New analysis highlights widespread WordPress version gaps as organizations face continued exposure to known software vulnerabilities
More than 16 million WordPress websites in the United States are running outdated software, according to new research from web hosting provider
20i, highlighting the ongoing challenge businesses face in keeping websites updated as cyber threats continue to evolve.
20i analyzed more than 18.8 million live WordPress websites in the United States and found that 87.86%, representing more than 16.59 million sites, were running versions older than WordPress 7.1, the latest major generation released in August 2026.
The findings come amid a series of recent WordPress security releases addressing vulnerabilities across the platform. Software vulnerabilities have become a significant source of security breaches, accounting for almost one-third (31%) of breaches, according to 20i.
Multiple WordPress Security Updates Released
WordPress issued three security releases in less than four weeks during July and August 2026.
WordPress 7.0.2 addressed one critical and one high-severity security issue, followed by additional security fixes in versions 7.0.3 and 7.0.4. WordPress recommended that users update their installations following each release.
Despite the availability of newer versions and security updates, millions of U.S. websites remain on older WordPress generations.
According to the 20i analysis, approximately 13.2 million U.S. websites are still running WordPress 6.x, a generation spanning releases from 2022 through 2026. Around 360,000 sites remain on WordPress 5.x, while approximately 191,000 are running WordPress 4.x. A further 45,000 websites are using versions dating back to between 2005 and 2010.
The scale of the U.S. market means American websites account for more than two in five of all outdated WordPress websites identified in 20i's global analysis of more than 44 million websites.
Outdated Software Affects Businesses of All Sizes
The global research also suggests that outdated WordPress software is not limited to smaller organizations.
Micro-businesses recorded the highest proportion of outdated WordPress websites at 88.4%. However, more than four in five websites were classified as outdated across every business-size category analyzed.
The research found that 86.8% of websites operated by enterprise businesses generating more than $100 million in annual revenue were also running outdated WordPress software.
Lloyd Cobb, Director at 20i, said:
“With hackers able to act much quicker as AI changes the threat landscape, keeping software up to date is more important than ever. Being one major version behind might not seem like much, but if important security fixes haven't been applied, it can leave a website exposed to issues that attackers already know how to target.
“The answer isn't necessarily to install every major update the moment it's released, as businesses need to know an update won't affect how their site works, particularly if it handles sales. What’s important is having a process in place so updates are tested and dealt with rather than continually pushed back.
“Managed WordPress hosting includes automatic updates that can take care of many fixes, while major changes should be tested before going live and backed up so they can be rolled back if something goes wrong. That gives businesses a much better chance of staying current without putting the day-to-day running of their website at risk.”
Methodology
20i used BuiltWith to analyze the CMS versions of live WordPress websites globally and identify websites running outdated software. For the purposes of the analysis, websites running versions below WordPress 7.1 were classified as outdated.
The business-size analysis used available annual revenue data and grouped businesses into five categories: micro-businesses ($100–$10,000), small businesses ($10,000–$1 million), SMBs ($1 million–$10 million), mid-market businesses ($10 million–$100 million), and enterprises (more than $100 million).
