WordPress powers 39.6% of the web. In August 2025 that number was 43.4%. The 3.8 percentage point drop in fourteen months is the first sustained decline in the platform’s two-decade history. 1 Source 1 W3Techs, retrieved 20 August 2026 and 19 October 2026. Same period: Shopify 4.8% to 5.3%, Wix 3.9% to 4.2%, no-CMS category 28.6% to 32.1%. w3techs.com
The platform also carries a performance tax that hits the bottom line directly. Only about half of WordPress sites pass Google’s mobile speed bar, and the shortfall is concentrated in how fast the page first paints, the moment that decides whether a visitor stays. 2 Source 2 HTTP Archive Core Web Vitals Technology Report, July 2026 data, read 20 August 2026: 49% of WordPress sites pass Core Web Vitals on mobile against 53% for the web overall; good LCP 56% against 65%. httparchive.org/reports/techreport/tech?tech=WordPress If your site sits on the wrong side of that bar, the pipeline cost is real, it compounds every quarter you leave it unaddressed, and the five causes behind it are known and mostly cheap to fix.
This is not a developer trend story. What’s new is the C-suite conversation: CFOs auditing infrastructure costs they assumed were negligible, CEOs adding WordPress to risk registers for the first time, CMOs asking why campaign velocity is stuck when the agency keeps blaming the platform. The migration conversation has moved from the engineering backlog to the quarterly business review. It is the same conversation companies are having about every renewal on the stack, because your CMS is a SaaS product whatever its license says.
This piece maps the three structural failures driving that conversation and routes to the deep dives in our Rethinking WordPress cluster, from the security and cost analyses to a scored decision framework. Start wherever your pain is most acute.
Is WordPress losing market share?
Yes. WordPress fell from 43.4% of all websites in August 2025 to 40.7% in August 2026, and to 39.6% by mid-October: a 3.8 percentage point drop in fourteen months and the first sustained decline the platform has recorded. The pace picked up in the autumn, with 2.7 points lost in the first twelve months and another 1.1 in the nine weeks after. Two decades of steady gains preceded it. That record is over.
The share isn’t bleeding to one rival. It’s redistributing across several at once:
- Hosted site builders are taking the simple end. Over the same period, Shopify moved from 4.8% to 5.3% and Wix from 3.9% to 4.2%.
- The “no CMS” category is now the second-largest bucket. It grew from 28.6% to 32.1% of all measured sites: sites with no traditional content layer at all, including the headless and static architectures companies migrate to, plus sites whose CMS can’t be detected.
| Share of all websites | August 2025 | August 2026 | October 2026 |
|---|---|---|---|
| WordPress | 43.4% | 40.7% | 39.6% |
| WordPress, share of CMS-known sites | 60.2% | 59.0% | 58.4% |
| No CMS detected | 28.6% | 30.9% | 32.1% |
| Shopify | 4.8% | 5.3% | 5.3% |
| Wix | 3.9% | 4.2% | 4.2% |
Source: W3Techs, read 20 August 2026 and 19 October 2026.
One caveat worth knowing before you quote the number. W3Techs introduced new CMS survey categories on 30 March 2026, and roughly two-thirds of the twelve-month decline falls after that change, so some of the movement may be better detection rather than departures. What that caveat does not explain away is WordPress’s share of the CMS market specifically, which fell from 60.2% to 59.0% over the twelve months and to 58.4% by October, and has declined every year since its 2022 peak. Both measures point the same direction. The decline is real; the exact slope deserves a year of confirmation.
The most revealing number comes from BuiltWith, a service that tracks the technology behind every site it can reach. More than half of all the sites that ever ran WordPress have since left it. 3 Source 3 BuiltWith, WordPress Usage Statistics, retrieved 20 August 2026. 85.2M sites have run WordPress at some point; 38.0M are still running it; 47.2M no longer are, for reasons ranging from migration to rebuild to business closure. trends.builtwith.com/cms/WordPress Of the 85.2 million that ever ran it, 38.0 million are still running it today. The other 47.2 million moved on for reasons ranging from genuine migration to outright business closure.
More than half of all sites that ever chose WordPress are no longer running it. The churn is not new. The rate is.
A platform with 39.6% global share is not failing. What’s changed is that the decade-long assumption (WordPress as the safe, low-risk default for a corporate or marketing site) is now a testable claim rather than an obvious truth. That reassessment is not confined to CMS platforms either; it’s the same repricing running through the whole SaaS category.
Why are companies re-evaluating WordPress?
Three structural failures, not developer preferences: governance (one person controls the update channel and has already used it in a commercial dispute), security debt (11,334 new ecosystem vulnerabilities in 2025, nearly half of them public before a patch existed), and hidden total cost of ownership ($44,400 to $148,500 a year, split across eight to twelve vendors so no invoice shows the total).
The public narrative blames developer preferences. That explains which platform a company migrates to. It doesn’t explain why the CFO signed off on the migration budget.
