WordPress Statistics 2026
By Axis Intelligence Research
Co-author: Elena Rodriguez | Last updated: September 30, 2026 | License: CC BY 4.0
WordPress runs on 40.2% of all websites and holds 58.7% of the CMS market, according to W3Techs data from September 29, 2026. That is down from 43.2% in December 2025. Axis Intelligence Research calculates that 14.7% of all websites run a WordPress major version older than 7.0. Our WordPress Patch Gap Index (WPGI™) stands at 48.6 out of 100.
Quick Answer
WordPress is still the largest CMS on the web. W3Techs measures it on 40.2% of all websites and 58.7% of sites with a known CMS as of September 29, 2026. The share is falling, not growing: the figure was 43.2% in December 2025, a 3.0-point drop in nine months.
Axis Intelligence Research adds two numbers you won’t find elsewhere:
- The WordPress Patch Gap Index (WPGI™) reads 48.6/100. It measures how far the ecosystem’s patching capacity trails exploitation speed.
- WordPress core has shipped 7 security-bearing releases in 2026 so far, compared with 1 in all of 2025.
Key Findings
- WordPress powers 40.2% of all websites and 58.7% of CMS-built sites as of September 29, 2026 (W3Techs). That is 3.0 percentage points below the 43.2% recorded in December 2025.
- Axis Intelligence Research calculates a WordPress Patch Gap Index (WPGI™) of 48.6 out of 100 for September 2026. The index combines four published exposure measures from Patchstack and W3Techs.
- WordPress core shipped 7 security-bearing releases between January 1 and September 29, 2026, against 1 in all of 2025, according to Axis Intelligence Research’s count of the WordPress.org release log.
- 63.5% of WordPress sites ran version 7 by September 29, 2026, 132 days after WordPress 7.0 shipped on May 20, 2026 (W3Techs, WordPress.org). Axis Intelligence Research calculates that the remaining 36.5% equals 14.7% of all websites.
- WooCommerce runs on an estimated 8.0% of all websites, compared with 5.4% for Shopify, according to Axis Intelligence Research’s calculation from W3Techs data.
What Percentage of Websites Use WordPress in 2026?
W3Techs detects WordPress on 40.2% of all websites and 58.7% of websites whose CMS it can identify, in data dated September 29, 2026. Another 31.5% of sites use no CMS that W3Techs tracks.
Both numbers matter, and they measure different things. The 40.2% counts every surveyed site, including hand-coded ones. The 58.7% counts only sites where W3Techs can name the CMS. Mixing the two is the most common error in WordPress market share reporting.
WordPress Market Share vs Other CMS Platforms (September 2026)
| CMS | Share of all websites | Share of CMS market | Source |
|---|---|---|---|
| WordPress | 40.2% | 58.7% | W3Techs, Sep 29, 2026 |
| Shopify | 5.4% | 7.8% | W3Techs, Sep 29, 2026 |
| Wix | 4.2% | 6.1% | W3Techs, Sep 29, 2026 |
| Squarespace | 2.4% | 3.6% | W3Techs, Sep 29, 2026 |
| Joomla | 1.1% | 1.6% | W3Techs, Sep 29, 2026 |
| Webflow | 0.8% | 1.2% | W3Techs, Sep 29, 2026 |
| Drupal | 0.6% | 0.9% | W3Techs, Sep 29, 2026 |
| No detected CMS | 31.5% | — | W3Techs, Sep 29, 2026 |
By CMS-market share, WordPress is 7.5 times larger than Shopify (58.7 ÷ 7.8, Axis Intelligence Research calculation). No rival is closing that gap on its own. The more useful question is where the lost points are going.
Elena Rodriguez: A 3.0-point slide sounds like a platform in trouble until you set it against the field. WordPress still holds 58.7% of the known-CMS market, 7.5 times Shopify’s 7.8%. For a buyer choosing a CMS, share is a proxy for the size of the hiring pool, the plugin catalog and the agency bench. On that measure the gap to the runner-up is still the whole story.
Is WordPress Market Share Declining?
Yes. W3Techs recorded WordPress at 43.2% of all websites in December 2025, as reported by Search Engine Journal. The live W3Techs reading on September 29, 2026 is 40.2%.
