Who’s Left to Build WordPress?

WordPress still runs about 41.5% of every website on the internet and 59% of all sites built on a known CMS, at least at the time of writing. The raw count of WordPress sites keeps climbing, and no other platform on the open web comes close. Anyone predicting its imminent collapse is selling something.

What is changing is what WordPress is used for. The ground under it is moving in four directions at once, and the combination is what matters. The people who use WordPress are getting older. The way the web gets built has shifted away from the model WordPress was designed for.

AI is taking apart the simple end of the market that a huge share of WordPress sites and plugins live on. And the people running the project have spent the last two years demonstrating, in public, exactly why talented developers leave.

None of these alone would be fatal, but together, they describe a platform that is maturing into something narrower than it used to be, and a plugin economy that is about to get sorted hard into winners and losers.

I have a stake in this. I have run a WordPress plugin business for well over a decade, so read the rest as the assessment of someone with skin in the game, not a neutral observer. I think the honest version of this story is more useful to anyone building on WordPress than either the boosters or the doomers are offering.

The Numbers, Stated Honestly

Let’s start with where things actually stand, because both sides of this debate tend to cheat with the figures.

WordPress’s share of all websites sat in a plateau of roughly 43.2 to 43.6% from 2022 through 2024, and has since slipped to 41.5% as of mid-June 2026, with six consecutive months of decline through May (reported by Search Engine Journel).

Its share of the CMS market specifically has come off a peak around 61.7% in 2024 to 59.3% now. Those are two different measurements and people constantly confuse them, so to be precise: 41.5% is the slice of the entire web, while 59.3% is the slice of sites that run any detectable CMS at all. (W3Techs tracks both.)

A separate methodology, the HTTP Archive crawl, puts WordPress closer to 33% of the origins it samples (from GravityKit’s tracker) and also shows a decline, with the “no detectable CMS” category growing.

Here is the concession a WordPress defender will reach for, and they are right to:

A two-point drop off a 43% base is small, and the raw count of WordPress sites is still climbing. The share is falling mostly because the web is growing faster than WordPress is adding sites, not because existing sites are abandoning ship.

The risk is in where new sites start, not in whether existing ones leave. The share of the installed base erodes slowly while the share of new builds is the leading indicator, and that is where the platform is losing ground first.

So the story that follows is a slow narrowing rather than a collapse, set by who no longer chooses WordPress at the start.

The People Who Built WordPress Grew Up

WordPress arrived in 2003 and hit its stride in the years after that. The people who adopted it early, learned it deeply, and built businesses and agencies on it, were in their twenties then. They are in their forties now. That cohort is the WordPress establishment, made up of the agency owners, the freelance developers with a stable client base, the plugin and theme businesses, and the people who speak at the WordCamps.

Their working practices are built around WordPress, their income depends on it, and that makes them both the platform’s most committed users and its most resistant to change. I do not mean that as a knock, because it’s what happens to any technology around long enough for its founding generation to mature.

The data backs the aging of that core, with an important limit. The one published dataset that asks WordPress people their age is the 2023 WordPress.org annual survey, still the most recent the project has run, and in it roughly half of respondents are 40 or older and only about 23% are under 30, with visible clusters of people who have used WordPress for 10 and 15 years (results here).

The limit is that survey is self-selected from the engaged, English-speaking, project-adjacent community. It measures the establishment, not the tens of millions of people whose agency built them a site and who have never heard of WordPress.org. So it is strong evidence that the WordPress professional class has aged, and weak evidence about the silent majority of users.

The broader developer picture points the same way. On Stack Overflow’s annual survey, the share of developers aged 35 and over rose from about a quarter in 2019 to nearly half, 47%, in 2025, while the under-25 share kept falling, from 21% to under 19% in a single year (2025 results). PHP, the language WordPress is written in, has become a mature ecosystem with a thin trickle of newcomers.

JetBrains’ 2025 PHP survey found the typical PHP developer has years of experience, only a small single-digit percentage are in their first year, and only around 15% of new programmers pick PHP at all. Bootcamps teach JavaScript and younger designers reach for Webflow and Framer. The center of gravity in web development has moved to ecosystems where WordPress and PHP are not the obvious starting point.

