15 WordPress Statistics You Should Know for 2026

WordPress powers 39.6% of all websites and 58.3% of sites built on a known content management system, according to W3Techs data for October 25, 2026. Its free directory lists 72,545 plugins and 8,777 themes, and 63.8% of WordPress sites already run the latest major version, WordPress 7.1. The flip side of that ecosystem is security: Patchstack recorded 11,334 new WordPress-related vulnerabilities in 2025, 91% of them in plugins.

The 15 WordPress statistics below cover market share, the plugin and theme ecosystem, versions and PHP, and security. Each figure comes from W3Techs, WordPress.org’s own data or Patchstack’s annual security report, with links in the Sources section.

Updated October 2026.

What percentage of websites use WordPress in 2026?

1. WordPress powers 39.6% of all websites

According to W3Techs, WordPress was used by 39.6% of all websites on October 25, 2026. No other content management system comes close: Shopify, in second place, runs 5.3% of websites.

2. WordPress holds 58.3% of the CMS market

Among websites that use a content management system W3Techs can identify, WordPress has a 58.3% market share. About 32.1% of all websites use no detectable CMS, so WordPress’s share of CMS-built sites is much higher than its share of the whole web.

Source: W3Techs, October 25, 2026.

3. WordPress’s share fell from 43.0% to 39.6% during 2026

W3Techs’ historical data shows WordPress at 35.4% of websites on January 1, 2020, peaking at 43.6% in January 2025 and starting 2026 at 43.0%, before falling to 39.6% by October 2026. Survey-based figures like these can move when the sample or detection changes, so the trend over several years is more reliable than any single month.

4. Shopify and Wix are gaining ground: 5.3% and 4.2% of websites

Over the same period, W3Techs shows Shopify rising from 4.7% of websites in January 2025 to 5.3% in October 2026, and Wix from 3.3% to 4.2%. Hosted builders are taking a growing share of new small-business and e-commerce sites, while WordPress remains the default for content-heavy and custom sites.

WordPress plugin and theme statistics

5. The WordPress.org directory lists 72,545 free plugins

A query of the official WordPress.org plugin directory API on October 25, 2026 returned 72,545 plugins in the free plugin directory. The most popular, such as Elementor and Yoast SEO, report more than 10 million active installations each. Commercial plugins sold elsewhere add thousands more.

6. There are 8,777 free themes in the WordPress.org directory

The same API lists 8,777 themes in the WordPress.org theme directory as of October 25, 2026. Block themes, which are edited visually in the Site Editor rather than through code, are now the standard for new default themes.

WordPress version and PHP statistics

7. 63.8% of WordPress sites run WordPress 7.1

WordPress.org’s version statistics show 63.8% of sites running WordPress 7.1 in October 2026, followed by 7.0 (7.3%), 6.9 (6.7%) and 6.8 (5.2%). Since 7.1 was released on August 19, 2026, that means nearly two-thirds of WordPress sites upgraded within about two months.

8. WordPress shipped two major releases in 2026: 7.0 in May and 7.1 in August

According to the WordPress.org release archive, WordPress 7.0 “Armstrong” was released on May 20, 2026 and WordPress 7.1 “Mary Lou” on August 19, 2026. WordPress 7.2 entered beta on October 20, 2026.

9. WordPress 7.1 was built by more than 800 contributors

The WordPress 7.1 announcement credits more than 800 contributors from around the world, including over 170 first-time contributors, who delivered more than 1,500 enhancements and fixes. Highlights include responsive styling controls in the Site Editor, a new media editor, and native support for AVIF and HEIC images.

10. PHP 8.3 is the most common PHP version on WordPress sites (27.3%)

WordPress.org’s PHP version statistics show PHP 8.3 on 27.3% of WordPress sites in October 2026, followed by PHP 8.2 (23.3%), PHP 7.4 (15.2%), PHP 8.4 (10.0%) and PHP 8.1 (9.7%). Newer PHP versions are faster and still receive security fixes.

11. About 20.7% of WordPress sites still run PHP 7.4 or older

Adding up WordPress.org’s PHP statistics, roughly 20.7% of WordPress sites run PHP 7.4 or earlier, versions that no longer receive official security updates from the PHP project. Upgrading PHP through your host’s control panel is one of the simplest ways to make a WordPress site faster and safer.

WordPress security statistics

12. 11,334 new WordPress ecosystem vulnerabilities were found in 2025

Patchstack’s State of WordPress Security in 2026 report (updated February 25, 2026) counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% increase on 2024. That is more than 30 new vulnerabilities disclosed every day across the plugin and theme ecosystem.

13. 91% of WordPress vulnerabilities are in plugins

According to Patchstack, 91% of the vulnerabilities reported in 2025 were in plugins and 9% in themes. WordPress core had only six reported vulnerabilities, all low priority. The practical lesson: the fewer plugins you install, and the better maintained they are, the smaller your risk.

14. 46% of vulnerabilities had no patch available at disclosure

Patchstack found that for 46% of the vulnerabilities disclosed in 2025, the developer had not released a fix by the time the issue was made public. Site owners in that window need to remove or disable the plugin, or rely on a firewall or virtual patching service.

15. Heavily exploited vulnerabilities are mass-exploited within a median of 5 hours

Patchstack reports a weighted median of 5 hours from disclosure to mass exploitation for the most heavily exploited WordPress vulnerabilities, with broken access control the most exploited category. Automatic updates for plugins are the best defense against attacks that move this fast.

What do these WordPress statistics mean for site owners?

WordPress remains the most widely used way to build a website, with an enormous free ecosystem, but it puts maintenance on the owner: keeping core, plugins and PHP up to date, and choosing plugins carefully. Managed hosting takes much of that work off your hands.

If you are starting a WordPress site, compare hosts in our best managed WordPress hosting guide; popular hosts such as Bluehost and budget options like Hostinger include one-click WordPress installs. Not sure WordPress is right for you? Read our guide on how to choose a CMS, and find an available domain with the domain name generator.

How we compiled these statistics

Market share data comes from W3Techs (October 25, 2026). Plugin, theme, version and PHP figures come directly from WordPress.org’s public directory and statistics APIs, queried on October 25, 2026, and release details from WordPress.org’s release announcements. Security figures come from Patchstack’s State of WordPress Security in 2026 report. Older statistics without a current source were removed.

FAQs

Sources

1. W3Techs: Usage statistics of content management systems (October 25, 2026)
2. W3Techs: Historical yearly trends in the usage of content management systems
3. WordPress.org: Plugin directory
4. WordPress.org: Theme directory
5. WordPress.org: WordPress version statistics API
6. WordPress.org: PHP version statistics API
7. WordPress.org: WordPress 7.1 “Mary Lou” (August 19, 2026)
8. WordPress.org News: Releases
9. Patchstack: State of WordPress Security in 2026