28+ WordPress Statistics: Market Share, Plugins & WooCommerce (2026)

Open almost any browser tab, type a domain, and there is roughly a one-in-two chance that whatever loads on the other end is running WordPress. The blogging engine forked off b2/cafelog in 2003 now powers more of the public web than every other CMS combined. It is the default substrate for indie blogs, Fortune 500 marketing sites, ten-figure media properties, university homepages, and, through WooCommerce, a sizable slice of independent e-commerce. When people argue about whether WordPress is still relevant in 2026, the data quietly answers: it is more dominant than ever, even as the conversation moves to headless stacks, AI site builders, and edge frameworks.

The numbers we care about for a US deal-driven audience are not abstract market-share trivia. They are the operational realities of the platform that hosts most of the coupon sites, affiliate blogs, and merchant landing pages our readers encounter every day. How many plugins are actually maintained. How many vulnerabilities Wordfence and Patchstack disclosed last year. How WooCommerce stacks up against Shopify on real-world stores. Which page builder runs the most checkouts. We pulled the 2026 versions of those data points from W3Techs, BuiltWith, WordPress.org's own directories, Wordfence's 2024 Annual Report, Patchstack's State of WordPress Security in 2024, HTTP Archive's Web Almanac CMS chapter, Sucuri's threat research, Statista, and Automattic's most recent State of the Word.

CMS Market Share: Just How Dominant Is WordPress?

1. WordPress powers 43.4% of all websites on the internet.

W3Techs, which surveys the top 10 million websites by Tranco rank every day, reports WordPress is used by 43.4% of all websites as of early 2026. That share has crept up from 39.5% in 2021 and 43.1% a year ago, which means the platform is still growing in absolute terms even as the universe of websites itself expands. (W3Techs)

2. WordPress holds 62.7% of the CMS market.

Among sites that use any identifiable content management system, WordPress controls 62.7% of the market according to W3Techs. The next-closest competitor, Shopify, sits at 6.7%, followed by Wix at 3.9% and Squarespace at 3.2%. WordPress is more than 9 times the size of the second-place CMS. (W3Techs)

3. BuiltWith counts roughly 36 million live WordPress sites.

BuiltWith, which uses a different methodology focused on detected technologies across the live web, currently identifies around 36 million active WordPress sites and roughly 78 million historical installs. The discrepancy with W3Techs' percentage is partly methodology and partly the long tail of dormant installations, but both data sets put WordPress at an order of magnitude beyond any competitor. (BuiltWith)

4. WordPress sites account for roughly 36% of the top 1 million.

BuiltWith's segmentation of the top 1 million sites by traffic shows WordPress installed on about 36% of them, and on roughly 32% of the top 10,000. The platform's dominance is not just a long-tail phenomenon driven by hobby blogs. It scales surprisingly well into the highest-traffic tier of the web. (BuiltWith)

5. WordPress.com itself is among the 30 most-visited sites on the internet.

Statista and Similarweb data place WordPress.com inside the top 30 globally ranked properties by monthly visits, alongside Google, YouTube, Wikipedia, and the major social networks. That is just the hosted Automattic property, not the broader self-hosted footprint. (Statista)

6. WordPress's CMS share has grown every year since 2011.

W3Techs has tracked WordPress's CMS share continuously since 2011, when it was 13.1% of all sites. The platform has added share in every single annual snapshot since then, a 15-year unbroken run that no other CMS in the survey can match. (W3Techs)

WordPress.org vs WordPress.com

7. WordPress.com hosts roughly 70 million sites on the Automattic platform.

Automattic disclosures and the State of the Word 2024 confirm that WordPress.com hosts on the order of 70 million sites, though the company does not publish the exact count anymore. That is the managed, hosted half of the ecosystem. The self-hosted .org side, distributed across millions of independent web hosts, is what drives the 43.4% W3Techs share figure. (Automattic)

8. The WordPress.org software has been downloaded more than 2 billion times.

The official WordPress.org download counter currently shows total downloads of the core software exceeding 2 billion across all versions in the project's 22-year history. Major version 6.7 alone has been downloaded more than 80 million times since its release. (WordPress.org)

9. The most recent major release, WordPress 6.7, was downloaded 80 million times.

WordPress.org's release counters showed WordPress 6.7 (Rollins, released November 12, 2024) accumulating more than 80 million downloads in its first months on general release. WordPress 6.8 is the focus of the 2026 release cycle. (WordPress.org)

