Breaking down the numbers: WordPress' dominance on the web

With its roots as a blogging platform, WordPress dominates the .blog top-level domain (TLD): 84% of .blog domains are created with WordPress. But, due to its versatility, including a range of themes, plugins and an ever-growing community of developers, WordPress has a wide appeal to all kinds of website creators. Nowadays, WordPress-powered websites have a large share among all TLDs. In Figure 1, you can see the percentage of domains by TLD that were created with WordPress. Among .nl, 43% of domains are WordPress built, .br has 35%, and nearly a third of all .com domains also use WordPress.

In today's digital age, having a website is crucial for any business. WordPress is especially attractive for small businesses due to its affordability and versatility. With thousands of free and premium themes and plugins available, businesses can easily create a website that reflects their unique brand and meets their specific needs. WordPress also allows for easy integration with third-party tools and services, such as social media platforms and email marketing tools. In Figure 2, you can see that among business websites, WordPress is clearly the go-to CMS: 64% of business websites worldwide use WordPress. Wix and Squarespace, which rank 2nd and 3rd respectively, only have a combined 15% share of the market.

One of the biggest advantages of Squarespace and Wix is that they allow the user to  create and customize their website without any coding knowledge. Additionally, both platforms offer 24/7 customer support, which can be crucial for users who encounter technical difficulties or have questions about their website. WordPress users, on the other hand, must rely on forums and community support to troubleshoot any issues they may encounter. As a WordPress website owner you also are responsible for keeping your website up-to-date to the latest version. 

Due to its popularity, WordPress frequently attracts attention from cybercriminals. WordPress websites can be vulnerable to various attacks, such as brute force attacks, SQL injections and cross-site scripting. These attacks can occur due to outdated versions of WordPress, plugins and themes. Older versions are more susceptible to security risks because they lack the necessary security patches and updates. Hackers can exploit these vulnerabilities and gain access to the website's data and files.

According to our data a whopping 1.3 million websites globally have a WordPress version older than 5.0. That’s 7.9% of all WordPress websites identified in our data. These versions no longer receive any active security support and are vulnerable to attacks. Table 1 below gives an overview of the number of domains by WordPress version. 7.6 million (45%) websites run on the latest version (6.2.2), which was released earlier this month (May 2023). That leaves 3.8 million websites running on a version of WordPress 5. These versions still receive security support but will eventually have to be updated when WordPress decides to no longer release security updates.

One solution to address security risks is to use managed WordPress hosting services. Managed WordPress hosting is a specific type of web hosting service optimized for WordPress websites. With this service, all technical aspects of running a WordPress site are managed by the hosting provider. This includes not only security management but also aspects such as website loading speed and performance, control updates and back-ups as well as general support. Over the years, numerous Managed WordPress hosting providers have entered the market. In Figure 3 below, you can see the monthly number of WordPress websites maintained by three companies that offer managed WordPress services: WP-Engine, Kinsta and Siteground. All three companies show growth in the number of managed websites ranging from 25% (WP-Engine) to 69% (Kinsta) over the past two years.

WordPress has become a true internet giant over the past two decades, growing from a humble blogging platform to a CMS that powers a quarter of the entire web. However, its popularity also puts websites at risk of cyber-attacks. Older versions of WordPress, plugins and themes are particularly vulnerable to security risks. A whole industry has emerged that supports website owners in the maintenance of their WordPress sites. At the same time, the rise of headless CMSs and competition from website builders that require minimal technical knowledge may prove to be real competition for WordPress in the long term. Only time will tell whether WordPress will maintain its dominance or give way to newer and more innovative platforms.