WordPress (both self‑hosted WordPress.org and hosted WordPress.com) remains a dominant option—sources report it powers roughly 43% of websites—so it’s not obsolete by market share, but you should plan for PHP 7.4+, MySQL 5.7+, HTTPS and a managed host to reduce security and maintenance risk [1].
- WordPress powers about 43% of the web according to multiple sources [1].
- Hosts should support PHP 7.4+ and MySQL 5.7+ for modern WordPress sites [2].
- The official plugin directory lists tens of thousands of free plugins (60k–68k+ reported) [3].
- Patchstack reported 7,966 new WordPress ecosystem vulnerabilities in 2024, with 96% originating in plugins [4].
- A typical WordPress build timeline is 6–8 weeks, with Australian agency budgets commonly from $5,000–$30,000 [1].
What are the core technical components and minimum version requirements for a modern WordPress site in 2026?
WordPress.org is the self-hosted distribution of WordPress and requires you to provide hosting and a domain name to run a site [1].
WordPress.com is the hosted platform that abstracts hosting, security, updates and backups if you prefer a managed service [1].
The only absolute prerequisites to start a self-hosted WordPress site are web hosting and a domain name [2].
Hosts should support PHP version 7.4 or higher to run modern WordPress releases [2].
Hosts should also support MySQL version 5.7 or higher for WordPress databases [2].
Hosts should issue a free SSL certificate so your site runs on HTTPS, with Let’s Encrypt commonly provided by quality hosts [2].
Most quality hosts now include a free SSL certificate via Let’s Encrypt as part of their stack [5].
Permalinks must be configured for clean, search-friendly URLs rather than the default query-string structure for good on-page SEO [2].
Leaving permalinks on the plain query-string format produces URLs like yourdomain.com/?p=123 and is bad for SEO and professionalism [2].
WordPress 7.0 shipped on May 20, 2026, and version was already used by 52.0% of WordPress sites on July 26, 2026, so plan for compatibility with WordPress features and themes [6].
You’ll generally want a reliable managed WordPress hosting provider to reduce operational overhead and security risk [1].
Is WordPress outdated in when measured by market share, ecosystem size and vulnerability trends?
WordPress remains a dominant platform: multiple sources report it powers roughly 42–43% of all websites, so market share does not indicate obsolescence [1].
Elementor reports WordPress powers roughly 43% of all websites, reinforcing that market dominance [2].
Other samples put WordPress at 42.6% or 41.2% of all sites, and several summaries state it powers about 43% of the web, showing consistent market-size estimates across sources [4].
Historically W3Techs reported WordPress powers over 43% of all websites and 63% of CMS-based sites, underscoring its CMS market position [3].
The plugin and theme ecosystem remains large: the official WordPress plugins directory has over 60,000 free plugins and some counts place that at 68,000+ free plugins, leaving extensive extensibility [3].
Other tallies show the free plugin directory holding over 59,000 free plugins and that the average WordPress site runs 15–18 plugins, with mid-market installs often running 20–30 plugins, which both explains flexibility and increases exposure [5].
Security vendors and hosts point out that the plugin ecosystem is the largest security exposure for WordPress, with the majority of vulnerabilities originating in plugins rather than core [7].
Patchstack and related reporting counted thousands of ecosystem vulnerabilities in recent years, demonstrating ongoing vulnerability volume in the wider plugin ecosystem [4].
Page-builder adoption continues to shape the platform: observers credit Elementor for much of recent WordPress growth and HTTP Archive found Elementor to be the largest page-builder at 43% mobile adoption in a WordPress sample [8].
Performance baselines such as HTTP Archive measured WordPress at about 45% good mobile Core Web Vitals in 2025, which is a useful benchmark when comparing stacks on UX and performance [6].
Why are some organisations moving away from WordPress in and which alternatives offer measurable trade-offs?
Shifts in product expectations and AI-driven workflows are driving some organisations to re-evaluate platform choices and prefer systems that surface AI and UX as integral features [8].
Some commentators argue that user experience is now the product itself, which changes platform evaluation criteria toward delivery speed and integrated UX tooling [8].
Observers also expect AI-driven assistants to replace many documentation-dependent workflows, which can favour platforms that bake those assistants into the editing flow [8].
Governance and commercial disputes within the WordPress ecosystem have also affected trust and portability for some organisations, with high-profile disagreements and litigation cited as contributors to migration decisions [4].
Public disputes include critical remarks about commercial partners and reported demands tied to trademark licensing, plus litigation between major ecosystem companies that was active in 2024, which together have made some decision-makers cautious [4].