WordPress Share of All Websites, December 2025 to September 2026
| Date | WordPress share of all websites | Source |
|---|---|---|
| December 2025 | 43.2% | W3Techs data via Search Engine Journal |
| May 27, 2026 | 41.9% | W3Techs data via Search Engine Journal |
| September 29, 2026 | 40.2% | W3Techs (retrieved directly) |
That is a drop of 3.0 percentage points in about nine months. Axis Intelligence Research calculates it as a 6.9% relative decline (3.0 ÷ 43.2). The pace also picked up. From late May to late September, WordPress lost 1.7 points in four months. From December to May, it lost 1.3 points in six months.
A second dataset shows the same direction, but earlier. The HTTP Archive Web Almanac 2025 found that WordPress’s share of CMS-driven sites fell slightly year over year from its 2024 peak. The Almanac describes this as a slowdown after two decades of growth, and it found no single platform gaining enough to account for WordPress’s slower expansion.
Why the Two Main Datasets Disagree on WordPress Share
HTTP Archive places WordPress at 64.3% of mobile CMS usage in its 2025 crawl. W3Techs puts it at 58.7% of the CMS market. The difference comes from how each one samples. HTTP Archive crawls millions of URLs from the Chrome UX Report. W3Techs surveys a ranked list of sites. Neither is wrong, but they are not interchangeable. Always cite one with its date.
Elena Rodriguez: Procurement decks love to quote one share figure as if it were audited revenue. It’s a sample. Put 64.3% and 58.7% side by side with their dates and methods, and the argument moves from which number is right to which direction both are heading. Both are heading down.
How Popular Is WordPress Among the Top Websites?
WordPress is less dominant among high-traffic sites than across the web as a whole. Per W3Techs’s ranking breakdown (September 29, 2026), WordPress’s share of known-CMS sites is:
| Site tier | WordPress share of known-CMS sites | Source |
|---|---|---|
| All websites | 58.7% | W3Techs, Sep 29, 2026 |
| Top 1,000,000 | 48.6% | W3Techs, Sep 29, 2026 |
| Top 100,000 | 50.9% | W3Techs, Sep 29, 2026 |
| Top 10,000 | 51.4% | W3Techs, Sep 29, 2026 |
| Top 1,000 | 50.4% | W3Techs, Sep 29, 2026 |
Axis Intelligence Research calls this the top-site gap: 10.1 percentage points between WordPress’s overall CMS share and its share within the top 1 million (58.7 − 48.6). Most of WordPress’s lead comes from the long tail of small sites. Among the most-visited sites, it holds roughly half the market.
HTTP Archive’s rank data points the same way from another angle. Among the top 10,000 sites, it found WordPress at about 58% of CMS usage and Drupal at 6–7%. Drupal’s overall share is about 1%.
What Version of WordPress Are Most Sites Running?
WordPress 7.0 “Armstrong” shipped on May 20, 2026, after a delay from its planned April date. WordPress 7.1 “Mary Lou” followed on August 19, 2026. By September 29, 2026, W3Techs measured these major versions across WordPress sites:
| WordPress major version | Share of WordPress sites | Source |
|---|---|---|
| Version 7 | 63.5% | W3Techs, Sep 29, 2026 |
| Version 6 | 29.4% | W3Techs, Sep 29, 2026 |
| Version 5 | 4.8% | W3Techs, Sep 29, 2026 |
| Version 4 | 2.0% | W3Techs, Sep 29, 2026 |
| Version 3 | 0.2% | W3Techs, Sep 29, 2026 |
How Fast Did WordPress 7 Roll Out?
Version 7 reached 63.5% of WordPress sites in 132 days. Axis Intelligence Research calculates an average adoption pace of about 0.48 percentage points per day (63.5 ÷ 132). Automatic minor updates don’t explain this. A jump across a major version needs either the site owner’s approval or a host that manages core updates.
The other side of that number matters more for security. 36.5% of WordPress sites run a major version older than 7. Multiplied by WordPress’s 40.2% share of all websites, Axis Intelligence Research calculates that about 14.7% of all websites run a pre-7 WordPress branch (0.365 × 40.2). Some of those sites run 6.9.x, which still receives security backports. The 3.0 and 4.x installations, at 2.2% of WordPress sites combined, are a different kind of risk.
