The hall of shame for WordPress admin notices

I have wanted a public database of WordPress admin notices for years. Every WordPress professional knows the feeling. You log into /wp-admin/ to do one small thing, and the top of the screen is a wall of banners. Activate your license. Update to the latest version. Leave a 5-star review. Opt in to usage tracking. Help shape the future of a plugin you installed twenty minutes ago. None of it is the thing you came to do.

The idea never changed. Catalogue the worst offenders. Pin each nag to the exact plugin that renders it. Rank them so the pattern is impossible to ignore. What changed this month is that it finally became buildable. It is live at dismissed.fyi, and it came together over a few days. Most of it happened out in the open on X.

The original plan would never have worked.

For years, I assumed I would source the notices by hand. Spin up a site, install a plugin, screenshot whatever nag it threw, file it, move on. That works for ten plugins. It falls apart at two thousand. There are nearly sixty thousand plugins in the directory, and most of them update constantly. A manual screenshot library would be out of date before I finished the first page. The project sat in my head for years because the only sourcing method I could picture guaranteed it would die.

Instead of photographing the symptom, the scanner reads the cause. It enumerates every callback hooked onto admin_notices and the related hooks. It uses PHP Reflection to pin each one to its exact file:line and owning plugin. Then it renders that callback in isolation across five unrelated admin screens to prove how much of /wp-admin/ it actually hijacks. Source code in, structured rap sheet out. That is the change that took this from a someday idea to something that catalogued three thousand notices in a few days.

It started with a tweet.

On June 3rd, Jeff Chandler posted a single screenshot that lit the fuse. A stack of nags from Meta Box, The Plus Addons, Elementor, Spectra, and WP Rocket, all piled on top of each other, captioned OHHHH THE HUMANITY. That was the nudge. I replied that we needed a hall of shame and that I was going to build one. A few hours later, it existed.

The stack is the boring-on-purpose combination I reach for now. Claude designs and writes the thing. WordPress and WP-CLI are the runtime. SSH reaches the fleet. The rest is a couple of hours of my evening. The first version was deliberately rough. I told people on X to bear with me while I poured in real data, because not every finding was 100% accurate yet. Building in public means the rough version is the one everyone sees. That turned out to be the best part.

Then I changed my mind about how to rank them.

The first version ranked offenders in the obvious way. Count the notices. More banners, worse rank. It is intuitive, and it is also subtly wrong. A plugin that shows five static nags is annoying, but you can read all five, dismiss them, and know exactly what you are looking at. The code that draws them is right there in the plugin. It does not change until the plugin updates.

A different class of plugin does something worse with a single banner. It reaches out to the vendor’s own server on every admin page load. It pulls down whatever promotional content the vendor decides to serve that day. It injects that straight into your dashboard. The plugin you audited and the banner you see are no longer the same thing. The vendor can change the message, the link, or the offer at any time, for every site running the plugin, without shipping an update you could review. I ran into one of these during a malware cleanup, and the framing clicked.

So on June 8th, I rewrote the rankings. Plugins that remote-inject /wp-admin/ notifications are now the worst offenders on the board, ahead of anything ranked on raw notice count. I think it is a far more honest measure of bad behavior. I said the same thing on X at the time. This is more accurate than a raw count of notifications, and I will keep letting AI run the scans and improve the database sourcing.

What the board says about the ecosystem.

With 2,023 plugins scanned, the pattern is clear. Upselling a paid tier is the single most common reason a plugin interrupts you. Demanding you update comes next, then begging for a review. Remote-promo is the rarest tag on the board. Only 19 plugins. It sits at the very top of the rankings anyway, because of what it represents, not how often it happens.

Severity is judged by reach, not volume. A notice scoped to the plugin’s own settings page is Low. A global, non-dismissible banner that loads on every screen is Critical. Right now, 74 plugins render a notice on every single admin screen. 818 of the catalogued notices cannot be dismissed at all. Here are three of the current worst offenders. All three are remote injectors.

The community drove the feature list.

Building in the open meant the feature list wrote itself. Someone asked for pagination, sorting, and filters. The collection at dismissed.fyi/collection/ already had them, so I added the same controls to the offenders page. Ben Word suggested listing the exact hooks and filters needed to disable each notice. He keeps a file dedicated to muting them on every site he maintains. I have thought about that, including WP-CLI commands to dismiss them. There are already plugins that turn WordPress notifications off wholesale, which is probably easier than micromanaging each one. Almost every reply was either a feature request or a better way to frame the data. The remote-injection ranking was the biggest reframe of them all.

An idea I sat on for years, because the only way I could picture building it was by hand. It took an afternoon once the notices could be read straight from the source. The hall of shame has begun. You can browse it at dismissed.fyi.