WP Engine and Automattic’s legal interactions and court actions in are examples often referenced when organisations assess long-term portability and vendor risk [4].
SaaS builders such as Webflow have shown measurable adoption increases—Webflow’s active site count grew about 54% between early and April 2025—illustrating a viable alternative when teams trade some control for faster delivery and simpler maintenance [4].
Plugin-security risk and the commercial cost of extensions such as WooCommerce add-ons, which commonly cost $49 to $299 per year, are practical drivers for migration away from plugin-heavy WordPress stacks [7].
How much does it typically cost to build and maintain a WordPress website in 2026, by component?
Premium WordPress themes range from about $50–$100 as a one-off or $50–$200 per year if sold on subscription [1].
Theme pricing summaries place theme costs anywhere from free to $200 per year or as a one-time purchase, so budget accordingly [3].
Most builds go live in to weeks, which you should allow for project timelines and resourcing [1].
A typical Australian agency-built WordPress site can cost roughly $5,000 to $30,000, so plan your first-year budget in that range if hiring an agency [1].
A domain name typically costs about $10–$25 per year on average, so include that as a recurring line item [3].
Web hosting ranges widely from low-cost shared plans up to $300/month or more, with managed WordPress hosting commonly sitting in the $25–$100+/month band depending on included services [3].
Some low-cost managed providers advertise entry prices as low as $2.99–$3.99/month for basic plans, which can suit personal sites [3].
Most small-to-mid-size business sites run comfortably in the $25–$60/month range for managed WordPress hosting according to provider summaries [5].
Individual premium plugins typically cost between $15 and $200, and many premium plugins run $20–$200 each per year, so multiple plugins can add materially to annual costs [3].
WooCommerce extensions commonly cost $49 to $299 each per year, which is an important line item for e‑commerce stores [5].
Developer hourly rates typically range from $25–$150/hour, and maintenance retainers reported by platforms span from $30 to $5,000+ per month depending on scope [5].
Maintenance-focused retainer ranges include personal sites at $0–$50/month, small business sites at $100–$300/month, business/membership sites at $150–$500+/month, and e‑commerce/WooCommerce sites commonly requiring $300–$1,000+/month or more for complex stores [9].
Codeable’s published care plans show maintenance-only tiers around $39–$359/month and full-service bundles around $435–$2,190+/month, with example Basic and Advanced tiers at $140/month and $590/month respectively for different included services [9].
If you self-build, expect a basic first-year budget of roughly $75–$200 for domain, shared hosting and free themes, and then budget ongoing annual costs at about 20–40% of your first-year total for proper maintenance [5].
What hosting, performance and scalability specifications should I require for a WordPress site expected to handle X visitors per month in 2026?
Page-load targets and user expectations matter: a well-built WordPress site should load in under seconds to meet typical expectations [1].
Research shows 47% of users expect a page to load in under seconds, so set performance goals to match that expectation [1].
A modern host should offer single-click WordPress installs and staging environments as part of developer-friendly workflows [2].
Nginx is the leading web-server in known WordPress deployments with a 37.0% share, which can influence your server stack choices if you require specific server behaviours [6].
Managed WordPress hosting typically costs roughly $25–$100+/month and often includes automatic core and plugin updates, scheduled backups and basic server-level security scanning as standard services [9].
Good hosts commonly run automated daily backups of your site database, which is central to recovery planning [2].
Hosting plays a key role in robust WordPress security, and professional providers increasingly rely on isolated container technologies, automatic security updates, staging and proactive attack detection [7].
By 2026, professional WordPress hosts are relying more on container isolation, automatic security updates, staging systems and proactive attack detection to improve resilience and scale [7].
Key hosting security features you should require include current PHP versions, automatic backups, a Web Application Firewall, malware scanning, DDoS protection, SSL encryption and server monitoring [7].
No published figure for exact CPU, RAM or storage quotas per X monthly visitors is available in the claim ledger, so you will need to request those quotas from prospective hosts or run load testing to determine needed resource levels.
What are the most common security and privacy risks for WordPress sites in and which mitigation procedures should be implemented?
The most common security exposure in the WordPress ecosystem is the plugin layer, with vulnerability reports counting thousands of ecosystem issues in recent years [4].
Patchstack’s totals showed 7,966 new WordPress ecosystem vulnerabilities in 2024, underlining high-volume vulnerability activity [6].
Security reporting indicates that 96% of those vulnerabilities originated in plugins while WordPress core had very few issues, with only seven core vulnerabilities reported in the same period [4].
Many vulnerabilities were remotely exploitable without authentication—about 43% in one reporting period—so unpatched sites can be compromised without an attacker logging in [4].
