CLN LoginExecutive Summary
Data from a global survey of 210 WordPress agencies and freelancers reveals a segment that is small in headcount but wide in responsibility. Most agencies are solo operators or small teams (78%), and yet many manage dozens or hundreds of client sites, on WordPress and usually on other platforms too. The defining theme across this report is between what agencies are responsible for and the resources they have to meet it. The leverage agencies are reaching for to close that gap is centered around AI and automation.
Lean teams, large portfolios, broad scope
The typical WordPress agency in 2026 is a solo operator or small team responsible for a portfolio that ranges from a handful of sites to well past a hundred. Most agencies (70%) build on other platforms too: React or Next.js sites, Shopify stores, web apps. WordPress specialists are the minority. Headcount and portfolio size are only loosely linked, which means site count is the better guide to the operational load an agency actually carries.
Hosting and platform decisions sit with the agency
Hosting and platform decisions sit with the agency
83% of agencies either choose the hosting outright or recommend it and stay involved in the final decision. The CMS call is theirs in nearly three quarters of engagements too. Where sites run, on managed hosting or self-managed VPS and dedicated servers, is the dividing line that shapes every downstream decision. 80% of agencies sit firmly on one side of that line, and scale pushes them toward owning infrastructure: 90% of agencies running more than 100 sites operate at least some of them on self-managed VPS or dedicated.
Services as the New Growth Engine
Facing a margin squeeze from competitors and rising operational costs, hosters are looking to increase Average Revenue Per User (ARPU). The data shows a decisive pivot toward a service-led model: 50% of providers plan to expand professional services to drive revenue, outpacing all other tactics. Whether through site builds, maintenance, or security remediation, the modern host is evolving from an infrastructure landlord into a technical partner.
Security is driven by infrastructure, and patching is the universal headache
The security approach an agency takes follows from where its sites run: self-managed agencies lean on server-level tools, managed-hosting agencies lean on WordPress plugins, and the hosting provider’s tooling fills in around the edges. Across the agency segment, the dominant security cost is not breach response. It is keeping plugins and themes updated across all client sites, named as a top challenge by 65% of agencies and rising to three in four at the largest portfolios. About one in four agencies (28%) say overall security work is significant, heavy, or overwhelming.
Performance is heavier than security, and updates scale poorly
37% of agencies describe performance work as significant, heavy, or overwhelming, slightly heavier than security at 28%. The biggest performance challenges sit at the application or client-decision layer: plugin bloat (59%), slow third-party scripts that clients add after launch, and client budgets capping hosting and CDN choices. When it comes to updates, the agency segment has not yet settled on a default approach. Four roughly equal patterns share the market, and at the largest portfolios manual one-site-at-a-time updating is at 45%. That’s the operational reality signaling automation has not yet caught up.
AI is widely used, and agencies want more
Nine in ten agencies are already using AI tools somewhere in their workflow, concentrated in the obvious creative and coding uses: content writing (59%), code (53%), SEO (39%). At the same time, the areas of biggest operational pain are barely touched: only 16% currently use AI for site monitoring or maintenance automation. The capabilities agencies most want from AI next, automated WordPress updates with intelligent pre-update testing (38%) and automated security across client sites (35%), map directly onto that gap. Inside coding workflows, agentic AI is no longer exotic: nearly two in five agencies are already running AI agents (Cursor, Claude Code, Windsurf) for complex, multi-step tasks.
Overall
The picture is internally consistent across the six chapters. Agencies carry portfolio-scale responsibility on small-business resources, the work splits along infrastructure lines, and the dominant ongoing headache is the patching and maintenance load that grows with every site added. AI and automation are simultaneously the force agencies expect to impact the segment and the lever they plan to utilize. The agencies that find that leverage early will be the ones best positioned for what is coming.
1
Who WordPress Agencies Are
How WordPress agencies operate begins with who they are. Across 210 agencies and freelancers, one pattern holds: small teams carrying a large and varied operational load. Most agencies are solo operators or small shops, yet many manage dozens or hundreds of client sites, and most offer a wide menu of services that reaches well beyond WordPress. That combination, broad responsibility on lean resources, is the backdrop for everything else in this report.
