WordPress Statistics and Facts: Usage, Security, Themes

Rate this post
WordPress runs 40.7% of all websites, and 58.9% of every site whose content management system is identifiable. Its nearest rival among content management systems, Shopify, sits on 5.3% of all websites. That is the single number most people come here for, and it comes from W3Techs, which re-measures the top ten million sites daily. Below is a smaller set of WordPress figures than this page used to carry, for one reason: every number here was read from its original source rather than copied from another list. Where a figure could not be checked, it has gone.

Usage and market share

  • WordPress powers 40.7% of all websites and 58.9% of sites running a known CMS. (W3Techs)
  • The rest of the CMS market is not close. Shopify has 5.3% of all websites, Wix 4.2%, Squarespace 2.5%, Joomla 1.1%, Webflow 0.8%, Drupal 0.7%. (W3Techs)
  • Around 30.9% of websites use none of the content management systems W3Techs monitors, which is worth remembering whenever you see WordPress described as running “half the web”. It runs a little over 40% of everything, and a clear majority of everything built on a recognisable CMS.
  • Joomla, once framed as WordPress’s chief competitor, is now smaller than Wix, Squarespace and Shopify. (W3Techs)

Versions in use

Version adoption is the statistic most often quoted years out of date, so here is the current split across WordPress sites:
  • WordPress 7: 59.4%
  • WordPress 6: 33.4%
  • WordPress 5: 5.0%
  • WordPress 4: 2.0%
  • WordPress 3: 0.2%
(W3Techs) Roughly one WordPress site in twenty is still on version 5, and about one in fifty on version 4. Those are the sites that turn up in breach reports.

The two dates that matter

  • The first public release, WordPress 0.70, shipped on 27 May 2003. (WordPress.org)
  • The block editor arrived with WordPress 5.0, released on 6 December 2018 under the codename Bebo, alongside the Twenty Nineteen theme. (WordPress.org)
The block editor is not new any more, and the classic editor is not the default anywhere. If you are still running the old screen deliberately, our guide to keeping the classic editor covers how that stands today.

Themes

  • The official directory offers over 15,000 free themes. (WordPress.org)
  • TemplateMonster lists 3,481 premium WordPress themes, priced from $32 to $99. (TemplateMonster)
  • On ThemeForest, individual WordPress themes run from about $13 to $119, with a great many sitting at $59, $69 or $89. (ThemeForest)
  • Envato stopped offering free WordPress themes on ThemeForest in October 2025. Older free downloads still work, but they get no updates or support. (Envato)
If you are shopping rather than counting, our ThemeForest alternatives roundup compares the marketplaces that are still trading.

Plugins

  • The official directory holds over 71,000 free plugins, before you count anything sold on CodeCanyon, GitHub or a vendor’s own site. (WordPress.org)
  • Install counts, read from the directory itself: Classic Editor 8 million+, LiteSpeed Cache 7 million+, UpdraftPlus 3 million+, Duplicator 1 million+, WP Super Cache 1 million+.
  • Ratings track maintenance more closely than they track age. UpdraftPlus holds 4.8 out of 5 from 8,636 reviews and is tested against WordPress 7.1. The official AMP plugin sits at 3.8 from 367 reviews and is only tested to WordPress 6.8.8, having gone roughly a year without a release.
Caching is where install counts and real-world speed meet; our cache plugin comparison works through which of them suits which host.

E-commerce

  • WooCommerce runs on 8.1% of all websites and 11.7% of sites with a known CMS. (W3Techs)
  • Measured against e-commerce platforms alone, WooCommerce holds 48.1% of the market. (W3Techs)
Put another way: a free WordPress plugin is on more of the web than every hosted CMS except WordPress itself. Store owners choosing a front end can start with our WooCommerce theme picks.

Security

These come from Patchstack’s State of WordPress Security in 2026, which covers the 2025 calendar year.
  • 11,334 new vulnerabilities were disclosed across the WordPress ecosystem in 2025.
  • 91% were in plugins and 9% in themes. WordPress core accounted for six, all classed as low priority.
  • 1,966 of them (17%) scored as high severity, more high-severity issues than the previous two years put together.
  • Highly exploitable vulnerabilities rose 113% year on year.
  • For the vulnerabilities that get attacked hardest, the median time to mass exploitation is five hours.
The practical reading of that list: WordPress itself is rarely the hole. Your plugin inventory is the attack surface, and a five-hour median means patching on a weekly cycle is not patching.

Speed

Google’s Core Web Vitals are the performance numbers that carry weight in search. The thresholds for a “good” score, measured at the 75th percentile of page loads:
  • Largest Contentful Paint: 2.5 seconds or less
  • Interaction to Next Paint: 200 milliseconds or less
  • Cumulative Layout Shift: 0.1 or less
(web.dev) Interaction to Next Paint became a stable Core Web Vital in 2024, replacing First Input Delay. Any WordPress speed advice still built around FID is measuring something Google retired.

What it costs

  • Divi: $89 a year, or $249 once for lifetime access, both for unlimited sites. (Elegant Themes)
  • Themify Master Club: $89 a year, or $249 for the Lifetime Club, covering 42 themes. (Themify)
  • Organic Themes All Access: $99 a year for 44 themes. (Organic Themes)
  • Neve is free; Neve Pro starts at $69 a year. (Themeisle)

Things that used to be on lists like this

Any WordPress statistics page more than a couple of years old will recommend software that no longer exists. Four examples, all confirmed closed:
  • Instant Articles for WP, the official Facebook plugin, was closed in the WordPress directory on 18 April 2023, days after Meta ended Instant Articles support.
  • Glue for Yoast SEO & AMP was permanently closed on 31 March 2023.
  • Backup by 10Web, better known as WD Backup, was closed on 2 June 2021.
  • MOJO Marketplace was sunset on 31 December 2023.

Who owns all this

WordPress is GPL-licensed open source, written in PHP with MySQL or MariaDB behind it. The trademark and the WordPress.org domain do not belong to the company most people associate with WordPress, which surprises people; who actually owns WordPress sets out how the foundation, the project and Automattic relate.

Using these figures

Every number above carries the source it came from, so you can check it before you quote it. Market share and version data move daily, so re-read the W3Techs pages rather than citing this page as the origin. If you have a WordPress statistic with a primary source we have missed, leave it in the comments.