“WordPress powers 40% of the web” is one of the most repeated statistics in the industry. It is also measured across the entire web, including tens of millions of small and abandoned sites. Ask a narrower question, like how many of the most-visited sites run WordPress, and the published answers fall apart: we found sources claiming 10.57%, 18.6%, 29%, “over 50%” and 58% for roughly the same thing.
So we measured it ourselves. In September 2026 we scanned the 20,000 most-visited domains on the web, checked each one for WordPress, and recorded what version it was willing to tell us. Then we asked a question nobody seems to publish an answer to: how many WordPress sites actually hide their version number?
The short version: WordPress is far less dominant at the top of the web than the headline market-share figure suggests, its share climbs steadily the further down the rankings you look, and well over a third of the WordPress sites we found have stripped their version from public view. Every number below comes from our own scan, and the method is documented in full so you can check it.
- Of the 13,621 top-20,000 sites that responded, 8.8% run WordPress. Across the top 10,000 alone it is 7.5%, nowhere near the 29% figure that circulates widely (including, until today, on this site).
- WordPress share rises the further down the rankings you go, from 4.3% in the top 1,000 to 10.3% between 10,001 and 20,000. That single fact explains most of the disagreement between published numbers.
- Version hiding is common: 38.2% of the WordPress sites we found expose no version at all, having stripped both the generator tag and the feed.
- Checking the RSS feed as well as the HTML found 51.8% more versions than the generator meta tag alone. A homepage-only check badly understates exposure.
- Of the sites that do show a version, only 36.0% are on the current 7.1 branch and 33.7% are a full major version behind. A handful are still on WordPress 4.x, which shipped in 2018.
- Themes are wildly fragmented: 826 distinct themes across 1,108 sites, and the most common one accounts for just 3.0%.
How we measured this
The source list is the Tranco top one million, generated 2 September 2026. Tranco is a research-grade ranking that combines several providers and is designed to resist the manipulation that made older popularity lists unreliable. We took ranks 1 through 20,000 and scanned every one of them, so this is a census of that band rather than a sample.
Each domain got one request to its homepage, sent with a real browser User-Agent and following redirects, with a 10 second timeout. From the returned HTML we recorded three things: whether the page is rendered by WordPress, what version it exposes, and which theme it loads. Sites that returned a version in neither the HTML nor the feed were then re-requested at /feed/, since some security plugins strip the generator tag from the page but leave the feed alone.
Two decisions did more to shape the results than anything else, and both are worth spelling out because they are where most published figures quietly diverge.
The denominator problem
Only 13,621 of the 20,000 domains responded at all. The rest were parked, DNS-dead, timed out, or refused a non-browser client outright. The top of any domain ranking is also full of things that are not websites: CDN endpoints, ad exchanges, telemetry hosts and API domains that never serve a page to a human.
Every percentage on this page uses the 13,621 responding sites as its denominator, because a domain that serves no page cannot meaningfully be said to run WordPress or not. Quote our figures against all 20,000 instead and WordPress drops to 6.0%, which is a different claim about a different population. Whenever you see two WordPress market-share numbers that disagree, this is usually why: one is a share of all sites, another is a share of sites that responded, and a third is a share of sites running any recognised CMS. That last denominator is much smaller, which is how you get figures near 58% for the same underlying reality.
What counts as a WordPress site
The obvious test is to search the HTML for wp-content. We started there, and it is wrong often enough to matter. That string appears on plenty of pages that are not WordPress, because it travels with any embedded asset. Our first pass flagged nytimes.com, weather.com and salesforce.com as WordPress. None of them are:
- nytimes.com matched on
cdn.thewirecutter.com/wp-content/uploads/. Wirecutter is WordPress, the New York Times homepage is not. - weather.com matched on
forecastwatch.com, and avast.com onav-comparatives.org. Both were hot-linking an image from someone else’s WordPress install. - salesforce.com matched on
wp.sfdcdigital.com, and forbes.com on its own/advisor/section. In both cases WordPress runs somewhere in the organisation, just not on the page being measured.
