30 days of dsh plugin quality data is enough to show which signals actually move and which ones only look like they do. We took every score recorded on dshquality.com between 2026-09-26 and 2026-10-26 and sorted the changes by cause. Here is how to read plugin quality data without over-fitting to one grade, what dsh plugin score trends over time say about maintenance, and which three numbers matter before you install anything. dsh quality data is noisy at the edges, so the direction counts for more than the decimal.
What 30 days of scanning actually produced
Between 2026-09-26 and 2026-10-26 the scanner recorded 1,180 score updates across 390 plugins. Most of the updates were small. The useful part is which signal caused each one.
| Signal | Share of changes | What it usually means |
|---|---|---|
| Repo activity (commits, releases) | 41% | Maintainer still shipping, score drifts up |
| Install script changes | 23% | Re-scanned, grade can drop in a single day |
| Documentation edits | 18% | Small movement, usually one or two points |
| Dependency updates | 12% | Mixed, can move either direction |
| Stale repo, no commits and no releases | 6% | Slow decay, the most reliable downward signal |
Repo activity dominates, and it pushes in both directions. A plugin that ships a release tends to gain. One that goes quiet tends to bleed a point or two a week.
Three numbers worth checking before you install
You do not need the whole report. Three numbers answer most of the question.
- The grade, plus the gap to the next grade. A B sitting at 89 and a B sitting at 76 are not the same risk.
- Days since the last release. Under 30 is healthy. Over 180 means you are adopting code that nobody is watching.
- How many install script signals are open. One is worth reading. Three is worth a conversation with your team.
How to read plugin quality data without over-fitting
A score is a summary, not a verdict. The common mistake is treating a one point move as news and rebuilding your plugin list around it.
- Read a window instead of a snapshot. Ten flat days say more than one day of movement.
- Separate the direction from the level. A C that has climbed for a month is in better shape than a B that has been sliding.
- Weight install script findings above everything else. They are the only findings that can hurt you on day one.
- Discount documentation changes. A README rewrite moves the documentation score and nothing else.
What dsh plugin score trends over time reveal about maintenance
A trend tells you about habits, and habits are what you are really betting on when you add a plugin to a project.
- Steady small gains: the maintainer is active and the score is following the work.
- Flat for a month: fine if the plugin is finished, worrying if it touches the network.
- Sharp drop after a release: read the diff. Something moved in the install path or in a dependency.
- Slow decay with no releases: the most common route from B to D, and the easiest one to catch early.
Where the data misleads
- Small plugins swing harder. One file change can move a five file plugin by ten points.
- Documentation is easy to pad, so a long README can hold up an otherwise weak score.
- A quiet August is not the same as a quiet November. Holiday lulls look like decay.
- Forked plugins inherit history that has nothing to do with the person maintaining them now.
Thirty days will not tell you whether a plugin is safe. It will tell you whether anyone is still looking after it, and that is the part you can act on.
Common questions
- How much data do you need before a trend means anything? Two weeks of daily scores is the floor. Below that you are reading noise.
- Does a higher score mean a safer plugin? Not by itself. Score covers maintenance, documentation and security posture, and only the security part maps directly to risk.
- Should I remove plugins that drop a grade? Watch first. A single grade drop after a release usually settles in a few days once the new version is re-scanned.
- Why do some plugins move every week? Small plugins with active maintainers move the most, because each release touches a large share of the code.
Every plugin page on dshquality.com lists the score, the signals behind it and the recent movement. How the grade is built is explained in /blog/dsh-quality-score-decoded, the fastest movers are in /blog/rising-star-dsh-plugins-fast-growing-scores, falling scores are covered in /blog/dsh-plugin-score-trends-what-a-dropping-score-means, and the full archive sits at /blog. The front door is /.