The Distribution Census

What was actually measured

Everything below comes from the marketplaces' own public endpoints.

The usual way to answer “is this marketplace worth entering” is to read other people's blog posts about other people's outcomes. That is survivorship bias with a citation. So instead: 2,000 WordPress plugins from the wp.org API, 1,199 VS Code extensions from the gallery API the editor itself queries, and 465 Shopify apps crawled from the store's sitemap in file order rather than from category pages — which is the difference between a sample of the store and a sample of its winners.

One methodological note that changed a conclusion. My first pass at classifying VS Code publishers worked by recognising company names, which is recall, and recall is how you end up confidently wrong. The gallery API publishes isDomainVerified — verifying a domain requires controlling one, and organisations do it while individuals mostly do not. Mechanical, checkable, and independent of what I happen to know.

Forty-six plugins added since January 2023 have reached 50,000 active installs or more. Publisher attribution was taken from the API's own author field, not from memory. Here is who they belong to.

Not one entrant reached scale on directory search alone. The directory is also ossifying: counting the top 2,000 plugins by the year they were added gives roughly 180 per year for 2016–2018, 68 per year for 2021–2022, and 29 per year for 2023–2026.

A second thing fell out of the same data, filed as an observation rather than an opportunity: among plugins with very large install bases, the worst-rated are overwhelmingly first-party integrations from large companies. WooCommerce Tax sits at 2.0★ across 105 ratings on 500k installs; Meta for WooCommerce at 2.1★ on 400k; WordPress Importer at 3.1★ on two million, with zero percent of its support threads resolved. People install them because they are official, not because they are good.

A popular-head sample can only answer questions about the head. “Can a plugin published today reach anyone” is a question about the tail, so the directory was enumerated rather than sampled: query_plugins pages the whole thing 100 at a time, and every record carries the date it was added as well as the date it was last updated.

Getting the population turned out to need two passes, and the reason would quietly bias anyone else's numbers too. The directory reports two different sizes: browse=new and browse=updated both count 71,091 plugins, while browse=popular counts 66,998. The 4,093 difference is what a popularity ranking has nothing to sort by — the plugins with no install base at all. Enumerate through popular and you silently drop the deadest part of the tail, and every rate you compute comes out flattering.

Something changed in 2026

Enumerating by date added surfaced something the popular-head sample could not see, because the plugins involved are invisible to a popularity ranking by construction: submissions to the directory have roughly quintupled in eighteen months. January 2025 took in 460 new plugins. July 2026 took in 2,495.

The recency objection has to be dealt with first, because it is a real one. A plugin added last month has had a month to find users; one added in 2019 has had seven years. Some of the collapse in the right-hand column is simply that.

It does not account for the size of it. Take the 2024 cohort, which has had between eighteen months and two and a half years — long enough by any reasonable standard: 38.9% of those plugins still have zero installs, against 22.7% of the 2019 cohort. And the left-hand column has no recency confound at all. A monthly submission count is a monthly submission count.

What is causing it is not in this data, and I am not going to pretend otherwise. The timing coincides with code generation becoming nearly free, which is the obvious hypothesis and remains a hypothesis: nothing here records how any plugin was written. What the data does support is the shape. Supply into the directory is rising steeply, and the share of that supply reaching any user at all is falling just as steeply.

Distribution is inherited

95 plugins added since January 2024 have reached 10,000 active installs. That is the complete list rather than a sample of it, and it is short enough to examine one row at a time.

The last row is the one that matters, and it does not survive being read. Five of those 19 are established businesses arriving with an audience built somewhere else — Leadpages, Stripe, Visa, LatePoint and the hosting company MilesWeb. Three are Elementor or Gutenberg add-ons, which is to say they attached themselves to an installed base rather than building one. One, Search & Replace Everything by WPCode, is an Awesome Motive brand that the author field does not connect to Awesome Motive — so the row is itself an overcount, and every such miss makes it smaller rather than larger.

What is genuinely left is a handful of independents in unusually hot niches: image compression, accessibility, SEO writing, cookie compliance, and llms.txt. Around ten plugins, out of a directory of seventy-one thousand, over two and a half years.

Nothing on the list reached ten thousand installs from a standing start inside the directory. The earlier section reached that conclusion from 46 plugins in a sample; this reaches it from every plugin the directory will show, and attaches a number: the median breakthrough belonged to someone who already had 420k installs to announce it to.

There is a second reading, less comfortable and equally supported. Several of the largest recent entrants carry ratings that would sink an independent plugin: 1.5★, 1.6★, 1.7★, 2.1★, all on hundreds of thousands of installs. Those are plugins bundled by hosts or pushed by platforms onto sites whose owners did not choose them. At the top of the recent cohort, install count and merit have come apart completely.

The same dataset answers a question site owners ask more often than developers do, so it has its own page: 176 plugins with 10,000+ installs that have not shipped in two years. Median silence on that list is 51 months. The longest is 158 months, on 30,000 sites.

Two figures from this section get asked as questions on their own, so they have their own page: how many WordPress plugins there are — counted rather than estimated — and how many of them are still being maintained.

And if the question is about a particular site rather than the directory as a whole, the scanner reads the plugin slugs a WordPress page already declares in its own asset URLs and checks each one against the directory. Free, no signup. It only sees plugins that load assets on the page it is given, so a clean result is not a clean bill of health — caching and bundling plugins merge those assets and hide the rest.

