I've been doing SEO since 2005, and if twenty years of watching Google has taught me anything, it's to pay attention when a trend line disagrees with the prevailing narrative.
So here's a trend line for you: US search interest in WordPress just hit a five-year high.
After years of headlines about AI website builders eating the web, no-code platforms replacing developers, and one very public legal fight, more people are typing “WordPress” into Google than at any point since 2021. And look at what they're typing. The queries rising fastest alongside the spike aren't hobbyist curiosity — they're buying signals: “wordpress development company” (+450%), “wordpress development services” (+400%), “what is wordpress used for” (+300%).
Now here's what makes that spike interesting: it's happening at the same moment WordPress's famous market share number — the “43% of the internet” stat everyone quotes — actually dipped.
Interest up. Headline share down. Something doesn't add up.
Except it does, and I'm going to walk you through it. TL;DR — here's what you're about to discover:
- The market-share “decline” is mostly Google destroying the incentive to mass-produce spam sites — an economy I watched get built on WordPress firsthand, back in my PBN days
- At the top of the web, where real businesses live, WordPress is more dominant than the headline number ever suggested
- The vibe-coding experiment produced a security hangover that's sending founders back to proven platforms
- WordPress 7.0 quietly shipped the most strategically important feature of the AI era — and Automattic is putting real advertising money behind the platform (plugin developers, take note)
Let's take it piece by piece.
The Market Share “Decline” Is Not What It Looks Like
First, the numbers everyone's arguing about.
According to W3Techs, WordPress powers 41.5% of all websites as of July 2026, and 59.2% of all sites built with a known CMS. That's down from a peak of 43.6% in early 2025 — and Search Engine Journal counted six consecutive months of decline through May 2026. After a smaller wobble in 2022–2023, this is the first time the line has bent decisively downward.
Cue the obituaries.
But here's the question almost nobody asked: which WordPress sites disappeared?
Because “market share of all websites” is a strange metric when you think about it. It treats a Fortune 500 publishing operation and an abandoned auto-generated affiliate blog as equal units. W3Techs measures what it calls the relevant web — many millions of sites with real content, filtered to exclude parked and duplicate domains. When sites die, get deindexed, or lose their traffic, they fall out of that sample. The composition of the measured web changes, and the percentages move with it.
So the real question is: what got removed from the web between 2024 and 2026?
Google Demolished the Spam Web — and the Spam Web Ran on WordPress
Here's the part of the story the market-share doomers skip entirely. And here's where I stop citing studies and start speaking from experience — because on this particular point, no study exists. Nobody surveys spammers about their CMS preferences.
In March 2024, Google formally rewrote its spam policies around three practices: scaled content abuse (mass-producing pages to manipulate rankings), expired domain abuse, and site reputation abuse — better known as parasite SEO. Google defined scaled content abuse as generating many pages primarily to manipulate rankings with little value added for users, and then it started enforcing that definition with a vengeance.
If you've never worked in SEO, here's the one concept you need to make sense of all three: links are currency. From the beginning, Google's algorithm has treated a link from one site to another as a vote of confidence — and even today, in the AI-search era, links still drive rankings. That single fact created an entire shadow economy. PBNs and webspam networks were never built for readers; they existed for exactly one purpose: to manufacture and sell backlinks that powered other sites' rankings.
Expired domain abuse was that economy's favorite shortcut, and it's worth spelling out because it shows how industrialized the whole thing became. A domain that once belonged to a real business — a retired dentist's practice, a defunct local newspaper — keeps the link authority it earned over years, even after the business is gone. So spammers would buy the expired domain, rebuild a website that looked plausibly like the old one, and then quietly turn it into a repository for low-quality, mass-produced content stuffed with paid links. To Google, it looked like an established site with a decade of history. Under the hood, it was a link warehouse. I watched this playbook run at industrial scale — and, as with everything else in this economy, the site slapped on top of that expired domain was almost always a WordPress install.
The fallout was immediate and brutal. Within days of the March 2024 update, SEOs documented entire websites vanishing from Google's index overnight — “Pure Spam” manual actions arriving in Search Console, portfolios of AI-content sites deindexed en masse. Originality.ai's analysis found more than 1,400 sites out of a ~79,000-site sample removed from search completely — and every deindexed site it examined showed signs of AI-generated content.
