Skip to content
2026 Report

State of Web
Frameworks

30 frameworks. 7 dimensions. The first data-driven analysis of what the web should be built on.

Published May 2026 · by Adyog

7
Recommended
11
Caution / Migrate
7
Dimensions
Executive summary

The web was built for humans reading pages in browsers. That era is ending.

AI agents are becoming the primary consumers of web content. The frameworks chosen in 2005-2015 were designed for a human-centric web that is disappearing.

Astro leads at 84/100. WordPress, which powers 43% of the web according to W3Techs, scores 44/100 — ranking #27 out of 30.
Key findings
Finding 1

WordPress is a systemic risk

11,334 total CVEs. 387 critical. 23 actively exploited. Security score: 22/100. AI-readiness: 35/100.

Finding 2

The modern web is already here

BBC, Stripe, Notion, Linear, Figma run Next.js. Cloudflare and Netlify chose Astro. The companies building the web's infrastructure are not choosing WordPress.

Finding 3

AI-Readiness is the new dividing line

FastAPI scores 95/100 on AI-Readiness. Joomla scores 25/100. The web is bifurcating into AI-ready and AI-obsolete.

Finding 4

The tipping point is real — but only at the top

We scanned 2,245,592 websites. Among the top 100 most-visited: 79% modern. Among the top 10,000: 51.5% modern. Across the broader web: WordPress is 73%. The elite moved. The long tail hasn't.

Finding 5

Every industry has a different framework problem

Government runs Drupal (29% of gov sites), not WordPress. Telecom chose Angular. Healthcare has no dominant framework — fragmentation is the risk. Media is split exactly 50/50. Ecommerce was decided by Shopify, not by any framework.

Finding 6

The ASEAN digital divide is wider than the global one

Singapore government: 68% modern. Philippines government: 17% modern. Same region, same decade, completely different digital realities. Policy drives infrastructure more than GDP.

Scale of analysis

Not opinions. Data from 2,245,592 real websites.

2,245,592
Sites scanned
Continuous scanning across 22 countries
6
Regions
IN, UK, US, AUNZ, EU, SEA
13
Industries
Healthcare to telecom
See full scan methodology and results →
Industry findings

The framework question is industry-specific

Government
Drupal dominates (29%). Not WordPress. The migration question is Drupal 7 → Drupal 10, not CMS → modern.
Healthcare
No dominant framework. Fragmented across Drupal, WordPress, Vue, Angular. The risk is inconsistency, not any single framework.
Fintech
Only industry where modern clearly leads. Next.js dominant. But 11 fintechs still on WordPress — a compliance risk.
Media
Split exactly 50/50. BBC, Sky moved. Rappler, Inquirer didn't. The divide is engineering capacity, not awareness.
Education
76% legacy globally. 93% in ASEAN. Universities are the slowest-moving institutions in every region we scanned.
Ecommerce
Shopify (3,449 detections) made the framework choice irrelevant. Enterprise goes custom React/Next.js. WooCommerce is caught between.
Read all industry insights →
Full rankings

All 30 Frameworks

# Framework Gen Security AI Score Verdict
1 Astro modern 95 92 84 recommended
2 FastAPI modern 90 95 82 recommended
3 Next.js modern 82 88 81 recommended
4 HTMX modern 95 78 79 recommended
5 SvelteKit modern 92 85 77 recommended
6 Nuxt.js modern 88 82 76 recommended
7 Hugo modern 92 88 75 recommended
8 Remix modern 90 83 72 acceptable
9 React modern 80 55 71 acceptable
10 Laravel modern 72 74 70 acceptable
11 Eleventy modern 95 86 70 acceptable
12 Django modern 68 75 67 acceptable
13 Vue.js modern 85 58 67 acceptable
14 Spring Boot modern 55 80 65 acceptable
15 Ruby on Rails modern 62 72 64 acceptable
16 Flask modern 75 70 63 acceptable
17 Angular modern 75 45 63 acceptable
18 Shopify modern 70 50 63 acceptable
19 Gatsby modern 78 60 60 acceptable
20 SolidJS emerging 50 40 51 caution
21 Qwik emerging 50 40 51 caution
22 Fresh emerging 50 40 51 caution
23 Hono emerging 50 40 51 caution
24 Phoenix emerging 50 40 51 caution
25 Squarespace modern 50 30 49 caution
26 Wix modern 50 25 49 caution
27 WordPress legacy 22 35 44 caution
28 Drupal legacy 35 40 41 caution
29 Magento legacy 25 30 35 caution
30 Joomla legacy 30 25 34 migrate away
AI-Readiness

The Divide

AI-Ready
FastAPI 95
Astro 92
Next.js 88
Hugo 88
Eleventy 86
AI-Obsolete
WordPress 35
Squarespace 30
Magento 30
Wix 25
Joomla 25
Security

Highest Risk

WordPress 11,334 CVEs · 387 critical
22
Magento 600 CVEs · 78 critical
25
Joomla 800 CVEs · 65 critical
30
Drupal 1,200 CVEs · 89 critical
35
SolidJS 0 CVEs · 0 critical
50
Direction

Recommendations

New projects

Content: Astro or Hugo. Apps: Next.js or SvelteKit. APIs: FastAPI. Enhancement: HTMX.

WordPress migrations

Content sites: Astro or Hugo. 80%+ hosting savings, minimal attack surface, AI-ready by default.

The frameworks built for yesterday's web are a liability on tomorrow's. The data is clear. The direction is clear.

State of Web Frameworks 2026 · Published by Adyog · Adyog WebPulse

Scores are computed algorithmically. No framework vendor pays for placement.