Elena Rodriguez: Every site stuck below version 7 is a line item nobody budgeted for. The update is free. The regression test, the theme fix and the plugin replacement behind it are not. That 14.7% of the web is deferred maintenance sitting on someone’s balance sheet, whether their finance team knows it or not.
How Many Security Releases Has WordPress Core Shipped in 2026?
This is the finding that changes how people should talk about core security. Axis Intelligence Research reviewed every post in the WordPress.org releases log. We counted the releases whose announcement describes security fixes.
Security-Bearing WordPress Core Releases, 2025 vs 2026
| Release | Date | What the announcement states | Source |
|---|---|---|---|
| 6.8.3 | Sep 30, 2025 | Security release with two fixes | WordPress.org |
| 6.9.2 | Mar 10, 2026 | Addressed 10 security issues | WordPress.org |
| 6.9.4 | Mar 11, 2026 | Completed security fixes not fully applied in 6.9.2 | WordPress.org |
| 7.0.2 | Jul 17, 2026 | One critical, one high severity issue; forced auto-updates enabled | WordPress.org |
| 7.0.3 | Aug 6, 2026 | Several security fixes | WordPress.org |
| 7.0.4 | Aug 12, 2026 | Security fix | WordPress.org |
| 7.1.1 | Sep 17, 2026 | 11 security fixes plus bug fixes | WordPress.org |
| 7.1.2 | Sep 22, 2026 | Fix for a critical severity vulnerability | WordPress.org |
The count: 1 security-bearing release in 2025, 7 in 2026 through September 29. Two 2026 releases alone (6.9.2 and 7.1.1) carried 21 security fixes between them (10 + 11). WordPress 7.0.2 was serious enough that WordPress.org forced updates through the auto-update system.
For context, Patchstack’s State of WordPress Security in 2026 counted just 6 vulnerabilities in WordPress core in 2025, all rated low priority. Patchstack counts disclosed vulnerabilities and WordPress.org counts fixes, so the two figures aren’t a like-for-like series. Still, the direction is clear. The “core is almost never the problem” message that most WordPress statistics pages repeat described 2025 accurately. It does not describe 2026.
Elena Rodriguez: The maintenance contract most agencies sold in 2025 assumed one core security release a year. 2026 has delivered seven, two of them rated critical. Core didn’t get worse. 7.0 shipped AI abilities and a rebuilt admin, and new code draws new scrutiny. But a retainer priced on last year’s patch cadence is now underpriced, and the owner of that gap is whoever signed it.
How Many WordPress Vulnerabilities Were Found in 2025?
Patchstack’s 2026 report, published February 25, 2026, covers calendar year 2025:
| Metric | Value | Source |
|---|---|---|
| New vulnerabilities in the WordPress ecosystem, 2025 | 11,334 | Patchstack, Feb 25, 2026 |
| Increase vs 2024 | +42% | Patchstack |
| Vulnerabilities in 2024 (prior report) | 7,966 | Patchstack 2025 report |
| Share found in plugins | 91% | Patchstack |
| Share found in themes | 9% | Patchstack |
| Vulnerabilities in WordPress core | 6 (all low priority) | Patchstack |
| Vulnerabilities serious enough to need mitigation rules | 4,124 (36%) | Patchstack |
| High-severity, likely mass-exploited | 1,966 (17%) | Patchstack |
| Increase in highly exploitable vulnerabilities | +113% | Patchstack |
| Not patched by the vendor at public disclosure | 46% | Patchstack |
| Weighted median time to mass exploitation | 5 hours | Patchstack |
| Premium/freemium component reports that were exploitable | 76% of 1,983 | Patchstack |
| Attacks blocked by hosting-layer defenses (pentest) | 26% | Patchstack |
Three numbers in that table should change how you plan patching. First, 46% of disclosed vulnerabilities had no fix available at disclosure. Second, heavily exploited flaws were attacked within a weighted median of 5 hours, and roughly half of high-impact vulnerabilities were exploited within 24 hours. Third, in Patchstack’s pentest of hosting companies, only 26% of attacks were blocked at the hosting layer.