And Google didn't stop. The August 2025 spam update hit hard too — Google never names its targets, but case studies of the fallout found sites propped up by exact-match spammy backlinks — classic private blog network (PBN) footprints — among the hardest hit. Then the March 2026 core update and the March 24, 2026 spam update — the fastest spam update Google has ever rolled out, finishing in under a day — kept the pressure on, with post-mortems documenting devastating traffic losses at sites running high-volume AI content operations, and some niche publishers losing rankings for their entire catalogs overnight. Templated location pages, thin affiliate reviews, auto-generated FAQ farms — all of it got flattened.
Now ask yourself: what platform were those sites built on?
I can answer that one personally. Early in my career, I built private blog networks. I've participated in high-profile SEO experimentation projects. I've watched links I was tracking evaporate from PBNs overnight, and I've seen — more than once — exactly what it looks like when Google decides a network shouldn't exist. It doesn't devalue it. It vaporizes it.
And in twenty years of that work, virtually every made-for-SEO site I built, bought into, or audited ran on WordPress. Every PBN node. Every content farm. Every thin affiliate blog. Not because there's anything wrong with WordPress — because it was free, scriptable, and infinitely cloneable. A PBN operator could spin up 200 sites in a weekend. Content-farm operators ran thousands of cookie-cutter WordPress installs. When AI writing tools arrived in 2023, those same operators bolted GPT pipelines onto WordPress and scaled from thousands of pages to millions. If I had to put a number on it, I'd estimate more than 90% of the world's webspam runs on WordPress. You won't find that figure in a peer-reviewed study — but I'd take the bet.
Now, let me be precise about what “demolished” means, because Google can't actually remove anything from the web. No search engine can delete a website. What Google controls is the incentive. Spinning up and maintaining a network of made-for-SEO WordPress sites costs real time and real money — domains, hosting, content, link management — and that investment only pays off if Google counts the links and ranks the pages. So Google attacked the ROI from both ends: it got dramatically better at spotting these networks, and it started ignoring or erasing their influence entirely. When the expected lifespan of a spam asset drops below what it costs to build, the business model dies.
That's what actually happened between 2024 and 2026. Google didn't delete the spam web — it eliminated the demand for it. People simply aren't building these networks at scale anymore, and the old inventory — deindexed, worthless, abandoned — is expiring without being replaced.
Google broke the spam economy. Not WordPress — Google. And when abandoned spam sites fall out of the “relevant web” sample by the tens of thousands while no new ones take their place, the platform that hosted them loses headline market share, even if not a single legitimate business left.
To be straight with you: I can't prove causality here. W3Techs doesn't publish a CMS breakdown of dead sites, and analysts have offered other explanations for the dip, from the rise of framework-built sites to ecosystem drama. But as someone who watched the spam economy from the inside for two decades, my read is that a meaningful chunk of the WordPress “decline” is the web's junk tail being amputated. That's not a platform in retreat. That's a platform getting healthier by subtraction.
The Number That Tells the Truth: WordPress Dominates Where Quality Is Highest
If the decline were legitimate businesses abandoning WordPress, you'd expect to see it at the top of the web first — the sites with budgets, developers, and options.
That's not what the data shows:
- 41.5% of all websites — but 59.2% of every site built with a known CMS (W3Techs)
- Roughly 58% of CMS usage among the top 10,000 sites (HTTP Archive's 2025 Web Almanac)
- Wix and Shopify: 4.3% and 5.2% of the overall web, and — in the Web Almanac's words — “almost absent” from the top 10,000
Read that again. Among the sites that matter most — the ones with real audiences, real revenue, and real engineering teams — the platforms allegedly eating WordPress's lunch all but vanish. They're concentrated almost entirely in the small-site segment — the same segment where the AI site builders now compete with them.
So the honest picture looks like this: at the low end of the web, there's genuine churn — casual users trying prompt-to-site tools, spam operations getting deleted, hobby sites going stale. At the high end, where businesses live or die by their websites, WordPress remains the default choice of the professional web.
Which raises the obvious next question: if AI site builders are winning the low end, why is search interest in WordPress rising?
The Vibe Coding Hangover
2025 was the year “vibe coding” went mainstream — describe what you want, let the AI generate it, ship it without reading the code. Prompt-to-site platforms raised enormous rounds on the promise that anyone could build production software by chatting.
2026 is the year the bill arrived.
