The death of WordPress? What is really changing and what to do with your website

WordPress is not dead, but it has stopped growing

"WordPress is dead" is a headline that comes back every two or three years, and so far it has always been proved wrong. In 2026, though, the question is more serious: for the first time in twenty years WordPress's share is falling measurably, month after month.

There is no single reason. There is a governance crisis at the top of the project, plugin security that keeps getting more fragile, and artificial intelligence that is changing both how websites are built and how they are attacked. Our view: WordPress remains a sound tool for many websites, but it is no longer the default choice. Anyone with a company website today needs to decide, not inherit.

The numbers: from 43% to 40% in nine months

According to W3Techs, as of 1 October 2026 WordPress is used by 40.2% of all websites and by 58.7% of those with an identifiable CMS (eSEOspace on W3Techs data). It is still by far the most widely used: Shopify, in second place, stands at 5.4%.

WordPress's share of all websites, as measured by W3Techs on 1 January each year and on 1 October 2026 (eSEOspace on W3Techs data):

What matters is not the level but the direction. After ten years of growth and four of stagnation, in 2026 the curve is heading down, and Search Engine Journal counted six consecutive months of decline up to May (Shopifreaks). The HTTP Archive, which measures a different sample, sees the peak as early as July 2022 and a relative loss of 7% over four years (GravityKit).

One detail says a lot. The share WordPress has lost is not going mostly to its direct competitors: in the first half of 2026 Shopify and Wix together gained only a few tenths of a point, and more than half of the decline ends up among websites with "no CMS" (Smartworld). These are static, custom-built or AI-generated websites. Over the same period downloads of Astro, one of the most popular frameworks for such websites, more than doubled (Shopifreaks).

The cracks: governance, plugins, maintenance

Who runs the project. WordPress is open source, but its infrastructure (WordPress.org, the plugin directory, the updates) depends largely on Matt Mullenweg and Automattic, his company. Since September 2024 Automattic has been in litigation with WP Engine, one of the largest WordPress hosts: for weeks WP Engine customers could not update plugins through the official channels, until a judge ordered access to be restored (eSEOspace). In 2025 the project scaled back its releases, citing among other things the energy absorbed by the lawsuit. In September 2026 Automattic's board placed Mullenweg on forced leave, and he regained control within two weeks (Capmad); in the same days the court allowed WP Engine's antitrust claims to proceed. For a business, this means the tool its website rests on depends on a balance of power it does not control.

Plugins. The WordPress core is solid; the problem is what gets added to it. In 2025 Patchstack counted 11,334 new vulnerabilities in the ecosystem, 42% more than the year before: 91% in plugins, 9% in themes, and only 6 in the core, all of low severity (Patchstack). Three other figures from the same report carry more weight:

• 46% of vulnerabilities had no fix available yet when they were disclosed;
• for the most exploited flaws, the median time between disclosure and the first mass attacks is 5 hours;
• hosting providers' firewalls blocked only 26% of attacks in testing.

Updating often is still necessary, but on its own it is no longer enough.

Maintenance. A typical WordPress website is made up of core, theme, page builder and ten or twenty plugins from different authors, each with its own updates. Elementor alone runs on almost one WordPress website in three, and roughly one website in seven still runs on versions that are no longer fully supported (eSEOspace on W3Techs data). This work has a cost, often invisible until something breaks.

What the technical community says on Hacker News

On Hacker News, the Y Combinator forum popular with developers and startup founders, WordPress made the front page several times in 2026. Almost never for good news.

The backdoor case is the most instructive for anyone running a company website. A buyer paid a six-figure sum for a company that published more than 30 free plugins; the buyer's very first update already contained the backdoor, which then lay dormant for eight months. Once activated, it served spam pages only to Google, invisible to the website owner. WordPress.org closed all the plugins within a day, but the forced update did not clean up websites that were already infected (Anchor Hosting). The point: there is no check at all when a plugin changes hands.

The AI case changes the scale of the problem. The researcher estimates that an exploit of this kind is worth hundreds of thousands of dollars on the black market; with an AI subscription it cost the equivalent of 25 dollars (Searchlight Cyber). Two months later another critical flaw in the core arrived. Finding vulnerabilities has never been so cheap, and defenders have less time to patch.