So we tightened the rule. A site counts as WordPress only if it serves a first-party /wp-content/themes/, /wp-content/plugins/ or /wp-includes/ path, or carries a WordPress generator tag. Uploads alone do not count, because uploads are just media and anyone can hot-link them. Themes and plugins are what actually render a page.
That single change removed 326 of 1,529 apparent WordPress sites, or 21%. It is the difference between reporting 10.1% and reporting 7.5% for the top 10,000, and it is our best guess at why loose scans tend to overstate WordPress adoption.
How many of the top sites actually run WordPress
Of 13,621 responding sites, 1,203 run WordPress: 8.8%. Restricted to the top 10,000, it is 7.5%.
The more useful result is what happens as you move down the rankings. WordPress share more than doubles:
| Rank band | Sites responding | WordPress | Share |
|---|---|---|---|
| 1 to 1,000 | 652 | 28 | 4.3% |
| 1,001 to 5,000 | 2,814 | 208 | 7.4% |
| 5,001 to 10,000 | 3,667 | 298 | 8.1% |
| 10,001 to 20,000 | 6,488 | 669 | 10.3% |
This is the finding that resolves the contradiction we started with. There is no single correct answer to “what percentage of top sites use WordPress,” because the answer depends entirely on where you draw the line. Cut at 1,000 and you get 4.3%. Cut at 20,000 and the last band alone is 10.3%. Both are true. Published figures rarely say which cutoff they used, which is how 10.57% and “over 50%” end up presented as the same statistic.
The direction of the trend also makes intuitive sense. The very top of the web is dominated by companies large enough to build their own stack: search engines, social networks, streaming services, banks and infrastructure providers. WordPress becomes the sensible choice a little further down, where a site needs to publish well without funding a platform team. The 28 WordPress sites we did find in the top 1,000 are a telling list, including wordpress.org itself, wordpress.com, harvard.edu, nasa.gov, capgemini.com, creativecommons.org and cpanel.net.
One number this study corrects is our own. Our WordPress statistics roundup has carried the widely-repeated claim that 29% of the top 10,000 websites run WordPress. Our own measurement puts it at 7.5%, and we have updated that post accordingly.
38% of WordPress sites hide their version
This is the part we could not find published anywhere, and the reason we ran the scan in the first place. WordPress advertises its own version by default, in a generator meta tag on every page and again in the RSS feed. Security plugins routinely strip both. Nobody seems to have measured how many sites actually do it.
| Where the version was found | Sites | Share of WordPress sites |
|---|---|---|
| Generator meta tag in the HTML | 490 | 40.7% |
| RSS feed only (tag stripped) | 254 | 21.1% |
| Exposed by either route | 744 | 61.8% |
| No version exposed at all | 459 | 38.2% |
Two things stand out here.
First, hiding the version is genuinely common. More than a third of these sites have stripped every public version fingerprint we checked. If you have ever run a version check on a site and got nothing back, this is why, and it is not a broken tool. It is the expected result on a well-hardened install. We cover what to do in that situation in our guide to checking the WordPress version of any site.
Second, and more practically: checking the RSS feed found 51.8% more versions than the generator tag alone. Of the 744 sites that leaked a version, 254 of them had already removed it from their HTML and left it sitting in /feed/. Those sites have almost certainly been configured to hide the version and their owners probably believe it worked. Any survey that only parses the homepage will report a far higher “hidden” rate than reality, and any site owner who only removed the meta tag has done half a job.
What versions are they running
Among the 742 sites that gave us a usable version number, two thirds are on WordPress 7:
| Major version | Our scan (top 20,000) | W3Techs (all sites) |
|---|---|---|
| WordPress 7 | 66.3% | 59.2% |
| WordPress 6 | 29.0% | 33.6% |
| WordPress 5 | 3.5% | 5.0% |
| WordPress 4 | 1.2% | 2.1% |
Our numbers skew newer than the web as a whole, which is what you would expect. These are the most-visited sites on the internet, and they are better maintained than the average install. The gap is a useful sanity check on both datasets: they disagree by a few points in exactly the direction the different populations predict, rather than contradicting each other.