Premium plugins deserve particular attention. Of 1,983 valid reports for premium or freemium components, 76% were exploitable in real attacks. Premium components also carried three times more Known Exploited Vulnerabilities than free ones. Buying a plugin doesn’t buy you more scrutiny of its code. Usually it buys you less.
The WordPress Patch Gap Index (WPGI™)
The WordPress Patch Gap Index (WPGI™) is an original Axis Intelligence Research metric. It measures the gap between how fast WordPress vulnerabilities are exploited and how much of the ecosystem is actually protected when that happens. A score of 0 would mean every vulnerability is patched at disclosure, every site is on the current branch, and every exploit is blocked. A score of 100 would mean none of those are true.
WPGI™ Reading: 48.6 / 100 (September 2026)
| Component | What it measures | Input value | Weight | Weighted points | Source |
|---|---|---|---|---|---|
| Vendor patch gap | % of vulnerabilities with no fix at disclosure | 46.0 | 30% | 13.80 | Patchstack, 2025 data |
| Perimeter miss rate | % of exploit attempts not blocked by hosting defenses (100 − 26) | 74.0 | 25% | 18.50 | Patchstack pentest, 2025 |
| Legacy branch exposure | % of WordPress sites not on the current major version (100 − 63.5) | 36.5 | 25% | 9.13 | W3Techs, Sep 29, 2026 |
| Actionable threat share | % of new vulnerabilities needing mitigation rules | 36.0 | 20% | 7.20 | Patchstack, 2025 data |
| WPGI™ | 100% | 48.6 | Axis Intelligence Research |
Formula: WPGI = 0.30 × 46.0 + 0.25 × 74.0 + 0.25 × 36.5 + 0.20 × 36.0 = 48.6
How to Read the WPGI™ Score
| Band | Score | Meaning |
|---|---|---|
| Contained | 0–24 | Most exposure is closed before exploitation arrives |
| Elevated | 25–49 | A meaningful share of sites is exposed during the first-hours window |
| Severe | 50–74 | Exposure is the default state for much of the ecosystem |
| Critical | 75–100 | Patching capacity has effectively failed |
At 48.6, WordPress sits at the top of the Elevated band, 1.4 points from Severe. The biggest contributor is the hosting perimeter (18.5 of 48.6 points). The main lever for improvement is plugin vendors shipping fixes before disclosure, since vendor patch gap carries the heaviest weight.
What would move the score: If vendors had fixes ready for three-quarters of disclosures instead of 54%, WPGI would fall about 6.3 points. If version 7+ adoption reached 90%, WPGI would fall about 6.6 points. Axis Intelligence Research will publish the next reading after Patchstack’s mid-year data and the next W3Techs version snapshot.
Elena Rodriguez: Run the numbers the way an operator would. A five-hour weighted median to mass exploitation, 46% of flaws with no vendor fix at disclosure, and a hosting layer that blocked 26% in testing. The ROI deck for “we update on Fridays” assumes a threat that waits for Friday. WPGI puts one number on that assumption so it can go into a board slide.
WooCommerce and Page Builder Statistics: What Runs on Top of WordPress?
W3Techs measures which technologies run on WordPress sites. Axis Intelligence Research converted those shares into shares of the whole web by multiplying by WordPress’s 40.2% share of all websites.
| Technology | Share of WordPress sites | Estimated share of all websites (Axis calc.) | Source |
|---|---|---|---|
| Elementor | 31.5% | 12.7% | W3Techs, Sep 29, 2026 |
| WooCommerce | 19.8% | 8.0% | W3Techs, Sep 29, 2026 |
| WPBakery | 7.4% | 3.0% | W3Techs, Sep 29, 2026 |
| Beaver Builder | 1.0% | 0.4% | W3Techs, Sep 29, 2026 |
| Bricks | 0.4% | 0.2% | W3Techs, Sep 29, 2026 |
By this estimate, WooCommerce (about 8.0% of all websites) runs on roughly 1.5 times as many sites as Shopify (5.4%). That’s a site count, not a revenue measure. Shopify’s merchants are, on average, a different population from WooCommerce’s.