In the comments a few recurring positions emerge:

• WordPress's value is the ecosystem, not the code. Many point out that businesses stay for WooCommerce, the themes and the ready-made integrations; a more modern CMS without those plugins does not replace it (EmDash discussion).
• Developers like static sites; content editors less so. More than one commenter describes marketing teams that, without a panel to publish on their own, ended up going back to WordPress.
• The new risks a new lock-in. Several users note that the security EmDash promises only works fully on Cloudflare's infrastructure.
• WordPress can be kept secure, with discipline. Those who run it well describe the same recipe: few plugins from reliable authors, automatic updates, and a server that cannot connect to unauthorised external addresses (backdoor discussion).
• The problem is not WordPress's alone. The same pattern, third-party dependencies that nobody checks, applies to npm, browser extensions and every package ecosystem.

AI is changing how websites are made

For twenty years WordPress won because it let anyone have a website without writing code. AI is eroding exactly that advantage: today a fast, bespoke website can be generated in a few hours, and maintaining code weighs less than it used to. Three trends point the same way.

• Static sites and modern frameworks. Tools such as Astro produce ready-made HTML pages, with no database to query on every visit and therefore a much smaller attack surface. Their downloads doubled in a few months (Shopifreaks).
• CMSs designed for AI. Cloudflare's EmDash, built with AI agents in two months, isolates each plugin and grants it only the permissions it declares. It includes an MCP server and tools so that an agent can manage content, and it imports an existing WordPress website in a few minutes (Cloudflare). It is still a preview release, but it shows the direction.
• WordPress as the "engine" behind the scenes. Patchstack notes that many agencies use WordPress only to manage content and have AI generate the actual website (Patchstack). WordPress stays, but becomes invisible, and market trackers stop counting it.

Then there is a new audience: the AI assistants that read websites to answer people's questions. Lightweight, well-structured pages with clear data are easier to cite. A website weighed down by page builders and third-party scripts starts at a disadvantage.

AI does not solve everything, though: the same tool that generates a website in an hour also generates vulnerable code if nobody reviews it. Moving away from WordPress also means giving up an ecosystem that, for better or worse, updates the pieces for you.

Not just stay or leave: WordPress done differently

Between "classic" WordPress, installed and updated from the admin panel, and abandoning it altogether, there are two middle paths. They are the ones many professional developers use, and they address precisely the problems covered so far.

Bedrock: WordPress managed as an application

Bedrock is an open source project structure created by Roots, inspired by the principles of modern web applications. WordPress stays the same; what changes is how it is built and deployed:

• Core, themes and plugins become declared dependencies. They are listed in a file with exact versions and installed with Composer, PHP's package manager. The website is reproducible: the same file produces the same website in development, staging and production.
• The code is under version control. Every change goes through Git, can be reviewed before going live and can be rolled back.
• Separate configuration per environment. Passwords and keys live in environment files, outside the website's public folder; the server exposes only what is needed.
• No installs from the admin panel. As a rule, plugins cannot be added or modified from wp-admin in production: a stolen account is not enough to upload new code.

Against the risks described in this article, the benefit is tangible. A plugin that changes hands and fills up with malware does not reach production on its own: the update goes through a developer, a staging environment and a review of the changes. The flip side is that security fixes also have to be applied actively, and someone needs to do it every week.

This part of the ecosystem was also caught up in the tensions of 2026. In March WP Engine acquired WPackagist, the repository from which most Composer projects pulled WordPress.org plugins; within days Roots responded with an independent, community-funded alternative repository (Codeboxr).

Bedrock makes sense for websites that matter: news outlets, portals, e-commerce, websites with many people working on them. We use it ourselves, for example on a high-traffic news website we manage, where every update goes through a staging environment before going live. For a small brochure website it is often more structure than needed.

Headless WordPress: the admin panel stays, the website changes

In a headless architecture WordPress becomes just the "back office". Editorial and marketing teams keep using wp-admin as always, while the public website is a separate application, usually built with Astro or Next.js, that reads the content through the WordPress APIs.

In 2026 this path is more mature than before. WPGraphQL, the most widely used plugin for exposing content, has become a canonical plugin of the WordPress project; Astro moved under Cloudflare in January and released version 6 in March (Forminit).

The benefits:

• Speed. The public website can be made of static pages served from a global network, with no PHP or database on every visit.
• Smaller attack surface. The WordPress admin panel is no longer exposed to the public and can sit behind a VPN or an allowlist of addresses. Visitors to the website do not see WordPress.
• One piece of content, several channels. The same content can feed the website, apps and other services.