There is a genuine counter-argument here, and ignoring it would be dishonest. WordPress’s growth edge is in emerging markets, India, Brazil, Indonesia, where the median age is far lower than in the West. The marginal new WordPress user globally may well be in their twenties.

The honest position is narrow and defensible, and it’s that the WordPress establishment (the people who contribute, attend events, run agencies and build the commercial ecosystem) has measurably aged, and few young builders in the West are entering through that door. Whether the entire global user base has aged is unknown and probably runs the other way.

The Web Stopped Being Built the WordPress Way

When WordPress won, owning your own stack was the aspiration. You got hosting, you installed WordPress, you picked a theme, you added plugins, you learned enough about backups and security and feeds to keep it running. For a certain kind of person, and I was one of them, that was a genuinely good way to spend evenings and weekends. Building your own site was a craft worth learning.

Almost everything about that has inverted over twenty years. The web moved toward hosted platforms where you rent convenience and give up control: Shopify for commerce, Squarespace and Wix for the brochure site, Substack and Beehiiv for the newsletter, Linktree for the link in a bio.

Subscriptions replaced ownership across software in general, and people stopped expecting to run their own infrastructure for anything. Wix and Shopify have been the two platforms most visibly taking share in the same window WordPress has been losing it, and their combined gains roughly match WordPress’s decline, where Wix alone reports over 200 million registered users.

Publishing itself also moved. For a large share of individuals and small businesses, the first and often only place they publish is social media. A January 2026 survey of small business owners found 68% expect social posting and paid ads to drive most of their value this year, ranking it their clearest path to growth (eMarketer).

I want to be careful not to overclaim here though. More than 73% of US small businesses still have a website, so the owned site is not dead. What changed is its role. The site became the secondary credibility layer and social became the primary place people show up and sell. For someone starting out today, a website is no longer the obvious first move, and when they do want one, the WordPress route asks the most of them.

That is the real friction. Setting up WordPress properly still asks a person to understand hosting, choose and configure plugins, think about backups and security and updates, and absorb technical concepts that mean nothing to a normal user. That ask made sense when learning the web was a hobby people enjoyed, but it lands very differently on an audience with less time, shorter attention, and a dozen tools that will just do it for them. That flexibility was an advantage when people wanted to tinker, and quickly became a cost once they stopped.

From Upstart to Punching Bag

There is a perception problem layered on top of the structural one, and perception drives the choice of where to start a new site as much as any benchmark does.

WordPress used to be the scrappy open-source project remaking the web. Now it is just as often the old system people are surprised is still around, the one accused of bloated code, insecure plugins, and slow sites. How fair is that? Partly fair, and worth being precise about which parts.

On security, the popular verdict is mostly wrong about the thing it blames. WordPress core is among the more secure pieces of widely deployed web software: Patchstack counted 6 core vulnerabilities in all of 2025, all of them low priority. The danger lives almost entirely in the third-party ecosystem. Of the 11,334 new WordPress vulnerabilities disclosed in 2025, up 42% on the previous year, about 91% were in plugins, and the median time from public disclosure to mass exploitation is now five hours (Patchstack’s 2026 report). So “WordPress is insecure” is unfair to the software Automattic and the core team ship, and fair as a description of what happens when you assemble a site out of dozens of plugins of wildly varying quality. The openness is both the strength and the exposure.

On speed, the criticism is closer to earned. On real-world Core Web Vitals data, about 45% of WordPress sites pass on mobile, up from prior years, against the 68 to 75% range that Shopify, Wix, and Squarespace occupy on the latest cross-platform snapshot (WordPress figure; comparison). WordPress sits near the bottom of the platforms people compare it to. The nuance is that this measures the average deployed site, not the platform’s ceiling: a WordPress site on good managed hosting with caching and sensible plugins passes comfortably. The median is dragged down by cheap hosting, heavy themes, and stacked plugins, which is exactly what an open platform with no guardrails produces. A managed platform enforces performance its users never have to think about. WordPress hands you the rope.

The summary is uncomfortable but accurate, since the criticism is largely unfair to WordPress as a piece of software and largely fair to WordPress as it is typically deployed. For perception purposes, the second one is what counts, because the person deciding where to build does not separate the core from the ecosystem. They just hear that WordPress is slow and risky.

