Sometimes. WordPress still runs about 59% of sites with a known CMS and shipped AI features in version 7.0, but plugins carried 91% of 2025's 11,334 new WordPress vulnerabilities and only 45% of WordPress sites pass Core Web Vitals on mobile. Choose it for a trained publishing team, not by default.
WordPress is still the right choice for a business whose trained team publishes often and relies on its plugin ecosystem, provided someone keeps the site lean and updated. It is no longer the automatic choice for a typical small business site of a few dozen pages that must be fast, secure and cheap to maintain. The core software is solid; the risks come from the plugins, themes and page builders stacked on top of it.
That is an honest verdict, not an obituary. Here is the evidence as of June 2026, and a way to decide for your own business.
- of websites with a known CMS run WordPress (W3Techs, 1 June 2026)
- 59.4%
- of websites with a known CMS run WordPress (W3Techs, 1 June 2026)
- new vulnerabilities found in the WordPress ecosystem in 2025, up 42% on 2024
- 11,334
- new vulnerabilities found in the WordPress ecosystem in 2025, up 42% on 2024
- of those were in plugins; core produced six low-priority reports
- 91%
- of those were in plugins; core produced six low-priority reports
- of WordPress sites pass Core Web Vitals on mobile, against 74% for Wix
- 45%
- of WordPress sites pass Core Web Vitals on mobile, against 74% for Wix
01
Where WordPress stands in mid-2026
By W3Techs' count, WordPress ran 41.9% of all websites on 1 June 2026, and 59.4% of the sites whose CMS it can identify. Nothing else comes close: Shopify held 7.4% of that CMS market and Wix 6.1%. The trend, though, is gently downward. In October 2025 WordPress ran 43.3% of all sites and held 60.7% of the CMS market, and since then the share of sites with no detectable CMS has risen from 28.6% to 29.5%.
The software itself is moving faster than its reputation suggests. WordPress 6.9 arrived in December 2025 with notes that editors can attach to individual blocks and an Abilities API that lays groundwork for AI tools. WordPress 7.0, released on 20 May 2026 by more than 875 contributors, put an AI client into the core software, added a single screen for managing connections to outside services, and brought a refreshed admin dashboard with a new colour scheme and a visual revision browser. A companion AI plugin drafts titles and excerpts, generates and edits images, and suggests alt text.
Two older strengths are easy to overlook. WordPress is available in more than 200 languages, with over 70 fully translated for the 7.0 release, which matters to teams that do not work only in English. And with nearly three in five CMS-built sites running it, finding a developer or host who knows WordPress is rarely the hard part.
02
The real risk is the plugin layer
Patchstack, which coordinates and publishes WordPress vulnerability reports, recorded 11,334 new vulnerabilities across the ecosystem in 2025, 42% more than in 2024. Plugins accounted for 91% and themes for 9%. WordPress core produced just six reports, all rated low priority.
Two further findings matter more for a business. Patchstack found that 46% of vulnerabilities had no fix from their developer by the time they became public, so automatic updates alone could not have closed them. And for the most heavily exploited flaws, the weighted median time to the first attack was five hours.
The practical reading is simple. Your exposure grows with every plugin you install, because each one adds its own stream of reports and patches. The fewer plugins a site runs, the fewer of those 11,334 reports can ever apply to it.
03
Speed: configuration, not core
The HTTP Archive's 2025 Web Almanac, published in January 2026, found that 45% of WordPress sites had good Core Web Vitals on mobile, leaving WordPress among the lowest-ranked of the major platforms. Wix reached 74%. Median Lighthouse performance scores on mobile told the same story: 41 for WordPress against 64 for Wix.
WordPress performance variance is driven more by configuration than by core limitations.
The Almanac's authors trace the spread in page weight less to core than to the accumulated load of themes, plugins, page builders and third-party tools. Page builders stand out: the chapter notes that they often add complex page structures and heavier CSS and JavaScript. In plain terms, a lean WordPress site on decent hosting can be quick, while one assembled from a heavy page builder and a long list of plugins often is not. Slow pages cost enquiries, as our page speed piece shows.
04
AI answers: WordPress is not the problem
You may hear that WordPress markup is hard for AI answer engines to read. The evidence does not support it. WordPress delivers finished HTML: each block's markup is either saved when you publish or built on the server when the page is requested. Vercel's December 2024 study of AI crawler traffic found that none of the major AI crawlers ran JavaScript, apart from Google's Gemini, which uses Googlebot's infrastructure, and Apple's crawler. OpenAI's and Anthropic's crawlers fetched JavaScript files without executing them. Sites that build their content in the visitor's browser are the ones at risk of looking empty.
What matters for AI answers is the same on any platform: clear headings, answers stated plainly, and accurate structured data about your business. If your WordPress markup comes from a theme or plugin, that brings the argument back to keeping both lean. Our guide to the schema markup that matters covers what to include.
05
A decision guide
Instead of asking whether WordPress is good or bad, ask what your site has to do and who will run it.
| Your situation | Why | Sensible choice |
|---|---|---|
| A trained team publishes several times a week and relies on specific plugins | The editor and the ecosystem earn their keep | WordPress, kept lean |
| Twenty to fifty pages, edited now and then; speed and security come first | Pages built in advance leave little to maintain | A pre-rendered site, with content files or a headless CMS |
| You sell online and have little technical help | The platform hosts and maintains the software for you | A hosted platform such as Shopify |
| An existing WordPress site that is slow but working | A rebuild is not always the cheapest fix | Audit and trim plugins, then decide |
For the second row, our piece on when a headless CMS is worth it goes deeper, and what a website costs in India helps with the budget.
06
If you stay on WordPress, or are choosing it now
Most of WordPress's risk sits in the upkeep, so habits matter more than the platform. Six of them cover most of it:
- Update core, themes and plugins every week, and switch on automatic updates for the plugins and themes you trust. WordPress has offered them since version 5.5, though some hosts turn them off. Security releases can arrive with little warning: WordPress shipped two in two days in March 2026, the second because some of the first one's fixes had not been fully applied.
- Run a supported PHP version. WordPress recommends PHP 8.3 or newer. It still runs on PHP 7.4 and later, but warns that versions that old have reached end of life and can expose your site to security flaws.
- Audit plugins every quarter. Delete anything unused and replace anything unmaintained, ideally as part of a quarterly website audit.
- Think twice about heavy page builders on any rebuild. Consider the block editor and a light theme first.
- Measure Core Web Vitals from real visitors, not a one-off lab test.
- Keep off-site backups and test a restore. A backup you have never restored is a hope, not a plan.
Whichever platform you choose, speed, structured data and update discipline decide the result far more than the logo on the admin screen. If you are unsure whether to keep, trim or replace your current site, a free audit will give you a straight answer.
Sources
Facts current as of 26 June 2026.