The average mid-market site runs 20–30 plugins, which increases the attack surface when plugins are the primary origin of vulnerabilities [4].
Automated bot attacks carry most of the attack volume against WordPress sites, and small sites are particularly at risk because they often lack strong maintenance and security measures [7].
Out-of-date plugins and themes remain among the biggest security risks and are repeatedly cited by hosts and vendors [7].
Top mitigation steps include regular updates, reliable backups, strong passwords, two-factor authentication, WAFs and active monitoring—each named as essential defence measures by security vendors [7].
Two-factor authentication is now considered one of the most effective measures for modern WordPress security and should be deployed where possible [7].
Host-level safeguards to require include current PHP versions, automatic backups, a Web Application Firewall, malware scanning, DDoS protection, SSL encryption and server monitoring as part of a layered defence approach [7].
Security budgets vary widely, with reported averages typically between $70 and $1,000 depending on the level of protection you choose, so plan resources proportionally to your exposure [3].
Bots continuously scan for unpatched sites, so maintaining a fast patch cadence and proactive monitoring materially reduces compromise risk [7].
For different use cases (personal blog, small business, ecommerce store, enterprise), what is the best building approach and stack in 2026?
Hosted WordPress.com handles hosting, security, updates and backups and is the fastest route to a managed, quick launch if you prefer a fully-hosted solution [1].
Self-hosted WordPress.org requires you to provide hosting and a domain name but enables full customization and choice of plugins, themes and server stack [1].
For personal blogs, self-build first-year costs can be as low as $75–$200 using shared hosting, free themes and minimal plugins, making self-hosted WordPress.org attractive for tight budgets [5].
Small business sites commonly run comfortably on managed hosting in the $25–$60/month range with maintenance retainers in the $100–$300/month band depending on features, so managed WordPress is often the pragmatic balance of cost and speed [5].
For ecommerce, WooCommerce has millions of active installs and W3Techs detects it broadly across WordPress sites, but extensions and maintenance carry notable recurring costs—WooCommerce extensions commonly cost $49–$299 each per year—so factor extension licensing and higher maintenance retainer needs into platform choice [6].
Developer and design investments shape time-to-launch; most builds go live in 6–8 weeks and hiring or partnering with a designer is commonly recommended for better UX outcomes [1].
SaaS builders such as Webflow have shown rapid adoption growth and are a good alternative when speed and lower maintenance are higher priorities than full code-level control [4].
Use the Core Web Vitals performance baseline (WordPress measured at about 45% good mobile Core Web Vitals in 2025) to compare likely performance outcomes across stacks when performance is a decisive criterion [6].
See the comparison table below for a compact mapping of use cases against typical time-to-launch, first-year cost and maintenance ranges.
After launch, what exact maintenance tasks and cadence are required to keep a WordPress site secure and performant in 2026, and which tools automate these tasks?
Most WordPress sites that fail after year one do so because nobody maintains them, so an explicit maintenance cadence is essential from day one [1].
Good hosts run automated daily backups of your site database, which supports safe recovery after failures or hacks [2].
Regular WordPress maintenance significantly reduces the risk of hacks, according to hosting and security providers, so schedule updates and scans frequently [7].
Professional maintenance typically includes updates to WordPress core, plugins and themes, backup verification, performance checks, malware scans, user-management reviews and active monitoring [7].
Maintenance-only care plans commonly cost around $39–$359/month and provide plugin updates, security monitoring, uptime checks and backups, while full-service bundles combining hosting and support commonly charge $435–$2,190+/month depending on scope [9].
Concrete maintenance-tier examples include a Basic maintenance tier at $140/month with one hour of developer time and daily verified offsite backups, and an Advanced tier at $590/month that adds visual regression testing and malware cleanup as covered services [9].
Essential routine steps vendors name include backups, updates, strong passwords, two-factor authentication and scheduled performance checks to keep user experience targets such as sub-2s page loads achievable [7].
Two-factor authentication is a high-impact control you should enable for administrator accounts to reduce compromise risk [7].
How can Site Build Desk help you choose the right WordPress approach and prepare a brief that reduces cost overruns and maintenance risk?
Site Build Desk helps small businesses, online sellers and entrepreneurs choose the right platform and prepare project briefs that reduce scope creep and maintenance surprises (campaign context provided by the site owner).
Use the ledger-backed cost ranges such as a $5,000–$30,000 agency build or a $75–$200 self‑build first year to set realistic budgets in your brief and to allocate maintenance retainers appropriately [1].
