Is WordPress Still a Good Choice in 2026? An Honest Answer

For the first time in over a decade, WordPress is shrinking. It peaked at roughly 43.6 percent of all websites in early 2025 and had fallen to 41.5 percent by July 2026, while Wix, Shopify, Squarespace and Webflow each picked up ground. In the same period its founder publicly attacked a major hosting company, the ecosystem recorded a 42 percent jump in security vulnerabilities, and Automattic laid off a sixth of its staff. We build most of our client sites on WordPress, so treat everything below with that in mind. Here is the honest answer to whether you should still choose it.

What Actually Happened

Three separate things, often blurred together into one story.

The governance fight

In September 2024, Matt Mullenweg, co-creator of WordPress and chief executive of Automattic, used a WordCamp keynote to call the hosting company WP Engine a cancer to WordPress, arguing it profited from the open-source project without contributing proportionally. He reportedly sought around 8 percent of WP Engine's annual revenue as a trademark licence fee. He then used control of WordPress.org, the repository every WordPress site depends on for updates, to block WP Engine's access, which affected over 200,000 sites.

WP Engine sued in October 2024 and won a preliminary injunction that December. The litigation was still active well into 2026. Inside Automattic, 159 employees, about 8.4 percent of the company, took a buyout rather than continue. In April 2025 a further 16 percent were laid off, including over 100 people from the WooCommerce team. BlackRock marked its Automattic shares down to 27.74 dollars by June 2025, roughly 67 percent below the 85 dollar valuation from the 2021 funding round.

The software was never at risk. What took damage was confidence. A community that had built businesses on the assumption of neutral infrastructure watched that infrastructure used as leverage in a commercial dispute.

The security numbers

Patchstack's annual report recorded 11,334 new vulnerabilities across the WordPress ecosystem during 2025, a 42 percent increase on the previous year. That figure gets quoted as evidence WordPress is insecure, which is the wrong reading. Almost all of those vulnerabilities were in plugins, not in WordPress itself, and there are over 59,000 free plugins in the directory written by tens of thousands of different people at wildly varying standards.

The honest framing is that WordPress core is well maintained and the plugin ecosystem is a genuine risk surface that scales with how many plugins you install and how rarely you update them. That is a management problem with a known solution, not a flaw you cannot do anything about.

The market share decline

Real, and worth being careful about. It is tempting to draw a line from the WP Engine dispute to the decline, and plenty of coverage did. The timeline does not cooperate: the dispute erupted in late September 2024, and WordPress usage went up the following quarter, reaching its all-time high in early 2025. The decline came later and accelerated through 2026.

W3Techs data puts the fall at over two percentage points in a little over a year. More plausible explanations are competition from hosted platforms that spend heavily on advertising, AI site builders taking the very low end, and newer frameworks taking the top end. Mullenweg's own public explanation was underinvestment in research and development by the companies profiting most from the ecosystem. All of that is more boring than the lawsuit story and probably closer to the truth.

What Got Better

This gets far less coverage than the drama, and the real story is more interesting than the version most articles ran. WordPress 7.0, codenamed Armstrong, was originally set for 9 April 2026 to launch live at WordCamp Asia. It did not make that date. The core team found that the new real-time collaboration feature was storing sync data in post meta and inadvertently disabling query caches across entire sites whenever the editor was opened. Fixing it properly meant building a new database table, so the release slipped roughly six weeks and shipped on 20 May 2026.

Then the headline feature got cut anyway. On 8 May, twelve days before launch, real-time collaborative editing was removed from the release entirely. The core team cited race conditions, excessive server load, memory efficiency problems and bugs that kept surfacing in testing. It is being rebuilt separately and is a candidate for the 7.1 cycle. If you read coverage published earlier in the year promising Google Docs style co-editing in 7.0, that is why it is not there.

What shipped in its place is the asynchronous version of the same idea, and for most business sites it is arguably more useful anyway: block-level Notes so someone can comment on a specific section, a Suggestions mode, mentions, and Visual Revisions that show what actually changed rather than a wall of raw HTML.

The rest of the release is substantial. The AI Client and Abilities API put AI infrastructure directly into core rather than requiring a plugin, with a Connectors screen supporting OpenAI, Anthropic and Google. Worth knowing: none of it is switched on by default. An administrator has to add their own API keys, and the optional features like alt text suggestions ship in a separate plugin. Alongside that, the admin got its first real redesign since 2013, built on DataViews, with a command palette, a font library, and several blocks that were previously plugin territory.

Alongside that, Automattic enabled AI agents including Claude and ChatGPT to create and manage content on WordPress.com sites in March 2026. Whatever you think of that direction, it is not the behaviour of a platform standing still.

When WordPress Is Still the Right Choice

• You publish regularly. Nothing beats WordPress for content-led sites, and if search traffic is part of your plan you will be publishing.
• You want to make your own changes. Editing a page, adding a product, publishing a post: a non-technical person can do all of it. On a custom build, each of those is a developer ticket.
• You want to be able to leave. This is the argument nobody makes and it matters most. Thousands of people in the UAE alone can work on a WordPress site. If your relationship with your agency ends, you hand the site to someone else. On a proprietary platform or a bespoke framework, leaving means rebuilding.
• Your budget is realistic rather than large. The ecosystem means most standard requirements already have a solution and you are configuring rather than commissioning.
• You need something specific and unusual. With 59,000 plugins, the odd requirement usually already exists.

When It Is the Wrong Choice

• Nobody will maintain it. This is the real disqualifier and it is behind most WordPress horror stories. An unmaintained WordPress site with 24 plugins and no updates since 2023 is not a website, it is a security incident waiting for a date.
• You need a genuinely fast, heavily interactive application. WordPress can be made fast, and there is a ceiling. If the site is closer to software than to publishing, look at modern frameworks.
• You want a simple brochure site and will never touch it. A hosted builder is cheaper to own and there is nothing to update.
• Your team genuinely will not use it. We have built beautiful WordPress sites for clients who never logged in once. That flexibility was wasted money and something simpler would have served them better.

How to Run It Properly

1. Keep the plugin count low and deliberate. Every plugin is a dependency and a risk surface. Twelve is comfortable. Thirty-five means somebody solved every problem by installing something.
2. Only install plugins that are actively maintained, updated within the last few months, and used by a large number of sites. Abandoned plugins are the single most common way sites get compromised.
3. Update on a schedule, not when something breaks. Monthly at minimum, with a staging environment for anything significant.
4. Automate backups off-site and test a restore at least once. An untested backup is a hope, not a backup.
5. Use good managed hosting. The cheapest shared hosting in this market saves a few hundred dirhams a year and costs you speed, uptime and, eventually, a bad afternoon.
6. Remove what you stopped using. Deactivated plugins still sit in the filesystem and can still be exploited. Delete rather than deactivate.

So, is WordPress still a good choice in 2026? For most small and mid-sized businesses, yes, with one condition attached. The platform's problems are real and every one of them is a management problem rather than a technology problem. Plugin risk is managed by installing fewer and updating them. Governance uncertainty is managed by the fact that it is open source and you can host it anywhere. The only version that genuinely fails is the one nobody looks after, and that version fails on every platform. It just fails more visibly on this one, because this one is on nearly half the internet.