← All insights
Security & Trust

At 10 Million Sites Scanned, WordPress Is 74.3% of Everything We Detect

The largest independent framework scan ever conducted shows a web even more concentrated than W3Techs suggests.

· 5 min read
Share on X LinkedIn
At 10 Million Sites Scanned, WordPress Is 74.3% of Everything We Detect

WebPulse has now scanned over 10 million sites across Tranco top-100K, Common Crawl WARC archives, and regional domain lists. Among detected frameworks, WordPress accounts for 74.3% — three out of every four sites where we can identify the underlying technology.

The Scale of Concentration

10,002,735
Total sites scanned
Source: WebPulse scan aggregation (June 2026)
74.3%
WordPress share of detected
Source: WebPulse framework detection across all scan sources (June 2026)
0.56
Herfindahl-Hirschman Index
Source: WebPulse computation from detection data (June 2026). HHI above 0.25 indicates high concentration.

What This Means

An HHI of 0.56 is far above the 0.25 threshold that economists use to define a concentrated market. The detected web isn't just WordPress-heavy — it's a near-monoculture. When a single codebase underlies three-quarters of detectable sites, every WordPress vulnerability is a systemic event.

11,334 new vulnerabilities
WordPress CVEs in 2025
Source: Patchstack annual report (2025)

This concentration also explains why the web feels homogeneous. The same themes, the same plugins, the same performance bottlenecks — because 74.3% of detected sites share the same technical DNA.

Important Qualifier

WebPulse detects frameworks via HTML signatures and HTTP headers. WordPress has the strongest signatures of any framework — its output is unmistakable. Modern frameworks like Next.js and Astro produce cleaner HTML that's harder to fingerprint. Our 74.3% is 'of detected' — not 'of the web.' The actual WordPress share of all websites is lower, but its share of identifiable sites is this dominant.

Share this insight
More insights