There is a stronger check available, too. WordPress.org publishes its own version telemetry, gathered from installs phoning home for updates rather than from scanning pages, which is a completely independent method with a completely different population. It currently reports 67.4% of installations on some release of WordPress 7. We measured 66.3% by reading public HTML. Two unrelated approaches landing within about one point of each other is the best evidence we have that the detection rule above is sound.
Being on WordPress 7 is not the same as being current, though. Breaking it down by exact release:
- 36.0% are on the 7.1 branch, the current release.
- 63.6% are behind it, with 7.0.4 the single most common outdated version at 24.0%.
- 33.7% are a full major version behind, on WordPress 6 or older.
- 1.2% are on WordPress 4.x, which stopped being current in 2018.
That last group is worth a moment. These are not forgotten hobby blogs; they sit inside the 20,000 most-visited domains on the web, and they include large public universities on both sides of the Atlantic. We confirmed each one by hand, checking the generator tag and the RSS feed independently rather than trusting a single signal.
They also split into two very different situations, which is a distinction most coverage of “outdated WordPress” misses. WordPress backports security fixes to old branches for a long time, so an old major version is not automatically an unpatched one. One university we found was running 4.7.35, and 4.7.35 is the newest release the 4.7 branch has ever had. Somebody is patching that site diligently; they just are not moving it to a new major version. Another was on 4.9.8, and the 4.9 branch has since reached 4.9.31. That site is 23 security releases behind inside its own branch, which is a genuinely different risk.
The practical lesson is that a major version number alone does not tell you whether a site is exposed. You have to compare it against the latest release on that branch, which is exactly the check most version-checker tools skip.
There is a real irony in the exposure data here. The sites still running WordPress 4.x are the ones with the most to lose from advertising it, and they are advertising it. The sites that took the trouble to hide their version are, on the whole, the ones that also took the trouble to update.
No theme owns this market
1,108 of the WordPress sites exposed a theme directory. Between them they were running 826 distinct themes, and the most popular one accounted for just 3.0% of installs. There is no dominant theme at this level of the web.
| Theme | Sites | Share |
|---|---|---|
| hello-elementor | 33 | 3.0% |
| retrotube | 23 | 2.1% |
| ultimatube | 19 | 1.7% |
| divi | 18 | 1.6% |
| astra | 16 | 1.4% |
| generatepress | 12 | 1.1% |
| avada | 9 | 0.8% |
| newspaper | 9 | 0.8% |
The recognisable names are the ones you would predict: page-builder foundations like hello-elementor, Divi and Avada, and lightweight performance themes like Astra and GeneratePress. The rest of the list is a very long tail of custom and vertical-specific themes, including several built for high-traffic video sites. That is the real story of the theme market at this scale, and it is a healthy one. Most large WordPress sites are running something built or heavily adapted for them, not an off-the-shelf theme.
What this means if you run a WordPress site
Three practical things fall out of the data.
- If you have hidden your version, check the feed too. A fifth of every WordPress site in this scan had removed the generator tag and left
yoursite.com/feed/broadcasting the version to anyone who asks. Open yours in a browser and search for “generator” before assuming the job is done. Our guide to removing WordPress fingerprints covers both. - Hiding the version is worth doing, and it is not a substitute for updating. It buys you nothing against an attacker who simply tries the exploit anyway, and everything we found suggests the sites most exposed by an accurate version string are the ones least likely to have hidden it. Update first, then hide.
- Being behind is the norm, not the exception. Roughly two thirds of the version-exposing sites in the top 20,000 are running something older than the current release. If you are one minor version back, you are in unremarkable company. If you are a full major version back, you are with a third of the web’s busiest WordPress sites, and that is a larger group than it should be. A reliable backup is what turns updating from a risk into a routine.
