Culture

Business websites

.com

Brand protection

Online stores

Hosting

Data privacy

Policy-making

Registrars

Investing & reporting

Internet Basics Series

How to

People

Cybersecurity

Web trends

Tech news

Security

COVID-19

Technology detection

domains

Software

WordPress

TLDs

GDPR

Loura Kruger-Zwart

Any time you fill out a survey, contact a business via their website, or submit preferences online, you are essentially filling out a form. These forms are sometimes coded into a website, but for those less technologically inclined, no-code forms can be used on or embedded into a website for visitors to use. The platforms that offer these services are called ‘form builders,’ and their shapes and sizes vary depending on their origin, destination, and intended uses—and with so many uses come so many options. 

At Dataprovider.com, we gather and structure web data like this, tracking the installations and usage of online technologies like form builders. So, to get an inside look at the web’s most used online forms, we turned to the data.

There are two clear winners in the form builder sphere: Contact Form 7 and Medallia. With over 50% of the market share, Contact Form 7 runs the show. This form builder is a WordPress plugin, and a free one at that. This helps clarify the popularity, given that WordPress is the most used CMS globally. Its open-source philosophy means that free plugins are typically well received, and the prevalence of Contact Form 7 across WordPress sites is corroborated by its 10m+ active installations stat on the WordPress Plugin Directory.  

Medallia trails at a close second. This software platform is focused on ‘experience management’—customer, contact center, employee, and digital—utilizing surveys and other feedback collection forms. Following these two front-runners, other WordPress plugins make it high onto the list: WPForms Lite and WPForms Pro rank 3rd and 6th among the most used form builders. Gravity Forms is also a premium WP plugin, as are Formidable Forms and Ninja Forms—ranking 4th, 7th, and 8th most used form builders, respectively.

Beyond the dominance of WordPress websites online today, there are a number of non-plugin form builders that make the top ten. Google Forms is part of Google’s Editors suite and can be used embedded in a site or simply accessed as a link, while Refiner is a ‘microsurvey’ software—these are the little rating boxes that pop up on a website asking for quick, one-click feedback, especially for web and mobile product companies. Microsoft Forms is a free-to-use part of Office 365 for surveys, polls, and quizzes, and finally, Typeform is an interactive high-design software that specializes in making ‘forms worth filling out’. 

We’re sorry to do it, but we had to ask: if we exclude websites that use WordPress as their content management system, what does the top ten look like then?

Unsurprisingly, Medallia dominates this list. As a CMS-agnostic software, it is not limited to WordPress, and seems to be much loved across the web. Contact Form 7 does still make an appearance in second place, as do other non-WP options from Figure 1, but a number of new names enter the race. Getsitecontrol is not a form builder specifically, but offers popups and inline forms as part of its (email) marketing suite. Shopify’s growing popularity is demonstrated by the presence of Hulk Form Builders and Powerful Contact Form Builder on this new list, given that both are apps for Shopify sites. Wufoo and Qualtrics are two builders that make the list but with rather small user bases, with the former being reasonably dated, and the latter focused on internal use for companies and universities.


A core part of web form builders is their purpose as data collection tools—customer data, employee data, and various kinds of personal data are all submitted through online forms.  Businesses need to trust that the plugins are reliable, users need to trust that any personally identifiable information (PII) is stored securely, and the companies behind form builders must ensure this trust is warranted. This kind of valuable data is wanted by hackers, making the software behind online forms targets for cyberattacks, or at least vulnerable to data leaks. 

This means that privacy is absolutely paramount on websites with forms, and digital security cannot be taken lightly when it comes to PII. According to our spider, the security of form-having websites is lacking: we look to the data on SSL certificates, Content Security Policies (CSP), and HTTP headers for details. 

Of websites that use form builders, 93.6% have a valid SSL (Secure Sockets Layer) certificate, meaning the information that travels between a site and its visitors is encrypted (Figure 3). However, this also means that 6.4% of websites that collect information from their visitors have no or an invalid certificate, making it easier for malicious actors to intercept and access potentially sensitive data.

