Is WordPress dying because of AI?
If you spend any time on X lately, you’d think so. AI is the future. Everybody’s going static. WordPress has no place in the world anymore.
Well… not everybody is saying that. Mostly it’s the drama queens. The folks who make extreme statements and act as if the whole world is black or white. Every few months there’s a fresh round of it. Back in April it was Cloudflare launching EmDash, which got billed as a WordPress replacement. (I had some fun with that one in OMG! WordPress Is Dying!)
And to be fair, they’re not making it all up.
WordPress market share has dropped. According to W3Techs, WordPress peaked at 43.6% of all websites at the start of 2025. Today it’s at 39.5%, and most of that drop happened this year.
Some plugin developers are hurting, too. Katie Keith, CEO of Barn2 Plugins, has been unusually open about it. Barn2’s new sales are down 48% over two years, and when she surveyed 33 plugin companies last year, 80% said new sales were flat or down.
And people are building sites with Astro and plain static HTML, which absolutely have a place. Astro got big enough that Cloudflare brought the whole Astro team on board in January. I’ve started using it myself (more on that in a minute).
So something is changing. The question is what, exactly.
I work inside WordPress every single day. AI has completely changed how I do that work… honestly, almost nothing about my workflow looks the way it did a year ago. So I want to cut through the hype and give you my take on where WordPress actually stands.
Why People Are Saying WordPress Is Dead
Before getting into what’s changing, it’s worth asking who’s doing the loudest talking.
A lot of the people declaring the death of WordPress have something to sell. “Let me get you off that evil WordPress with all its security holes” is a pretty convenient pitch when you’re about to offer the replacement. Others are just fishing for engagement. Extreme takes get clicks.
That doesn’t make them wrong about everything. But it’s worth knowing where a hot take is coming from before you rebuild your business around it.
What’s Actually Changing
Here’s the real shift… WordPress is no longer the automatic default.
For a long time, it was the thing everybody reached for when they wanted a website. Everybody knew it. Even a simple five-page brochure site for a small business would end up on WordPress, simply because it was the known solution.
That’s no longer needed. You can build a nice brochure site with AI very easily, and frankly, I’d recommend you don’t use WordPress for that kind of site. You don’t need a content manager for five pages that rarely change.
So yes, a lot of those simple sites are dropping off WordPress. Rightly so.
I also saw someone on X running tests where they asked AI to build different kinds of sites. The AI never recommended WordPress on its own. You had to bring it to the table yourself. I tend to believe it. The popular AI site builders don’t even offer it. Vercel’s v0 builds everything with Next.js and React, and Lovable says plainly that it doesn’t offer a choice of framework.
But here’s the other half of the story. AI is speeding up the alternatives, and it’s also getting baked into WordPress itself.
WordPress 6.9 added the Abilities API, a standard way for AI tools to understand what a site can do. WordPress 7.0 went further, with an AI client built into core. The official MCP Adapter plugin lets AI agents like Claude connect to a site directly. And just this week, the WordPress AI team laid out a plan to make WordPress manageable by whatever AI agent you choose. (I covered the Abilities API side of this in A Smarter WordPress.)
Almost every major plugin is becoming AI-native, too. And AI works with WordPress extremely well. That’s how I spend my days.
So what you’re really seeing is leakage off the bottom of the market. The sites that never needed WordPress in the first place are leaving. Even after this year’s drop, WordPress still runs 58% of all websites that use a known CMS.
Why Real Sites Aren’t Going Anywhere
Now take the other end of the market.
Picture the average membership site. It’s running FluentCRM, WP Fusion, maybe WooCommerce, a booking plugin, and a handful of other tools that all talk to each other. (Here’s how my own membership site is built, if you want a real example.) Somebody comes along and says you should rebuild that whole thing by vibe coding it with AI.
That would be asinine. That’s just the truth of the matter.
Switching a site like that off WordPress comes with a massive cost, and there’s no real payoff. The site works. The tools are mature. Nobody is going to throw that out because the cool kids on X said “screw WordPress.”
WordPress also has things no new platform can copy overnight. A huge network effect. An enormous plugin ecosystem… the official directory passed 60,000 plugins last year and is now over 70,000. And a massive community. Last year alone there were more than 81 WordCamps in 39 countries, with nearly 100,000 people attending and over 5,000 volunteers running them.
