Every few months, someone forwards us an article declaring WordPress dead. Usually it’s paired with a market share chart showing a line going down, and usually the person sending it wants to know if they should be worried about the platform their business runs on.
Our answer hasn’t changed in years: we build almost every client site on core WordPress, using the default block editor, Gutenberg, as it ships. Not a page builder plugin bolted on top. Not a closed platform we don’t control. This is the reasoning we actually use internally when a client asks why, weighed fairly against the wider field, Squarespace, Joomla, Drupal, Webflow, Framer, Tilda, and the rest, plus an honest look at the ecosystem drama that’s made 2025 and 2026 uncomfortable years to be a WordPress advocate.
What’s in this guide
- The “WordPress is dying” headlines don’t match what we see
- How WordPress compares to the wider CMS field
- The vibe-coding phenomenon, and why we’re cautious about it
- Why we build in Gutenberg, not a page builder plugin
- The WP Engine and Automattic mess, and why it doesn’t change our answer
- What this means if you’re choosing a platform
- Frequently asked questions
1. The “WordPress is dying” headlines don’t match what we see
Start with what’s true, because the decline is real. WordPress powered 41.5% of all websites as of July 2026, according to W3Techs, down from a peak of 43.6% in early 2025, and Search Engine Journal counted six consecutive months of decline through mid-2026. That’s not a rounding error.
Context changes what it means, though. Independent analysis from The Repository, a WordPress-focused news outlet with no stake in making the platform look good or bad, found that most of what WordPress lost in 2026 didn’t go to a rival CMS. It went to “None,” the category W3Techs uses for sites with no detectable CMS at all: static generators, custom frameworks, and increasingly, AI-generated sites. That’s a changing web, not a mass exodus to a named competitor.
The gap widens further at the top of the web. HTTP Archive’s 2025 Web Almanac put WordPress at roughly 58% of CMS usage among the top 10,000 sites globally. If closed platforms were winning serious businesses over, that’s exactly where it would show up first. It isn’t.
2. How WordPress compares to the wider CMS field
Market share alone doesn’t answer “which platform should you build on.” Here’s how we actually think about the field when a client asks us to justify the recommendation.
| Platform | Type | Can you export and self-host? | Where it actually fits |
|---|---|---|---|
| WordPress | Open source CMS | Yes, full ownership | Businesses that need long-term flexibility and full content ownership |
| Squarespace | Closed SaaS builder | No true export | Simple, design-led sites with no growth or migration plans |
| Joomla | Open source CMS | Yes | Long-time Joomla users; ecosystem and plugin choice is far smaller than WordPress’s |
| Drupal | Open source CMS framework | Yes | Complex enterprise builds with custom data structures and in-house developers |
| Webflow | Closed SaaS design tool | Partial code export, hosting stays proprietary | Designer-led marketing sites where visual precision matters more than a CMS backend |
| Framer | Closed SaaS/AI design tool | No self-hosting | Fast prototypes, portfolios, and landing pages, not a long-term business site |
| Tilda | Closed SaaS block builder | No | One-off landing pages and campaigns, not a full site |
Most of these platforms are perfectly reasonable choices for the job they’re built for. The distinction that actually matters for a client paying us to build something they’ll rely on for years is ownership: does the finished site belong to them outright, or does it exist for as long as they keep paying one company’s subscription. Every closed platform in that table fails that test to some degree.
Worth knowing: “open source” is a legal guarantee, not a marketing term
WordPress core is licensed under the GPL, which means no single company, not even Automattic, can legally withdraw it, lock it behind a paywall, or stop you self-hosting it. A closed platform’s “we won’t do that” is a policy that can change with a new pricing tier. WordPress’s is written into the licence, and that difference is exactly what’s being tested by the governance dispute covered further down.
3. The vibe-coding phenomenon, and why we’re cautious about it
There’s a newer category that doesn’t fit neatly into that table at all: vibe coding, describing what you want to a large language model and letting it generate the whole site or app, often without anyone reading the resulting code. 2025 was the year it went mainstream. Prompt-to-site and prompt-to-app platforms raised enormous funding rounds on the promise that anyone could ship production software by chatting with an AI. 2026 is the year the bill arrived, and the data behind it is worth taking seriously rather than dismissing as tech-industry noise.
Veracode’s ongoing testing of more than 100 large language models found that roughly 45% of AI-generated code samples introduce OWASP Top 10 vulnerabilities, and that failure rate has stayed flat even as the models’ surface-level syntax correctness has climbed past 95%. Escape.tech scanned 5,600 vibe-coded applications running live in production and found more than 2,000 high-impact vulnerabilities, over 400 exposed secrets, real API keys sitting in readable code, and 175 instances of exposed personal data, including medical records and payment details.
The failures aren’t hypothetical. Moltbook, a social app whose founder built it without writing a line of code, launched in late January 2026 and was found within days to have its entire production database exposed, roughly 1.5 million API authentication tokens and 35,000 email addresses sitting in the open. Even Lovable, one of the flagship prompt-to-app platforms with millions of users and a multibillion-dollar valuation, worked through three documented security incidents in a two-month stretch this year. Stanford researchers flagged the underlying problem as early as 2022: developers using AI coding assistants wrote less secure code than those without, while being more confident their code was safe. That gap between confidence and reality is the whole vibe-coding story in one sentence.