Further, a CSP is specified on only 13.3% of websites that use online forms. CSP helps to mitigate the risk of Cross-Site Scripting (XSS) attacks, which could potentially compromise form submissions or steal personal data. Enforcing a strict policy on which scripts can be loaded and executed reduces the risk of malicious scripts accessing sensitive information. In Figure 4 we see that 86.7% of the websites in question do not protect their visitors in this way.

CSPs are specified via HTTP headers, as are other security measures like X-Frame-Options and X-Content-Type-Options. The X-Frame-Options header prevents clickjacking attacks by ensuring that your website cannot be embedded within a hacked frame. Malicious actors use clickjacking to trick users into submitting sensitive information, and disallowing framing ensures that a website’s forms are not exposed to this risk. Despite its importance, only 11.4% of websites with forms specify this header (Figure 3). X-Content-Type-Options works similarly, allowing websites to specify what kinds of browser actions are disallowed. ‘Sniffing’, for example, has been used for recognizing online file types but opens undue security risks. By setting this HTTP header to “nosniff,” websites can prevent browsers from incorrectly interpreting or executing content types—which could be exploited in drive-by downloads or content injection attacks—and helps protect user data from compromise. That said, only 18.4% of websites that collect information through forms specifically disallow sniffing via the X-Content-Type-Options header. 

Online forms are a modern and efficient way to collect information from various targets, and websites use the form builders that best suit their site and their purposes. The popularity of WordPress plugin form builders matches the general popularity of WordPress, while ‘experience management software’ options are also increasingly used for their broader feedback-collection capabilities. Security remains a crucial point when it comes to the websites using forms, but at least the percentage of valid SSL certificates among them is relatively high. In any case, online forms are here to stay, and it is up to each party to ensure that their data collection processes are secure.  

Tech

Name, email, five-star review… we fill out online forms so often we barely notice them anymore. However, form builders and ‘experience management’ software are behind the scenes on all these websites. Which platforms and plugins are most popular across the web? The data reveals all—read on to learn more.

In top form: the 10 most-used form builders across the web

Eelco Blaauw

What is a Content Management System (CMS)?

A Content Management System (CMS) is a software solution designed to streamline the creation and management of digital content. From personal blogs to large-scale e-commerce platforms, CMSs provide the infrastructure needed to publish and maintain online content efficiently.

With over 100 different CMS platforms detected across 50+ million websites, the market is highly diverse, each solution catering to distinct business needs, technical preferences, and monetization strategies. The evolution of CMS technology has been driven by the demand for more flexible, scalable, and user-friendly solutions. Businesses increasingly prioritize low-code or no-code approaches, security, and integrations with emerging technologies such as AI-driven content automation. As competition in the digital space intensifies, understanding the landscape of CMS offerings is crucial for businesses looking to optimize their content strategy.

Figure 1 shows the most widely used CMSs across the internet. Choosing the right one for your specific needs ensures a strong foundation for managing your content effectively.

Despite the multitude of options, a few key platforms dominate usage across the web. As shown in Figure 1, Wix (9.6%) and Squarespace (8.0%) are among the most popular choices for users seeking all-in-one, hosted website builders. E-commerce-focused platforms such as Shopify (4.5%) and GoDaddy Website Builder (4.8%) also hold significant market share, catering specifically to businesses looking for ready-to-use solutions that simplify website management. Traditional CMS platforms like Joomla (1.4%) and Blogger (1.0%) remain in use but have seen a decline in popularity as newer, more user-friendly solutions gain traction. However, despite the growing competition, WordPress continues to dominate the market, powering nearly 60% of all CMS-based websites. Far surpassing any other platform, this dominance has firmly established WordPress as the industry leader.

The rise (and reign) of WordPress in the CMS landscape

For years, the market leader in CMS solutions has remained unchallenged: WordPress. Originally developed as an open-source blogging platform, WordPress has evolved into a versatile system supporting a wide range of use cases, including forums, learning management systems (LMS), and e-commerce.

As an open-source platform, anyone can contribute to its code, extend its functionality with plugins, or design themes to customize its look and feel. Best of all, it's completely free to use. This has led to a digital ecosystem where countless businesses thrive by offering WordPress-related services, from hosting to theme and plugin development.

