Plinth
For WordPress plugin & theme companies
Which paying customers went quiet this week?
Your churn number tells you who already left. Plinth watches paying sites stop checking in and tells you before the renewal fails — while you can still send an email that changes something.
- Zero network calls before consent
- GPL SDK, PHP 7.4+
- Every count with its denominator
| Licence | Quiet for | Plan |
|---|---|---|
| 03d74f69d7f1 | 21 days | pro |
| 41f8dbcc1e46 | 21 days | pro |
| b2f63b60cfc8 | 18 days | agency |
| 9c0e1a47bb52 | unknown | pro |
The signal
A site stops checking in long before it stops paying.
Cancellation-based churn moves after the customer is already gone. Plinth watches the check-in cadence of every install that opted in, learns what normal looks like for that site, and tells you when it stops — while the renewal is still weeks away.
A site with a low-traffic cron is not a quiet site. Plinth classifies liveness before it classifies quiet, and where it cannot classify, it says unknown rather than guessing.
The denominator
Every number carries what it is a share of.
An analytics screen that reports a count without its total is telling you something about the sites that opted in, while looking like it is telling you something about your business.
Usually shown
47
active installs
Forty-seven out of how many? If a third of your install base never opted in, this is a third of a story and it reads like all of it.
Shown in Plinth
47 of an unknown total
installs reporting
Where Plinth cannot work out your total install base, it says so and shows no percentage at all. Where it can — through your store connector or the wp.org figure — it shows the real share.
This is enforced rather than remembered: the component that renders a metric requires the denominator as an argument, and a build check fails the release if a screen is written without one. A rule a developer has to keep in mind is a rule that survives until the week they are busy.
How it works
Three steps, and the third one is waiting.
The integration is one PHP file you vendor into your plugin and one call in
plugins_loaded. There is no build step, no Composer
requirement and no dependency to keep in step with someone else’s.
What is unusual is not what it sends. It is that it sends nothing at all until the site owner has said yes — and that this is proved by a packet capture on every commit rather than asserted in a policy.
// Nothing is sent until the site owner says yes.
add_action( 'plugins_loaded', function () {
\Plinth\Plinth::init( [
'product_key' => 'pk_live_…',
'plugin_file' => __FILE__,
// Shown in the consent notice as the
// data controller — because you are.
'vendor_name' => 'Acme Plugins',
// Hashed on the site. The raw key never
// leaves, and we could not reverse it.
'licence_salt' => ACME_PLINTH_SALT,
] );
} );-
1
Drop the SDK into your plugin
A zero-dependency PHP file, vendored into your build. It runs on PHP 7.4 and up, and it is GPL — so your users can read every line of it. A privacy claim nobody can read is a marketing claim.
-
2
Your user consents, or does not
Nothing leaves the site before consent — not a DNS lookup, not a ping. That is asserted by a packet capture on a real WordPress install, on every commit, across five WordPress versions.
-
3
Watch for the gap
Check-ins arrive, liveness is classified nightly, and quiet accounts surface with the evidence attached — the exact installs behind every figure, so you can check it rather than trust it.
The boundary
We never work out who your customers are.
Whatever Plinth knows about one of your customers, your plugin told it — from the account system you already run. There is no code path that reads a site’s own users, and a build check fails the release if one appears. Everything below is enforced by the API refusing payloads, not by a policy we could quietly revise.
What always arrives
After the site owner opts in, and nothing at all before it.
- A licence hash — salted with your key, on the site
- Plugin and WordPress version
- PHP version and hosting environment class
- Which of your features were used, and how often
- Check-in timestamps
That is the whole list, and it is the structure of the API rather than a summary of it: a payload carrying anything else is refused with a 422 rather than accepted and ignored. Consent is checked before a value is read, not before it is sent.
What never arrives
At any setting. There is no switch for these, and no plan that adds one.
- The list of other plugins and themes on the site
- Post content, user accounts, or anything else from the database
- The site administrator’s own email address
- Raw licence keys — hashed before they leave the site
- IP addresses and user agent strings
The list of other plugins on a site is refused permanently, at every phase. It is the most commercially valuable thing an SDK could collect, and collecting it would make Plinth the reason a vendor should not ship an SDK.
What arrives only if you turn it on
A site’s address — scheme and host only, the path stripped before it leaves — and a customer’s name, email and company, from your own records. Off unless you wire it. A vendor who does nothing collects nothing new, and their installs stay exactly as pseudonymous as they were.
Three things have to be true. Any one of them missing and none of it is collected:
- You turned it on, per product, in your own plugin’s code.