There is a deeper irony in the uncool framing worth bringing up too. Open source is having its best cultural moment in years, and AI is the reason. GitHub is full of wildly popular open-source AI projects, OpenClaw and Hermes among them, pulling hundreds of thousands of stars between them. Open-weight models now trail the frontier by months rather than years (Epoch AI), close enough to win whole categories of work, coding especially. Sharing code in the open and building on each other’s work is fashionable again in a way it has not been since WordPress’s own early days. The catch for WordPress is that the revival is pooling around AI tooling and modern stacks on GitHub, not around WordPress.org. WordPress was the original mass open-source success, and it is mostly not the project this renaissance is reviving.

AI Is Dismantling the Bottom of the Market

This is the force that turns a slow narrowing into something faster, and it hits precisely the segment WordPress is most exposed on: the casual user who wants a simple site.

For years the answer to “I need a website” involved learning a tool. Now a non-technical person can describe what they want and get a working site in minutes. The tools doing this are real and large, not vaporware. Lovable passed roughly $500 million in annualized revenue by 2026 and was reportedly in talks to raise at around a $12 billion valuation (Sacra). On the coding side, Cursor crossed $2 billion in annualized revenue and was in talks at around $50 billion (TechCrunch). Vercel’s v0 pushed its parent past $200 million ARR. Wix’s AI builder is now the default way many of its users start, and Hostinger, which is itself a major WordPress host, says more than a million sites have been built with its AI builder since launch (Hostinger’s own numbers). “Vibe coding,” the practice of building software by describing it to an AI, was Collins Dictionary’s word of the year for 2025. This is not a niche.

Two different things are happening and they are worth separating. AI is lowering the floor, letting non-technical people ship a decent marketing site or landing page without learning anything. And it is raising the ceiling, letting technical people build custom sites with Cursor or Claude or modern frameworks like Astro and Ghost instead of reaching for WordPress out of habit. The first group is the larger threat to WordPress, because it is the larger market, and it overlaps almost perfectly with the simple-site segment WordPress historically absorbed by default.

If that segment shrinks, the plugins that serve it shrink with it. A big share of the WordPress plugin market exists to do things AI can now just do: simple forms, basic SEO copy, galleries, small layout tweaks, contact pages.

I will be honest about the evidence here, because this is where the argument is most often overstated. There is no published data yet showing plugin installs or revenue declining because of AI. The mechanism is clear and the direction is predictable, but it is a forward-looking bet, not a measured fact. I am making the bet because I think a large chunk of the WordPress base is exactly the kind of simple site that no longer needs to be a WordPress site at all, and the plugins built for that base are the most exposed thing in the ecosystem.

There is a real counter, and it is WordPress’s best card. The sites these AI builders produce are hard to own and hard to move. They lock you into one company’s platform and pricing, which is the exact dynamic that historically pushed serious users toward self-hosted WordPress in the first place. WordPress’s openness and portability is a genuine moat for anyone who later wants out. It is possible the AI-builder boom is creating a future migration market that WordPress eventually captures.

And WordPress is not standing still in the meantime. The same AI is being built into WordPress itself through tools like 10Web and Elementor’s AI features. The “AI versus WordPress” framing may partly resolve as “AI inside WordPress.” I think that helps the platform survive at the top and middl,e but I don’t think it saves the bottom.

What Is Safe, for Now

Some parts of WordPress are far more exposed than others. The picture is a barbell, where the top end holds, the bottom falls out, and the undifferentiated middle gets crushed.

WooCommerce and enterprise WordPress are fine for the foreseeable future, for reasons that have nothing to do with technical superiority and everything to do with how their owners behave. WooCommerce still runs about a third of all online stores, more than any single competitor, even though Shopify leads decisively among high-traffic merchants and out-earns it many times over on transaction volume (store-count comparison).

At the high end, WordPress powers serious operations including Spotify, Meta’s news properties, CNN, Al Jazeera’s multi-bureau publishing all run on it through WordPress VIP. These users move slowly, and they have real reasons to stay, including editorial workflows entire teams are trained on, owned infrastructure, regulatory and auditability requirements, and the plain fact that replatforming a twenty-thousand-page multilingual estate is a multi-quarter project with real downside and no upside anyone gets promoted for. Nobody is going to point an AI at a complex commerce or enterprise site and let it rebuild the thing. The risk tolerance is zero, and correctly so.

