Why We Built SteadyScore: The Tool We Needed for 20 Years

A form plugin we’d recommended to a client six months earlier fell over quietly after a WordPress core update. Three people tried to submit a contact form that evening and got a white screen. When we checked the plugin’s wordpress.org page after the fact, the story was all there: eight months since the last update, three open security threads, and a “tested with” version two majors behind. None of it was hidden. Every bit of it had been visible in the same place we looked when we first picked the plugin. We could have caught it. We just had no system that would have made us look again.

The agency reality

Running a WordPress agency for twenty-plus years means managing dozens of client sites, each with somewhere between fifteen and sixty plugins. Together they form a portfolio of choices we’re responsible for: choices we made years ago when the maintainer was active, choices we inherited from previous developers, choices clients pasted in themselves after watching a YouTube tutorial. Every plugin is a small, ongoing bet that someone, somewhere, is still tending it.

The tools to evaluate plugin reliability either didn’t exist or were buried inside security plugins built around active threats: vulnerabilities to fix today, malware to clean up now. None of them answered the slower, more useful question. Which of these plugins are quietly degrading? Maintenance health, as distinct from acute threat, was nobody’s product.

What we tried first

We tried the obvious things. Manual audits every quarter, run by whichever developer drew the short straw. Spreadsheets that aged the moment we closed them. A custom script one of us wrote that hit the wordpress.org API and flagged plugins untouched for eighteen months. Each was useful on its own. None of them survived contact with the actual rhythm of agency work, where a thirty-minute window between client calls is not a thirty-minute window to run a manual audit.

What we needed was something built into WordPress itself that ran continuously and quietly, and surfaced its findings where a developer is already looking: the admin sidebar. Not a separate dashboard, separate login, separate spreadsheet.

The design constraints

Before we wrote a line of code we set a handful of constraints. They were as much about what we wouldn’t build as what we would.

• Runs inside WordPress admin. Where agency developers already work. No separate console to bookmark, no second login, no SaaS-flavored “dashboard.”
• Fast first scan. Initial scoring in roughly 60 seconds, not “we’ll email you when it’s ready.”
• Free tier without an account. No email-gated wall to get to the wordpress.org plugin scores. You install, you activate, you see numbers.
• Transparent methodology. The scoring inputs and weights are documented. No black-box score; if you disagree with a weighting, you can read the rationale.
• Privacy respect. No telemetry of site contents. We don’t need to know what your client’s product catalog looks like to score their plugins.

What SteadyScore does

SteadyScore evaluates each plugin against a handful of signals (update frequency, vulnerability history, active install base, user ratings, “tested with” currency, and a few others) and rolls them into a single score between 0 and 100. Categories sit on top of the raw number: Trusted, Moderate, Caution, Avoid, Unknown. The categories exist because most of the time you don’t want to compare 87 to 91. You want to know which of these things needs your attention this week.

The free tier covers every plugin on wordpress.org. Pro adds scoring for premium plugins, the ones with no public marketplace data, along with AI-driven code analysis that catches subtler quality issues and continuous monitoring so you know when a score drops without having to check. The split exists because the marginal cost of scoring a wordpress.org plugin is near zero, and the marginal cost of analyzing premium-plugin source code is not. SteadyScore is what we use across our own client portfolio.

What we learned building it

A few things surprised us. The first was how much signal sat in the simplest measurement. Even before we layered in AI or vulnerability databases, the basic “when was this plugin last updated, and is anyone still talking about it on the support forum” check exposed patterns we’d been missing for years. A handful of plugins we considered staples turned out to be six months from abandonment. A few we’d written off as dead were actually being maintained, quietly and well.

The second was how often a low score had a good answer waiting behind it. Plugins that scored poorly on update frequency often had a healthier, better-maintained alternative we simply hadn’t bothered to look for. The score didn’t tell us what to do. It told us where to spend the next half hour of research, which turned out to be exactly the leverage we needed.

The third, once AI analysis went into Pro, was how much code-level signal you can pull from a plugin nobody is reviewing. A human eye reading sixty thousand plugins can’t catch the patterns an AI scan catches in an afternoon. We’re careful not to overclaim here. AI analysis isn’t a substitute for a security audit. But for flagging the obvious stuff, code smells, suspicious external calls, license violations, it earns its keep.

What’s next

SiteReview is the second SteadyPress product, and the second measurement layer we’d been quietly needing for years. Where SteadyScore covers plugin reliability, SiteReview covers whole-site audits: performance, configuration, hosting fit, and the dozens of small things that compound into “this site feels slow” without anyone being able to point at a single cause. The line is the same. Things agencies have always done by hand, given the tooling to do continuously.

Why we built it

We didn’t set out to start a product company. We set out to solve our own problem, then realized the problem wasn’t ours alone. SteadyPress exists because the gap was real. We hit it every week, on every client portfolio, for two decades. If you’ve had your own Sunday-night plugin failure, you already know the gap we’re talking about. The tool is just the thing we made so that next time, neither of us has to find out at 11pm.