Wordpress Visitor Statistics

WordPress is the most attacked CMS in publicly reported exploit patterns (2023)—and visitor spikes can reflect bot probing. See the visitor stats that matter.
Attila HorváthGeorge Lockwood

Written by Attila Horváth

Fact-checked by George Lockwood

Statistics
19
Sources
19
Sections
6
Reading time
5 minutes
WordPress has broad reach, with 150+ million people using WordPress sites worldwide. That scale shapes not just visitor behavior, but also the kinds of security pressure and performance signals site owners should watch. This page connects threat targeting and bot activity with user-experience metrics like LCP, TTFB, and INP, plus practical factors such as caching and image loading that affect mobile speed and drop-off.

Key Takeaways

  1. 143.3% of all websites used WordPress in May 2024 (market share)
  2. 2WordPress remains the most attacked CMS platform based on publicly reported vulnerability exploitation patterns in 2023 (CMS targeted by attacks)
  3. 3In 2023, 18% of web application attacks involved bot activity (relevant to credential stuffing and probing of WordPress login endpoints)
  4. 4Wordfence reported millions of attempted attacks against WordPress sites in 2023 (threat volume)
  5. 5The WordPress Security Team reported 15,000+ security issues handled since 2004 (security operations scale)
  6. 6Core Web Vitals Google guidance uses an LCP target of 2.5 seconds or faster (performance threshold)
  7. 7Core Web Vitals Google guidance uses a TTFB target of 0.8 seconds or faster for good (performance threshold)
  8. 8Core Web Vitals Google guidance uses an INP target of 200 milliseconds or less for good (performance threshold)
  9. 9Average WordPress websites have higher Lighthouse performance scores when server-side caching is enabled (performance uplift)
  10. 10Google reported that 53% of mobile site visits are abandoned if pages take longer than 3 seconds (user drop-off)
  11. 11WordPress plugins exceed 59,000 in the official WordPress plugin directory (ecosystem scale)
  12. 12The official WordPress theme directory lists more than 9,000 themes (ecosystem scale)
  13. 13The median INP (Interaction to Next Paint) across the HTTP Archive dataset was 123 milliseconds (interactivity baseline relevant to WordPress sites)
  14. 1434% of pages had LCP images not preloaded (a common avoidable performance issue in content-driven CMS sites including WordPress)

WordPress powers 43% of sites worldwide but faces heavy bot and exploit attacks, making caching and Core Web Vitals crucial.

Related reading

01Industry Overview

8
  1. 143.3% of all websites used WordPress in May 2024 (market share)
  2. 2WordPress remains the most attacked CMS platform based on publicly reported vulnerability exploitation patterns in 2023 (CMS targeted by attacks)
  3. 3In 2023, 18% of web application attacks involved bot activity (relevant to credential stuffing and probing of WordPress login endpoints)
  4. 4WordPress.org reports 150+ million people use WordPress sites worldwide (end-user reach estimate)
  5. 5WordPress is the most popular CMS in the United States with 37.2% market share among CMS sites (North America CMS adoption)
  6. 6WordPress.org recommends MySQL 5.7+ or MariaDB 10.3+ (minimum database requirement)
  7. 755% of respondents said they use WordPress for business websites (usage share in surveyed organizations)
  8. 8WordPress has over 100 million downloads of core software updates annually (update volume proxy)

More related reading

02Security And Risk

2
  1. 1Wordfence reported millions of attempted attacks against WordPress sites in 2023 (threat volume)
  2. 2The WordPress Security Team reported 15,000+ security issues handled since 2004 (security operations scale)

More related reading

03Performance Benchmarks

3
  1. 1Core Web Vitals Google guidance uses an LCP target of 2.5 seconds or faster (performance threshold)
  2. 2Core Web Vitals Google guidance uses a TTFB target of 0.8 seconds or faster for good (performance threshold)
  3. 3Core Web Vitals Google guidance uses an INP target of 200 milliseconds or less for good (performance threshold)

04Visitor Experience

2
  1. 1Average WordPress websites have higher Lighthouse performance scores when server-side caching is enabled (performance uplift)
  2. 2Google reported that 53% of mobile site visits are abandoned if pages take longer than 3 seconds (user drop-off)

More related reading

05Platform Ecosystem Adoption

2
  1. 1WordPress plugins exceed 59,000 in the official WordPress plugin directory (ecosystem scale)
  2. 2The official WordPress theme directory lists more than 9,000 themes (ecosystem scale)

More related reading

06Performance Metrics

2
  1. 1The median INP (Interaction to Next Paint) across the HTTP Archive dataset was 123 milliseconds (interactivity baseline relevant to WordPress sites)
  2. 234% of pages had LCP images not preloaded (a common avoidable performance issue in content-driven CMS sites including WordPress)

Cite this report

This report is designed to be cited. We maintain stable URLs and versioned verification dates. Copy the format appropriate for your publication below.

APA
Attila Horváth. (2026, September 22). Wordpress Visitor Statistics. Sigmadax. https://sigmadax.com/wordpress-visitor-statistics
MLA
Attila Horváth. "Wordpress Visitor Statistics." Sigmadax, 22 Sep 2026, https://sigmadax.com/wordpress-visitor-statistics.
Chicago
Attila Horváth. 2026. "Wordpress Visitor Statistics." Sigmadax. https://sigmadax.com/wordpress-visitor-statistics.

Sources and references

19 datasets cited across this report. Attribution is report-level.

w3techs.comwordfence.comcisa.govcloudflare.comwordpress.orgweb.devkeycdn.combusiness.google.comhttparchive.orgdeveloper.chrome.comg2.comsiteefy.comwordpress.com

6 additional datasets are cited and not shown individually.