This was the test that could break the thesis, and it partly did. Of 112 extensions first released since January 2023 that reached the top slice by installs, 63% belong to domain-verified organisations — but 37% do not. Against WordPress's 9%, that is roughly four times more open to independent entry.

Then the same measurement, applied to the cohort that arrived earlier:

The door is open and closing. And what came through it is narrow: essentially everything independent that reached scale is either free open-source developer tooling — Biome, BasedPyright, Pretty TypeScript Errors, opencode, DevDb — or an AI assistant wrapper. The clearest cold start in any of the three marketplaces is Cline, which went from a standing start in 2024 to 5.2M installs and is now domain-verified, because it became a company.

Which leaves the uncomfortable part. The channel that still works distributes free things. Almost none of the independent winners charge for the extension itself. This is a route to adoption, not to revenue, and anyone planning on the latter has to put it somewhere other than the artefact being adopted.

The store's own numbers settle an argument that usually gets settled by anecdote. 45.6% of apps sit under 25 reviews — the threshold below which listings are widely reported to convert at 1–2% rather than 5–8%. That alone is unremarkable; long tails are long.

The finding is what happens when you filter for the good ones. Among apps with at least five reviews, 45.8% are rated 4.8★ or higher — and 34.7% of those excellent apps are themselves under 25 reviews. A third of the genuinely good software in the store never gets discovered.

The surrounding economics are consistent with a market where being found is the scarce thing: 96.1% of apps offer a free plan or free install, the median paid tier is $20/month. Fifty-three developers in the sample ship more than one app, led by POWR.io and Eniture Technology at fifteen apiece.

The section above says discovery is the constraint. It does not say whether that constraint has tightened, because a sample of live apps cannot distinguish an app that arrived last year from one that arrived in 2014. Listing pages publish a launch date. A second sample — 1,650 apps drawn at random from the sitemap the store's own robots.txt advertises, 1,587 of them usable — collects it, which turns review count from a popularity measure into a cohort measure.

The threshold below was fixed before the data was collected, at 25 reviews: the same visibility line the section above uses.

The median app launched in the last two years has zero reviews. The median app launched before that has 3. Some of that gap is simply time — reviews accumulate, and a app from 2016 has had eight more years to collect them. But a factor of 11.4 is a great deal more than the extra time explains, and three quarters of the recent cohort have not collected a single one.

This is the same shape the WordPress directory shows, arrived at from a different marketplace with a different metric: the door is open, and almost nobody gets through it.

A figure from the earlier draft is withdrawn

The paragraph above previously ended “and only 15.1% carry the ‘Built for Shopify’ badge”. That number does not survive re-measurement: on this whole-store sample 83.7% of live apps carry it. Thirty apps from the original sample were re-checked the next day and the detectors disagreed on fourteen of them, always in the same direction.

It is withdrawn rather than corrected, because the collector that produced it was never saved and so the disagreement cannot be debugged — only replaced. Two further things are worth saying plainly. The samples are different populations, so part of the gap may be real: over half this sample launched within the last two years, and the badge rewards the modern embedded-app architecture that older incumbents never migrated to. Klaviyo, listed since 2012, does not carry it. And a badge held by most of a store is not a signal a merchant can use to choose between two apps.

The other three measurements ask who gets discovered. This one asks something the Chrome Web Store makes unusually easy to check and unusually hard to see from inside: of everything the store still serves, how much is anyone still maintaining?

Chrome publishes no ranking endpoint, so there is no popular list to sample. What it does publish is a sitemap — 41 shards, ordered by extension id. Extension ids are content-independent hashes, so an id range should not correlate with anything, which makes a sitemap draw effectively random with respect to popularity. Five hundred extensions, taken with a seeded shuffle from a frame of 52,396 ids.

This is a whole-store sample, long tail included. It is not comparable to the WordPress figure above, which measures the popular head. Long tails are always more neglected than heads, and setting the two side by side would be misleading.

44.1% have had no update in twelve months. 27.2% have had none in two years. And more of the store was last touched over six years ago (11.5%) than between four and six years ago (4.2%) — the tail does not taper, it accumulates.

One caveat I am imposing on myself rather than discovering later. Whether abandonment falls as user count rises is the obvious next question, and it looks like it does — but this sample yields only 35 extensions above 1,000 users, 13 above 10,000 and 2 above 100,000. A proportion computed on 13 records is a hint, not a finding, and it does not get published as one. Answering it needs a targeted sample of high-install extensions, which the store gives no way to enumerate.

One that clears the bar on its own: Betaflight Configurator, 80,000 users, last updated 96 months ago.

Three marketplaces, measured independently, produce one shape. Discovery is captured by parties who arrived with an audience — a hosting relationship, an existing portfolio, a platform to promote from. The marketplace is not where distribution is acquired. It is the settlement layer where distribution acquired elsewhere is converted into installs.

The single exception is developer tooling that is free and open source, and that exception is measurably narrowing.

There is a corollary worth stating plainly, because it is the part that costs people years: building a better product is not a distribution strategy in any of these three places. The Shopify data says a third of the best apps are invisible. The WordPress data says not one independent entrant broke through on search. If you are choosing where to spend a year, the question to answer first is not what should I build — it is which of these doors is open to me specifically.