Most agencies are small teams
We asked respondents how they would describe their organization.
Nearly four in five agencies (78%) are solo operators or small teams of up to 10 people. Only about one in five has more than 10 people on staff. This is an industry segment built from mostly small businesses.
Portfolios run wide
We then asked how many WordPress sites each agency actively manages or maintains for clients.
About 1 in 5 agencies manage more than 100 client sites
Half of agencies manage 20 sites or fewer. The rest sit further along the range, and for many a portfolio is not a handful of pet projects. It is an ongoing book of dozens to hundreds of live sites, each one a client relationship and a potential support call.
Team size does not tell you the operational workload
The previous two numbers are usually assumed to move together: bigger agency, bigger portfolio. They do, but only loosely, and the gaps are worth a closer look.
Portfolio size rises with team size, but the relationship is weak enough that headcount is a poor guide to operational load.
A solo freelancer carrying responsibility for a hundred-plus sites is not an outlier in this data. At the other end, the largest agencies often run fewer, larger, higher-touch engagements where 20 sites is a full book.
Agencies carry a broad service scope
Building sites is the common denominator, but it is rarely the whole job. We asked which services agencies offer.
The typical agency offers a median of three services, and the average is closer to four. Building sites is the base, but most agencies also host and maintain client sites, and nearly half take on security and performance directly.
Scope widens with the portfolio. Agencies managing more than 20 sites offer around five services on average, compared with roughly three for those under 20. As the book of sites grows, so does the kind of work attached to it.
WordPress is the anchor, not the whole story
- 30% work exclusively on WordPress
- 70% also build elsewhere
WordPress specialists are the minority. Most agencies are multi-disciplinary shops for whom WordPress is the primary platform but not the only one. Their work ranges across custom React or Next.js builds, Shopify stores, and standalone web apps.
Solution Spotlight
Nova is an AI-powered website and app builder that turns simple prompts into fully functional digital projects.
It enables users to quickly create and publish both WordPress websites and modern web applications without coding, making it easy to deliver professional online experiences faster.
The big picture at a glance
A typical WordPress agency in 2026 is a small team or a solo operator, running a portfolio that can stretch from a handful of sites to well past a hundred, offering a broad and growing menu of services, on WordPress and usually beyond it. The responsibilities are wide and continuous. The resources to meet them are finite.
2
Hosting and Platform Decisions
The decisions agencies make about hosting and platform set the operational reality for everything that follows. Where a site runs determines what security looks like, how performance and updates gets handled, and what happens when something breaks. This chapter looks at who makes those calls, what agencies actually use, and what drives the choice.
Agencies own the hosting decision
When a client engagement starts, the question of where the site will live almost always lands with the agency.
83% of agencies either choose the hosting outright or recommend it and stay involved in the final decision. Only 7% report the client picks hosting independently.
And the platform decision sits with them too
A similar pattern shows up for the CMS or framework itself.
More than half of agencies (54%) choose the technology based on project requirements, and another 20% recommend it with the client making the final call. The platform decision sits with the agency in nearly three quarters of engagements. Agencies are the architects of the technical stack their work runs on, not order-takers building to a client’s spec.
Most agencies pick one hosting model and stay there
We then asked how agencies actually host client sites.
Self-managed VPS or cloud servers tops the list, but the more useful signal is how agencies are split into two camps:
- 42% of agencies use only self-managed infrastructure (VPS or dedicated)
- 38% use only managed hosting options
- 20% mix both
The hosting model is mostly an agency-level choice, not a per-client one: four in five agencies operate entirely within one camp.
Scale pushes agencies onto their own infrastructure
Self-managed and managed-hosting groups are not evenly distributed across portfolios. The bigger the book of sites, the more likely an agency is to operate the infrastructure itself.
90% of agencies managing 100+ sites run at least some of them on self-managed VPS or dedicated infrastructure
Below 20 sites, the split is close to half and half. Between 21 and 100, two-thirds are self-hosting at least part of their portfolio. Past 100, almost all of them are. The pattern reflects familiar economics: the per-site cost of managed hosting adds up across a large portfolio, configurations are easier to standardize on servers the agency controls, and large clients often need setups that managed hosts will not accommodate.
