How Out of Date Are Canadian Small Business WordPress Sites? A 2026 Scan of 1,102 Websites

How out of date are the WordPress sites Canadian small businesses run? To find out, we fetched the homepages of 1,102 small business websites in eight Canadian cities on 1 November 2026 and read the versions they reveal. WordPress ran 42.1% of the homepages we could read. Core was mostly current, but plugins were not: 70.4% of WordPress sites with a comparable plugin version had at least one plugin behind, and 45.6% loaded a plugin version with a known, already fixed security flaw. Here is the full data, by version, plugin, city and trade, plus what to do about it.

This is original research. We did not survey anyone, buy a dataset or reuse someone else's numbers. On 1 November 2026 we looked up Canadian small businesses in eight cities and eight trades, found 1,102 distinct websites, and fetched each homepage once, the same way a browser does. Then we read what the page and its response headers say about themselves: which platform, which WordPress version, which PHP version, which plugins and at what version, and which security headers are set. We compared every version we found against the official release record.

The result is the most direct answer we know of to a simple question: how out of date are the WordPress sites that Canadian small businesses actually run? Every figure below carries its sample size, because a percentage without an n is just an opinion. We never name a business or tie any site to a weakness. Everything is reported in aggregate.

The study in one paragraph

We scanned the homepages of 1,102 Canadian small businesses on 1 November 2026. Of 379 measurable WordPress sites, 70.4% of those showing plugin versions ran at least one outdated plugin, 45.6% loaded a plugin version with a publicly disclosed, already fixed vulnerability, and 15.1% of identifiable core versions no longer receive security fixes.

That paragraph is written to be quoted. If you use it, please link to this page and cite it as shown in the cite this study section. The short version for a business owner is that WordPress core mostly looks after itself now, thanks to automatic minor updates, while plugins are where sites fall behind and where most of the known risk sits.

Key findings

The key finding is that core updates are largely handled while plugins are not. Here is every headline number with its base.

Two of these numbers deserve a warning label straight away. First, everything here is what a homepage reveals. A plugin that loads no files on the homepage is invisible to us, so the real share of sites with an outdated plugin is almost certainly higher, not lower. Second, a known vulnerability at a detected version is a risk signal, not proof that a site can be broken into. Many flaws need a specific feature to be switched on, or a logged-in user. We explain both limits in the limitations section.

How many Canadian small businesses use WordPress?

WordPress ran 42.1% of the Canadian small business homepages we could read (379 of 900). That is close to the global figure: W3Techs reported WordPress on 39.5% of all websites when we checked on 1 November 2026. Small local businesses, in other words, use WordPress at about the same rate as the web as a whole, a little more if anything.

Hosted builders were the next biggest group. Wix, Squarespace and the GoDaddy builder together accounted for 200 homepages. This matters for the comparison later in the article: on a hosted builder, the platform company updates the software for every customer at once. On WordPress, someone has to press the button, or set up a system that does. Our WordPress statistics hub covers global market share and version adoption in more depth; this study is about what happens on the ground in Canada.

Dentists were the business type most likely to run WordPress, at 55.6% of their homepages. Hair salons were the least likely, at 27.4%, because many of them use a booking platform's page or a hosted builder instead. The category breakdown has every number.

Which WordPress versions are Canadian small businesses running?

Most are on the current release. Of the 284 WordPress sites whose core version we could see, 64.8% were on WordPress 7.1.4, the release WordPress.org listed as "latest" on the day of the scan. That release had shipped only days earlier, on 28 October 2026, as a security release. Seeing two thirds of small business sites on it within four days tells you that automatic background updates for minor and security releases are doing their job.

The status labels come straight from WordPress.org's own stable-check service, which returns one of three words for every version ever released. "Latest" is the newest release. "Outdated" is the newest point release of an older branch, for example 6.9.11 or 7.0.8: WordPress still ships security fixes to those branches. "Insecure" is any other version. 15.1% of sites, 43 in all, were on an insecure version.