Page builders are losing ground to native blocks. HTTP Archive’s 2025 Almanac found Elementor’s share of builder usage fell from about 56% to 43% between 2024 and 2025. Over the same period, the native WordPress Block Editor grew to about 18%, and WPBakery fell from about 21% to 13%.
How Many WordPress Plugins Are There?
The WordPress.org Plugin Directory lists over 73,000 free plugins as of September 29, 2026. Three plugins show 10+ million active installations: Elementor, Yoast SEO, and Contact Form 7. WooCommerce and LiteSpeed Cache each show 7+ million, and Rank Math SEO shows 4+ million.
Directory counts only include free plugins hosted on WordPress.org. Premium plugins sold elsewhere aren’t counted, and Patchstack’s data shows that is where much of the exploitable risk sits.
How Fast Are WordPress Sites? Core Web Vitals by CMS
The HTTP Archive Web Almanac 2025 measured the share of mobile sites passing all Core Web Vitals by CMS:
| CMS | Mobile Core Web Vitals pass rate (2025) | Source |
|---|---|---|
| Duda | 85% | HTTP Archive Web Almanac 2025 |
| TYPO3 | 79% | HTTP Archive Web Almanac 2025 |
| Wix | 74% | HTTP Archive Web Almanac 2025 |
| Weebly | 47% | HTTP Archive Web Almanac 2025 |
| WordPress | 45% | HTTP Archive Web Almanac 2025 |
WordPress passes on 45% of mobile sites, 40 points behind Duda (Axis Intelligence Research calculation). WordPress improved about 4% year over year. Wix improved about 14%. WordPress’s median mobile Lighthouse performance score is 41, while Wix’s is 64.
The picture flips on page weight. WordPress’s median mobile page is 2,894 KB, the lightest of the five platforms HTTP Archive charted. Its median mobile JavaScript is 638 KB, compared with 1,634 KB for Wix. WordPress pages aren’t heavy by default. The variation comes from configuration: themes, builders, and plugins. The Almanac attributes WordPress’s performance spread to configuration rather than to limits in core.
Elena Rodriguez: WordPress ships lighter median pages than Wix and still passes Core Web Vitals less often: 45% against 74%. That’s a configuration bill, not a platform bill. Each builder, add-on and third-party script is a seat on the invoice. The sites that pass are usually the ones where someone audited what was installed.
Methodology
Data collection. Axis Intelligence Research fetched every source on September 29, 2026 and logged each figure in the dataset below with its URL and retrieval date. Market share, version, subtechnology, and rank data come from W3Techs pages dated September 29, 2026. Release data comes from the WordPress.org releases log. Vulnerability data comes from Patchstack’s State of WordPress Security in 2026 (published February 25, 2026, covering 2025) and the prior 2025 report. Performance and page-builder data come from the HTTP Archive Web Almanac 2025 CMS chapter (published January 15, 2026). The December 2025 and May 2026 W3Techs readings are taken from Search Engine Journal’s reporting of W3Techs data, because W3Techs’s historical tables did not render for automated retrieval.
Security-release count. A release counts as security-bearing if its WordPress.org announcement states that it contains security fixes. WordPress 6.9.3 (March 10, 2026) is excluded because it fixed a regression and did not add security fixes. We counted only releases announced in the WordPress.org news log. Backport-only builds without an announcement post were not counted.
Derived figures (all labeled “Axis Intelligence Research calculation”).
- Share of all websites for WordPress-hosted technologies = (share of WordPress sites) × 40.2%.
- Pre-7 branch exposure = (100% − 63.5%) × 40.2% = 14.7% of all websites.
- Relative share decline = (43.2 − 40.2) ÷ 43.2 = 6.9%.
- Top-site gap = 58.7% − 48.6% = 10.1 points.
- WordPress 7 adoption pace = 63.5 ÷ 132 days = 0.48 points per day.
WPGI™ construction. The four components are each expressed as a 0–100 exposure percentage and combined with fixed weights (30/25/25/20). Vendor patch gap carries the most weight because it’s the one exposure a site owner can’t close alone. Perimeter miss rate and legacy branch exposure share the middle weight because both are infrastructure choices. Actionable threat share is weighted lowest because it describes the vulnerability population, not site behavior. The components describe different populations (vulnerabilities, attack attempts, sites), so WPGI is a composite exposure score, not a probability. Anyone can recompute it from the inputs in the CSV.
