Most buyers are scammed because they look at revenue in isolation. Learn the three hard metrics that actually predict long-term value in the SaaS plugin market.
Deal Alert AI is reader-supported. We earn commissions from affiliate links at no cost to you.
This post is based on a video from our Deal Alert AI YouTube channel. Watch the original or read the full breakdown below.
When you browse marketplaces like Flippa or Empire Flippers, you will see thousands of listings for WordPress plugins. The listings almost always headline their monthly recurring revenue (MRR). A plugin making $2,000 a month looks attractive on paper. However, revenue is a lagging indicator. It tells you what happened in the past, not what is sustainable in the future. The WordPress ecosystem is unique because it is built on an open standard that changes rapidly. If a plugin fails to keep up with core updates, its revenue will not decline gradually; it will collapse overnight.
Many first-time buyers fall into the trap of assuming that high revenue equals high quality. They see a chart going up and to the right and assume the underlying technology is robust. This is a dangerous assumption. I have seen buyers acquire plugins with impressive top-line numbers that were built on deprecated code, relied on a single vendor’s API, or had user bases that were entirely reliant on a single, poorly documented integration. When the code breaks because WordPress releases a new minor version, the refund requests begin. The support tickets flood in. The churn rate spikes from 2% to 20% in a single week. The revenue disappears, but the maintenance cost remains.
To avoid these catastrophic failures, you need to look behind the revenue sheet. You need to evaluate the structural health of the business. This requires looking at three specific data points that are often hidden or omitted in sales summaries: the active user count distribution, the quality and velocity of user reviews, and the technical update dependency load. These three metrics form the backbone of a defensible valuation. If you get these three things right, you can buy a business with confidence. If you ignore them, you are buying a liability.
Understanding this shift in perspective is the most important step in your journey as an online business investor. It changes how you interrogate sellers. Instead of asking "How much are you making?", you ask "How many active users are you actually serving each month?" This single question separates the serious operators from the casual hobbyists and the scammers. It forces the seller to verify their numbers against backend data. It shifts the conversation from price to value. It is the first barrier to entry in profitable acquisition.
We scan Empire Flippers, Flippa, Acquire.com and Quiet Light daily — scoring every listing. Start free.
The first metric you must scrutinize is the active user count. In the WordPress world, "active users" is a term that is often misused. The WordPress.org directory displays a stat called "Active Installs." This number is notoriously inaccurate. It represents the number of sites that have the plugin installed and not uninstalled. It does not mean the user is using the feature daily. It does not mean the user is happy. It does not mean the plugin is functioning. A site can have a plugin installed, broken, forgotten in the database, and counted as an "active install" indefinitely. As a buyer, you must discount this number significantly.
To get a true sense of the user base, you need to look at engagement data within the application itself. If the plugin tracks usage, ask for the Monthly Active Users (MAU) dashboard. How many users logged in or triggered a core feature in the last 30 days? If the plugin is a premium service with a license key, the number of active, non-expired licenses is your most valuable data point. A plugin with 10,000 "Active Installs" on the WordPress.org directory might only have 500 users who are actually paying or actively using the premium features. That 10-to-1 ratio is standard in the industry, but you must verify it. If a seller claims their 10,000 installs are all paying customers, you are likely being deceived.
Furthermore, you must analyze the concentration of these users. Are the 500 active users spread across 500 different websites, or are they 50 users running 10 sites each that belong to one agency? The latter is far more dangerous. If one large agency stops using the plugin, you lose 10% of your entire business overnight. This is known as customer concentration risk. In WordPress agencies, this is a particular hazard. Many plugins are bought in bulk by agencies to add value to their client web design packages. If that agency changes their stack to a no-code builder or a different CMS, your revenue drops to zero. You need to ask for a breakdown of the top 10 customers by revenue. If any single customer represents more than 5% of total revenue, you must adjust your valuation downward to account for the insecurity of that relationship.
There is another layer to this metric: geographic and technical distribution. If 90% of your users are on hosts that do not support modern PHP versions, your technical debt is higher than you think. You are spending engineering time keeping the plugin compatible with obsolete server environments. This eats into your profit margins. A diverse user base across different hosting environments indicates a robust codebase and a healthier long-term prospect. It suggests the plugin is resilient to infrastructure changes. It is a subtle but powerful indicator of quality that very few buyers check.