WordPress is careful about how it describes that backporting. Its security page says that "only the latest version of WordPress is officially supported", and that the security team "also backports fixes to older versions as a courtesy". So an older branch that is still patched is acceptable for now but is living on goodwill. The safe position is the latest release.

The branch picture

The branch chart shows where the stragglers are. WordPress 7.1 accounted for 199 sites. Below that the numbers fall away quickly, but there is a long tail: 19 sites on branches from 6.0 to 6.6, 10 sites still on the 5.x series and 2 sites on 4.9, a version first released in 2017. A site on 4.9 has missed nine years of features and, depending on whether it sits on that branch's final point release, possibly years of fixes too.

How does that compare with the whole WordPress world? WordPress.org publishes the share of all sites on each version. On 1 November 2026 it reported 64.9% of WordPress sites on 7.1. In our Canadian sample the figure was 70.1% (199 of 284). Canadian small businesses are, if anything, a little more current than WordPress overall. The difference is within what you would expect from sampling, so the fair reading is "about the same".

Not every "insecure" site is old

Of the 43 sites on an insecure version, 15 were on 7.1.0 to 7.1.3 and 5 more on an older 7.0 point release. Those sites are only one security release behind, and many will catch up on their own once their next automatic update runs. That leaves 23 sites on branches from 4.9 to 6.9 that are not on a patched point release at all. Those sites are the real concern, because automatic updates have clearly stopped working for them, have been switched off, or have hit an error nobody noticed.

Three WordPress core flaws were added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog in 2026: CVE-2026-63030 and CVE-2026-60137 on 21 July, and CVE-2026-87902 on 25 September. We found 8 sites (2.8% of those with a visible version) running a core version affected by at least one of them. It is a small share, but these are flaws with evidence of real attacks. Our 2026 core vulnerability explainer lists the fixed versions for each branch.

What this means for you: if your site is on WordPress 7.1.4, or on the newest point release of the branch it is on, core is not your problem. If it is on anything else, find out why automatic updates are not running before you do anything else, because the same cause will keep your site behind after you fix it once.

How many sites run an unsupported PHP version?

Among WordPress sites that announce their PHP version, 35.4% already run a version past end of life, and 58.3% will be on an unsupported version after 31 December 2026. Only 96 of 379 WordPress sites (25.3%) announce PHP at all, through the X-Powered-By response header, so this is a smaller and probably less tidy subset.

PHP is the language WordPress runs on, and the PHP project supports each version for a fixed time. According to php.net's supported versions page, read on 1 November 2026:

The striking thing is how closely our small sample tracks the global picture. WordPress.org's PHP statistics, read the same day, put 33.0% of all WordPress sites on PHP 8.1 or older and 22.9% on PHP 8.2. In our sample those figures were 35.4% and 22.9%. In other words, roughly a third of WordPress sites, in Canada and worldwide, run a PHP version that gets no security fixes at all, and another fifth join them on 1 January 2027.

WordPress itself now recommends PHP 8.3 or greater on its requirements page. A PHP upgrade is usually a hosting setting, but the plugins and theme have to be ready for it, which is why it gets put off. We cover the end-of-life deadline in PHP 8.2 dies 31 December and the upgrade itself, step by step, in how to update PHP in WordPress.

What this means for you: if your host's control panel shows PHP 8.2 or lower, plan the move to 8.3 or 8.4 now, on a staging copy, rather than in the last week of December when every agency and host is busy.

How out of date are WordPress plugins on small business sites?

Very. Of the 331 sites where we could compare at least one plugin version against the official record, 70.4% ran at least one plugin that was behind its latest release. Only 29.6% had every visible plugin up to date. Across all 1,067 plugin observations, 53.1% were behind, and 25.4% were ten or more releases behind.

The median WordPress site showed 5 plugins on its homepage. The real number installed is higher, because plenty of plugins never load anything on the front page. That is the first lesson in this data: the core version is now usually fine, but the plugin layer is where sites drift. Core updates itself by default for minor releases. Plugins only do so if someone has switched on auto-updates for each one, or a person or service updates them.

