8.16 Million WordPress Sites and 5.16 Million in the US: Reading a CMS Baseline

Content management systems dominate internet-facing web exposure, and WordPress dominates content management systems. A measurement session on 20 October 2026 produced a figure large enough to be worth interpreting carefully rather than quoting.

The numbers

Queries ran between 22:32 and 22:37 UTC with sub_type="all" and a page size of one record.

Query	Matched assets
`app="WordPress"`	8,156,602
`app="WordPress" && country="US"`	5,155,170
`app="Apache httpd"`	599,482,423
`app="nginx"`	313,028,543

The WordPress total is an order of magnitude smaller than the web server totals, which is expected: a web server fingerprint matches every host running that software, while a CMS fingerprint requires the scanner to identify the application on top of it.

The US share is the interesting figure

5,155,170 of 8,156,602 is approximately 63%. Two thirds of identified WordPress assets resolve to the United States.

That concentration has a specific explanation in measurement terms. Cloud hosting providers with large US footprints account for a substantial share of internet-facing infrastructure, and scanning engines cluster their collection accordingly. A CMS detected on a hosting provider's US region is counted as US.

It does not follow that two thirds of WordPress sites belong to US organizations. A site owned by a company in Germany, hosted on a US cloud region, appears in the US count.

For a defender, that means the geographic filter is useful for locating hosting infrastructure and much less useful for locating ownership. The question "which of these are ours" cannot be answered by geography.

Why a CMS baseline matters at all

The value of a large, stable population figure is as a denominator for change.

WordPress core is patched routinely. The persistent risk in the ecosystem sits in plugins and themes, where the update cadence is decided by third-party maintainers and where installed versions are frequently invisible to external scanning.

That produces a specific asymmetry: the population that can be counted is the population whose core is identifiable, while the population at risk from a plugin vulnerability is unmeasurable from outside. Reporting on plugin flaws occasionally cites affected-site estimates derived from download counts, which measures adoption rather than exposure.

The web server numbers as a sanity check

Apache httpd at 599 million and nginx at 313 million are consistent with their respective market positions in hosting and enterprise deployments. Neither number has direct security meaning — a web server that is patched, correctly configured and behind a CDN is not an exposure problem even though it is counted.

What the pair does illustrate is scale calibration. When a product returns hundreds of millions of matches, a figure of eight million for a CMS is modest, and a figure of a few thousand for a niche appliance is small in absolute terms but not necessarily in risk terms.

Practical use

For organizations running WordPress estates:

Inventory by installation, not by domain. A single organization may run dozens of installations across brands and regions.
Track plugin and theme versions centrally. This is the actual exposure surface, and external data cannot see it.
Separate update ownership from hosting ownership. A managed host patching core does not patch plugins.
Use external counts for completeness checks only. If a scan finds a WordPress installation on your address space that your inventory does not list, that is the finding.
Record the query definition when reporting. A count without its dork and timestamp is not reproducible.

The fourth item is the only one where external scanning adds something an internal process cannot produce: the discovery of installations nobody documented.

The honest summary

An eight million figure describes how many CMS installations a scanner can identify. It says nothing about how many are vulnerable, how many are maintained, or who owns them. Its proper role is context: a reminder that the web tier is vast, that identification is imperfect, and that plugin-level exposure is invisible to the measurements most often quoted.