# The State of WordPress Agencies in 2026 > [!question] Lingering Questions > - Does pre-update testing demonstrably cut rollback incidents, or is the 38%-want-it figure aspirational? > - Are managed-hosting agencies actually more secure, or just shifting the patching burden to the host? > - How much of "agentic AI" coding adoption (39%) is production use vs. experimentation? > [!tip] Article Ideas > - "Patching at 100 sites" — a talk/demo built directly on Chapter 4's manual-update-by-portfolio-size data. #articleseed > - Cross-reference this report's six chapters against the companion sponsored article ([WordPress Agencies Aren't Afraid of AI. They're Buried in Updates.](3.%20Resources/Readwise/Articles/WordPress%20Agencies%20Aren’t%20Afraid%20of%20AI.%20They’re%20Buried%20in%20Updates..md)) — same underlying dataset, different framing. #addendum > [!link] Cross Reference > - [[3. Resources/Permanent Notes/An Agency's Maintenance Load Tracks Site Count Not Headcount]] — this report's Chapter 1 firmographics (47% of solo/small agencies run 20+ sites) is the primary evidence for that note; not re-derived here. > - [[3. Resources/Permanent Notes/AI Adoption Concentrates Where It Is Pleasant Not Where the Pain Is]] — this report's Chapter 5 (59%/53% content/code vs. 16% maintenance) is the same inversion documented from the companion article; connect, don't duplicate. > - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] > [!quote] Vocabulary > - **Virtual patching** — request-layer mitigation (e.g., a WAF rule) that blocks exploitation of a known vulnerability before the underlying code is actually updated; positioned in the report as the sponsor's answer to "patch every site the moment a CVE lands." > - **Recurring-revenue share** — the percentage of an agency's income from ongoing plans (hosting, maintenance retainers) versus one-off project work; used to distinguish project-led agencies (46%) from recurring-heavy ones (29%). ## Metadata - Source: [[3. Resources/Readwise/Articles/The State of WordPress Agencies in 2026]] - Author: CloudLinux & WebPros - Category: Article (survey report) - Sample: 210 respondents, fielded April 14–May 15, 2026 ## Author's thesis WordPress agencies in 2026 are small in headcount but wide in operational scope — site count, not team size, is the better predictor of how much responsibility an agency carries. The universal headache is patching (65% top security challenge, 75% at the largest portfolios), and AI is both the force agencies expect to reshape the segment (63%) and the lever they most plan to pull (43% name efficiency-through-AI as their top growth strategy) — yet AI adoption is concentrated in easy, visible work and barely touches the operational pain it's most wanted for. ## Key arguments - Headcount poorly predicts workload; portfolio size (client sites under management) is the load-bearing variable across security, performance, and infrastructure decisions. - Patching is the universal, unsolved operational pain, worsening with scale (60%→68%→75% across portfolio bands) even as AI adoption in maintenance stays flat at 16%. - This is vendor-sponsored research (CloudLinux/WebPros sell WAF and performance products); the findings most flattering to those products should be read as directionally useful but commercially motivated. ## Claim atoms ### Patching is the universal agency security challenge > [!quote] ID:rw_pdf01 > 65% of agencies name keeping plugins and themes updated as a top security challenge. - **Where**: Chapter 3. - **Why**: The single most-cited operational pain; rises to 75% at 100+ sites. Anchors the report's thesis. **Tags**: #xref #addendum <!-- atomicity: 1 idea ✓ --> ### AI is near-universal in agency workflows > [!quote] ID:rw_pdf02 > Nine in ten agencies are already using AI tools somewhere in their workflow. - **Where**: Chapter 5 opener. - **Why**: Only 8% have not adopted AI at all; adoption concentrates in content (59%) and code (53%), maintenance lags at 16%. **Tags**: #xref <!-- atomicity: 1 idea ✓ --> ### Largest portfolios still patch WordPress by hand > [!quote] ID:rw_pdf03 > 45% of agencies managing 100+ sites still update WordPress manually, one site at a time. - **Where**: Chapter 4. - **Why**: The clearest automation gap and product opportunity in the ecosystem. **Tags**: #xref #articleseed <!-- atomicity: 1 idea ✓ --> ### Efficiency-through-AI is the top growth strategy > [!quote] ID:rw_pdf04 > Efficiency improvements through AI, automation, and better tooling tops the list at 43%. - **Where**: Chapter 6, growth strategies. - **Why**: Ahead of expanding services (39%) and raising prices (33%) — AI is both the expected force (63%) and the chosen lever. **Tags**: #xref <!-- atomicity: 1 idea ✓ --> ### WordPress faces little client-driven platform pressure > [!quote] ID:rw_pdf05 > 85% of agencies say their clients never or rarely consider switching from WordPress. - **Where**: Chapter 2. - **Why**: Counters the churn narrative; yet 70% of agencies build beyond WordPress anyway, hedging regardless. **Tags**: #xref #addendum <!-- atomicity: 1 idea ✓ --> ### Performance work feels heavier than security > [!quote] ID:rw_pdf06 > 37% of agencies describe performance work as significant, heavy, or overwhelming. - **Where**: Chapter 4. - **Why**: Higher than security's 28%, because performance fixes are site-specific and harder to systematize. **Tags**: #xref <!-- atomicity: 1 idea ✓ --> ## Permanent candidates - Site-count-vs-headcount claim (atom-adjacent, Chapter 1): already captured in [[3. Resources/Permanent Notes/An Agency's Maintenance Load Tracks Site Count Not Headcount]] — connected, not duplicated. - AI-adoption-inverted-to-pain claim (atoms H2/H3): already captured in [[3. Resources/Permanent Notes/AI Adoption Concentrates Where It Is Pleasant Not Where the Pain Is]] — connected, not duplicated. ## Processing checklist - [ ] Find an independent (non-vendor) WordPress agency survey to calibrate the CloudLinux/WebPros figures. - [ ] Size "the new class of work AI agents create" — the report names it but never quantifies it. - [x] Connect into the relevant MOC — [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] ## Links - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — patching-at-scale is the report's central operational-security finding.