The second metric is the review section. On any SaaS platform, reviews are public records of customer satisfaction. For WordPress plugins, the reviews on the WordPress.org directory are the closest thing to a public ledger of product performance. However, most buyers just glance at the star rating. A 4.8-star rating looks great. But a 4.8-star rating based on 20 reviews is statistically meaningless. A 4.8-star rating based on 2,000 reviews is a different story entirely. You need to look at the volume of reviews. You need to look at the velocity of reviews. How many new reviews come out every month? If a plugin has 1,000 reviews, but 900 of them were posted in the last three months, that is a sign of a recent push or a recent release. If the reviews are stagnant, with no new comments for six months, the product has stopped evolving. It has become a ghost town.
More importantly than the stars is the content of the one-star reviews. In software, customers rarely leave one-star reviews because they are unhappy with the aesthetics. They leave them because the software broke. Or because support ignored them. Or because the price went up. You are not looking for complaints; you are looking for patterns. If the one-star reviews from the last six months all mention "PHP 8.2 compatibility issues," you know your immediate technical to-do list. If they all mention "lost data after update," you know your database schema is fragile. If they mention "support did not reply," you know the seller was understaffed, and you will need to hire more labor post-acquisition. Each negative review is a data point that reveals a specific operational failure.
Look for the trend in the last 90 days. Is the sentiment improving or deteriorating? If a plugin had a major negative review explosion three months ago, but the stars have recovered to 4.5, check the developer's responses. Did the developer apologize? Did they fix the bug? Did they offer a refund? The quality of the response reveals the culture of the business. A seller who handles criticism with grace and professionalism is likely to build a loyal community. A seller who is defensive or dismissive is handing you a hostile user base. You are buying the relationship between the code and the community. That relationship is built one reply at a time. If the community feels respected, they will forgive bugs. If they feel dismissed, they will uninstall immediately and post negative feedback elsewhere. This dynamic is worth several multiples of the monthly revenue.
You should also look for "review manipulation" patterns. Some sellers offer discounts for five-star reviews. This can distort the data. If you see a sudden spike in perfect reviews shortly after a price increase or a new feature launch, be skeptical. These reviews may not represent organic satisfaction. They represent a transaction. You want to know the true base rate of happiness. The organic reviews, the ones that are not incentivized, are the ones that tell you the truth about the daily user experience. Distinguishing between incentivized praise and organic loyalty is a skill that saves buyers from overpaying for products that actually work poorly.
The third and most technical metric is update dependency. What is the plugin relying on to function? WordPress runs on PHP, JavaScript, and a database. The plugin is a bridge between these systems. But the bridge is only as strong as its weakest link. Many plugins rely on third-party libraries. They use external APIs for payment processing, email sending, or map data. If the plugin relies on a API that is depreciated, or a library that is no longer maintained, the plugin is a ticking time bomb. When the vendor changes their API key format or shuts down their service, the plugin stops working for every user. The seller might not even know this is happening until it is too late. You must audit the codebase to identify all external dependencies.
Look at the history of updates in the plugin's repository. How often does the developer push updates? Is it every week? Every month? Once a year? In the WordPress ecosystem, security patches are critical. If a plugin has not been updated in six months, it is likely vulnerable to known security exploits. Hackers scan for outdated plugins. They know which versions are vulnerable. If you buy a plugin that has not been updated recently, you are buying a backdoor into your user's websites. This damages your reputation and your legal standing. You are responsible for the security of the code you publish. A plugin with a robust, frequent update cycle signals that the developer is active, engaged, and competent. A plugin with a stale update cycle signals neglect.
Furthermore, assess the complexity of the code. Is the plugin written in clean, modern code? Or is it a spaghetti mess of global variables and deprecated functions? This is a question of technical debt. Technical debt is the cost of doing it fast. If the original developer wrote the code quickly to launch a product, they probably skipped refactoring. Now, every small change requires rewriting half the file. Every new WordPress core update requires debugging old syntax. This increases the time it takes to fix bugs. It increases the cost of hiring a developer to maintain the system. You can estimate this cost by looking at the number of files and the length of the main function. A lean plugin with a few well-documented files is easier to own than a bloated plugin with hundreds of interdependent scripts. You are not just buying the revenue; you are buying the maintenance burden.
Specifically, check for dependencies on specific WordPress core versions. Does the plugin require WordPress 6.0 or higher? Does it use the new block editor API? Or does it rely on the classic editor, which is being phased out? If the plugin is built on APIs that WordPress is deprecating, you have a looming migration project. You will need to rewrite the frontend to support the block editor. This is not a minor task. It is a full product rebuild. Check the roadmap. Is the seller planning to migrate to the block editor? If not, you must budget for this transition. It is a hidden cost that can wipe out your acquisition profit if you are not prepared for it. Knowledge of the WordPress development roadmap is a competitive advantage in deal negotiation.