The moment you need to build anything with real plumbing underneath, you’re not going to run to AI and code it from scratch.
So my thesis is pretty simple. WordPress is going to get more specialized in the kinds of sites it’s the best fit for. It’s not going extinct. The bottom of the market will slowly move to other tools, the same way nobody would spin up Drupal for a little brochure site.
But for sites that do real work, WordPress stays the foundation that makes that work doable. On a platform you still own and control.
Owning Your Platform Still Matters
That owning and control part is a big deal to me.
If you’ve followed my stuff for a while, you know I take digital sovereignty seriously. (I boiled it down to 8 principles in The WP Edge last year.) The idea is simple: you own and control your own platform, and you’re not depending on a long list of third-party tools to keep your business running. One of the beauties of WordPress is that you build a platform you own, and you can pick it up and move it anywhere you want.
Now look at what happens with a lot of AI-generated static sites once they need real functionality.
If you’re stubborn about “no WordPress,” you end up wiring the site to outside services over APIs. Opt-in forms send people to a third-party CRM. The store runs on Shopify. I’ve even seen AI-built sites hand the entire checkout over to Stripe’s hosted pages.
Will it work? Sure.
But think about what you’ve built. You’ve got a big pile of static HTML you’d never want to hand-code (and maybe couldn’t), so you depend on your AI tool of choice to maintain it. And on top of that, the site only works because of a web of outside services… most of which charge you a monthly SaaS fee. You’ve gone from owner to renter.
Then somebody says, “Just vibe code your own CRM.”
Really? You’re going to recreate something like FluentCRM, or any full marketing automation platform, by vibe coding it?
Have fun.
Themes Are Where the Real Disruption Is
If you want to know where WordPress is going to get shaken up the most, look at themes.
I’ve heard people say themes are dead. They’re not. But this is the part of WordPress most ripe for change.
Think about why page builders exist. Elementor and all the others sprouted up to solve one problem: most people didn’t know how to hand-code a design. That was a real problem for a long time, and it’s why Elementor alone runs on 12.5% of all websites.
With AI, that problem is basically gone.
You don’t need a big page builder anymore. Yes, Elementor and the others are adding AI (Elementor AI is built right into the editor now), and AI can work with them. But at some point you have to ask… why bother? AI can just build you a custom theme, exactly to your specs. Want to change something? Tell your AI and it updates the theme. Put the theme on GitHub and you’ve got version control, too.
I was already moving away from page builders before AI came along, for performance reasons. (I wrote about switching from page builders to Gutenberg blocks back in 2023.) AI just finishes the job.
I’ve actually removed the Kadence theme from some sites recently. Not because I have anything against Kadence. I like it and still use it quite a bit. I just didn’t need it on those sites anymore. It made more sense to build a fully custom theme for that client and set them up so they can change it with their own AI.
You don’t need a point-and-click interface to design your site anymore. You can talk it out with your favorite AI tool.
Plugins Are Moving Upmarket
I’ve also heard people say WordPress plugins are dying. That they’re the dinosaurs.
How could that possibly be?
Plugins are what made WordPress, WordPress. They’re the reason everybody started using it. There’s a massive ecosystem of well-built plugins out there, developed by teams, with the edge cases already worked out. Upload, activate, and you’ve got that entire tool sitting inside a platform you own and control.
That’s a big deal, and it’s why plugins aren’t going anywhere.
What is changing is the small stuff. You can vibe code a simple plugin now, and it’s not a big deal. I’ve done it several times for clients who needed one specific thing. I’ll code it up with Claude and it works beautifully. So there are definitely plugins you don’t need to buy anymore.
The sales numbers back that up. In Barn2’s survey, the plugins hit hardest were the simple ones that are easy to replace, often with drops of 30% or more. Katie Keith lists people vibe coding their own replacements with ChatGPT or Claude as one of the reasons.
But that’s not true for all plugins. Not even close.
I think plugins move upmarket. The mature ones keep maturing. Nobody is going to rebuild FluentCRM with AI. I guess you could, but why would you, when you can activate a plugin and have a full marketing automation CRM that you own and make all the rules for?
So the site of the future is a combination of both. Mature plugins for the heavy lifting. AI-coded solutions for the little one-off needs that never justified buying a plugin in the first place.
What’s Going On With WordPress Security?