Solution Spotlight
Price, performance, and security top the list
We asked agencies to pick up to three things that matter most when they choose or recommend hosting.
Three criteria sit clearly at the top: price, performance, and security, each chosen by more than four in ten agencies. Reliability and support follow at around a quarter each. Below those five, every other factor drops to single digits.
WordPress is not under platform pressure
We asked how often clients raise the idea of moving off WordPress for something else.
85% of agencies say their clients never or rarely consider switching from WordPress
46% report it never comes up at all. Another 39% say it surfaces occasionally but is not a trend. Only 15% see it more often, with 7% calling it a regular conversation. Whatever pressure WordPress feels at the platform level, it is not translating into a steady stream of clients asking their agencies for an alternative.
What hosting decisions set in motion
Agencies own both the hosting and the platform choice for the vast majority of their client work, and increasingly on infrastructure they run themselves. Those choices determine the security model, the performance toolkit, and the update workflow each agency carries.
3
Security
Security is one of the heaviest pieces of operational work agencies carry across a client portfolio. This chapter looks at how they approach it, where the overhead concentrates, and how the workload actually feels.n
Security sits at the infrastructure layer or the WordPress layer
We asked agencies which approach they primarily use to secure client WordPress sites.
No single approach dominates. The four main models sit between 16% and 32%, with agencies spread across plugins, server-level tools, host-provider security, and manual practices. Only 3% report having no structured approach at all.
Self-managed agencies lean on server-level tools they operate themselves, with WordPress plugins playing a secondary role. Managed-hosting agencies are inverted: WordPress plugins are the primary line of defense, supplemented by whatever the hosting provider includes. Manual practices cluster with the self-managed group, which is not surprising: agencies that already operate the OS layer are likely to have additional security processes as well.
Keeping plugins and themes updated is the dominant headache
We asked agencies which security challenges create the most risk or overhead for their business, with up to three picks.
65% of agencies name keeping plugins and themes updated as a top security challenge Nothing else is close. Brute-force attacks, clients not following best practices, and cleaning up malware cluster in the 27% to 33% range: real concerns, but clearly secondary. Compliance and cross-site contamination drop into single digits.
The dominant security concern across agencies is not breach response. It is the day-to-day work of staying patched across dozens or hundreds of WordPress installs.
The patching problem scales with the portfolio
The dominance of plugin and theme updates is universal for all agencies, but the weight grows sharper as portfolios get bigger.
Among agencies managing 1 to 20 sites, six in ten name plugin and theme updates as a top security challenge. At 21 to 100 sites, two-thirds do. Past 100 sites, three in four. Other challenges intensify with scale too: malware cleanup roughly doubles between small and large portfolios, and “clients not following security best practices” rises sharply at mid-size portfolios. But patching is the one that grows most universally.
Patching across a hundred-plus sites is a different operation from patching five. The work compounds with every site added, while the time available does not.
Solution Spotlight
Imunify360 is an automated, multi-layer security platform with components designed specifically for WordPress. Its WAF for WordPress carries thousands of plugin and theme rules and applies virtual patches at the request layer, blocking known exploits without requiring the agency to push a plugin or theme update across every client site the moment new versions land. The same engine is available three ways: as part of Imunify360 for server-level deployments, embeddable in other products via Imunify Connect, and as a standalone Imunify WordPress plugin for agencies running on managed hosting.
Most agencies find the workload manageable, but a real minority does not
We asked agencies to describe the overall security workload across their client portfolio, including both routine work like monitoring and patching, and reactive work like incident response and malware cleanup.
- 72% describe security work as minimal or manageable
- 28% say it is significant, heavy, or overwhelming
For most agencies, security fits inside the rhythm of normal operations. For about one in four, it is a substantial ongoing time commitment. The smaller group reporting heavy or overwhelming workloads is where security has started crowding out other work entirely, and where automated security solutions can make the most impact.