The economic consequences followed the security ones. One widely circulated 2026 analysis, published by an AI app-building company itself so worth reading as an interested estimate rather than neutral research, reckoned that of the roughly 10,000 startups that built production apps on AI coding tools by the end of 2025, more than 8,000 needed partial rebuilds or rescue engineering by mid-2026, typically costing £40,000 to £400,000 each. Separately, industry analysts estimate that 70% to 88% of AI coding pilots never reach production at all, the distance between a working demo and something that holds up for real users is where most of them fail.
None of this means AI coding tools are bad, we use them ourselves, every day, for scaffolding, debugging and speeding up routine work. It means the market has just run a two-year live experiment on whether a business can skip proven infrastructure entirely, and the results came back negative for anything beyond a prototype or a weekend project. A prompt can generate a website. It can’t generate fifteen years of security hardening, a permissions model, or a maintenance path that doesn’t depend on re-prompting a black box and hoping. For a landing page, vibe coding is fine. For a business site handling customer data, payments, or bookings, it’s a real and measurable risk, not a hypothetical one.
4. Why we build in Gutenberg, not a page builder plugin
Gutenberg, WordPress’s native block editor, has matured a long way since its rocky 2018 launch. It’s part of core, so it never falls out of sync with a WordPress update, and every block it produces is stored as clean, readable content, not a proprietary format only one plugin can read.
Third-party page builder plugins solve a real problem, drag-and-drop design for people who don’t want to touch code, but they do it by layering a second system on top of WordPress that WordPress doesn’t fully control. Elementor, the most widely used example, has 19 publicly disclosed CVEs, and deactivating it can leave a page showing raw shortcode where your content used to be, a failure mode Gutenberg simply doesn’t have because it’s built into WordPress itself.
Want a site built the way we’d build our own, core WordPress, Gutenberg, no page-builder lock-in? See our WordPress web design packages.
5. The WP Engine and Automattic mess, and why it doesn’t change our answer
We’d be dishonest if we pretended the last eighteen months of WordPress governance news has been comfortable to watch. The Automattic v. WP Engine legal dispute is still active, discovery closed in May 2026 and trial is scheduled for September 2027, so the coverage has gone quiet without the underlying conflict being resolved. A class action against Automattic is proceeding after a judge found the company had tracked WP Engine customers. Separately, WordPress project lead Matt Mullenweg banned Yoast founder Joost de Valk from WordCamp Asia in early 2025, publicly branding him “persona non grata,” a moment that rattled people who’d treated WordPress governance as boringly stable.
Our honest take: none of this reflects well on how WordPress.org is currently governed, and we’re not spinning it as anything other than a real problem the project needs to resolve. Governance concerns raised by the community, about how much power sits with one person and one company, are legitimate.
What it doesn’t do is change our recommendation, because it doesn’t touch what our clients actually rely on. WordPress core is GPL-licensed, open source software. It isn’t Automattic’s to withhold or break over a business dispute with one hosting company, and it never has been. Thousands of hosts, agencies and developers with no stake in Automattic’s fight kept building the entire time this played out in court, and WordPress 7.0 landed on schedule in the middle of an active lawsuit. That’s what decentralisation buys you when the company at a platform’s centre starts behaving badly.
6. What this means if you’re choosing a platform
If you’re weighing this up for your own business, it usually comes down to one question: do you want to own your site outright, or rent access to one?
WordPress, built in core with Gutenberg, gives you a site with content stored in a standard, portable format, no proprietary lock-in, a fifteen-year security track record, and native AI capability built by a project bigger than any single company’s business decisions. It asks more of whoever builds it, there’s no drag-and-drop shortcut baked into the platform itself, but that’s a cost we’re happy to absorb on a client’s behalf rather than pass the long-term risk on to them.
Frequently asked questions
Is WordPress actually losing popularity?
Its overall market share dipped from a peak of 43.6% in early 2025 to 41.5% in July 2026, according to W3Techs. Independent analysis suggests most of that decline is sites moving to no detectable CMS at all, rather than businesses switching to a named competitor. Among the top 10,000 websites globally, WordPress’s dominance is largely unchanged.
Is WordPress still better than Squarespace, or Webflow?
It depends what you need. Squarespace and Webflow all work well for simple, design-led sites you’re not planning to grow or migrate. None of them let you export and self-host a complete copy of your site, which is the main reason we default to WordPress for anything a client expects to own and build on long term.
What is vibe coding and is it safe for a business website?
Vibe coding means generating a website or app by prompting an AI model rather than writing or reviewing the code yourself. It’s useful for prototypes and throwaway projects, but independent testing has found roughly 45% of AI-generated code samples introduce known security vulnerabilities, and real incidents, including exposed customer databases, have followed. We wouldn’t recommend it for a site handling customer data, payments or bookings without a full security review afterwards.
Why don’t you use Elementor or other page builder plugins?
Page builders add a second content and permissions system on top of WordPress. Elementor specifically has 19 publicly disclosed CVEs, and deactivating it can leave a site’s content unreadable. Gutenberg avoids both issues because it’s part of WordPress core, not a plugin sitting on top of it.
Does the WP Engine and Automattic lawsuit affect my WordPress website?
Not directly, unless your site is specifically hosted on WP Engine. WordPress core itself is open source software governed by a GPL licence, not owned outright by Automattic, and the wider hosting and development ecosystem has continued shipping updates throughout the dispute.
If you’d rather have a site built the way we’d build it for ourselves, on WordPress core, without page-builder bloat or platform lock-in, see our WordPress web design packages or our wider small business web design packages.