We have to talk about security, because there have been a lot of WordPress security updates lately. People like me who manage sites for a living have been dealing with it quite a bit. WordPress core alone has shipped security releases in almost every month since July.
AI has a lot to do with it, in two directions.
AI is finding the holes
On one side, AI is finding security holes at a pace nobody has seen before, and those holes are getting plugged.
Wordfence says about two-thirds of the reports to its bug bounty program now involve AI, and submissions are up 453% since late 2025. Their own AI researcher has become their number one finder of vulnerabilities. Security reports for WordPress core and its official plugins sat in the dozens per month for about nine years. In July they hit 450.
The biggest example came in July. A researcher used an AI model to find “wp2shell,” which Wordfence called the first critical unauthenticated WordPress core flaw in nearly a decade. It took the AI about 10 hours to find. It got patched, and WordPress pushed the fix out through automatic updates.
The AI companies themselves are in on it. Anthropic shows up in the credits on several recent WordPress core security releases, like 7.1.3. And Matt Mullenweg announced that plugin updates now get held briefly for AI-assisted review before they go out by auto-update.
That’s a good thing. My take is that we’re in a period of adjustment, and all of this is making WordPress a more secure platform, not a less secure one. The sheer number of fixes just makes it look more problematic than it is.
The catch is that you have to actually apply those fixes. Patchstack found the median time from a vulnerability being targeted to the first exploit attempts was 5 hours. (More on that in this WP Edge issue.) “I’ll update it eventually” doesn’t cut it anymore.
Vibe-coded plugins are creating them
On the other side, there’s a wave of new plugins being vibe coded and pushed out the door. The WordPress.org plugin team was getting about 700 new plugin submissions a week in May… five times what it saw two years earlier. In their words, “AI has lowered the barriers.”
Some people seem to think that if AI wrote the code, it must be secure. I’m not sure where anyone gets that idea.
Veracode tests AI-generated code every year. In its 2026 report, AI-written code still failed about 44% of security tests, and bigger models did no better. A Stanford study found people using AI assistants wrote less secure code, and were more confident it was secure. Patchstack says it has found vulnerabilities in AI-generated plugins already.
So there’s nothing inherently secure about vibe-coded software. In some cases it’s Swiss cheese, and you’d be way better off with a mature, well-maintained plugin.
It’s also worth knowing where WordPress problems actually live. In Patchstack’s latest report, 91% of the 11,334 vulnerabilities found in 2025 were in plugins and 9% in themes. Only six were in WordPress core, all low priority. Core rarely has serious holes. Wp2shell was the exception that proves the rule. Which plugins you choose matters a lot more. (It’s why I’m picky about plugins.)
Leaving WordPress doesn’t make you immune
And the static site folks who say “I don’t have to deal with any of that”? Sure. Your site doesn’t do anything. That’s why it’s immune.
That’s fine for a simple site. But any site that does real work has code and a database behind it, and security issues can show up there no matter what platform you use.
Vibe-coded apps prove the point. One researcher scanned 1,645 apps built with Lovable and found 170 of them leaking data, including emails, API keys and payment details. And the JavaScript world that Astro and friends are built on has its own problems. Last year a self-spreading worm compromised over 500 npm packages.
Even Wordfence’s Mark Maunder pointed out that reinventing login, permissions and user roles from scratch is “a risky prospect.” WordPress has had decades of people hammering on that stuff.
Moving off WordPress doesn’t make you immune.
The Hybrid Approach (And How I Run BMA Now)
Even for the sites that stay on WordPress (and I think most will), the way we work with WordPress is changing. It already has.
My own site is a good example. I recently moved the entire front end of Blog Marketing Academy over to Astro. What you’re reading right now isn’t being served by a WordPress theme. (I explained the thinking in I Fired WordPress From One of Its Jobs. I’d already done the same with my personal site, davidrisley.com.)
Weird, huh? For a guy who’s in the WordPress business.
But the site works great, and it’s a lot faster. WordPress is still running in the back end, because there’s a lot of plumbing back there.
Astro isn’t good at anything dynamic, though. So for the parts of the site where people log in (like my clients’ account dashboard), I use a fully custom WordPress theme that matches the Astro front end. When people log in, they can’t really tell the difference. And when I want to change the dashboard, I tell my AI and it updates the theme.
Publishing still works like the old days. I publish an article in WordPress, and it rebuilds the Astro front end automatically.
