Before I install anything now, I check how many people maintain it, a different number from how many people use it.
A story about one man and a great theme
For years my fiction site ran on Fictioneer, and I’ll repeat what I said earlier in this series: it’s an excellent theme, the best tool that exists for running serial fiction on WordPress. Its developer, Tetrakern, built something the big commercial shops never bothered to build, and built it with obvious love. Reading the code, you can feel a single coherent mind at work, and that’s the quality the Frankenstein themes from the assembly lines lack.
And that’s the problem. A single coherent mind is one mind. One person to fix bugs, one person to chase compatibility with every new WordPress release, one person to answer the support threads, one person between the theme and abandonment. Following the project over time, I noticed the small signals anyone can learn to read: releases still coming, bugs still fixed, and alongside them, the occasional weary comment from a maintainer who plainly loves the work and just as plainly carries all of it alone.
Nothing about the project was failing. This is a story about arithmetic.
Because I’d built a serious part of my business on those custom structures, my content had grown around the theme the way content does. Which meant my fiction platform’s future was, in a real sense, one person’s hobby energy. No malice required, no failure required. A new job, a health problem, or simple burnout, and the software holding my stories would begin drifting out of compatibility, one WordPress release at a time.
I left, eventually, for exactly that reason, and it remains the most respectful divorce I’ve ever conducted. The theme was excellent. The bus factor was one.
What is the bus factor in software?
Engineers call it the bus factor: how many people would have to be hit by a bus before the project dies. It sounds morbid because it is, and it’s the single most underrated number in software selection.
A bus factor of one is the norm. The directory is full of beloved plugins and themes maintained by one person in their evenings, and most of the time that works, until the evening they stop. Abandonment is rarely announced. It looks like an update that never comes, then a compatibility warning, then a security advisory nobody patches.
The worst part is who ends up holding the bag. The maintainer burns out after years of unpaid evenings, the site owner learns about it from a security advisory, and the plugin can sit in the directory looking perfectly installable long after anybody’s home. Nobody in that chain did anything wrong on purpose, and the damage lands anyway, usually on the smallest sites with the least help.
And an unmaintained plugin isn’t merely stale; as my own incident showed, orphaned and sold projects are exactly how attackers acquire trusted channels into hundreds of thousands of sites.
Checking the number takes minutes. Look at who publishes the software and whether that’s a person or an organization. Look at the changelog: steady releases across years, or a burst of energy followed by silence? Read the support forum: are questions answered, and by whom, and in what tone? A maintainer answering every thread personally is admirable and is also a bus factor of one introducing himself.
The gradient, revisited
Now combine this with the lock-in gradient from the page builder article, because the two multiply.
A shallow tool with a bus factor of one is a small risk: if it dies, you swap it in an afternoon. An embedded tool with a bus factor of one is a different animal entirely. That’s your content grown around a fence post that one person maintains. The deeper the embedding, the more the maintainer count matters, until at the deepest end, the full builders and platforms, you should be reading the vendor’s staffing the way you’d read a landlord’s finances.
This cuts against instinct, because the embedded tools feel safest. They’re polished, popular, everywhere. But popularity only measures adoption, and even big teams sell catalogs, pivot, or fold. The question is who’s contractually, financially, or emotionally bound to keep it good in year five.
I think the whole review industry trains people to ask the wrong question. Comparison posts line up features and star ratings, and almost none of them tell a small business owner to check whether one tired person stands between their site and the next security hole. That omission costs people their sites, and it would take a reviewer five minutes to fix.
What should you do about a low bus factor?
I’m not telling you to boycott solo developers. Some of the best software in the world is one person’s obsession, and Fictioneer proves it. I’m telling you to price the number in.
For shallow tools, a bus factor of one is fine. Enjoy the craftsmanship.
For anything embedded, demand a higher number or a proven exit. Either multiple maintainers with an organization behind them, or software that stores your content in structures that survive its death. One or the other. Insisting on both is how the cautious sleep.
For everything already on your site, check the pulse yearly. The maintainer situation that was healthy at install has had years to change, and the check costs five minutes per plugin. The annual audit from the previous article is the natural place for it.
And when you find a beloved tool with a bus factor of one holding something your business depends on, do what I did: thank the maintainer sincerely, and start planning your independence while everything is still working. The worst time to leave is after the last update never arrives.
Next in the series: the update channels themselves, and how attackers stopped breaking into websites and started buying the roads that lead to them. That story, including the hostile computer that can hide inside a cable, is The Supply Chain Is the Attack Surface. And if you want an experienced eye on the bus factors holding up your own site, that’s work I do.
Frequently Asked Questions