The honest qualifier that “the high end is safe” is a statement about retention, not growth. Shopify is winning new high-value commerce, and the governance crisis I am about to describe dented the exact stability story enterprises rely on. The installed base is sticky and the flow of new high-value builds is not clearly going WordPress’s way. So the top end is defended, not expanding.

The Plugin Gold Rush, and Why Moatless Plugins Are Finished

This is the least appreciated of the four forces, and the most consequential for anyone in my business.

The WordPress plugins team reviewed 12,713 plugins in 2025, more than 40% up on the previous year, with weekly submissions roughly doubling to around 330 by year-end, and the team itself noting that AI had dropped the barrier far enough that many people were building a plugin for the first time (the plugins team’s 2025 review).

This is the same phenomenon as the App Store where an open distribution platform plus a sudden drop in the cost of building means a flood of new entrants. For a young developer who wants visibility, contributions, a bit of reputation and maybe some money, a WordPress plugin is one of the easiest on-ramps there is, and AI just made it dramatically easier.

Most of these plugins will be junk and will struggle to get any distribution at all. But the dynamic is dangerous for established plugins in a specific way. Plugin code is open source. Anyone can read exactly how a popular free plugin works, and increasingly they can ask an AI to either replicate that functionality or build the missing pieces that bring a free clone up to parity with someone’s paid version. The premium features that a plugin business charges for are, in a lot of cases, no longer hard to reproduce. If the only thing protecting your plugin is that you built the feature first, that protection is gone.

What survives is whatever the open-source code does not contain. The defensible moats are proprietary data and live services that run on a server you control rather than shipping in the plugin: a threat-intelligence feed, a spam-filtering corpus, a licensing and update backbone, anything where the value is the service behind the code and not the code itself. Distribution is a moat too, the rankings and installed base that compound on WordPress.org, but a contingent one. Brand and trust matter. Deep integrations and network effects matter. The undifferentiated middle, a paid plugin whose entire value is functionality an AI can now copy in an afternoon, has no future as a standalone business.

The market already knows this, which is why it has spent the last few years consolidating. A handful of companies now control most plugin downloads. Awesome Motive has made dozens of acquisitions and owns, among much else, the two pieces of software a large share of independent plugin sellers use to sell their products and run their affiliate programs, which hands one company a view of the market that its rivals cannot see. That is a data moat built on distribution, not on code. In May 2026, Liquid Web folded its entire StellarWP portfolio of acquired plugins into a handful of products, retiring the individual brands (reported here). The roll-ups are pricing exactly the things AI cannot commoditize, data, distribution, infrastructure, bundles, and treating the code as the cheap part. They are right.

The counter worth holding in mind: AI helps the incumbents at least as much as the cloners. An established plugin can push AI features to millions of existing installs overnight; a clone ships into an empty listing nobody finds. And distribution as a moat is more fragile than it looks, both because a burst of downloads can leapfrog an entrenched plugin in search, and because, as the next section shows, the platform owner can simply take your listing away.

The Governance Problem at the Top

Everything above is a market story. This last force is a choice, and it is the one I am least optimistic about, because it sits with a small number of people who have shown no inclination to change.

WordPress’s plugin and theme developers were, in my view, among the biggest drivers of the platform’s success. The ecosystem is the reason WordPress could do anything, and it was built by independent businesses taking real risk. They have spent most of WordPress’s history treated as second-class citizens by the project’s leadership. A small example that captures the pattern is when in 2022, WordPress.org removed the active-install growth chart that showed plugin developers how their plugins were trending, justified only as “insufficient data obfuscation.”

Mark, our CEO here at WP Mayor and RebelCode, where he runs our plugin businesses, opened a ticket asking for it back and improved rather than deleted. It was marked high priority. Four years later it is still unresolved, the substantive discussion moved behind closed doors, and the sharpest objection went unanswered: Automattic, a company that acquires plugins, retains access to the exact growth data that everyone else lost. When the steward of the commons is also a competitor in it, decisions like that do not read as neutral.

