41% of Websites Run on WordPress in 2026

WordPress ran 41.2% of all websites and 59.1% of websites with a known content management system as of July 30, 2026, according to W3Techs’ continuously updated web technology survey. That is down slightly from 61.0% a year earlier, but WordPress still runs more of the web than every other tracked platform combined.

How much of the web actually runs on WordPress?

W3Techs tracks the technology stack of millions of websites and updates its figures daily. As of July 30, 2026, WordPress accounted for 41.2% of every website in that survey, and 59.1% of the narrower group of websites where W3Techs could identify a content management system at all. The gap between those two numbers matters: 30.4% of all websites use no CMS that W3Techs monitors, either because they are custom-coded, hand-built, or running a platform too small to track.

Within the CMS-identified slice of the web, WordPress is not just the leader, it is close to a majority on its own. No other platform clears single digits of overall web share, which is part of why WordPress remains the default answer whenever someone asks what software runs “most of the internet.”

Is WordPress gaining or losing ground in 2026?

Losing a little, slowly. W3Techs’ rolling trend data shows WordPress’s share of CMS-identified websites easing from 61.0% in July 2025 down to 59.1% by July 30, 2026, a drop of about two points over thirteen months. The decline has been gradual and consistent month over month rather than a single sharp drop.

Figure 1: WordPress’s monthly share of websites with a known CMS, sampled every three months. Source: W3Techs, Content Management System Market Share trend data, as of July 30, 2026.

As of July 2026 that erosion is showing up almost entirely as small gains for Shopify, Wix, and Squarespace rather than any single competitor overtaking WordPress. None of the three has come close to touching WordPress’s overall lead, since even Shopify’s 5.3% of all websites is a fraction of WordPress’s 41.2%.

How does the rest of the CMS market break down?

Outside WordPress, the CMS market fragments quickly. Shopify sits second at 7.6% of CMS-identified sites, Wix third at 6.1%, and Squarespace fourth at 3.5%, with Joomla and a long tail of smaller platforms splitting most of what remains.

Figure 2: Share of CMS-identified websites by platform. Source: W3Techs, Usage Statistics and Market Share of Content Management Systems, as of July 30, 2026.

For our full breakdown of who runs a website at all and who does not, see our small business website adoption data. A dedicated look at how much of that overall footprint comes through drag-and-drop website builders specifically, rather than a self-hosted platform like WordPress, is not yet published on this site.

How dominant is WooCommerce in ecommerce?

WooCommerce, WordPress’s native ecommerce plugin, is the single largest ecommerce platform W3Techs tracks by a wide margin. As of July 30, 2026, WooCommerce runs 48.4% of all ecommerce systems in W3Techs’ survey, comfortably ahead of Shopify’s 31.2%.

Platform	% of all websites	% of CMS-known sites	% of ecommerce systems
WordPress	41.2%	59.1%	48.4% (via WooCommerce)
Shopify	5.3%	7.6%	31.2%
Wix	4.3%	6.1%	not separately disclosed
Squarespace	2.5%	3.5%	not separately disclosed

Source: W3Techs, Usage Statistics and Market Share, as of July 30, 2026.

WooCommerce runs on the WordPress content model rather than as a standalone hosted product, which is part of why its ecommerce share tracks closely with plugin and page-builder choices rather than a single vendor’s roadmap. Businesses budgeting for that kind of build should also see our website cost breakdown for 2026, since ecommerce features are consistently the line item that moves a WordPress build’s price the most.

Which plugins and page builders run most WordPress sites?

Among sites that run WordPress, one page builder and one ecommerce plugin stand out well above the rest. Elementor is installed on 31.5% of WordPress sites, WooCommerce on 19.8%, and WPBakery on 7.5%, according to W3Techs’ subtechnology tracking within its WordPress survey.

Tool	Category	Share of WordPress sites
Elementor	Page builder	31.5%
WooCommerce	Ecommerce plugin	19.8%
WPBakery	Page builder	7.5%

Source: W3Techs, Usage Statistics of Elementor, WooCommerce, and WPBakery for Websites Using WordPress, as of July 30, 2026.

That concentration matters for anyone assessing WordPress plugin risk, because a handful of widely installed tools carry an outsized share of the ecosystem’s overall attack surface, a pattern the vulnerability data below confirms directly.

How secure is the WordPress plugin ecosystem?

Less secure than a year earlier, and the plugin layer is where nearly all of the exposure sits. Patchstack and Monarx’s State of WordPress Security in 2026 report, published February 25, 2026 and covering 2025 disclosures, logged 11,334 new vulnerabilities across the WordPress ecosystem that year, a 42% increase over 2024. Of those, 1,966 (17%) were high-severity issues carrying mass-exploitation risk.

Figure 3: Share of 2025’s 11,334 disclosed vulnerabilities by source, rounded. Core accounted for just 6 of the 11,334 total. Source: Patchstack and Monarx, State of WordPress Security in 2026, published February 25, 2026.

Premium and freemium plugins carried a disproportionate share of real-world risk: they made up 29% of 2025’s vulnerability reports, but 76% of premium-plugin vulnerabilities were confirmed exploited in the wild, roughly three times the known-exploited rate of free plugins. Attackers moved fast once a flaw went public, too. The report puts the median time to exploitation of a high-impact vulnerability at 5 hours, with about half exploited within 24 hours of disclosure, and 46% of disclosed vulnerabilities had no developer patch available at the time they were published.

Does a WordPress site need a privacy policy?