The costs, often underestimated:

• Two systems to maintain instead of one, with two hosting setups and two update cycles.
• More complicated previews. WordPress's "Preview" button does not work on its own and has to be rebuilt.
• Many plugins stop working. Page builders such as Elementor or Divi, galleries, sliders and contact forms produce HTML that the new website does not use; they have to be replaced (Gautam Khorana).
• Upfront investment. A migration of a 400-page B2B website described by a British agency took 11 weeks and around 90,000 dollars (Gautam Khorana).

The same source is clear about when not to do it: large newsrooms that publish a lot, technical teams of one or two people, websites that are already fast enough. For an SME's brochure website, a pure static site is usually simpler and cheaper. Headless pays off when you want to keep WordPress and its editorial habits, but the public website needs to be much faster and more secure.

Stay on WordPress or move: a grid to help you decide

There is no answer that suits everyone. For most SMEs the choice depends on what the website does and who updates it. Each row of the table leans one way or the other.

If most answers fall on the left, well-managed WordPress remains a sensible choice. If they fall on the right, a static site or a lighter CMS reduces costs and risks. In between are the two middle paths: Bedrock if the website is important and you want to keep it on WordPress with more control, headless if you want to keep the admin panel but make the public website static and fast.

What to do today with your WordPress website

Whether you decide to stay or to move, the first steps are the same and take a few weeks.

1. 01

   Take inventory

   WordPress version, theme, page builder, list of plugins with author and date of last update. This is where many websites discover forgotten or abandoned plugins.

2. 02

   Remove what you don't need

   Every plugin deactivated and deleted is one risk fewer. Also check that none of your plugins has recently changed owner.

3. 03

   Update and protect

   Core always on the latest version, automatic updates where possible, two-factor authentication for logins, no shared administrator accounts.

4. 04

   Close outbound doors

   The website's server should not be able to connect to unnecessary external addresses: that is how the backdoor in the 30 plugins received its orders.

5. 05

   Test your backups

   Having them is not enough: try a restore. And check the configuration files, where modern malware tends to hide.

6. 06

   Measure

   Mobile speed, visibility in search results and AI answers, hours and cost of maintenance per year.

7. 07

   Decide with the grid

   With the data in hand, the choice between looking after the current website and rebuilding it becomes a decision, not a habit.

At Cloudfactory we look after dozens of WordPress websites for businesses and professional firms every day, and we know both its strengths and the work it takes to keep it secure. In recent months we have also moved some projects, starting with our own, to static sites built with AI. That is why we have no single solution to sell: we help you work out which path makes sense, secure whatever stays on WordPress and see the migration through when it is worthwhile.

If you want to know what state your website is in, get in touch: we start with a check and tell you frankly whether it is worth looking after, slimming down or rebuilding.

How we wrote this article

At Cloudfactory we also use artificial intelligence in our editorial work: it helps us search for and cross-check sources, compare data, set up the structure and polish the language. The system we use is configured by us, with instructions, examples and procedures built around the way we write. Our team checked every source, edited the text and approved the published version. The assessments and choices are Cloudfactory's, and we are accountable for them.

Frequently asked questions

Sources

1. eSEOspace, WordPress Market Share in 2026 (W3Techs data)
2. GravityKit, WordPress market share 2026 (HTTP Archive data)
3. Shopifreaks, WordPress loses share for six consecutive months
4. Smartworld, WordPress declining in 2026 (in Italian)
5. eSEOspace, The WP Engine and Automattic Dispute Explained
6. Capmad, Automattic's board places Mullenweg on leave
7. Patchstack, State of WordPress Security in 2026
8. Anchor Hosting, Someone Bought 30 WordPress Plugins and Planted a Backdoor
9. Searchlight Cyber, WordPress RCE found with AI
10. WordPress, advisory GHSA-7hp8-65ch-5whp (CVE-2026-87902)
11. Cloudflare, Introducing EmDash
12. Bedrock by Roots (Packagist)
13. Codeboxr, WPackagist vs WP Composer
14. Forminit, Headless WordPress in 2026
15. Gautam Khorana, Headless WordPress 2026: the complete practical guide
16. Hacker News, the backdoor in 30 plugins
17. Hacker News, EmDash
18. Hacker News, RCE found with AI
19. Hacker News, the September core flaw