No other CMS comes close to matching WordPress in terms of community size, functionality, and years of development. The numbers speak for themselves. Figure 2 illustrates WordPress’s continuous growth over the past few years.

For an even deeper dive into WordPress’s dominance, take a look at our previous article with a detailed breakdown of the WordPress versions on the web.

WordPress.org vs. WordPress.com: what’s the difference?

One thing not covered in the previous article is the difference between WordPress.org and WordPress.com, two separate entities that often cause confusion.

WordPress.org is the home of the WordPress CMS, where the open-source community lives. Here, users can find themes, plugins, and documentation to customize and expand WordPress. This version is self-hosted, meaning users need to install it on their own web server. It is maintained by the WordPress Foundation, a nonprofit organization founded by Matt Mullenweg, the creator of WordPress.

WordPress.com (Managed WordPress Hosting)

WordPress.com, on the other hand, is a managed hosting service that simplifies website creation. As the internet and WordPress gained popularity, more individuals and businesses wanted their own websites, but not everyone had the technical knowledge or time to coordinate hosting, security, and updates. WordPress.com (and managed hosting providers in general) emerged to solve this problem by offering a fully managed experience where users don’t have to worry about servers, security, or maintenance. WordPress.com is owned by Automattic, a privately held company founded and led by Matt Mullenweg.

WordPress.org (Self-Hosted WordPress): You install, customize, and manage everything yourself.

WordPress.com (Managed WordPress Hosting): Hosting, security, and updates are fully handled for you.

The power struggle that could lead to a new CMS

Recent events have sparked controversy around Matt Mullenweg and, by extension, Automattic. As the leader of the WordPress open-source project, Mullenweg plays a central role in shaping its future. Automattic, his company, actively contributes to WordPress’s development to ensure its longevity—but, of course, also has a strong business interest in growing its market share in the managed WordPress hosting scene.

One of the most significant disputes involves a major WordPress hosting provider, WP Engine, and Automattic. The two companies are now locked in legal battles over trademark issues, with Automattic demanding 8% of WP Engine’s revenue. In a blog post, Mullenweg also criticized WP Engine for not contributing to WordPress’s open-source development.

In a controversial move, WordPress.org blocked update requests from sites hosted by WP Engine in September 2024. When a WordPress site—whether managed or self-hosted—checks for plugin updates, it has to contact WordPress.org servers to fetch the latest versions. Blocking this access effectively prevented WP Engine customers from updating their plugins, leading to security risks and operational issues for affected websites. Access to updates has since been restored for WP Engine and its customers.

As a result, after years of steady growth, WP Engine experienced a notable decline. This is clearly illustrated in the figure down below.

This dispute has raised concerns within the open-source community. Among them, Joost de Valk, creator of the widely used Yoast SEO plugin, has publicly voiced his concerns. In a blog post, he called for a leadership change, arguing that no single individual should have full control over the future of an open-source ecosystem.

Mullenweg responded in a follow-up post, suggesting that those dissatisfied with WordPress leadership could create their own alternative, going so far as to propose the name “JKPress.”

WordPress’s overwhelming market share raises important questions about the future of the CMS landscape. With nearly 60% of CMS-based websites relying on WordPress, does its dominance stifle innovation, or does it provide a stable foundation for the web? As businesses continue to demand more specialized and user-friendly solutions, will WordPress adapt to meet these needs, or will emerging platforms carve out new market segments? The rapid rise of platforms like Shopify in e-commerce and the growing popularity of no-code website builders such as Squarespace and Wix suggest a shift in how users approach content management. While the market is currently dominated by a few key players, history has shown that even the most established platforms can be disrupted. Could a new, lightweight CMS gain traction and challenge the status quo? Perhaps we’ll even see something like “JKPress”, rising unexpectedly from the sidelines to become the next big contender.

What happens when one guy has influence over 60% of CMS-based websites? The WordPress.com v.s. WordPress.org v.s. WP Engine case is one component of a larger trend: CMS platforms are increasingly popular, but despite growing competition, a few major players hold the largest market share. Read on to learn more about CMS, WordPress, and the data behind the news.