Almost always, yes. WordPress core has shipped a built-in tool for building a Privacy Policy page under Settings > Privacy since 2018, added specifically ahead of the EU’s May 2018 GDPR enforcement deadline, according to WordPress.org’s own documentation. The tool drafts starter language based on GDPR’s disclosure expectations and pulls in default text from core, themes, and participating plugins, but WordPress.org is explicit that site owners are responsible for writing a complete, accurate policy on top of that starting point.

Figure 4: A minimum decision test for what a WordPress site’s privacy policy needs to cover. Source: synthesized from WordPress.org’s Privacy documentation above.

Given that 19.8% of WordPress sites run WooCommerce and Elementor alone sits on 31.5% of WordPress sites, most page builders and checkout tools, most WordPress installs are collecting some form of personal data even before a site owner adds analytics or a newsletter signup. A Privacy Policy Generator that walks through what a site actually collects, rather than relying only on WordPress core’s generic starter text, closes the gap between the default prompts and what a specific site’s forms, comments, and checkout flow are really doing with visitor data.

How has the WordPress ecosystem evolved since GDPR?

The last eight years moved WordPress from a platform that had to catch up to privacy law to one dealing with a maturing, high-volume vulnerability disclosure pipeline instead.

Figure 5: Three dated milestones spanning WordPress’s privacy tooling and current security posture. Sources: WordPress.org documentation; Patchstack and Monarx, State of WordPress Security in 2026; W3Techs version distribution data, as of July 30, 2026.

Version adoption has moved quickly too. Version 7 already runs 53.0% of WordPress sites, version 6 runs 39.6%, version 5 runs 5.1%, and everything older than that combines for roughly 2.3%, per W3Techs. That pace of upgrading matters directly for security, since Patchstack’s data shows 46% of 2025’s disclosed vulnerabilities had no patch available at publication time, which makes staying current one of the few defenses a site owner fully controls.

How does WordPress compare to Shopify, Wix, and Squarespace at a glance?

Positioned on overall web reach against share of the narrower CMS-identified market, WordPress sits alone in the top right, while every other tracked platform clusters in a tight band well below it.

Figure 6: Positioning by percentage of all websites (x-axis) and percentage of CMS-identified websites (y-axis), each normalized against WordPress’s own figures. Source: W3Techs, as of July 30, 2026.

That gap is a big part of why WordPress remains the default recommendation across so much of the web hosting and agency industry: no single rival platform is close enough on either axis to be a like-for-like substitute at WordPress’s scale.

The Bottom Line

WordPress still runs more of the web than every other tracked content management system combined, at 41.2% of all websites and 59.1% of websites with a known CMS as of July 30, 2026. That lead is shrinking, not growing, down from 61.0% of the CMS market a year earlier, but the platforms picking up share are doing so a fraction of a point at a time. The bigger story for 2026 is what runs on top of that base: WooCommerce alone accounts for 48.4% of all tracked ecommerce systems, plugin vulnerabilities jumped 42% year over year to 11,334 disclosures, and 91% of those came from the plugin layer, not WordPress core itself. Any site owner running WordPress, especially one running WooCommerce, comments, or contact forms, is collecting personal data that needs disclosing. A Privacy Policy Generator built for what a specific site actually collects is a faster and more complete starting point than WordPress core’s generic GDPR-era template alone.

Frequently Asked Questions

What percentage of websites use WordPress? 41.2% of all websites and 59.1% of websites with a known content management system run on WordPress, as of July 30, 2026, according to W3Techs’ continuously updated web technology survey.

Is WordPress losing market share in 2026? Yes, slightly. WordPress’s share of the CMS-identified market slipped from 61.0% in July 2025 to 59.1% a year later in July 2026, per W3Techs, as Shopify, Wix, and Squarespace each gained a fraction of a point.

How much of the ecommerce market runs on WooCommerce? WooCommerce, WordPress’s ecommerce plugin, runs 48.4% of all ecommerce systems W3Techs tracks as of July 2026, more than Shopify’s 31.2% share.

How many WordPress vulnerabilities were found in 2025? Security researchers logged 11,334 new vulnerabilities across the WordPress ecosystem in 2025, a 42% increase year over year, with 91% originating in plugins, according to Patchstack and Monarx’s State of WordPress Security in 2026 report.

Does a WordPress site need a privacy policy? Yes. WordPress core has shipped a built-in Privacy Policy page tool under Settings > Privacy since 2018, added ahead of the EU’s GDPR deadline, and any WordPress site that runs comments, contact forms, or WooCommerce checkout collects personal data that a privacy policy needs to disclose.

Sources and References

1. W3Techs. “Usage Statistics and Market Share of Content Management Systems.” Retrieved July 30, 2026.
2. W3Techs. “Usage Statistics and Market Share of WordPress.” Retrieved July 30, 2026.
3. W3Techs. “Usage Statistics and Market Share of WooCommerce.” Retrieved July 30, 2026.
4. W3Techs. “Usage Statistics and Market Share of Shopify.” Retrieved July 30, 2026.
5. Patchstack and Monarx. “State of WordPress Security in 2026.” Published February 25, 2026, covering vulnerabilities disclosed in 2025.
6. WordPress.org Documentation. “WordPress Privacy.”

Note: All figures verified as of July 2026. W3Techs’ market share figures are a rolling, continuously updated survey rather than a fixed-date report; the July 30, 2026 timestamp reflects the most recent snapshot available at time of writing. WordPress market share and security figures are refreshed at least twice a year.