WordPress statistics are easy to find and hard to trust, because many of the numbers people repeat are years old. Here’s the short version: WordPress runs 39.5% of all websites and 58.2% of sites with a known CMS, it has more than 73,000 free plugins, and 91% of its new security vulnerabilities in 2025 were in plugins.
Every figure below comes from a primary source and was checked on October 30, 2026. We went back to where each number started and dropped any we couldn’t trace.
WordPress usage statistics
These come from W3Techs, which surveys the top 10 million websites.
- WordPress is used by 39.5% of all websites.
- Among sites with a CMS W3Techs can identify, its market share is 58.2%.
- 32.1% of websites use no CMS that W3Techs can detect.
- WordPress has more than seven times the share of the next CMS, Shopify.
| CMS | % of all websites | CMS market share |
|---|---|---|
| WordPress | 39.5% | 58.2% |
| Shopify | 5.3% | 7.9% |
| Wix | 4.2% | 6.1% |
| Squarespace | 2.4% | 3.6% |
| Joomla | 1.1% | 1.6% |
| Tilda | 0.8% | 1.2% |
| Webflow | 0.8% | 1.2% |
| Duda | 0.7% | 1.1% |
WordPress’s share is falling. When we first published this post in January 2024, W3Techs put it at 42.7% of all websites. It’s still far ahead, but “43% of the web” is out of date.
WordPress version statistics
From WordPress.org’s own usage stats, which count sites that report to it:
- 64.6% of sites run WordPress 7.1, the current major version, released on August 19, 2026.
- 7.0% run 7.0, 6.5% run 6.9 and 5.1% run 6.8.
So nearly two thirds of sites moved to the newest version within about ten weeks. W3Techs, which measures differently, puts all 7.x versions at 67.6% of WordPress sites, with 25.6% on 6.x, 4.7% on 5.x and 2.0% on 4.x.
WordPress PHP and database statistics
Also from WordPress.org:
- PHP 8.3 is the most common version, on 27.6% of sites, followed by 8.2 on 22.9%.
- 14.9% of sites still run PHP 7.4, which stopped getting security updates from the PHP project in November 2022.
- 10.3% run PHP 8.4 and 6.0% run PHP 8.5.
- MariaDB 10.11 is the most common database, on 19.6% of sites, ahead of MariaDB 11.8 on 16.3% and MySQL 8.0 on 13.1%.
WordPress language statistics
- 42.7% of WordPress.org sites use English (US).
- Next come Japanese (6.0%), Spanish from Spain (5.7%), German (5.7%) and French from France (4.6%).
WordPress plugin statistics
From the WordPress.org plugin directory:
- The directory lists 73,270 free plugins.
- Three plugins report 10+ million active installs: Elementor, Yoast SEO and Contact Form 7.
- Classic Editor is still on 8+ million sites, nearly eight years after the block editor arrived.
- LiteSpeed Cache and WooCommerce each report 7+ million.
WordPress theme statistics
- The WordPress.org theme directory lists 8,754 free themes.
WooCommerce statistics
From WooCommerce’s WordPress.org listing:
- WooCommerce has 7+ million active installs.
- It’s rated 4.5 out of 5 across 4,833 reviews.
- More than 400 of those are one-star reviews, and about 4,000 are five-star.
WordPress security statistics
From Patchstack’s State of WordPress Security in 2026, which covers 2025:
Get Started with the Best WordPress Membership Plugin Today
Connect, Manage and Build your Membership Site
- 11,334 new vulnerabilities were found in the WordPress ecosystem, up 42% on 2024.
- 91% were in plugins and 9% in themes.
- WordPress core had just 6, all low priority.
- 46% didn’t get a fix from the developer in time for public disclosure.
- 17% (1,966) had a high risk of mass exploitation.
The lesson isn’t that WordPress is unsafe. Core is very solid, and the risk sits in the plugins you choose and how quickly you update them. Our WordPress security guide covers what to do about it.
WordPress.com statistics
WordPress.com is the hosted service, separate from the open source software. From its activity page:
- More than 409 million people view more than 20 billion pages each month.
- Users publish about 70 million new posts and leave about 77 million new comments each month.
- Sites are written in more than 120 languages. 71% are in English and 4.7% in Spanish.
WordPress history
From WordPress.org’s history page:
- May 27, 2003: the first release, version 0.7.
- January 3, 2004: version 1.0.
- December 6, 2018: version 5.0 introduces the block editor.
- January 25, 2022: version 5.9 introduces full site editing.
- May 20, 2026: version 7.0.
- August 19, 2026: version 7.1, the latest major release.
What these WordPress statistics mean for your site
Three things stand out if you run a WordPress site, particularly one with user accounts:
- Update your plugins, and remove the ones you don’t use. With 91% of new vulnerabilities in plugins and 46% unpatched at disclosure, every plugin is a decision worth making carefully.
- Check your PHP version. If you’re among the 14.9% on PHP 7.4, ask your host to move you to a supported version.
- Protect your logins. Give each account only the role it needs, using the roles editor and our guide to WordPress user roles, and add reCAPTCHA to your forms. WordPress user management covers the rest.
We make WP User Manager, a plugin for registration, profiles and member sites. If your site has users, try the free WP User Manager plugin.