The 20 most common plugins and how far behind they are

The table lists the 20 plugins we detected most often, how many sites run each, and the median number of stable releases between the detected version and the latest. A median of 0 means more than half the sites were current. We only report a median where at least 10 sites showed a version that matched a real release.

A few patterns stand out.

• Contact Form 7 is the most neglected common plugin. 77.3% of the sites where we could compare its version were behind, with a median of 6 releases. Contact forms are often set up once at launch and never touched again, which is exactly the problem.
• Elementor Pro lags its free sibling. The free Elementor plugin had a median of 0 releases behind, because it updates from WordPress.org like any directory plugin and many sites have auto-updates on. Elementor Pro is licensed separately and updates through its own licence system. Its median was 5 releases behind, and 66.3% of sites were not on the latest. When a licence lapses, updates stop quietly.
• Yoast SEO was the most common plugin of all, on 45.6% of WordPress sites, and 58.9% of comparable installs were behind. Yoast releases often, so a site that updates monthly will still often be one release back on any given day. That is why the median is a modest 1.
• Slider Revolution is the clearest case of a stuck premium plugin. Its vendor changelog lists 7.2.7, released 29 October 2026, as the newest version. Of the 40 sites where we could read a version, only 3 were on the 7.x line at all.

Premium plugins are a recurring theme. Nobody gets an update notice for a plugin whose licence ran out two years ago, or whose licence key belongs to a developer who has since moved on. Our guide to taking over a WordPress site from a developer includes the licence checklist.

Plugins that WordPress.org has closed

28 WordPress sites (7.4%) loaded at least one plugin that the WordPress.org directory has closed, meaning it is no longer available for download and receives no updates through the directory. Where a reason was published, the most common was a security issue (10 instances), followed by licensing or trademark problems, guideline violations and author requests. A closed plugin is a dead end: there will be no fix, so the only remedy is to replace it.

What this means for you: open your Plugins screen today. Anything with an update waiting, anything you do not recognise, and anything that is premium but shows no licence status are your first three lists. Fewer plugins means fewer things to keep current.

How many sites run a plugin with a known vulnerability?

45.6% of the WordPress sites in our sample (173 of 379) loaded at least one plugin at a version that has a publicly disclosed vulnerability with a fix already available. Measured only against the 331 sites where a plugin version could be compared, it was 52.3%. For 27.7% of all WordPress sites the worst matching issue was rated high or critical.

We matched each validated plugin version against WPVulnerability.net, a free database that combines records from the CVE program, Wordfence, Patchstack and WPScan, and counted only vulnerabilities with a fixed release. We did not test whether any site could actually be exploited, and we never will: that would be an attack, not research. A match means the site is running code that the plugin's own developer has since fixed for a security reason.

The two examples that drive the critical count

Two premium form and page-builder plugins account for most of the critical matches. Both advisories are public, and we name the plugins, not any site.

• Elementor Pro 4.2.1 and earlier is affected by CVE-2026-32475, an arbitrary file upload flaw published on 19 August 2026 with a CVSS score of 9.0, fixed in 4.2.2. Of the 89 sites where we could read an Elementor Pro version, 47 (52.8%) were on 4.2.1 or earlier. That is the single biggest contributor to the critical count, and it follows directly from the licence-update gap above.
• Gravity Forms 3.1.2 and earlier is affected by CVE-2026-103039, an unauthenticated PHP object injection flaw published on 30 October 2026 with a CVSS score of 9.8, two days before our scan. An earlier flaw, CVE-2026-84434, allowed unauthenticated file upload in 3.1.0.4 and earlier. Of 28 sites showing a comparable Gravity Forms version, 14 were on 3.1.2 or earlier and 12 were older than 3.1.1.

The free Elementor plugin also appeared often in the matches (70 sites), but mostly for medium-severity issues, typically stored cross-site scripting that needs a logged-in user with editing rights. That is a real but smaller risk for a business site where only the owner logs in.

What about actively exploited plugin flaws?

