Hosting provider 20i scanned more than 18.8 million live WordPress sites in the United States and found that 87.86 percent, roughly 16.59 million, run a version older than WordPress 7.1, the major release that arrived in August 2026. That is a big pile of sites falling behind, especially since WordPress shipped three security releases in under four weeks this summer.
The releases themselves show why timing matters. WordPress 7.0.2 fixed one critical and one high-severity issue, and versions 7.0.3 and 7.0.4 added more patches. Still, plenty of sites trail by far more than a point release. About 13.2 million US sites use WordPress 6.x, which covers releases from 2022 through 2026. Another 360,000 run 5.x, roughly 191,000 sit on 4.x, and 45,000 use versions dating back to between 2005 and 2010.
Size offers no protection, either. Micro-businesses lead at 88.4 percent outdated, yet more than four in five sites were outdated in every business-size category 20i checked. Even 86.8 percent of enterprise sites, meaning companies earning over $100 million a year, run outdated WordPress. Overall, American sites make up more than two in five of the outdated sites in 20i’s global sample of over 44 million.
Why it matters comes down to breaches. 20i says software vulnerabilities cause almost one-third of them, or 31 percent. Lloyd Cobb, a director at 20i, pointed out that attackers now work faster with AI, so a site one major version behind can still expose fixes nobody applied and flaws criminals already know how to target.
Cobb doesn’t tell businesses to install every release the minute it lands, though. Online stores in particular need confidence that an update won’t break checkout. He suggests a steady routine instead: test updates before they go live, keep backups ready for a rollback, and let automatic updates handle routine fixes where a managed host offers them.
One caveat deserves attention. The study labels every site below 7.1 as outdated, so a fully patched 7.0.4 site lands in the same bucket as one that hasn’t changed since 2008. The real number of exposed sites is likely lower than the headline. Even so, the pattern points at habits more than at missing patches, and habits are the part a business can actually fix.