10. Around 53% of WordPress sites run a supported, up-to-date major version.

WordPress.org's public statistics page, which aggregates anonymous version pings from running installations, shows roughly 53% of detected sites on the latest two major releases, with about 4% still on versions older than 4.0. The long tail of outdated installs is a meaningful chunk of the security story below. (WordPress.org)

The Plugin Ecosystem

11. The WordPress.org plugin directory hosts more than 60,000 free plugins.

The official WordPress.org plugin directory contains more than 60,000 publicly listed free plugins as of 2026. That does not include the larger universe of paid plugins distributed through marketplaces like Envato's CodeCanyon or directly from independent developers. (WordPress.org)

12. Plugins in the official repo have been downloaded over 2.6 billion times.

WordPress.org's plugin directory cumulative download counter currently exceeds 2.6 billion all-time downloads across the public repository. Yoast SEO, the single most-downloaded plugin in the directory's history, accounts for more than 460 million of those downloads on its own. (WordPress.org)

13. The five most-installed plugins each have more than 5 million active installs.

WordPress.org's active install ranking shows Classic Editor, Yoast SEO, Contact Form 7, Akismet Anti-Spam, and Elementor each running on more than 5 million active sites. Classic Editor alone is reported at over 10 million active installs, a remarkable number for what is essentially a compatibility shim for the pre-Gutenberg editor. (WordPress.org)

14. The average WordPress site runs roughly 20 to 25 plugins.

HTTP Archive's 2024 Web Almanac CMS chapter, which crawls the top several million origins, found WordPress sites running a median of around 22 active plugins, with sites in the top decile running 40 or more. The plugin ecosystem is both WordPress's biggest competitive moat and its largest attack surface. (HTTP Archive)

15. WooCommerce alone is installed on more than 7 million WordPress sites.

BuiltWith's e-commerce tracker reports WooCommerce active on roughly 7.4 million live sites, with another 6 million historical installations in its database. Inside the WordPress ecosystem specifically, WooCommerce is by far the single most-deployed e-commerce plugin. (BuiltWith)

Themes, Block Editing, and Page Builders

16. The WordPress.org theme directory hosts more than 12,000 free themes.

The official WordPress.org theme directory currently lists more than 12,000 free themes, with several hundred of them tagged as block themes that fully support the Site Editor introduced with WordPress 5.9. The catalog grows by hundreds of new themes per year. (WordPress.org)

17. Block themes now ship as the default in every recent WordPress release.

Twenty Twenty-Five, the default theme bundled with WordPress 6.7, is the eighth consecutive default to be built as a block theme designed for the Full Site Editing experience. Block themes still make up a minority of total installs, but they are now the only kind of theme the WordPress project itself produces. (WordPress.org)

18. Elementor is the most-installed page builder, on roughly 16% of all WordPress sites.

BuiltWith tracks Elementor as the single most-installed page builder in the WordPress ecosystem, active on around 16% of all WordPress sites it detects, which works out to more than 5 million active installs in the WordPress.org directory alone. Divi, WPBakery, Beaver Builder, and Bricks follow at progressively smaller share. (BuiltWith)

19. The top three page builders collectively run on more than a third of WordPress sites.

HTTP Archive's 2024 Web Almanac found that Elementor, Divi, and WPBakery, the three largest page builders, are collectively detected on more than 35% of WordPress sites, a meaningful counterweight to Gutenberg adoption. The Block Editor is the default for new sites, but the installed base is still a hybrid world. (HTTP Archive)

20. Gutenberg block development drove a 27% rise in custom block plugins in 2024.

WordPress.org plugin directory data shows the count of plugins tagged with the gutenberg or blocks keyword grew about 27% between the end of 2023 and the end of 2024, an indication that the block ecosystem is maturing into its own subcategory of plugin development. (WordPress.org)

WooCommerce and E-commerce

21. WooCommerce powers roughly 36% of all online stores tracked by BuiltWith.

BuiltWith's e-commerce usage tracker puts WooCommerce at about 36% of all detected online stores, ahead of Shopify at roughly 21% and Wix Stores, Squarespace Commerce, and Magento well behind. On a site-count basis, WooCommerce is the most-deployed e-commerce platform on the web. (BuiltWith)

