About this plugin
SteadyScore scans every plugin installed on your WordPress site and gives each one a single reliability score from 0–100 — so you can see, at a glance, which plugins you can trust and which ones deserve a second look.
WordPress admins inherit risk from every plugin they install: abandoned code, unpatched vulnerabilities, low-quality authors. SteadyScore puts an honest number on each plugin’s risk profile so you can prioritize what to replace, audit, or remove. Agencies run it on client sites; developers run it on their own for routine plugin hygiene.
Every score is built from six transparent factors:
- Rating & reviews — the plugin’s WordPress.org star rating and review volume.
- Active installs — how widely the plugin is deployed and trusted.
- Update recency — how recently the author last shipped a release.
- Compatibility — tested-up-to against your version of WordPress.
- Security — known vulnerabilities, via Wordfence Intelligence.
- Author reputation — the author’s track record across their whole portfolio.
What’s in the free version
- A reliability score, 0–100, for every plugin listed on WordPress.org.
- The full six-factor breakdown for each plugin, with a plain-English recommendation.
- Known-vulnerability data from Wordfence Intelligence (add a free key of your own).
- Lifecycle flags — abandoned, removed from WordPress.org, or not updated in 2+ years.
- A sortable dashboard with risk / active / in-use filters and CSV export.
- Background scoring through Action Scheduler — no wp-cron load, nothing on your front end.
Available with the Pro addon
SteadyScore Pro extends the free plugin:
- Reliability scoring for commercial & closed-source plugins — LearnDash, WP Rocket, premium Gravity Forms add-ons, and the like — via the SteadyPress API.
- AI-powered upgrade & replacement recommendations for the plugins that need attention.
- Google Sheets export of the full audit.
- Scheduled monitoring with monthly email alerts on score drops and newly disclosed vulnerabilities.
Pro requires this free plugin. Commercial plugins the free tier can’t score still appear in your inventory — marked “needs Pro,” with honest “rating data unavailable” messaging rather than a fake number.
Built to stay out of the way
Scoring runs in the background through Action Scheduler — no wp-cron load, no slow admin screens. Results cache locally for 12 hours, so the dashboard stays instant. SteadyScore is strictly read-only: it never activates, deactivates, updates, or deletes any plugin.
Acting on a score is always your call.
External services
The free tier makes anonymous, read-only requests to:
- wordpress.org plugin API ( https://api.wordpress.org/plugins/info/1.2/ ) — to fetch plugin metadata (rating, install count, last-update date, tested-up-to version). No personal data is sent; only plugin slugs. Used on first install to score the inventory, and on a daily refresh thereafter. Documented at https://codex.wordpress.org/WordPress.org_API.
- Wordfence Intelligence API ( https://www.wordfence.com/api/intelligence/v3/ ) — to fetch vulnerability data for installed plugins. Requires a free API key from wordfence.com, which you configure in plugin settings. No personal data is sent; only plugin slugs. Wordfence Intelligence terms: https://www.wordfence.com/products/wordfence-intelligence/
If you upgrade to the Pro tier, the plugin also communicates with:
- SteadyPress API ( https://api.steadypress.ai ) — to score commercial plugins, run AI analysis, and validate your license. Only the plugin slug, version, your site’s domain, and your license key are sent. SteadyPress terms: https://steadypress.ai/terms/ · SteadyPress privacy: https://steadypress.ai/privacy/.
The free tier never contacts the SteadyPress API.
SteadyScore is built and maintained by SteadyPress. ai.