The security data alone is sobering. Veracode's ongoing testing of more than 100 large language models found that roughly 45% of AI-generated code samples introduce OWASP Top 10 vulnerabilities — and that failure rate stayed flat from 2025 into 2026 even as the models' syntax correctness climbed past 95%. Escape.tech scanned 5,600 vibe-coded applications running live in production and found more than 2,000 high-impact vulnerabilities, over 400 exposed secrets (real API keys sitting in readable code), and 175 instances of exposed personal data — including medical records and payment details. One developer who audited 50 vibe-coded apps found that 88% had database row-level security entirely disabled: any query could return any user's records.
Georgia Tech's Vibe Security Radar, which traces published CVEs back to AI-generated code, tracked the trend line going nearly vertical: 6 attributable CVEs in January 2026, 15 in February, 35 in March — more in that one month than in all of 2025 — and the researchers estimate the true count is five to ten times higher, since most AI tools leave no fingerprints in commit history.
The failures aren't hypothetical. Moltbook, a social app whose founder proudly built it without writing a line of code, launched in late January 2026 and was found within days to have its entire production database exposed — roughly 1.5 million API authentication tokens and 35,000 email addresses sitting in the open. Even Lovable, the flagship prompt-to-app platform with millions of users and a multibillion-dollar valuation, worked through three documented security incidents in a two-month stretch this year.
Perhaps most telling: Stanford researchers saw this coming as far back as 2022, finding that developers using AI assistants wrote less secure code than those without — and were more confident their code was secure. That gap between confidence and reality is the whole vibe-coding era in one sentence.
The economic consequences followed. One widely circulated 2026 analysis — from Creatr, itself an AI app-building company, so treat the exact figures as vendor estimates — reckoned that of the roughly 10,000 startups that built production apps on AI coding tools by the end of 2025, more than 8,000 needed partial rebuilds or rescue engineering by mid-2026, at a typical cost of $50,000 to $500,000 each. “Rescue engineering” is now a legitimate specialty; “vibe-coded debt” appears in actual job descriptions. And industry analysts estimate that 70–88% of AI pilots never reach production at all — the distance between “works in a demo” and “works for 10,000 users” is where they die.
None of this means AI coding tools are bad. (We use them enthusiastically — more on that below.) It means the market ran a two-year experiment on whether businesses can skip proven infrastructure, and the results came back. A prompt can generate a website. It cannot generate fifteen years of security hardening, a plugin ecosystem, a global developer talent pool, or a maintenance path that doesn't depend on re-prompting a black box and hoping.
For a landing page or a weekend prototype, vibe coding really is great. For a business that needs to still exist in three years? People are Googling “WordPress” again for a reason.
Meanwhile, WordPress Made the Smartest Move of the AI Era
Here's where the story stops being about what died and starts being about what's being built.
On May 20, 2026, WordPress 7.0 “Armstrong” shipped — in my view the most consequential release since Gutenberg, with more than 875 contributors behind it. And buried under the visible improvements (a command palette across the whole admin, block-level custom CSS, a modernized dashboard) is the real headline: WordPress now ships native AI infrastructure in core.
Three pieces matter:
The AI Client. A provider-agnostic PHP API that lets WordPress — and any plugin — talk to AI models from Anthropic, Google, OpenAI, and others through a single interface. Site owners connect their preferred provider once, under Settings → Connectors, and every AI-capable plugin on the site can use it. No more seventeen plugins each demanding their own API key.
The Abilities API. A typed, permission-gated, schema-validated registry of everything a WordPress site can do — create a post, update a product, manage a member. It landed in core in WordPress 6.9 late last year and matured in 7.0. Think of it as WordPress formally describing its own capabilities in a machine-readable way, with WordPress's existing permission system enforcing who (or what) is allowed to invoke each one.
The MCP Adapter. This is the piece that changes the game. The Model Context Protocol (MCP) is the emerging open standard that lets AI agents — Claude, ChatGPT, Cursor, and whatever comes next — discover and operate external tools. The MCP Adapter, an official companion plugin kept deliberately out of core so it can ship on its own cadence, exposes a WordPress site's registered abilities as MCP tools at a standard endpoint. Any MCP-capable AI agent can now connect to a WordPress site and work with it directly — with the site's permissions and human approval controls in force. We believe in this direction enough that we’ve already shipped on it ourselves — more on that below.