Consider maintenance retainer ranges and care-plan examples—WordPress retainers run from $30 to $5,000+ per month depending on scope—when you assign ongoing support in the brief [9].
Prioritise managed hosting and the hosting security checklist—current PHP, automatic backups, WAF, malware scanning, DDoS protection and monitoring—when uptime and security matter for your project [7].
Include designer time in the brief and favour API-friendly architectures with reusable components to future-proof builds, which aligns with recommended practice to hire or partner with a designer and architect around APIs [8].
If you want help drafting a concise brief that maps features to these cost and maintenance ranges, Site Build Desk can prepare that brief and advise on which managed-hosting or SaaS approach best matches your goals (contact details and engagement steps are provided on the Site Build Desk site).
| Source | Market Share Percentage |
|---|---|
| wpcreative.com.au [1] | WordPress powers 43% of the internet [1] |
| elementor.com [2] | WordPress powers roughly 43% of all websites on the internet [2] |
| pravinkumar.co [4] | As of March 2026, WordPress powers 42.6% of all websites globally [4] |
| techtidesolutions.com [6] | WordPress was used by 41.2% of all websites as of July 27, [6] |
| freshysites.com [5] | WordPress powers 43% of the web [5] |
| Use case | Recommended approach | Typical time-to-launch | Typical first-year cost range | Typical maintenance range |
|---|---|---|---|---|
| Personal blog | Self-hosted WordPress.org | 1–2 weeks to configure on shared hosting (single-click installs available) | $75–$200 first year | $0–$50/month maintenance |
| Small business brochure | Managed WordPress hosting (self-hosted) | 6–8 weeks typical agency build time | $5,000–$30,000 build (Australia example) | $100–$300/month maintenance |
| Ecommerce store | Self-hosted WordPress.org with WooCommerce or managed ecommerce hosting | 6–8 weeks typical, plus store setup and integrations | Variable; include extension costs ($49–$299/extension/year) | $300–$1,000+/month maintenance for ecommerce |
| Enterprise site | Managed/enterprise WordPress hosting or hybrid headless approaches | Project timelines vary; plan multiple months | Custom budgets; enterprise plans and integrations often exceed standard agency ranges | Full-service retainers commonly $435–$2,190+/month or negotiated enterprise SLAs |
Key Takeaways
- Choose managed WordPress hosting that provides current PHP, automatic backups, WAF and monitoring to reduce operational risk.
- Budget realistically: self-build first-year sites can cost $75–$200, while agency builds in Australia commonly run $5,000–$30,000.
- Expect plugin costs and maintenance retainers to be ongoing—plan 20–40% of your first-year budget annually for maintenance.
- Prioritise fast loads (sub‑2s) and Core Web Vitals during build and schedule a maintenance plan that includes updates, backups and scans.
- If you need speed-to-market and lower ops overhead, consider hosted or SaaS builders; if you need control and extensibility, choose self-hosted WordPress.org.
Frequently Asked Questions
Is WordPress outdated in 2026?
WordPress still powers roughly 43% of websites, so it isn’t strictly outdated by market share, though you should weigh plugin and performance trade-offs when choosing a stack [1].
Why are people moving away from WordPress?
People are moving away from WordPress for reasons including shifts toward AI-driven workflows and user-experience-first products, governance and portability disputes in the ecosystem, and concerns about plugin security and commercial extension costs [8].
How much does it cost to build a WordPress website in 2026?
A full Australian agency build typically ranges from $5,000 to $30,000, while a self-built basic first-year site can cost $75 to $200; ongoing maintenance commonly sits at 20–40% of the first-year budget or in monthly retainers from $0 to $1,000+ depending on complexity [1].
What is the best way to build a website in 2026?
The best approach depends on your goals: hosted WordPress.com is fastest for a managed launch, self-hosted WordPress.org gives full customization, and SaaS builders like Webflow trade control for faster delivery and simpler maintenance [1].
Sources
- How to Build a WordPress Website in (A Complete Guide) (2026-04-16)
- The Ultimate WordPress for Beginners Guide for 2026 (2026-07-12)
- WordPress Website Cost [+Development Team Price Calculator] (2024-05-23)
- WordPress Is Losing Market Share for the First Time in a Decade. Here Is What Is Actually Happening. (2026-08-26)
- How much does a WordPress site cost? pricing guide (2026-08-17)
- WordPress Usage Statistics 2026: 18+ Key Trends (2026-07-28)
- How to protect your website (2026-07-16)
- My Best Advice for WordPress Product Businesses in and Beyond (2025-10-14)
- WordPress Website Maintenance Cost Explained with Real Market Data for 2026 (2026-03-25)