The CMS market faces uncertainty: the complicated case of WordPress

Olle Vastbinder

WordPress is a great baseline for any website, be it personal or professional. With plugins, it's possible to customize functionalities to suit your needs. And with ready to-go themes, you can have a great design instantly. A theme is an essential part of any WordPress installation, as it's key in displaying your input from WordPress' backend on your live website. Without a theme, content has no way of being displayed. As with plugins, themes come in all shapes, sizes, and price classes. To better understand our numbers, it's important to first take a look at how WordPress themes work.

Why WordPress themes make the difference 

Although it's possible to create your own unique theme, WordPress has a great marketplace for themes, offering just under 11.896 free themes ready to download.* That's why most creators use an existing theme as the base for their own design. You can keep the default design for a theme, and even adapt it to your needs. The most popular themes often offer separate options for settings, making tweaking and editing the design easy for all users. And more demanding users can even edit the theme code themselves.

When someone wants to modify the theme code, it's recommended to create a so-called child-theme. Without a child theme, theme updates can overwrite any customizations of the original theme code. With a child-theme, you create a sub-theme. That sub-theme has all the functionality of the main theme, but updates to the main theme will not overwrite your design.

Where a WordPress theme dictates the visual design of any given page, a website builder offers more functionalities. There is a very fine line between themes and page builders, but the most popular WordPress themes all offer numerous page builder functionalities and are typically considered page builders too. These extra functionalities can be design improvements on the one hand, making it a theme, while offering extra technical functionalities on the other, making it a page builder. That's why companies typically offer both themes and plugins that work together to give you full control of your entire WordPress website. The three most popular WordPress themes according to our web data are all considered to be both a theme and a page builder.

Now we have a better understanding of what themes are, we are taking a look into the popularity of WordPress themes. Currently, we detect 30.4 million websites that are using WordPress as their CMS. Of those, 44% (13.4 M) have a known WordPress theme installed. And when you look at our data, it's immediately clear who is leading the pack here: Hello Elementor. With 7.3 million installs, they have 44.9% of the market. In second place, Divi still has a very respectable 1.99 million installs (12.2% of the total), with Astra a very close third with 1.97 million (12.1% of the total) installations. The gap between Astra and the rest of the top ten is significant, with GeneratePress netting around 500k installments (3.1% of the total). You can see the entire top ten in figure 1.

The dominance of the top three can be explained using three simple words: free, adaptable and fast. First, almost all themes offer a free version. These are usually more basic, lacking certain premium options. Notable is that the top three all also offer paid services, giving users more control, more default formats to choose from and more support.

A highly adaptable theme offers numerous extras for designing on functionalities. These can be simple improvements, like forms or pop-up creation. But they also add more expert options, like user management. Paid versions often offer more adaptation and styling options than the free versions. You regularly have a flotilla of styles and adaptations to pick from, making it easy for anyone to create a unique style.

Speed is an essential part of any website. Because anyone can create and share themes, there can be a huge difference between them. Not slowing WordPress down is a requirement for any successful theme. 

Popular WordPress themes sorted by language 

When we take a deeper dive into our data. We see minor shifts in popularity of each theme when we look at a websites' language. For Japanese language websites, for instance, the most popular theme is Lightning, outscoring Hello Elementor by almost 50%. Lightning is a Japanese built theme, so that preference seems logical, as users can use it in their own language with full language support.

For English, Spanish, and Portuguese, Divi has to cede its 2nd place to Astra. And where it's a small margin for English websites, Spanish and Portuguese websites are favoring Astra by quite a margin. 

One last interesting statistic to look at is the number of installments of the WordPress default theme. When you perform a fresh WordPress installation, you automatically get the newest version of the WordPress default theme. These are always named 'Twenty X', where X stands for the year of release. So for fresh installations in 2023, the default 'Twenty Twenty-Three' theme would be used.

