has a large install base. Large install bases create pressure on authors to maintain. This is not “abandoned.”
• Potentially abandoned — old listing and a small install bucket. This is a flag, not a verdict.

The distinction between “low activity” and “potentially abandoned” exists because lumping all stale plugins into one bucket would be misleading. A plugin with 3 million installs that has not had a directory update in 22 months is not comparable to a plugin with 200 installs that has not been updated in 4 years.

The rest of the cluster

The analyzer is the entry point, but the cluster has nine other tools for adjacent jobs:

Plugin tools:

• Health Check — same analyzer, opens on the health tab
• Abandoned Check — same analyzer, opens on the activity tab
• Plugin Search — search by keyword, returns a sortable table
• Plugin Comparison — 2–3 slugs side by side
• Slug Finder — marketing name → directory slug
• Author Analyzer — all plugins by a given author
• Download URL — current zip URL + versioned zip list
• Download Stats — 30-day daily series + 7-day delta

Core tools:

• Version Checker — is your WordPress current?
• PHP Version Checker — is your PHP in the WordPress.org serve-happy window?
• Salt Generator — fresh AUTH_KEY and friends from WordPress.org live

Why it is built this way

Server-side proxy — the browser cannot hit api.wordpress.org directly due to CORS restrictions. Every request goes through a Cloudflare Worker proxy that adds cache headers, rate limiting, and JSON normalization. Plugin info is cached 12 hours; salts are never cached.

No site scan, no login required — this is a deliberate product decision. A site scanner creates privacy and performance concerns and requires you to trust us with a URL on a live server. Directory lookups require none of that. The tradeoff is that we cannot tell you what plugins your site is running — you tell us the slug, we tell you about the slug.

Honest data labels — we never print “X active installs” as a number because that number does not exist in the API. We print the bucket. We never print “+Y% download growth” because we do not compute trends from a coarse data set. We print the 30-day series and a 7-day delta; you decide what it means.

Try it

• WordPress Plugin Analyzer
• Health Check
• Abandoned Check
• PHP Version Checker
• Salt Generator
• Full cluster overview

Start with a slug you already know. Type akismet or contact-form-7 and read the score. Then run a plugin you are less sure about.