What the security picture sets up
Security splits along the same line as hosting: self-managed agencies own it at the server layer, managed-hosting agencies handle it at the plugin layer, and the hosting provider’s tooling fills in around the edges. What they share, regardless of where the work sits, is the challenge of keeping client sites patched as portfolios grow.
4
Performance and Operations
Performance work runs alongside security in the operational load agencies carry. The pain points are different, but the pattern is the same: small teams, large portfolios, and a need to deliver speed at scale.
Plugin and theme bloat is the top performance challenge
We asked agencies which challenges create the most difficulty when delivering fast, high-performing WordPress sites, with up to three picks.
Plugin and theme bloat sits at the top by a wide margin. The next four challenges cluster in the 23% to 30% range: slow client-added scripts, tight client budgets for premium hosting or CDN, hosting resource limitations, and Core Web Vitals. The technical fundamentals of WordPress performance (caching, images, database) sit lower on the list, which suggests they are largely solved problems when budget and architecture allow.
Client-induced performance problems scale with the portfolio
One of those client-driven pain points sharpens dramatically as portfolios grow.
Among agencies running 20 sites or fewer, only one in six names client-added scripts as a top performance challenge. By 21 to 100 sites, more than a third do. Past 100 sites, half. Plugin and theme bloat stays roughly flat across portfolio sizes (around 60% everywhere), but client-induced performance drag is a problem that intensifies with scale, both because there are more clients adding scripts and because the agency has less per-site time to audit them.
Solution Spotlight
nMAx Cache runs alongside it at the server level as a component of CloudLinux, serving cached pages directly from the web server with about 3× faster time to first byte on cached pages.
Performance feels heavier than security
We asked agencies to describe the overall performance workload across their portfolio, including both routine optimization and reactive fixes.
- 63% describe performance work as minimal or manageable
- 37% say it is significant, heavy, or overwhelming
That 37% high-burden share is higher than what agencies reported for security (28%, in the previous chapter). Where security can largely be systematized and automated, performance fixes tend to live closer to the site itself: caching tuning, image work, plugin replacement, code optimization. Fixes are often site-specific, which makes performance harder to apply at portfolio scale than security.
Updates are managed four different ways
We then asked how agencies manage WordPress updates (core, plugins, themes) across their client sites.
No single approach dominates. Manual one-site-at-a-time updates lead at 29%, with WordPress management platforms close behind at 26%, automated updates with manual review at 17%, and hosting provider tools at 16%. A small share (7%) doesn’t actively manage updates for clients at all. The tooling is fragmented, and no default has emerged.
Manual updates dominate the largest portfolios
Of the four main approaches, manual one-site-at-a-time updating concentrates exactly where you would expect it not to.
45% of agencies managing 100+ sites still update WordPress manually, one site at a time At smaller portfolios, manual updating sits at about a quarter of agencies, alongside management platforms and automated options. At 21 to 100 sites it stays at roughly the same share. Past 100 sites, it jumps to nearly half. The simplest reading is that automation tooling has not caught up with the operational reality of large WordPress portfolios, providing an opportunity for software vendors to fill this gap.
What performance and operations set up
Performance work appears heavier than security for the typical agency, and most of the toughest pain (plugin bloat, client-added scripts, tight budgets) sits at the application or client-decision layer, where fixes are site-specific.
Updates, the other half of ongoing operations, have not yet found a default approach across the majority of agencies, and at the largest portfolios a plurality of agencies are still patching by hand.
AI and automation are the obvious leverage points for both.
5
AI and Automation
AI is the newest form of automation in the agency toolkit, and by this point it is almost universal. The question is no longer whether agencies use AI but where they apply it, what they want from it next, and how they see it changing their business. This chapter looks at all three.
AI is already prevalent in agency workflows
We asked agencies where they are already using AI tools in their day-to-day work.
Nine in ten agencies are already using AI tools somewhere in their workflowOnly 8% of agencies say they have not adopted AI tools at all. Adoption concentrates in the obvious creative and coding applications: content writing, code generation and debugging, SEO research. Design, client communications, and project management trail behind. The lowest-adoption area on the list is the one most relevant to the operational load from earlier chapters: only 16% currently use AI for site monitoring or maintenance automation.
