WordPress Is Losing Market Share for the First Time in a Decade. Here Is What Is Actually Happening.

The Number Nobody Expected to See

For over a decade, WordPress only went in one direction. Up. From 27.3% of all websites in 2017 to a peak of 43.6% by mid-2025, the platform seemed unstoppable. Every year, the story was the same: WordPress grew its market share again, and the gap between it and every competitor widened.

Then the number dipped. As of March 2026, WordPress powers 42.6% of all websites globally, according to W3Techs. That is the first meaningful decline since tracking began in 2011. A full percentage point down from the peak.

One percentage point might not sound dramatic. But when you are talking about a platform that powers roughly 500 million websites, that shift represents millions of sites. More importantly, it signals something the data alone does not capture: the reasons businesses are leaving WordPress have fundamentally changed. This is no longer about features or pricing. It is about trust, governance, and whether the platform's leadership is acting in the community's best interest.

As someone who builds websites professionally and recommends platforms to clients every week, I have been watching this closely. Here is what is actually happening, and what it means if you are running a business website on WordPress right now.

The WordPress Civil War Nobody Can Ignore

The single biggest factor shaking confidence in WordPress is not a technical problem. It is a leadership crisis that has been escalating since September 2024 and shows no signs of resolution.

It started when Matt Mullenweg, the co-creator of WordPress and CEO of Automattic, publicly called WP Engine, one of the largest WordPress hosting companies, "a cancer to WordPress" during his WordCamp US keynote. His grievance was that WP Engine was profiting enormously from the WordPress ecosystem without contributing enough back to the open-source project. He reportedly demanded that WP Engine pay 8% of its annual revenue, roughly $32 million, as a trademark licensing fee.

What followed was an escalation that rattled the entire WordPress community. Mullenweg used his control over WordPress.org, the central repository that virtually every WordPress site depends on for plugin and theme updates, to block WP Engine's access entirely. Over 200,000 WordPress sites were directly affected. The Advanced Custom Fields plugin, used by millions of sites, was taken over without the developer's consent and forked into a new plugin called Secure Custom Fields. A login checkbox was added to WordPress.org requiring users to confirm they were not affiliated with WP Engine.

WP Engine sued Automattic in October 2024, alleging attempted extortion, abuse of power, and interference with business operations. A federal judge granted WP Engine a preliminary injunction in December 2024, ordering Automattic to restore access within 72 hours. As of March 2026, the lawsuit remains active, with WP Engine filing a third amended complaint.

The fallout extended inside Automattic itself. In October 2024, Mullenweg offered employees who disagreed with his actions a buyout package of $30,000 or six months' salary. 159 people, roughly 8.4% of the company, took the offer and left. Then in April 2025, Automattic laid off another 16% of its workforce, approximately 281 employees, including over 100 from the WooCommerce team. The company's Grand Meetup annual retreat was cancelled.

Investors noticed. BlackRock marked down its Automattic shares to $27.74 as of June 2025, a 63.5% decline from the $85 per share valuation during the 2021 Series E round. That is a dramatic loss of confidence from one of the world's largest investment firms.

The Governance Problem Goes Deeper Than One Lawsuit

The WP Engine dispute exposed a structural issue that most WordPress users had never considered: who actually controls the platform that powers 42% of the web?

WordPress operates under what is called a BDFL model, which stands for Benevolent Dictator for Life. Mullenweg has held this role since the project's creation. He simultaneously serves as project lead, CEO of the for-profit Automattic, and (until recently) a board member of the WordPress Foundation. The Foundation was supposed to steward the open-source project independently, but legal filings revealed that when Automattic transferred the WordPress trademarks to the Foundation in 2010, it simultaneously granted itself an exclusive, perpetual, royalty-free license, effectively retaining control while presenting the transfer as an act of open-source generosity.

WordPress.org itself, which the community had long understood as belonging to the project or the Foundation, was claimed in legal filings as Mullenweg's personal property. An open letter signed by twenty core contributors, including committers and team leads who had built WordPress for years, laid out their objections. They cited the Foundation's lack of community oversight, the absence of a conflict of interest policy, and what they described as the volatility of the self-governing BDFL model.

Contributors who spoke up about governance were banned from WordPress.org, losing the ability to manage their own plugins or participate in community channels. In January 2025, Mullenweg blocked the accounts of former Yoast CEO Joost de Valk and several other prominent community members over alleged plans to fork WordPress.

By June 2025, a coalition of contributors launched FAIR (Federated and Independent Repositories) at an independently organized event alongside WordCamp Europe in Basel. The initiative aims to create alternative infrastructure so the WordPress ecosystem is not dependent on a single individual's control.

The Security Numbers Keep Getting Worse

While the governance crisis dominates headlines, there is a quieter problem that affects every WordPress site owner daily: security.

Patchstack, the WordPress CVE Numbering Authority, reported 7,966 new WordPress security vulnerabilities in 2024, up from 5,948 in 2023. That is a 34% year-over-year increase. Of those vulnerabilities, 96% originated in plugins, not WordPress core. Only 7 vulnerabilities were found in the core software itself. Additionally, 43% of the 2024 vulnerabilities were exploitable without any authentication at all, meaning attackers could target them without needing login credentials.

The plugin ecosystem, which is simultaneously WordPress's greatest strength and biggest liability, creates a security surface area that most business owners drastically underestimate. The average mid-market WordPress site runs 20 to 30 plugins. Each plugin is an independent piece of software maintained by a different developer or team, with varying levels of security awareness and update frequency. When one plugin gets compromised, every site running it becomes vulnerable.

Compare this to a managed platform like Webflow, where security is handled at the infrastructure level. There is no plugin ecosystem to audit, no hosting configuration to harden, and no CVE feed to monitor. Security patches deploy automatically across all hosted sites with zero action required from site owners. For lean teams without a dedicated security function, this difference in operational risk is significant.