- The site owner consented — the same opt-in gate as every other kind of telemetry, checked before anything is read rather than before it is sent.
- They consented to a notice that said so. Consent given under a notice promising the site address would never be collected does not authorise collecting it. Those installs keep sending what they agreed to until their owner is asked again and says yes.
This is less than Plinth once promised. It held nothing that identified a site or a customer, and said so publicly. We withdrew that rather than quietly reinterpreting it, and the whole of what changed is written down.
Planned plans
Free tells you what your install base is. Team tells you who.
The dividing line is deliberate, and the free tier keeps the argument: the quiet report, the coverage figure and the weekly digest are all in it. A free tier that withholds the argument demonstrates nothing to the person deciding whether to pay for it.
Free
Always$0
- Up to 1,000 reporting installs · 1 product · 2 seats
- The quiet-account report
- Coverage, version adoption and feature adoption
- Installation explorer, site health and CSV export
- The weekly digest
Past the cap, installs are refused at ingest, counted, and the count shown beside every figure it affects. Installs already reporting are never evicted to make room. You may reasonably decide free is enough; you may not be misled about what it is showing you.
Team
Price not setPrice not set yet
- Unlimited installs, products and seats
- Customers — who each licence hash belongs to
- Insights — six detectors, each carrying its evidence
- Retention cohorts and upgrade opportunities
- Threshold alerts
There is no price here yet, and that is deliberate rather than unfinished. Nobody has been asked what this is worth, so a number would be the first place that gap turned into a claim. It gets set with the first customers.
Where it stands
Built, audited, and honest about what is still open.
Plinth is not a landing page in front of an idea. The ingest path, the nightly classification, the dashboard and the paid path are all built, and the whole of it was put through an external audit whose findings are published rather than quietly revised.
The product
- SDK, ingest, nightly liveness, coverage and quiet detection
- EDD and WooCommerce store connectors
- Insights, retention cohorts, alerts and the weekly digest
- Billing through a merchant of record, and entitlements
The rules, enforced
- Packet capture proving zero calls before consent
- A build check refusing any count rendered without its denominator
- A test that attempts a cross-tenant read and requires it to fail
- Accessibility and eight-viewport checks on every screen
Before sign-up opens
- The twelve customer conversations nobody has had yet
- A price, set with the first customers rather than guessed
- An application error tracker wired in
- Audit-log entries on the last four settings mutations
We have not proved the central claim yet.
Plinth is new. We have not yet proved that a quiet check-in predicts a non-renewal rather than simply identifying sites with automatic updates switched off — that takes a full renewal cycle of real data, and nobody has one.
Nor has anybody been asked whether this is worth paying for. Both are written down alongside every other limitation we know about, and the results go there whichever way they fall. If a page like this one is going to be worth reading, it has to be the kind that would have printed the bad answer too.
Questions
The things you would ask before shipping our code.
When can I actually use it?
There is no date, because a date we could not keep would be the first thing this page got wrong. Leave your address below and you will hear once, when sign-up opens — not a newsletter.
Will my users object to telemetry in my plugin?
They are asked, and until they say yes nothing happens — not a DNS lookup, not a ping. The SDK is GPL, so anybody sceptical can read exactly what it does, and the consent notice names you as the data controller, because you are.
What if only some of my sites opt in?
Then every figure says so. Plinth shows counts beside the total they are a share of, and where it cannot work out the total it prints of an unknown total and no percentage at all. The whole product exists because a partial number that looks complete is worse than no number.
Does a quiet site really mean a customer is leaving?
Not on its own, and we do not claim it does. A quiet account is a site that stopped checking in for fourteen days having previously been regular — that is a fact, not a prediction. Whether it predicts non-renewal is the thing we have not proved yet, and it is stated plainly further up this page rather than buried.
Can you see my competitors’ numbers, or they mine?
No, and not as a policy — as a shape. Each licence hash is salted per tenant, so the same site under two vendors produces two unrelated identifiers and no cross-vendor comparison is constructible. There is also a test that attempts a cross-tenant read and requires it to fail.
Who is behind it?
WaaFaa — the same team behind the other products on this site. Support is one address, answered by the person who wrote the code: waafaaofficial@gmail.com.
Hear about it once, when it opens.
One email when sign-up opens, and nothing else. If you sell a WordPress plugin or theme and would talk to us about what this is worth before then, say so — those twelve conversations are the thing standing between here and a price.
Prefer to wait quietly? This page is the status page. It changes when the product does.