Agencies want AI to take on updates and security next
We then asked which AI capabilities would create the most value for the agency, with up to three picks.
The wishlist maps almost exactly onto the operational pain from the previous two chapters. Automated WordPress updates with pre-update testing tops the list at 38%, automated security across client sites is next at 35%, and automated performance optimization sits fourth at 25%. The areas where AI is least applied today are precisely the areas where agencies say they want it to go next.
Solution Spotlight
An AI visibility platform that shows how AI systems understand a business and what to improve to increase visibility in AI-powered search. It identifies missing or incomplete information, tracks when competitors appear instead, and provides clear improvement suggestions without manual checks or guesswork.
Most agencies expect AI to expand what they do
We asked how agencies expect AI to shape their service offerings over the next two to three years.
The picture is split. The top two answers sit almost equal: 30% expect AI to primarily reinforce and scale the WordPress work they already do, 29% see it improving both WordPress and opening up new non-WordPress opportunities. 13% expect AI to drive a more direct move into non-WordPress services, 14% say it is too early to tell, and 13% don’t expect AI to change their services much at all.
Nearly three quarters expect AI to expand what they can do in one direction or the other.
Specialization influences how agencies see AI’s role
The picture sharpens when split by whether the agency works only with WordPress or builds across multiple platforms.
WordPress-only agencies overwhelmingly see AI as a way to scale and improve the WordPress work they already do (44%, the modal answer), with only 12% seeing it as a doorway into non-WordPress services. Multi-platform agencies invert the priority: the modal answer is “both” (35%), and they are roughly half as likely to see AI as purely WordPress-improving (23%).
Coding workflows are shifting toward agentic AI
The first chart in this chapter showed code development as one of the top current uses of AI. We asked agencies what specifically they are doing inside their coding workflow.
Nearly two in five agencies are already running AI coding agents for complex, multi-step tasksManual coding or basic AI autocomplete shows up in 63% of agencies’ workflows, the most common answer. The next-most-common is autonomous AI agents (Cursor, Claude Code, Windsurf) at 39%. Design-to-code workflows that turn Figma mockups into front-end code follow at 26%. The categories overlap (agencies often use more than one), but agentic coding is no longer exotic.
Solution Spotlight
AI WordPress site generators
A newer category of AI tools aimed specifically at WordPress agencies is AI site generators, with tools like 10Web AI Builder, ZipWP, Hostinger AI Builder, Elementor AI, and Divi AI assembling a working WordPress site from a prompt. We asked agencies about their experience with these tools.
Most agencies have at least looked. 36% have tested generators without putting them into production, 38% use them either regularly (24%) or for specific project types (14%), and about a quarter have never used them.
Familiarity with the category is essentially universal.
Among agencies that have formed an opinion, the case for and against generators is sharp.
The case for generators is about speed and economics: dramatically faster initial builds, the ability to serve smaller-budget clients profitably, more proposals and demos won through fast turnaround.
The case against is about craft and control: generic output that is hard to differentiate, customization limits, code quality.
For the agencies that have stayed away from generators entirely, the barriers cluster around the same concerns the current users name.
Code or output quality is the leading concern by a wide margin (56%), followed by customization limits (44%). Three other concerns sit around a quarter each: the work being devalued, projects being too complex for generators, and performance or SEO worries. The barriers map closely to the limitations cited by current users. The agencies that have stayed away are seeing the same problems the early adopters are running into in practice.
Solution Spotlight
An intuitive website builder that lets you create, edit, and publish a professional website with no coding required. Simply tell the AI what your website is about and get a complete first version instantly, with layout, content, images, and structure created for you and ready to edit.
What AI and automation set up
AI is already inside almost every agency, but mostly for the easier-to-automate parts of the work (content, code, SEO).
The harder-to-automate parts (security, updates, performance) are where agencies say they most want AI to go next, and where the operational gap is biggest.
Specialization shapes the strategic outlook: WordPress-only agencies see AI reinforcing their focus, while multi-platform shops see it as a doorway. Inside coding workflows, agentic AI is already standard for nearly two in five agencies. The next chapter looks at how agencies expect all these forces to impact their business in the next two to three years.