We cross-checked every match against CISA's Known Exploited Vulnerabilities catalog (catalog version 2026.10.30). It contains three WordPress plugin entries: WordPress File Manager, Duplicator and Social Warfare, all from 2019 and 2020. None of the 379 sites showed any of those three plugins on the homepage, so the plugin KEV count is zero. That is good news, with a caveat: CISA's catalog lists very few WordPress plugins compared with the volume of plugin flaws attackers actually use, so "not in KEV" does not mean "not being exploited". Our WordPress security statistics page covers what the security vendors report about exploitation across the ecosystem.

How many sites expose their version numbers?

69.7% of WordPress sites (264 of 379) exposed at least one software version string to anyone who asks: the WordPress version in the generator tag, the PHP version in a header, or the web server version. The generator tag alone was present on 64.1% of sites. And 92.3% showed at least one plugin version in their asset links.

Is that a problem? Less than people think. Hiding a version number does not fix anything, and automated attack tools usually try their exploit against every WordPress site they find rather than reading version tags first. Removing the generator tag also hides very little, because the same version shows on core file links, which is why 41 sites that had hidden the tag still revealed their version to us. Treat version hiding as tidiness, not security.

The PHP header is a better case for removal. Announcing "PHP/7.4.33" tells the world that the server runs software with no security support, and it costs nothing to switch off. It is one line in php.ini (expose_php = Off) or a setting in most hosting panels.

What this means for you: spend your effort on updating, not hiding. Once everything is current, there is nothing embarrassing left to hide.

Do small business WordPress sites use HTTPS and security headers?

HTTPS is now nearly universal: 97.4% of all measurable homepages (877 of 900) ended up on an HTTPS address, and all but one WordPress site did. Security headers are a different story. 58.8% of WordPress homepages set none of the six common security headers we checked, against 20.2% of homepages on other platforms.

The gap is mostly about who is responsible for the server. A hosted builder sets headers such as HSTS for every customer at once, which is why 70.1% of non-WordPress homepages sent HSTS, against 17.4% of WordPress homepages. On WordPress, headers depend on the host and on whoever configured the site. The OWASP Secure Headers Project describes what each header does; for a typical business site the useful starting set is HSTS, X-Content-Type-Options and a frame policy, which are low-risk to switch on. A Content-Security-Policy is worth having but needs testing, because a strict policy can break analytics, chat widgets and embedded maps.

If your host runs Apache, the starting set looks like this in .htaccess. Test on staging first:

<IfModule mod_headers.c>
  Header always set Strict-Transport-Security "max-age=31536000"
  Header always set X-Content-Type-Options "nosniff"
  Header always set X-Frame-Options "SAMEORIGIN"
  Header always set Referrer-Policy "strict-origin-when-cross-origin"
</IfModule>

What this means for you: headers are a quick, cheap improvement, but they come after updates. A site with perfect headers and a vulnerable form plugin is still a vulnerable site.

Which WordPress themes do Canadian small businesses use?

Page-builder themes dominate. Hello Elementor, the minimal theme made to pair with Elementor, appeared on 59 sites including child themes. Divi was second with 42 and Astra third with 29.

The Divi sites that printed a version told a familiar story: most were on the 4.x line, with only a couple on Divi 5. Major theme versions are a bigger job than plugin updates, because they can change how every page is built, so they get put off for years. That is a reasonable call for a theme that is still receiving security fixes on its old line and a risky one for a theme that is not.

Results by city

The differences between cities are smaller than the differences between individual sites. Every city's WordPress sites showed the same basic pattern: core mostly current, plugins often behind.

Toronto had the lowest share of homepages on WordPress (32.7%) and also the lowest share with an outdated plugin, but with 34 Toronto sites in the plugin base, that difference is not statistically solid. Edmonton had the highest WordPress share (49.2%) and the largest number of unpatched core installs (10 of 46). Halifax sites showed the generator tag on 77.8% of WordPress homepages, the highest exposure rate. We would not build a strategy on any single city figure. The useful message is that this is a national pattern, not a local one.

