44.5% of WordPress Sites Are Behind the Latest Release, and Popular Sites Barely Do Better

A bakery's website was built on WordPress in 2021, launched, and left alone. It still works: the menu loads, the contact form sends. Behind the scenes it runs a version of WordPress that has missed years of fixes, and nothing on the page tells the owner or the customers.

WordPress updates are free, and minor updates install automatically by default. Major releases, and the fixes that come with them, usually need someone to click Update. When nobody does, a site falls further behind with each release, and the oldest versions no longer get security patches at all.

44.5% of WordPress sites that show their version are not on the current 7.1 release, and 29.9% are more than one major release behind. Popularity barely matters: the most visited WordPress sites are behind the latest release 41.4% of the time, against 45.5% for the least visited.

We used the September 2026 HTTP Archive crawl, a public crawl of more than 15 million websites that records the technology each homepage runs. It identified 4,945,342 WordPress homepages; 3,121,352 of them show their WordPress version, and 1,823,990 hide it. We compared each visible version with the current release on the WordPress.org release list on September 24, 2026, and grouped sites by how popular they are, from the most visited 10k WordPress sites to those outside the top 10 million.

A site counts as behind the latest release, or outdated, when it is not on 7.1; a site on 7.0 is one release behind and may simply be waiting for a scheduled update. "More than one major release behind" means older than 7.0. We also checked 3,431 small business WordPress websites, listed on US Google Business Profiles, that show their version, and recorded whether each redirects visitors from the insecure http:// address to the secure https:// one and whether its security certificate, which makes the padlock appear in the browser, is valid.

55.5% of WordPress sites that show their version run the current 7.1 release. The next largest group, 14.6% or 454,811 sites, is on 7.0, one release behind. Everything older adds up to 29.9%, sites that have skipped at least one full major release.

The long tail is where the risk sits. 757,148 sites are spread across the ten releases from 6.0 to 6.9, a sign that many sites were updated once, some time ago, and then left alone. 124,217 run WordPress 5.x and 52,114 run something older still, 176,331 sites in all. Those releases are many major versions behind the current one.

Site popularity barely moves the share behind the latest release. 41.4% of the most visited 10k WordPress sites are behind 7.1, against 43.4% of sites ranked from 10k to 10 million and 45.5% of sites outside the top 10 million. A site with millions of visitors is almost as likely to be behind as a site with a handful.

The difference shows in the oldest versions. The share running WordPress 5.x or older rises from 3.4% of the most visited 10k sites to 6.3% of sites outside the top 10 million. Large sites often delay major updates for testing; small sites more often stop updating altogether.

Small business websites show the same drift. Of 3,431 small business WordPress websites that show their version, 63.1% run 7.1 and 36.9% run something older. 14.9% are on 7.0, 22% are still on a 6.x release or older, and 3.8% on 5.x or older. Of the small business WordPress sites whose jQuery version is visible, 62% load one older than 3.5.0, the JavaScript library release that many plugins and themes depend on.

Sites behind the latest release are more likely to have other gaps. 10.3% of small business WordPress sites behind 7.1 do not redirect visitors from http:// to https://, more than twice the 4.6% of sites on 7.1. 8.6% have an expired or invalid security certificate, nearly three times the 2.9% of up-to-date sites. A site nobody updates is usually a site nobody checks.

Log in to your dashboard and check the version under Updates. If you are more than one major release behind, take a backup, update plugins and theme first, then update WordPress itself. If you are on 5.x or older, treat it as a project: test on a staging copy first, because some old plugins will not survive the jump.

Turn on automatic minor updates at the least, schedule major updates within a few weeks of each release, and check that your site redirects to https and that its certificate is valid. A monthly routine prevents the slow drift this data shows.

If nobody on your team owns that routine, wordpress maintenance services cover updates, testing and backups every month.

Embed this research

Cite this study