About This Dataset
File: wordpress-statistics.csv: every number on this page as one row, with source organization, document, URL, retrieval date, primary-source flag, and a method note for every Axis Intelligence Research calculation. Coverage: Global; 2024–2026, snapshot date September 29, 2026. License: CC BY 4.0. Reuse freely with attribution. Mirrors: Hugging Face, Kaggle, and GitHub (Axis Intelligence Research).
How to Cite This Page
APA: Axis Intelligence Research, & Rodriguez, E. (2026, September 30). WordPress statistics 2026: Market share falls to 40.2% as core security releases surge. Axis Intelligence. https://axis-intelligence.com/wordpress-statistics/
MLA: Axis Intelligence Research, and Elena Rodriguez. “WordPress Statistics 2026: Market Share Falls to 40.2% as Core Security Releases Surge.” Axis Intelligence, 30 Sept. 2026, axis-intelligence.com/wordpress-statistics/.
Chicago: Axis Intelligence Research and Elena Rodriguez. “WordPress Statistics 2026: Market Share Falls to 40.2% as Core Security Releases Surge.” Axis Intelligence, September 30, 2026. https://axis-intelligence.com/wordpress-statistics/.
FAQ: WordPress in 2026
Should I start a new site on WordPress now that its share is falling?
A falling share and a shrinking platform are different things. WordPress still holds 58.7% of the known-CMS market (W3Techs, September 29, 2026), 7.5 times Shopify’s share. The decision depends more on who will maintain the site. The ecosystem’s weak point is upkeep, which the WPGI™ score of 48.6 reflects, not capability.
Which WordPress version should my site be on in October 2026?
It should be on the 7.1 branch at 7.1.2 or later. WordPress 7.1.2, released September 22, 2026, fixes a critical-severity vulnerability, according to WordPress.org. If you can’t move to 7.1 yet, check the WordPress.org release notes for your branch’s latest security build.
How much of the web runs outdated WordPress?
Axis Intelligence Research calculates that about 14.7% of all websites run a WordPress major version older than 7.0. That’s 36.5% of WordPress sites multiplied by WordPress’s 40.2% web share (W3Techs, September 29, 2026). Of WordPress sites, 2.2% still run versions 3 or 4.
Is WordPress core less secure in 2026 than in 2025?
Core has needed far more security releases. Axis Intelligence Research counts 7 security-bearing core releases in 2026 through September 29, compared with 1 in 2025. Two of them fixed critical-severity issues. Most ecosystem risk still sits in plugins: 91% of 2025’s 11,334 vulnerabilities, per Patchstack.
How long do I have to patch a WordPress plugin vulnerability?
Plan for hours, not days. Patchstack found a weighted median of 5 hours from disclosure to first exploitation for heavily exploited WordPress vulnerabilities in 2025. About half of high-impact flaws were exploited within 24 hours.
Does my hosting firewall protect my WordPress site from plugin exploits?
Usually only partly. In Patchstack’s 2025 pentests of hosting providers, only 26% of WordPress vulnerability attacks were blocked. The first test, which focused on known exploited vulnerabilities, found traditional defenses blocked just 12%. Firewall rules written for WordPress specifically, or virtual patching, close more of that gap.
Are premium WordPress plugins safer than free ones?
Not according to 2025 data. Patchstack found that 76% of the 1,983 vulnerabilities it validated in premium or freemium components were exploitable. Premium components also had three times as many Known Exploited Vulnerabilities as free ones.
Is WooCommerce bigger than Shopify?
By number of sites, yes. Axis Intelligence Research estimates WooCommerce at about 8.0% of all websites (19.8% of WordPress sites × 40.2%), against 5.4% for Shopify (W3Techs, September 29, 2026). That comparison doesn’t cover merchant revenue or order volume.
Why do WordPress sites fail Core Web Vitals more often than Wix sites?
The difference comes from configuration, not page weight. HTTP Archive’s 2025 Almanac found 45% of WordPress mobile sites pass Core Web Vitals, against 74% for Wix. Yet WordPress’s median mobile page is lighter, at 2,894 KB. Themes, page builders, and plugins create the spread.