The Migration Trend Is Real, Not Hype

The combination of governance uncertainty, security burden, and mounting maintenance costs is pushing a growing number of businesses to evaluate alternatives. And the data shows Webflow is capturing a meaningful share of those migrations.

Webflow's active website count grew from approximately 320,600 in early 2024 to about 493,000 by April 2025, a 54% increase. The company's revenue hit approximately $213 million in 2024 with 66% year-over-year growth. Forrester recognized Webflow as a Strong Performer in its Q1 2025 Content Management Systems Wave, citing its visual-first composable CMS approach and enterprise scalability.

The migration results from specific companies tell a compelling story. Rakuten Super Logistics (now ShipNetwork) migrated from WordPress to Webflow and reported a 12.7% increase in pageviews, a 27.9% decrease in bounce rate, a 9.5% increase in new users, and a 3.4% increase in pages per session. Their marketing operations manager noted that changes that used to take a developer 45 hours in WordPress could now be done in 20 minutes by a marketer in Webflow.

Healius, a major Australian healthcare company, migrated its web portfolio from WordPress to Webflow and achieved 3x cost savings compared to its previous setup. Lattice, the HR tech company, returned to Webflow Enterprise after a brief WordPress experiment and saw a 280% increase in organic traffic while saving approximately $50,000 per year by eliminating developer dependency.

The pattern across these migrations is consistent. Companies report faster page loads (Webflow sites average 2.4 second LCP versus 3.2 seconds for WordPress on mobile), reduced maintenance burden, and significantly more marketing team autonomy. 58% of Webflow sites pass all Core Web Vitals metrics, compared to 42% for WordPress.

Why AI Makes the WordPress Tax Even Harder to Justify

Here is the angle that I think most WordPress defenders are missing. The rise of AI tools has fundamentally changed the calculus of website complexity.

WordPress's value proposition has always been: "Yes, it is complex, but that complexity gives you flexibility." That was a reasonable trade-off when the alternative was hiring a developer to build everything from scratch. In 2026, AI tools handle much of the repetitive technical work that used to justify WordPress's plugin-driven architecture.

Webflow now has an MCP server with 10 agent skills for AI-powered site management. I use it daily in Cursor to manage CMS content, run accessibility audits, and push updates without opening the Designer. AI agents can bulk-update CMS items, generate alt text across an entire site, check WCAG compliance, and safely publish changes, all through natural language prompts.

On the WordPress side, AI tools can help with content creation and some optimization tasks. But the underlying complexity remains. You still need to manage hosting, update plugins, monitor security, resolve conflicts between plugins after updates, optimize database queries, and configure caching layers. AI can help you write code for WordPress faster, but it cannot eliminate the maintenance overhead that is baked into the architecture.

For a business owner evaluating platforms in 2026, the question is no longer "Which platform has more features?" It is "Which platform lets me focus on my business instead of managing my website's infrastructure?"

Is WordPress Actually Dying?

No. Let me be clear about that. WordPress still powers 42.6% of the web. It has a 59.9% share among sites using a known CMS. Over 500 million websites run on it. The ecosystem includes more than 61,000 free plugins and 30,000 themes. WooCommerce alone powers roughly 33% of all e-commerce stores. These numbers are enormous, and WordPress is not going anywhere soon.

What is changing is the type of site that gravitates toward WordPress versus alternatives. WordPress remains dominant for content-heavy publishers, large e-commerce operations on WooCommerce, sites that need deep custom backend logic, and organizations with existing WordPress expertise where switching costs outweigh the benefits.

But for B2B marketing sites, SaaS landing pages, service business websites, and portfolio sites, the momentum is clearly shifting toward managed visual platforms. These are the segments where Webflow, Framer, and Squarespace are growing fastest, because the trade-off between WordPress's flexibility and its operational burden no longer makes sense for teams that just want a fast, secure, well-designed website that their marketing team can manage independently.

What This Means If You Are on WordPress Right Now

If you are a business owner running a WordPress site, here is my honest assessment.

Do not panic. WordPress is not disappearing. Your site is not going to stop working. The governance crisis is serious, but the core software continues to be maintained, and the community is working on structural solutions through initiatives like FAIR.

Do take security seriously. With nearly 8,000 new vulnerabilities discovered in the WordPress ecosystem last year, and 43% exploitable without authentication, this is not something to ignore. Make sure your plugins are updated, you are running a security plugin, and you have a monitoring system in place. If you do not have the time or expertise to manage this, consider whether a managed platform would better serve your needs.

Evaluate your total cost of ownership. Add up what you actually spend on WordPress: hosting, premium plugins, security tools, developer time for updates and troubleshooting, and the opportunity cost of your team waiting on developers for content changes. Many businesses discover their "free" WordPress site costs significantly more than a Webflow subscription when they account for everything.

Consider whether now is the right time to migrate. If you have been thinking about moving to Webflow or another platform, the tools and processes for WordPress-to-Webflow migration are more mature than they have ever been. Proper 301 redirect mapping preserves SEO equity. Content can be exported cleanly. And the performance gains are often immediate.

The WordPress story in 2026 is not a simple narrative of decline. It is a story about a platform at an inflection point, where the governance model that enabled its rise is now creating the uncertainty that is driving some of its most valuable users away. The market share dip from 43.6% to 42.6% might be a temporary fluctuation. Or it might be the beginning of a longer trend. Either way, business owners owe it to themselves to evaluate their options with clear eyes.

If you are running a WordPress site and want an honest assessment of whether migrating to Webflow makes sense for your specific situation, I am happy to take a look and walk you through the trade-offs. No pressure, just a clear-eyed comparison. Let's chat.