22. WooCommerce holds about 39% of e-commerce sites in the top 1 million.

Inside the top 1 million sites by traffic, BuiltWith shows WooCommerce installed on around 39% of detected e-commerce properties. Shopify leads in gross merchandise value but trails in raw site count, a divergence that has held steady for several years. (BuiltWith)

23. The WooCommerce plugin alone has more than 7 million active installs.

WordPress.org reports WooCommerce active on more than 7 million WordPress sites, with more than 245 million all-time downloads from the official repository. The plugin is now owned by Automattic and developed by a dedicated team of more than 100 engineers. (WordPress.org)

24. The WooCommerce extensions marketplace lists more than 800 official add-ons.

The WooCommerce extension marketplace, hosted on woocommerce.com, lists more than 800 official add-ons across categories including payments, shipping, subscriptions, bookings, and marketing. That is on top of the thousands of third-party WooCommerce-compatible plugins in the wider WordPress.org repository. (WooCommerce)

Security, Vulnerabilities, and Threats

25. Patchstack added 7,966 new WordPress vulnerabilities to its database in 2024.

Patchstack's State of WordPress Security in 2024 report disclosed 7,966 new vulnerabilities in the WordPress ecosystem over the course of the year, a 34% year-over-year increase from 5,948 in 2023. The growth reflects both more researchers actively hunting for issues and the expanding plugin surface itself. (Patchstack)

26. 97% of disclosed WordPress vulnerabilities in 2024 came from plugins.

Patchstack found that 97% of all WordPress vulnerabilities disclosed in 2024 originated in plugins, with another 2% in themes and only 0.2% in WordPress core itself. The pattern has held for years: the core project is comparatively well-audited, while the long tail of community plugins is where most issues hide. (Patchstack)

27. Wordfence blocked more than 67 billion malicious requests against WordPress sites in 2024.

Wordfence's 2024 Annual Report reported the firewall blocked more than 67 billion malicious requests against WordPress sites it protects, including over 1.7 billion credential-stuffing login attempts. The volume continues to grow year over year as automated attack tooling becomes cheaper. (Wordfence)

28. Sucuri found WordPress represented 95.6% of infected sites it cleaned.

Sucuri's most recent Website Threat Research Report found that WordPress accounted for 95.6% of all infected sites the company remediated, which is broadly proportional to WordPress's CMS market share but underscores that being the dominant platform also means being the dominant target. Out-of-date plugins were the most common entry vector. (Sucuri)

Performance and Core Web Vitals

29. 41.6% of WordPress sites passed all three Core Web Vitals in HTTP Archive's 2024 crawl.

HTTP Archive's 2024 Web Almanac CMS chapter found that 41.6% of WordPress sites passed all three Google Core Web Vitals (LCP, INP, and CLS) on mobile, up from 36.6% the year before. The CMS as a whole is improving its baseline performance faster than the rest of the web, partly thanks to native lazy-loading and the gradual rollout of more performant default themes. (HTTP Archive)

31. The average WordPress page weight grew to 2.6 MB on mobile in 2024.

The same HTTP Archive analysis put the median WordPress page weight on mobile at roughly 2.6 MB, with images accounting for around 1 MB of that on average. Page weight is still climbing year over year, which makes the Core Web Vitals improvement above all the more remarkable. (HTTP Archive)

32. Roughly 64% of WordPress sites now serve images in next-gen formats.

HTTP Archive found about 64% of WordPress sites are now serving at least some images in WebP or AVIF formats, up sharply from a few years ago. The adoption is driven by both core's native WebP support since 6.1 and the rise of plugin-based image optimization services. (HTTP Archive)

Frequently Asked Questions

WordPress in 2026 is doing something no other CMS has ever done: gaining share for the 15th consecutive year while serving roughly two out of every five active websites on the public internet. Its plugin ecosystem is larger, more downloaded, and more attacked than any competitor's, its e-commerce arm runs more stores than Shopify by site count, and its performance baseline is improving faster than the web average. For deal hunters and affiliate-site operators reading this on 99coupons.ai, those numbers translate into a simple reality: most of the merchant sites, blogs, and coupon destinations you visit this week are almost certainly running WordPress somewhere underneath, and the data above is the empirical case for why that probably is not changing any time soon.