That was the small version. The last two years produced the large version, in public. In September 2024, Matt Mullenweg, who controls both Automattic and WordPress.org, called the hosting company WP Engine a “cancer to WordPress” from the stage, then cut off its access to WordPress.org resources, breaking plugin updates for its customers. WordPress.org added a checkbox forcing people to declare they were not affiliated with WP Engine before they could log in. Then Automattic took over WP Engine’s Advanced Custom Fields plugin, used on roughly two million sites, and forked it under a new name, seizing the directory listing without the developer’s consent. A federal judge granted WP Engine a preliminary injunction in December 2024 ordering Automattic to restore access, return the plugin, and remove the checkbox (court coverage). As of mid-2026 the case is unresolved, the injunction still stands, antitrust claims were dismissed and re-pleaded, and a jury trial is set for 2027. Nobody has won and nobody has settled.

The fallout landed on the community, not just the two companies. In January 2025 Automattic cut its sponsored contribution to WordPress from around 3,900 hours a week to roughly 45, a near-total withdrawal, and the project shipped only one major release that year as a result. A buyout offer the previous autumn saw 8.4% of Automattic’s staff leave, most of them from the WordPress side of the business. The volunteer Sustainability Team was dissolved after its representative resigned in protest, with Mullenweg responding that he had just learned the team existed. Several prominent community figures who advocated for governance reform had their WordPress.org accounts deactivated (reporting here).

When Joost de Valk and others proposed moving WordPress.org and the trademark to an independent foundation and built a federated alternative to the plugin repository, the project found it could be built but not funded, because no hosting company would back it without being seen to take a side. By February 2026 its founders had stepped away (reported here).

The structural fact under all of this is the one that should worry anyone betting their business on WordPress. WordPress.org, the infrastructure that controls plugin distribution and automatic updates for 40% of the web, is Mullenweg’s personal property, not the nonprofit Foundation’s. There is no oversight board and no mechanism for the community to overrule a decision. As of mid-2026, after everything, none of that has changed (a mid-2026 review of the saga reached the same conclusion: nobody has won, nobody has settled, and the governance structure is untouched).

I want to be fair to the other side, because the grievance underneath the conflict is not fake. WP Engine, backed by private equity, did build a large business heavily on WordPress while contributing little back, and it did brand itself in ways that blurred the trademark. Trademark holders who do not police their marks lose them. The “give back to the commons” critique of well-funded free-riders is a real open-source concern, and a court did dismiss WP Engine’s most aggressive antitrust claims. A decisive leader keeping a project coherent is a recognized and historically common open-source model. Leadership was within its rights to defend the trademark and to ask well-funded hosts to contribute.

What crossed the line was the method. Seizing a developer’s plugin for two million sites, gating community logins on a loyalty checkbox, dissolving a volunteer team over a joke, and deactivating critics’ accounts are not trademark enforcement. They are demonstrations of unchecked control, and the court found enough in the methods to issue an injunction.

Talented people watched all of it and drew the obvious conclusion about what building on this platform, and contributing to it, actually costs. They will keep drawing it until something changes at the top, and there is no structure in place that would force that change.

Where This Leaves Us

Put the four forces together and the shape is a sorting. WordPress is becoming a platform for the serious end of the market, commerce, enterprise, professional publishing, agencies serving clients who have real reasons to stay, and the businesses with genuine moats that serve them. The casual end, the personal sites and small-business brochure pages and the long tail of simple plugins built to serve them, is being pulled away by AI and hosted platforms and the simple fact that a new generation has no particular reason to start there. The middle, undifferentiated plugins and the developers who depend on them, gets squeezed from both ends.

For anyone running a WordPress business, the strategic question is no longer “is WordPress growing?” It is “which side of the barbell am I on, and do I have a moat that survives contact with an AI that can read my code?” That question has clear answers, and they are worth confronting now rather than when the trend is undeniable.

What would change the trajectory? On the market side, not much; demographics and AI are not going to reverse. On the governance side, everything is reversible, because it is a choice. An independent foundation, real community governance over the distribution infrastructure, and a leadership posture that treats plugin developers as the asset they are rather than tenants on someone’s personal property would not fix the demographic or technological pressures, but it would stop the platform from bleeding the exact people it most needs to keep.

I am not holding my breath. I would be glad to be wrong.