Is WordPress still viable in 2026?

Victor Tavarez 6 min read

WordPress is no longer the default pick it was 10–15 years ago, at least among developers. With meta-frameworks like Astro, Next, and Nuxt, long gone are the days when developers reached into their metaphorical toolbox and pulled out WordPress by reflex. But does that really mean that the technology itself is no longer viable? Is it outdated?

The State of WordPress in 2026

As of November 2026, WordPress powers about 39% of all websites and about 58% of sites whose CMS can be identified.1 That’s down from a peak of roughly 43.6% in early 2025,2 while PHP, the language WordPress is built on, still runs about 70% of websites whose server-side language is known.3

In October 2026, however, two critical vulnerabilities rated were discovered in PHP’s core runtime,4,5 leading many to argue that WordPress, and PHP at large, is no longer viable.

Old Isn’t the Same as Obsolete

Other mature technologies have had their fair share of vulnerabilities and are still actively maintained and used. C, for example, is notorious for having memory-safety bugs; Microsoft has attributed roughly 70% of the vulnerabilities it patches to memory-safety issues.6 Yet as of October 2026, C is still the second most popular language on the TIOBE Index, behind only Python,7 and remains a go-to .

Many of the world’s most widely used technologies are still written in C: SQLite, PostgreSQL, Redis, curl, nginx, and FFmpeg, to name a few. Even PHP’s own interpreter is written in C.

Likewise, WordPress and PHP are still actively maintained and used by millions. When details of those PHP vulnerabilities leaked publicly on October 20, PHP’s maintainers moved their scheduled release up a day and shipped fixes on October 21.5,8 And as of November 2026, 68.8% of WordPress sites are already running WordPress 7,1 a sign the platform is still actively developed and adopted.

Why the Skepticism?

For WordPress itself, many point to maintenance: outdated plugins and unpatched installs. In 2025, 91% of new WordPress vulnerabilities were in plugins and 9% were in themes. It’s tempting to blame WordPress itself, but only six were in WordPress core, and all were low risk.9

Developers also dislike PHP itself, a reputation formed in the 2000s by tutorials full of SQL injection, HTML mixed with logic, and features like register_globals that have long since been removed. To be fair, not every complaint is outdated. PHP’s standard library is still inconsistent, with function names and argument orders that follow no single pattern, a quirk kept for the same backward compatibility that lets decade-old sites keep running. WordPress, too, has kept its old procedural style for backward compatibility, so for many developers “PHP” means WordPress-era PHP rather than the modern language.

These criticisms are understandable, but do they actually make the technology unviable in 2026?

Should You Migrate?

It depends. If you’re a small business whose website is already built on WordPress and you’re considering migrating because you’re worried it’s outdated, I would almost certainly push back. The technology is still actively maintained, and a rebuild in Astro or Next would mean paying for a new site that, at best, does the same job. Often it would do it worse for you: WordPress lets you edit your own content, runs on inexpensive hosting, and has a plugin for nearly everything a small business needs. Moving to a static-first framework usually means either handing every content change to a developer or bolting on a headless CMS, which brings back much of the complexity you were trying to escape.

That doesn’t mean WordPress is maintenance-free. The real risk is in what you install on it. In 2025, 46% of newly disclosed WordPress vulnerabilities had no patch from the developer at the time of disclosure, so keeping everything updated isn’t enough on its own. Meanwhile, only about 48% of WordPress sites run a PHP version that still receives security patches.9 The fix isn’t a new framework; it’s discipline. Use as few plugins as possible, remove the ones you don’t use, keep PHP current, and consider a managed host that handles updates and WordPress-specific protection for you.

There are cases where migrating makes sense: a brochure site whose content almost never changes, a site a developer maintains anyway, or one with performance problems that caching and better hosting haven’t fixed. Frameworks like Astro are excellent tools, and in those cases they may be the right fit. But “WordPress is old” isn’t one of those reasons, and neither is PHP’s reputation. The PHP many developers remember isn’t the PHP of today. PHP 8.5, released in November 2025, added a pipe operator for cleaner function chaining, building on years of modern features across the 8.x releases.10

Choose Boring Technology

The bigger lesson goes beyond WordPress. In his essay “Choose Boring Technology,” Dan McKinley lists PHP alongside Postgres and Python as technology that is boring but good, and argues that teams should spend their limited appetite for new tools only where it truly matters.11 Joel Spolsky made a similar case years earlier with Netscape, whose decision to rewrite its browser from scratch left a gap of nearly three years between major releases.12 New technology earns its place when it solves a problem your current tools can’t, the way the Linux kernel is gradually adopting Rust for memory safety rather than rewriting decades of working C. Reaching for the newest framework just because it’s new isn’t an upgrade. It’s a cost.

So is WordPress still viable in 2026? For most small businesses, absolutely. It isn’t the shiny choice anymore, but it was never supposed to be. New is a feature, not a requirement.

References

  1. W3Techs, "Usage Statistics and Market Share of WordPress," accessed November 10, 2026. https://w3techs.com/technologies/details/cm-wordpress
  2. Colorlib, "WordPress Statistics," citing W3Techs data, 2026. https://colorlib.com/wp/wordpress-statistics/
  3. W3Techs, "Usage Statistics of PHP for Websites," accessed November 10, 2026. https://w3techs.com/technologies/details/pl-php
  4. CISA, "Critical Vulnerabilities in PHP Require Immediate Patching," October 21, 2026 (updated October 26, 2026). https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
  5. Satnam Narang, "php2shell (CVE-2026-109618, CVE-2026-109619): Frequently Asked Questions About Critical PHP Remote Code Execution Vulnerabilities," Tenable, October 21, 2026. https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote
  6. Alfonso Maruccia, "Use Rust or C#, Abandon C++: Five Eyes Agencies Warn About Memory Safety in Programming Languages," TechSpot. https://www.techspot.com/news/101102-us-cyber-defense-five-eyes-agencies-promote-transition.html
  7. TIOBE Software, "TIOBE Index," October 2026. https://www.tiobe.com/tiobe-index/
  8. Sansec, "PHP2Shell: PHP RCE (CVE-2026-109618, CVE-2026-109619)," October 2026. https://sansec.io/research/php2shell
  9. Colorlib, "WordPress Hacking Statistics," citing Patchstack's State of WordPress Security in 2026, March 2026. https://colorlib.com/wp/wordpress-hacking-statistics/
  10. The Register, "PHP 8.5 lays down long-awaited pipe operator, adds new URI tools," November 20, 2025. https://www.theregister.com/2025/11/20/php_85_lays_pipe_operator/
  11. Dan McKinley, "Choose Boring Technology," March 30, 2015. https://mcfunley.com/choose-boring-technology
  12. Joel Spolsky, "Things You Should Never Do, Part I," Joel on Software, April 6, 2000. https://www.joelonsoftware.com/2000/04/06/things-you-should-never-do-part-i/
PHP2SHELL Gives little abstraction from the computer’s hardware, so commands map closely to what the CPU can do