6
Looking Ahead
This closing chapter looks at where agencies’ businesses are today and where they expect to take them next. Revenue trends, business-model mix, the growth strategies agencies are choosing, the forces they see reshaping the segment, and how prepared they feel for what is coming.
Most agencies are growing, but not all
We asked agencies how their revenue has changed over the past 12 months.
30% of agencies grew revenue by more than 20% in the past 12 months
Half of agencies report growth over the past 12 months, 27% are flat, and 23% have declined. Significant growth (more than 20%) is actually the single most common answer, ahead of flat or stable. The agency segment as a whole is not in trouble. It is also not uniformly thriving: nearly one in four agencies report decline, and more than one in ten posted a significant drop.
The recurring-vs-project mix runs across the full range
Agency revenue is delivered through different business-model mixes. We asked what share of revenue comes from recurring services like maintenance plans, care plans, and retainers.
- 46% of agencies are project-led (less than 25% of revenue from recurring services)
- 24% sit at a mixed model (25 to 50%)
- 29% are recurring-heavy (more than 50%)
The mix runs across the full range. Project-led, mixed-model, and recurring-heavy agencies all hold meaningful shares of the segment, and no single business model dominates.
Improving efficiency through AI and automation is the top growth strategy
We asked which strategies agencies plan to pursue to grow revenue in the coming year.
Efficiency improvements through AI, automation, and better tooling tops the list at 43%, ahead of expanding service offerings (39%), moving more clients to recurring service plans (34%), raising prices (33%), specializing in higher-value niches (29%), and targeting larger or enterprise clients (23%). The top of the list reads as a referendum on the central operational story of this report: agencies are not just adopting AI and automation, they see them as a primary lever for growth.
Solution Spotlight
A cloud-based email solution that enables agencies to offer professional, branded email services to their clients. With reliable email delivery, advanced spam protection, and simple mailbox management, it helps agencies expand their service offering while improving client retention through an essential business communication tool.
AI and automation lead the forces shaping agencies
We also asked which forces agencies see as the biggest in shaping WordPress agencies over the next two to three years, with up to three picks.
AI and automation lead by a wide margin: 63% name it as one of the top forces, nearly twice the share of any other answer. Cybersecurity threats targeting WordPress sites come second at 36%, followed closely by competition from DIY site builders, AI tools, and SaaS platforms at 35%. Economic pressure (25%) and price competition from other agencies (21%) sit in a second tier. Notably low on the list: hosting platforms absorbing services agencies used to provide (4%) and difficulty finding talent (3%).
Confidence in the next two to three years is mixed
To close the survey, we asked agencies how prepared they feel for the challenges and opportunities of the next two to three years, on a 1 to 5 scale.
- 37% feel prepared (4 or 5 on the scale)
- 39% sit in the middle (3)
- 24% feel underprepared (1 or 2)
The largest group sits in the middle, neither fully confident nor unprepared. Of the rest, slightly more agencies feel prepared than underprepared. The split is consistent with the rest of the chapter: the forces ahead are clear, the growth strategies are picked, but how those strategies will land is still uncertain for many.
What the agency segment is heading into
This report has traced a single thread across six chapters:
WordPress agencies carry portfolio-scale operational responsibility on small-business resources, and the way to close that gap is leverage. The last two chapters bring that thread to a head. AI and automation are simultaneously the force agencies expect to reshape the segment, and the lever they most plan to pull. The agencies that find that leverage early, in the places it matters most (security, updates, performance, and the new class of work that AI agents themselves are creating), will be the ones best positioned for what is coming.
Methodology and Sample
The State of WordPress Agencies 2026 is based on a global online survey of WordPress agencies and freelance developers, fielded between April 14 and May 15, 2026, through online forms published by CloudLinux and WebPros. 210 respondents qualified for inclusion by confirming that their business builds, designs, or maintains WordPress websites for clients. Their firmographic profile (size, portfolio, services, platforms beyond WordPress) is described in Chapter 1.
Geographic distribution
Respondents participated from all major regions, with the largest shares serving client bases in North America and Europe.