I recently helped a client do something similar, without the Astro part. He used ChatGPT to come up with a new design mockup for his site, and he liked it a lot better than what he had. But he runs FluentCRM and other tools inside WordPress, so moving him off WordPress wouldn’t have been worth the hassle. Instead, I turned his mockup into a fully custom theme just for his site, synced to GitHub for version control. Now his AI talks to the theme (and to FluentCRM through an MCP connection), and I have the same access. We can both work on it.
There are other routes, too. Static site exporters like Simply Static (I haven’t tried it yet, but it looks cool) let you keep using WordPress the way you always have, then generate a full static copy of the site for visitors. WordPress core doesn’t have to boot up to serve your content… which has always been the source of WordPress slowdowns, and the whole reason performance plugins exist. With a static front end, you don’t need performance plugins at all.
I even saw someone describe turning WordPress on only when they need to make changes. It generates the static site, then they turn it back off. Interesting. I might look into that one.
The point is, you don’t have to use WordPress the way you did three or four years ago. The day-to-day role WordPress plays is shifting. But the fundamentals that make it great for real work, on a platform you own, aren’t going anywhere.
Where This Leaves WordPress
So where does all this leave us?
WordPress isn’t going anywhere. Its role in the market is shifting. Sites that never really needed WordPress are moving to other tools. That’s already happening, and it makes perfect sense.
For complex sites, it’s a different story. If you have real content workflows, user management, memberships, multiple authors, or e-commerce you actually control, WordPress makes all of that easy. Tools like FluentCRM keep plugging into it because it’s such a great foundation for that kind of work.
That “control” part matters. Yes, you could run your store on Shopify or send everyone to Stripe’s checkout directly. Then go look up the horror stories from people who had their Stripe account shut off because they did something that wasn’t approved. It happens. Stripe’s own risk policy says it will typically pause payouts, usually for 120 days, when it decides an account is too risky. (Stripe has privacy wrinkles inside WordPress, too, but at least there you control the rest of the setup.) You want to own the platform.
AI is also making WordPress more usable for non-developers. People who can’t code can now customize things, even debug their own sites, and handle a lot of the mechanical work of publishing.
There’s a simple reason AI is so good at it. WordPress is fully open source, it has a massive community, and it’s probably one of the most documented pieces of software on the planet. Every AI knows how WordPress works. That makes it an incredibly valuable platform to pair with AI… the opposite of obsolete.
And with the hybrid approaches, you can modernize your front end without giving up the foundation and all the tools running on top of it.
Who Should (and Shouldn’t) Be on WordPress Now
Most of my Concierge clients run membership sites. That’s who I mostly work with. And there isn’t a single one of them I’d look at and say, “Yeah, let’s vibe code an alternative to that.”
Their sites do too many things with proven, out-of-the-box tools. And I can still work on those sites with AI all day long. There’s no need for them to change, and it would be a mistake to try.
Small brochure sites are different. If someone asked me to help build one, I’d at least ask the question: do we even need WordPress for this?
Sometimes the answer is no. Sometimes it’s still yes… usually so the client can log in and point-and-click their way through small changes if they’re not comfortable with AI themselves.
And that’s a real consideration. Those of us watching this stuff closely forget that a lot of people are still stuck in the ChatGPT chat box. They’re not going to vibe code anything.
Don’t Get Locked In to Someone Else’s AI
If that describes you, here’s my advice.
Don’t hire someone to rebuild your site with AI tools that only they know how to use. You’ll end up dependent on that person for every little change, and I wouldn’t recommend that to anybody.
A better setup? Let them use whatever AI tools they like, but put you on something like WordPress. When the project’s done, you can still log in and manage your own platform without going through anybody.
You never want to give that up.
It’s Not Zero or 100
The people declaring the death of WordPress are, in my opinion, baiting you. Or they have some reason to say it.
One of the biggest problems I see is that people get too binary in their thinking. Something is either at zero or at 100. Somewhere along the way, we lost the ability to see that there’s a range.
So you get extreme statements. Somebody posted on my timeline this morning that WordPress plugins and themes are “toast.”
Why do people talk like that? It’s clearly not the case. A few seconds of thought would tell you that.
But that’s not to say WordPress isn’t shifting. It is… quite a bit. Hopefully I’ve captured where it really stands.