Limitations
Worth knowing before you cite any of this.
- We only looked at homepages. A site running WordPress at
/blog/with something else at the root is counted as not WordPress here, so our adoption figures are a floor rather than a ceiling. - The version statistics are calculated only over sites that expose a version, which by definition excludes every site that hardened itself. That subset is biased toward less-maintained sites, so the real “how current is WordPress” picture is probably a little better than our 36.0% figure suggests. This is a limitation of every version survey, ours included, and it cannot be fixed without access the public web does not give you.
- Some hosts serve a bot-protection challenge instead of the real page. We discard responses that are too short to contain any fingerprint rather than counting them as negatives, but some will have slipped through as false negatives.
- Headless WordPress is invisible to this method. A decoupled front end serves no
wp-contentpaths and no generator tag, so it looks like any other custom stack. No fingerprint-based counter can see it, which means every WordPress market-share figure in circulation, ours included, undercounts by an unknown amount that is growing. - This is a single snapshot taken on 3 September 2026, not a trend. We plan to re-run it.
The method above is documented in enough detail to reproduce independently: the source list and its date, the request behaviour, the detection rule and the denominator. If you do re-run it you will not match our numbers exactly, because the web moves under you, but the shape of the result should hold.
Frequently asked questions
What percentage of the top 10,000 websites use WordPress?
In our September 2026 scan, 7.5% of the top 10,000 sites that responded to a request were running WordPress (534 of 7,133). That is much lower than the 29% figure that circulates widely. The gap comes down to two things: how strictly you test for WordPress, and whether your denominator includes domains that never serve a page.
Why is this so much lower than the 40% WordPress market share figure?
They measure different populations. The 40.7% figure from W3Techs covers the whole web, where the vast majority of sites are small, and WordPress is extremely strong in that segment. Our scan covers only the 20,000 most-visited domains, where large organisations running custom platforms are heavily over-represented. Both numbers are correct about their own population. Our rank-band data shows the effect directly: WordPress share climbs from 4.3% in the top 1,000 to 10.3% by rank 20,000, and it keeps climbing beyond that.
How many WordPress sites hide their version number?
38.2% of the WordPress sites in our scan exposed no version at all, having stripped it from both the page source and the RSS feed. Another 21.1% had removed it from the HTML but left it visible in their feed, so they are partially hidden at best. Only 40.7% still advertise the version the way a default WordPress install does.
How many WordPress sites are running an outdated version?
Of the sites that exposed a version, 63.6% were behind the current 7.1 release and 33.7% were a full major version behind. Around 1.2% were still on WordPress 4.x, which has been unsupported since 2018. Bear in mind these figures only cover sites that expose a version, a group that skews toward less actively maintained installs.
How do you tell whether a site is running WordPress?
Search the page source for wp-content, but check what matched before trusting it. A first-party /wp-content/themes/ or /wp-content/plugins/ path means the page is rendered by WordPress. A /wp-content/uploads/ path on someone else’s domain just means the site embedded an image hosted on a WordPress install, which is how our first pass wrongly flagged the New York Times. That distinction removed 21% of our apparent WordPress sites.
Can I use this data?
Yes, with a link back to this page. If you quote the adoption figures, please carry the denominator with them: our percentages are shares of the 13,621 domains that responded, not of all 20,000 scanned. Against the full 20,000 the WordPress share is 6.0% rather than 8.8%.
Bottom line
WordPress is not the default choice at the very top of the web, and it was never plausible that 29% of the top 10,000 sites ran it. What the data does show is a platform whose share grows steadily as you move away from the giants, reaching 10.3% by rank 20,000 and climbing further down the long tail where that famous 40% lives.
The finding we did not expect is how partial the hardening is. A third of these sites have hidden their version properly. Another fifth think they have, and are still publishing it in their feed. If you do one thing after reading this, open yoursite.com/feed/ and search it for the word “generator.”