Results by business type

Dentists were the most likely to use WordPress and the most likely to keep it current: 47 of 51 dental sites with a visible version were on a still-patched core release. Accountants and hair salons had the highest shares of sites with an outdated plugin.

One plausible reason for the better dental numbers is that many dental sites are built and maintained by agencies that sell an ongoing plan. Accounting and law firm sites, in contrast, are often built once and left alone. 36 of 43 accounting sites with a comparable plugin showed at least one outdated plugin (83.7%). For professions that handle client financial and legal data, that is the wrong way round. A firm's website is rarely where client files live, but a hacked site that redirects visitors or serves malware damages trust in exactly the way these firms cannot afford.

How to check your own WordPress version, plugins and PHP

You can check everything this study measured in about ten minutes, and you do not need to be technical. Here is how to check your WordPress version and the rest.

Check your WordPress version

1. Log in to your dashboard and look at the At a Glance box on the home screen, or open Dashboard, Updates. Both show the version number.
2. Compare it with the current release on WordPress.org. On the day of our scan that was 7.1.4. If you are on an older branch, check that you are on its newest point release.
3. Developers can run wp core version with WP-CLI.

Check your plugins

1. Open Plugins. Anything with an "update available" notice is behind.
2. Look at the Automatic updates column. Turning it on for well-maintained plugins is reasonable for most small sites, as long as you have backups.
3. For premium plugins (Elementor Pro, Gravity Forms, WPML, Slider Revolution, WP Rocket and similar), check that the licence is active and registered to you, not to a former developer.
4. Delete plugins you are not using. Deactivated plugin files can still be reached on the server.

Check your PHP version

1. Go to Tools, Site Health, Info and open the Server section. It shows the PHP version.
2. If it shows 8.2 or lower, plan an upgrade to 8.3 or 8.4 on a staging copy.

If you would rather have someone else do this every month, that is exactly what a care plan is for. Our WordPress security audit guide lists what a full audit checks beyond these basics.

What this means and what to do

The data points to one conclusion: updating is the job, and plugins are where it falls apart. Core has mostly solved its own problem with automatic minor updates. Plugins, premium licences and PHP have not, and they need a person or a process.

A priority list for business owners

1. Update or replace any plugin with a known, fixed vulnerability. If you run Elementor Pro, make sure it is 4.2.2 or later. If you run Gravity Forms, make sure it is 3.1.3 or later.
2. Get core onto a patched release, and find out why automatic updates stopped if they did.
3. Renew or reclaim premium plugin licences so updates flow again.
4. Move PHP to 8.3 or 8.4 before 31 December 2026.
5. Remove closed and unused plugins.
6. Add the basic security headers and turn off the PHP version header.
7. Keep tested, off-site backups, so a bad update or an attack is an inconvenience rather than a disaster.

Do it yourself, or pay for a care plan?

Plenty of owners can do the list above themselves, once. The hard part is doing it every month, testing each update first, and noticing when something silently stops. That is what a care plan buys. Our care plans are typically about 15 to 20 percent of the build cost per year and cover updates, off-site backups, monitoring and small changes. For a small business website, which we typically build for $1,500 to $4,000 (most about $2,000), that works out to roughly $300 to $400 a year at the typical build price. Full price ranges are on our pricing page, and our article on whether WordPress maintenance is worth it does the cost comparison against fixing a hacked site.

Methodology

We built the sample, measured it passively and compared it against official sources, all on 1 November 2026.

Sample

• Source: DataForSEO's Business Listings search API, which returns business profiles from Google Maps data. We searched 8 cities (Calgary, Edmonton, Halifax, Montreal, Ottawa, Toronto, Vancouver, Winnipeg) within 20 km of the city centre, for 8 business types (accountant, auto repair shop, dentist, hair salon, lawyer, physiotherapist, plumber, restaurant), taking the first 20 listings with a website for each pair: 1,280 listings.
• Small business filter: we removed any domain that appeared in two or more listings (117 listings, a proxy for chains and franchises), chain location subdomains (4), and listings whose "website" was a social, booking or delivery profile (57). We kept one record per domain: 1,102 domains.
• Measurable: 1,037 domains answered. Of those, 900 returned a readable HTTP 200 page. The rest returned a bot challenge, an error or a non-200 status and were excluded rather than guessed at.