WordPress developer Jorijn Schrijvershof captured the strategic logic perfectly: the AI Client makes WordPress a caller — able to use AI. The Abilities API and MCP make WordPress a callee — usable by AI. And the callee interface is the one that survives provider churn. Models will come and go; the standard way for agents to operate a website is being defined right now, and WordPress just made itself the first major platform to implement it in core.
This isn't vaporware. WordPress.com rolled out full agent access in March 2026 — AI tools like Claude and ChatGPT can now create, edit, and manage posts, pages, and media on WordPress.com sites, with human approval controls on every action. TechCrunch covered it. Adoption is following: the top 40 AI-powered WordPress plugins drew more than 315 million visits in a single year, per WP Mayor's running stats roundup. Automattic has gone so far as to position WordPress as the operating system of the agentic web — and for once, the marketing language undersells the engineering.
And Automattic is putting real money behind the platform. As I write this, Meta's Ad Library shows WordPress.com running more than 130 active paid ads — I counted them myself this morning, and you may well have seen a few in your own feed. Plugin developers should pay close attention to where those ad dollars lead, because the funnel changed: WordPress.com opened plugin installs to its lower-priced plans starting in September 2025, and as of this spring every paid plan can install plugins — down to the entry-level Personal tier. Every user those ads acquire is now a potential plugin customer. Automattic isn't just building an AI-native platform; it's paying to fill the funnel that ends in the plugin ecosystem.
WordCamp US 2026 (August 16–19 in Phoenix) has a dedicated “AI in Action” track. WordPress 7.1 is targeted for August 19, with 7.2 slated for December. The release cadence is back, and it's pointed squarely at one thing.
The Agentic Web Needs Something to Stand On
Step back and connect the threads, because they converge on a single idea.
The next era of the web is agentic: AI assistants researching, transacting, and taking actions on behalf of people. That era needs websites that agents can reliably operate — structured capabilities, real permissions, predictable APIs. Not a pile of prompt-generated code that no one, human or machine, can safely reason about.
Consider what each contender brings to that future:
- Vibe-coded apps are opaque by construction. There's no standard interface, no permission model, no schema — just whatever the generator produced that day. They're the hardest possible surface for agents to work with safely.
- Closed builders (Wix, Squarespace, Shopify) can add AI features, but you're renting their roadmap. Their AI works the way they decide, on the data they let you touch, until they change the terms.
- WordPress is open source, self-hostable, owned by you — and now natively speaks the protocol AI agents use. You control the data, the permissions, and the provider.
That last point connects to something deeper that's been resurging alongside the search interest: the ownership argument. As AI-generated content floods every rented platform, and as social feeds become algorithmically hostile to anyone who won't pay for reach, businesses are relearning the oldest lesson on the internet: don't build your house on rented land. A website you own — with your content, your customer relationships, your member data, on infrastructure you control — is the one digital asset no platform shift can take from you.
For fifteen years that was a philosophical argument. In the agentic era it becomes a practical one: when AI agents are doing real work on your behalf, whose infrastructure do you want them operating on — yours, or someone else's?
This is, frankly, why I'm bullish. MemberPress exists because we believe businesses should own their audience and their revenue rather than rent access to it. Everything above — the spam purge rewarding legitimate sites, the vibe-coding correction, WordPress becoming AI-native — points the same direction: toward owned, durable, professionally-built web presence.
WordPress just spent two years absorbing every punch the industry could throw and came out the other side as the platform best positioned for what's next.
The Honest Caveats
A reference post is only useful if it's straight with you, so here's what the comeback story does not erase:
The lawsuit isn't over. The Automattic/WP Engine litigation is very much ongoing — discovery closed in May 2026, and trial is currently scheduled for September 2027. Coverage has gone quiet, but quiet is fatigue, not resolution. The December 2024 preliminary injunction that restored WP Engine's access to WordPress.org resources remains in force, and the ecosystem has largely gotten back to work, but the underlying dispute remains live.
Governance is unresolved. WordPress.org still operates without the formal governance structure many in the community have asked for. The project's bus factor is a legitimate long-term question, and pretending otherwise helps no one.
The low-end erosion is partly real. Not every lost site was spam. Prompt-to-site tools really do serve the “I need a five-page site by Friday” user better than WordPress does today, and that segment isn't coming back. WordPress's future is as the professional and business layer of the web — which, as the top-of-web data shows, is exactly where it's strongest.