The governance failure
WordPress.org is not governed by a neutral foundation with override authority. In October 2024, its effective controller seized the Advanced Custom Fields plugin (one of the most installed in the ecosystem, running on millions of sites) and delivered a fork through the automatic update mechanism. The same channel enterprises rely on for security patches delivered unauthorized code for commercial reasons. A federal court had to intervene with a preliminary injunction. 4 Source 4 TechCrunch, “In latest move against WP Engine, WordPress takes control of ACF plug-in,” October 12, 2024. Federal court preliminary injunction: WPEngine, Inc. v. Automattic Inc., N.D. Cal., No. 3:24-cv-06917. techcrunch.com/2024/10/12/in-latest-move-against-wp-engine-wordpress-takes-control-of-acf-plugin/
No enterprise risk framework accounts for a CMS platform operator as a supply chain threat actor. WordPress proved it should.
The financial exposure from a governance event like this is unbounded. It depends entirely on which plugins are affected and what those plugins control. That’s why it belongs on the risk register before something happens, not after.
The security debt
The WordPress ecosystem logged 11,334 new vulnerabilities in 2025, a 42% year-over-year increase, and almost all of them came from the plugins you bolt on rather than WordPress itself. 5 Source 5 Patchstack, State of WordPress Security 2026. 11,334 new vulnerabilities (CVEs) in 2025; 42% YoY increase; 91% in plugins, not core; 46% of new vulnerabilities had no patch available at public disclosure; window between disclosure and active exploitation measured in hours. patchstack.com/whitepaper/state-of-wordpress-security-in-2026/ Nearly half of those new flaws went public with no fix available, and the gap between a vulnerability becoming public and being actively exploited is measured in hours, not days.
A mid-market site running 20 to 30 plugins, which is normal, carries 20 to 30 independent patch schedules, 20 to 30 vendors with no contractual SLA obligation, and 20 to 30 separate exposure windows where a published CVE is actionable before the fix arrives.
The EU Cyber Resilience Act (a European law holding software makers legally accountable for security flaws) added a compliance layer on September 11, 2026. Since that date, commercial plugin developers must report actively exploited vulnerabilities to EU authorities within 24 hours. A plugin that fails to meet that obligation can be ordered removed from distribution platforms, potentially forcing emergency uninstalls across every site running it. Your site’s stability depends on vendors meeting compliance requirements they may not have the resources to fulfill.
Read the security analysis: 11,334 new WordPress vulnerabilities in one year, and the reporting deadline attached to them
The hidden TCO
WordPress.org is free to download. Running it at mid-market scale is not. The cost is distributed across 8 to 12 vendors with no single invoice showing the aggregate. That’s why “WordPress is free” persists as a budget assumption years after it stopped being accurate.
Mid-market WordPress total cost of ownership (TCO), meaning the full annual spend across every vendor in the stack, runs $44,400 to $148,500 per year for a company running roughly ten sites and properties. The five buckets it hides in:
- Managed hosting: $4,800 to $24,000
- Premium plugins: $2,000 to $6,000
- Security tools: $400 to $1,500
- Developer maintenance: $7,200 to $27,000
- Agency support: $30,000 to $90,000
A modern static site deployed to a usage-based host typically costs $0 to $600 per year in hosting, with minimal security overhead. A headless CMS paired with a modern frontend adds $1,200 to $6,000 per year. The “free” CMS is often the most expensive infrastructure your company runs.
Read the line-by-line breakdown: The Real Cost of WordPress
What the decision actually looks like
The governance, security, and cost failures don’t automatically mean leaving WordPress is the right call. They mean the decision deserves a structured evaluation, not a panic response to a breach and not “this is what we’ve always run.”
The right framework evaluates six dimensions against your situation: actual performance against your pipeline, real total cost (not assumed), security exposure relative to your regulatory environment, governance dependency risk, talent availability, and content velocity versus the campaign calendar. Those six factors produce a scored output: stay, modernize, migrate, or treat it as urgent.
On our own price list, a straightforward single-site move starts at $10,000, a redesign starts at $25,000, and a multi-site estate runs $50,000 to $120,000, phased. Under $30,000 per year in total WordPress costs with a stable site and a small team, switching costs rarely pencil out quickly. Over $80,000 per year, the comparison math is worth running formally, because a bill that size can repay a one-time move from savings alone. Any governance event or breach should trigger an immediate audit regardless of cost.
Timelines matter to that math, so plan them honestly. In our migration work, a single site under 500 pages on a standard plugin stack runs 3 to 6 months from decision to launch, multi-site or heavily customized estates run 6 to 12, and the evaluation itself takes 4 to 8 weeks before any development starts.
In 16 years as a HubSpot partner, across more than 2,000 platform projects, the pattern we saw most often was not a bad platform decision. It was a decision nobody had priced, because the invoices lived in eight or ten different places and no one had ever assembled them into a single view. The migration conversation doesn’t start with technology. It starts with that number.
Run the evaluation: Should You Leave WordPress? A Six-Factor Evaluation to Decide with Data
This article is the entry point for Rethinking WordPress, Lynton’s cluster on the true cost of the web’s default CMS. It is not a case for leaving. It’s a case for looking. Each companion piece goes deep on one dimension: security debt, hidden TCO, site speed, and the migration decision framework.
The research is free. So is the diagnosis. 60 seconds →