The State of WordPress 2026 | Synmek Annual Report

Let's Talk →

Design

Web Design

UX/UI Design

SaaS Design

Research & Strategy

Development

Web Development

SaaS Development

Mobile App Development

E-Commerce

WordPress

WordPress Agency

WordPress Design London

WordPress Developers London

Headless WordPress

Maintenance & Security

Growth

SEO & Digital Marketing

PPC Advertising

Locations

London

Toronto

Los Angeles

Pricing

[email protected]<br>+44 (0) 203 488 4857

Research

The State of WordPress 2026

Synmek Content Team

&bull;

31 Jul 2026<br>&bull;<br>21 min read

WordPress lost share of the web this year for the first time in two decades. The decline is real, smaller than the headlines suggest, and coming from somewhere almost nobody is looking.<br>Synmek’s annual research report on the platform that runs a third of the internet. Published July 2026. Next edition July 2027.<br>41.5% WordPress share of all websites, W3Techs, 11 July 2026: down from 43.2% in December<br>46.28% WordPress origins passing all three Core Web Vitals, vs 84.87% for Duda<br>5 hours Median time from vulnerability disclosure to first exploitation attempt

Why this report exists<br>Every WordPress statistic you have read this year is probably true and probably misleading.<br>You will see that WordPress powers 43% of the web. You will also see 41.5%, and 33%. All three figures are correctly reported from real datasets. They disagree because they are measuring different things, and almost nobody explains which.<br>That matters more than it sounds. In 2026, for the first time in twenty years, the direction of travel changed. WordPress is no longer gaining share. Whether that is a rounding error or the beginning of something structural depends entirely on which dataset you read and how carefully you read it.<br>We build on WordPress every day, so we have a commercial interest in the answer. This report is our attempt to get at it honestly, with every figure sourced and dated, including the figures that do not flatter the platform.<br>Key findings<br>WordPress share is falling on every measure. W3Techs put it at 41.5% of all websites on 11 July 2026, down from 43.2% in December 2025. HTTP Archive put it at 33.21% of measurable origins in April 2026, down from a 35.76% peak in July 2022.<br>It is still not close. WordPress holds roughly 59% of the market among sites running a detectable CMS. The nearest competitor, Shopify, sits around 7.4% of that same market.<br>The share is not going to Wix or Squarespace. It is going to the "no detectable CMS" bucket, which now accounts for 48.3% of measurable origins.<br>Performance is WordPress’s most serious competitive liability. On the November 2025 Core Web Vitals Technology Report, 46.28% of WordPress origins passed all three metrics. Duda passed at 84.87%.<br>But WordPress is not slow to respond, it is slow to load. WordPress INP pass rates sit near 86%, comparable to Wix. The failure is concentrated almost entirely in LCP. That changes what the fix is.<br>Security has become an operations problem, not a coding problem. 11,334 new vulnerabilities were disclosed across the ecosystem in 2025, up 42% year on year. 91% were in plugins. A single-digit number were in core.<br>"Keep your plugins updated" now fails about half the time. 46% of vulnerabilities disclosed in 2025 had no patch available on the day the details went public.<br>The median gap between public disclosure and first exploitation attempt is five hours. Weekly patching is patching after the wave.<br>Elementor still leads the build layer but its growth has stalled. Detected on 32.67% of WordPress sites in April 2026, with year-on-year growth down from roughly 28% in early 2023 to 8.3%.<br>The governance dispute cost the project a release year. WordPress shipped no major version between 6.8 and 6.9, with project leadership citing the WP Engine litigation. WordPress 7.0 finally landed on 20 May 2026.<br>1. The decline is real. It is also three different numbers.<br>Start with the measurement problem, because everything else depends on it.

Three ways to measure the same platform<br>WordPress share, 2026, by dataset and denominator<br>W3Techs · share of all websites (11 Jul 2026)

41.5%<br>W3Techs · share of known-CMS sites (Jul 2026)

59.2%<br>HTTP Archive · share of measurable origins (Apr 2026)

33.21%<br>All three are correct. They answer different questions.<br>Same platform, three denominators. Quote a share figure without naming the dataset and you are being imprecise.W3Techs surveys the top 10 million websites and counts subdomains of a site as a single entry. HTTP Archive crawls the origins in the Chrome UX Report and counts them separately, then reports against a denominator that includes every site with no detected CMS at all.<br>Neither is wrong. They answer different questions. W3Techs answers "of the sites people actually visit, how many run WordPress." HTTP Archive answers "of every distinct origin Chrome can see, how many run WordPress." If you quote one figure at a client without saying...