Measurement

• One GET request for each homepage, following redirects, with the user agent WPDeveloperResearch/1.0 (+https://wpdeveloper.ca), at most 8 requests in flight, a 20 second timeout. No login pages, no xmlrpc.php, no readme files, no directory probing, no vulnerability testing.
• WordPress detection: /wp-content/ or /wp-includes/ paths, a WordPress generator tag, or a REST API link (api.w.org).
• Core version: the generator tag, or the ?ver= value on core files whose version equals the WordPress version (block library styles, the emoji script, dashicons). Both sources were present on 164 sites and agreed on all of them.
• PHP version: the X-Powered-By or Server header, when present.
• Plugins: folder names in /wp-content/plugins/ paths, with the ?ver= value on their files, plus version comments and generator tags that plugins print themselves (Yoast SEO, Elementor, Site Kit, WP Rocket, WPML, WooCommerce, All in One SEO, Slider Revolution). A version counted only if it matched a real release: the WordPress.org plugin API's version list for directory plugins, or the vendor's public changelog for Elementor Pro and Gravity Forms. This rule throws out file timestamps, build hashes and cases where WordPress appended its own version to a plugin file.
• Releases behind: the number of stable releases newer than the detected version.
• Core status: WordPress.org's stable-check API (latest, outdated, insecure).
• Vulnerabilities: WPVulnerability.net plugin and core records, counting only issues with a fixed version; severity from the record's CVSS rating. Cross-checked against the CISA Known Exploited Vulnerabilities catalog, version 2026.10.30.
• PHP support: php.net supported versions and end-of-life pages.

Ethics

Every request was a normal page load that any visitor makes. The raw data stays private. We do not publish, sell or share any list of sites, and nothing on this page can be traced to a business. If you run one of these sites and want to know what we saw, contact us and we will tell you about your own site only.

Limitations

This study undercounts problems, by design. Read every figure as a floor.

• Homepage only. Plugins that load nothing on the homepage, such as backup, security, SEO redirect and admin tools, are invisible to us. So are plugins whose files are combined or renamed by a caching or optimisation plugin.
• Versions can be missing or altered. 95 WordPress sites showed no core version at all. Some security plugins strip or fake version strings. We excluded any version that did not match a real release, which removes noise but also drops some genuine readings.
• Premium plugins are under-measured. We compared only Elementor Pro and Gravity Forms, where vendors publish a full release list. WP Rocket, WPML and WPBakery were detected but not compared.
• A known vulnerability is not a confirmed hole. Some flaws require a particular feature, a logged-in user or a specific setting. Some sites run a firewall that blocks the attack. We report exposure, not exploitability.
• PHP is self-selected. Only 25.3% of WordPress sites announced PHP. Sites that hide it may be better maintained.
• The sample is not random. It is the first 20 businesses with websites that the listings data returned for each city and trade. It leans toward established businesses in large cities. Rural Canada, Quebec outside Montreal and many trades are not covered.
• Sampling error. Treating the sample as random, the margin of error on a share near 50% of the 379 WordPress sites is about plus or minus 5 points. For a single city or trade, with 29 to 74 WordPress sites, it is plus or minus 11 to 18 points.
• One day. WordPress 7.1.4 was four days old on scan day, so some sites counted as "insecure" were simply waiting for their next automatic update.

Cite this study

You are welcome to quote, chart or republish any figure here with a link back to this page.

Four Cents WordPress Studio (2026). How Out of Date Are Canadian Small Business WordPress Sites? A 2026 Scan. Passive homepage scan of 1,102 Canadian small business websites (379 measurable WordPress sites), 1 November 2026. https://wpdeveloper.ca/blog/outdated-wordpress-sites-canada-study

Journalists and researchers can contact us for the aggregate tables behind each chart. We do not share site-level data. We plan to repeat the scan in 2027 with the same method so the trend can be tracked.