Original research from TLDWP's detected WordPress dataset — security posture, infrastructure, patch adoption, and live-web trends, written by Stefan Ristić.
WordPress 7.1 already leads the fresh version data, but tens of thousands of recently checked sites are still generations behind. We compared a seven-day snapshot with TLDWP's full rolling dataset to see how quickly WordPress really moves.
Read research article →We grouped millions of detected WordPress sites by domain ending — .com, .de, .io, and 37 more — and compared four observable signals: security headers, public user enumeration, exposed files, and HTTPS. The differences are substantial, but a TLD is a cohort signal, not a verdict on any individual site.
Read research article →We checked millions of live WordPress sites: 38.9% expose public author identifiers through standard WordPress endpoints or author archives. Those values can mirror login usernames, but they are not the same thing by definition. Here's what we measured, why it matters, and how to reduce unnecessary exposure.
Read research article →WordPress core patched a critical unauthenticated RCE (wp2shell) on July 17. Two weeks later, we measured patch adoption across the freshest version-observable sites in TLDWP. The forced-update wave moved quickly, but a measurable vulnerable tail remained.
Read research article →We measured 7,589,296 detected WordPress sites across security headers, exposed files, public user enumeration, malware signals, and core versions. 83% fail our six-header check and 37% expose public user identifiers. Many of the most common gaps are straightforward to fix.
Read research article →Security headers are free, fast to add, and close whole classes of attack — yet 83% of WordPress sites are missing nearly all of them, and only 1.7% score an A. Here's what each header does, how many sites skip it, and copy-paste config to fix yours today.
Read research article →