Once you have these three metrics, you can assign a more accurate valuation multiple. The standard rule of thumb for SaaS businesses is to pay 3x to 5x annual recurring revenue. However, in the WordPress plugin space, the multiple should be adjusted based on the health of the user base, reviews, and code. If the user base is concentrated in one agency, if the reviews show signs of instability, and if the code is outdated, you should pay a lower multiple, perhaps 2x or even 1.5x. This accounts for the risk of churn and technical breakage. Conversely, if the users are diverse, the reviews are consistently positive, and the code is modern and well-maintained, you can justify a higher multiple, up to 6x or more. The difference in price can be tens of thousands of dollars. Diligence is not just about finding problems; it is about mastering the math of risk.
To illustrate, consider Plugin A. It has $5,000 MRR. It has 5,000 active users, but 40% come from one agency. It has a 4.2-star rating, with recent complaints about slow support. The code was last updated six months ago. Plugin A is risky. You might value it at 30x MRR, or $150,000. Now consider Plugin B. It has $3,000 MRR. It has 3,000 active users, spread evenly across 2,000 different sites. It has a 4.8-star rating, with positive comments praising the design and utility. The code is updated weekly and supports the latest PHP versions. Plugin B is high quality. You might value it at 50x MRR, or $150,000. Despite lower revenue, Plugin B is a safer and more valuable asset. It has scalability potential. It has a loyal community. It has a clean technical foundation. This is the paradox of acquisition: lower revenue can mean higher value if the quality is superior.
When you present an offer to the seller, reference your diligence. Tell them you have reviewed their user retention data. Tell them you have analyzed their review sentiment. Tell them you have audited their code dependencies. This shows that you are a sophisticated buyer. It discourages them from inflating their price. It creates leverage for you. Sellers respect buyers who do their homework. They know that a knowledgeable buyer will not pay for hype. They will pay for verified performance. By demonstrating your expertise in these three areas, you change the dynamics of the negotiation. You move from being a purchaser to being a partner. This mindset is essential for building a portfolio of high-quality digital assets.
You should also consider the barrier to entry. If the code is simple and easy to replicate, many competitors can copy it. Your moat is not the code; it is the brand, the reviews, and the user trust. If you buy a plugin with a weak brand and poor reviews, you are buying a commodity. You can be undercut by a competitor offering the same features for less. If you buy a plugin with a strong brand and a loyal community, you are buying a franchise. The users do not care who owns the company; they care that the product works. Your job is to maintain that trust. The stronger the trust, the higher the valuation multiple you can withstand. This is why brand equity matters in digitals assets.
Now that you understand the theory, let us consolidate this into a practical workflow. You need a checklist that you can use for every single acquisition opportunity. This checklist ensures you do not miss any of the critical data points. It standardizes your process. It allows you to compare different deals against each other objectively. Do not rely on memory. Do not rely on the seller’s presentation. Use this checklist. Verify each item. If you cannot verify an item, assume it is unfavorable. This is the prudent approach. It protects your capital. It filters out the bad deals before you waste time or money. Here is the comprehensive checklist you need to master.
This checklist is your professional standard. It is the difference between an amateur and a pro. Use it consistently. Over time, you will internalize these checks. You will know what to ask for in the first email. You will know what data to demand before you pay for a data room access. This speed and precision will make you a desirable buyer. Sellers will prefer to work with buyers who know what they are doing. It reduces the friction of the deal. It saves time for both parties. It leads to faster closings and better outcomes.
Even with a good checklist, you must be aware of the specific red flags that are common in the WordPress marketplace. The first red flag is a sudden spike in revenue without a corresponding increase in users. If revenue goes up but monthly active users stay flat, it means you are relying on price increases or upsells. This is unsustainable. Users will eventually push back. The second red flag is a lack of documentation. If the seller cannot provide a technical documentation file, user manual, or internal SOPs, it means the business is not scalable. It is dependent on the seller’s brain. When the seller leaves, the business collapses. The third red flag is a single developer dependency. If all code is written by one person, and that person is the seller, you have a single point of failure. If they vanish, you cannot maintain the product. You must ensure that the code is documented enough for another developer to pick up.
Another red flag is a high percentage of free users who never convert to paid. If the free-to-paid conversion rate is below 1%, your growth strategy is flawed. You are not able to convert trial users into paying customers. This means your marketing is either not reaching the right people or your product is not compelling enough. The fourth red flag is a lack of email capture. If the plugin does not collect user emails, you have no way to communicate with your base. You are blind to your users. You cannot send them update notices, feature announcements, or support messages. This is a fatal flaw for any SaaS product. If the email list is incomplete or missing, you must budget for a significant marketing spend to rebuild that channel.