7.0 adoption takes time. As of this writing, about half of WordPress sites still run version 6 — though adoption has been strikingly fast, with version 7 already on more than 40% of WordPress sites within two months of release. The AI infrastructure story still plays out over the next 12–24 months as the rest of the install base updates, plugins adopt the Abilities API, and the agent ecosystem matures.
We'd rather you hear all of that from us than from a comment section.
What This Means If You Run a Website
If you're deciding where to build — or whether to stay — here's the practical read:
If you run a business on WordPress: you're standing on the platform that just became the default interface between the web and AI agents. Keep core updated, and start paying attention to which of your plugins register abilities. The plugins that make themselves agent-operable first will define the next wave of the ecosystem. (Yes, we’re on it — in fact, we just shipped it. MemberPress AI Foundation is our own MCP and it's live as an add-on under MemberPress → Add-ons in your WordPress dashboard, available on Launch, Growth, and Scale plans. It’s our first step toward making your membership site fully agent-operable.)
If you were tempted by prompt-to-site tools: use them for what they're great at — prototypes, throwaway pages, exploration. But look hard at the security and rescue-cost data before putting revenue, member data, or customer trust on one. The businesses paying $50,000–$500,000 for rescue engineering this year all thought it wouldn't be them.
If you left WordPress during the drama: the drama got quieter, the software got dramatically better, and the strategic position got stronger. It's worth another look.
If you're building for the long term: the lesson of 2024–2026 is that the web rewards durability. I've spent twenty years watching Google's updates torch shortcuts — including some I'd built myself — and reward genuine value. The AI-builder correction taught the same lesson from a different direction: maintainable foundations win, opacity loses. Own your platform, own your audience, build things that last.
The Real Story Behind the Trend Line
So why is everyone searching for WordPress again?
Because the two-year stress test is over, and the results are in. Google burned down the spam economy — an economy I watched get built on WordPress, one cloned install at a time — and WordPress's legitimate core came through with its dominance of the quality web intact. The vibe-coding experiment taught a generation of founders the difference between generating a website and owning one. And while everyone was busy writing obituaries, WordPress shipped the most strategically important release in its history — becoming the first major platform that the coming wave of AI agents can natively, safely operate.
The market share headline says WordPress got smaller. The evidence says the web got cleaner, and WordPress got stronger, more concentrated among the sites that matter, and better positioned for the next decade than at any point since Gutenberg.
I've watched Google reshape the web every few years since 2005, and it usually breaks something I care about. This time, it cleared the field for the platform I'd bet on. That's not a platform in decline. That's a platform whose comeback the trend line noticed before the pundits did.
Sources referenced in this article:
- W3Techs — WordPress usage statistics · CMS market overview · historical trends
- Search Engine Journal — WordPress market share declines six months in a row
- The Repository — WordPress market share data series
- HTTP Archive — 2025 Web Almanac, CMS chapter
- Google Search Central — March 2024 core update & new spam policies
- Search Engine Journal — sites deindexed after March 2024 update · Originality.ai manual-action study
- Search Engine Land — August 2025 spam update · Sterling Sky case study
- Google Search Status Dashboard — March 2026 spam update · Search Engine Land — March 2026 core update
- Veracode — GenAI Code Security Report · Spring 2026 update
- Escape.tech — vibe-coded application security scan
- DEV Community — 50 vibe-coded apps audit
- Georgia Tech Research — Vibe Security Radar
- Wiz — exposed Moltbook database
- The Next Web — Lovable security incidents
- Stanford (Perry, Srivastava, Kumar, Boneh) — Do Users Write More Insecure Code with AI Assistants?
- Creatr — vibe coding technical debt analysis
- CIO — AI pilots failing to reach production
- WordPress.org — 7.0 “Armstrong” release · AI Client announcement · MCP Adapter · 2026 release schedule
- Jorijn Schrijvershof — WordPress 7.0 caller/callee analysis
- WordPress.com — AI agent content management · TechCrunch coverage
- Automattic — WordPress: Operating System of the Agentic Web
- WP Mayor — WordPress AI statistics
- The Repository — Automattic v. WP Engine litigation status · TechCrunch — December 2024 injunction
- WordCamp US 2026
- WordPress.com — plugin access opens to Personal & Premium plans (Aug 2025) · current plan features
- Meta Ad Library — WordPress.com active ads (count as of July 8, 2026 — firsthand observation)
- Google Trends — “wordpress,” United States, past 5 years
Add a Comment