Finally, look at the domain age. If the domain has been registered recently, but the plugin claims to have been around for years, there is a discrepancy. If the domain has been bounced around many owners, there is volatility in the business. A stable, long-term domain ownership is a good sign. It suggests long-term commitment. It builds trust with search engines. It signals stability. All these small details add up to a picture of the business’s health. You are looking for consistency. You are looking for alignment between the product, the users, and the revenue. If there are gaps, investigate them. Do not assume they are harmless. Assume they are hiding a cost. This skeptical approach is what protects your investment.
Knowing how to evaluate a business is only half the battle. You also need to find businesses worth evaluating. This is where marketplace selection matters. Not all marketplaces have the same quality of leads. Some are full of hobbyist projects. Some are full of established, profitable SaaS assets. You need to go where the serious sellers go. Deal Alert AI is designed to help you filter through the noise and find the high-signal opportunities. Our platform analyzes thousands of listings and uses data signals to highlight the assets that meet the diligence criteria discussed in this article. We look for the user stability, the review health, and the technical readiness that you need for a safe acquisition. By using our tools, you save time. You focus your energy on the deals that are actually viable. This efficiency is crucial when you are scaling your portfolio.
Major marketplaces like Empire Flippers and Flippa have their strengths and weaknesses. Empire Flippers tends to have higher-quality, vetted assets, but they have a higher minimum price point. Flippa is broader, with more volume, but you will find more riskier assets. You need to use both platforms strategically. Use the major marketplaces for their curated lists. Use Deal Alert AI to expand your search to smaller platforms and private sales. The best opportunities are often off-market. They are not listed publicly because the seller wants to maintain control over the negotiation. Building relationships and monitoring the ecosystem allows you to find these hidden gems. They are the deals that change your portfolio’s growth trajectory.
Your goal is to build a system. A system that feeds you opportunities, a system that screens those opportunities, and a system that closes the deals efficiently. This is how you scale. You do not rely on luck. You do not rely on a single great deal. You rely on process. You rely on the discipline of diligence. You rely on the consistency of execution. This is the path to building wealth in the digital asset space. It is unglamorous, but it is effective. It is based on data. It is based on reality. It is based on the hard work of understanding the product you are buying. When you master this, you become dangerous. Sellers know it. Other buyers know it. You become the person in the room who knows the true value of the asset. And that position is the most valuable position you can hold.
Now that you have the framework, what do you do next? First, audit your current knowledge. Do you have the technical skills to read code? If not, hire a developer. You need a technical advisor who you can trust. Pay them hourly to review the code of any potential target. This is a low-cost insurance policy against high-cost mistakes. Second, build your network. Join WordPress developer communities. Follow the core developers. Understand the roadmap. Know what is coming around the corner. This contextual knowledge helps you predict the impact of technical changes on your assets. It helps you plan your development roadmap. It helps you negotiate with sellers who may not understand the broader ecosystem trends.
Third, practice your diligence. Do not just read about it. Take a recent deal that has closed on a public marketplace. Look at the listing. Look at the reviews. Look at the user base. Write down what you would have asked. Write down what your multiple would have been. Compare your estimate to the actual sale price. See where you were off base. Adjust your model. Do this for five deals. Then do it for ten. At the end of this exercise, you will have a calibrated intuition. You will know what "good" looks like. You will know what "bad" looks like. You will be ready to put real money on the line. This preparation is the difference between a gamble and an investment. It is the difference between a loss and a gain. It is the foundation of your success.
Remember, the marketplace is always changing. New platforms emerge. New competitors enter. The technology evolves. The users’ expectations shift. The only constant is your diligence. Your ability to do the work, to ask the hard questions, and to make the right calls. This is what separates the successful buyers from the rest. This is what Deal Alert AI helps you with. We provide the data, the trends, and the connections. You provide the judgment, the strategy, and the execution. Together, we build a portfolio that compounds in value. We build a business that generates cash flow. We build an asset class that lasts. Start with the three metrics. Keep it simple. Keep it rigorous. Keep it consistent. And you will find the successes you are looking for. The opportunity is there, waiting for you to claim it.
We scan Empire Flippers, Acquire, Flippa, and Quiet Light daily. The best sub-$500K businesses are gone within 48 hours.
We scan Empire Flippers, Flippa & Acquire every morning. The best deals sell in 48 hours.