If we tally all the default themes up, you get to an impressive 1.4 million. This puts WordPress itself firmly in fourth place globally. The Twenty Seventeen (the first theme aimed at businesses and not blogs) and Twenty Twenty-One versions are the most used default themes, even making it into the global top 10 from figure 1. The different WordPress themes have a captivating history, following online design trends through the last two decades. And while using the default theme might seem an odd choice, both WordPress' adaptability using plugins and the option to edit any theme to your needs, using the default as a base, is not a bad idea.

Adaptability is key for a WordPress theme to become popular. All popular WordPress themes are easy to modify and use. The global top three are known for their versatility. But at the base of that popularity for every theme is a basic, free version. While offering less options than the paid versions, after a free version is installed, they can constantly show the extra possibilities the paid version offers.

As WordPress continues to grow, the theme and plug-in marketplace will also keep expanding, making that into an interesting market to keep track of. 

*For this blog, it's important to note that we cannot detect unique themes that were created from scratch.

Asset Management

WordPress has been the go-to CMS for many businesses, organizations, and individuals ever since its conception in 2003. Anyone can set up a WordPress website in a few hours. Part of the appeal of WordPress is the option to customize it as much as you want in a user-friendly interface. Both plugins and themes play a central role in that. We already took a look at the fifteen most popular plugins, and now we're focussing on the ten most used WordPress themes.

The top 10 most-used WordPress Themes

Veronika Vilgis

WordPress is the most popular content management system on the web. One reason for its popularity is its versatility, allowing website owners to customize their site to their needs. WordPress plugins play a crucial role in adding functionality and features. They can help optimize content, integrate social media, improve SEO, security and much more. However, with over 60,000 free and paid plugins to choose from, deciding which ones to install and which ones to avoid can be overwhelming.

WordPress offers both open-source and paid options. WordPress itself is open-source and free to use. Users only need to find their hosting provider and register their domain. The paid WordPress.com plan includes hosting and a domain, with options for more advanced features at a monthly cost. For most users, the open-source WordPress.org with self-hosting is often sufficient, providing full access to plugins and customization.

Most plugins can be found on WordPress.org and can be installed directly if you are logged in as a WordPress admin for a website. Plugins provide a range of features and functionality for a site. Generally, they help with things such as optimizing the performance and speed, customizing or enhancing the design of the site, improving security and privacy. They also enable website owners to add additional features such as social media marketing, SEO enhancements or e-commerce solutions. A WordPress website typically has numerous plugins running at the same time.

Plugins can be either free or paid. Paid plugins offer premium functionalities and are sold by third-party developers. The paid plugins typically offer more features and dedicated support. Some popular paid plugin companies include WooCommerce, Yoast, Sucuri, and Gravity Forms. Most of these paid plugins are also available in a free version. It is not uncommon for someone to start out with a free version and upgrade to the paid one.

Dataprovider.com currently tracks 253 of the most popular WordPress plugins. Our data shows there are currently 22.1 million websites using one or more WordPress plugins. Of those 253 plugins, 39 have the term 'Pro' or 'Premium' in their name, signalling they are paid versions. So, let’s take a look at the top 15 most commonly used plugins and their overall share. 

In Figure 1, you can see the top 15 plugins. The most popular plugin is called Contact Form 7 and allows the website owner to manage contact forms. This plugin tops our list, with 37% of WordPress websites using it. The 2nd spot is taken by Yoast SEO, with 32%. Yoast is an SEO tool which helps website makers improve their content when it comes to SEO. WooCommerce shares the 3rd place with Elementor, with 31% of all websites sporting one or both. While WooCommerce enables e-commerce features, Elementor is a website builder that helps website builders in designing and creating a website. Because you need to download a separate pro version of Elementor when you opt for the pro version, this plugin also takes the 4th spot.

As you can see from the percentages, a website can have more than one plugin. Out of the 253 most popular plugins Dataprovider.com currently tracks, the average website is using 3.3 of them. But don’t let these numbers deter you from adding a few more. The WordPress site with the most plugins in this data set was using 51. 

As with all software, it's important to keep WordPress core, themes, and plugins up to date to ensure security. Outdated software is vulnerable to exploits and security breaches are common. The U.S. National Vulnerability Database (NVD) keeps track and publishes security risks. And WordPress plugins often feature prominently in the 20 most recent reports. 

Not all plugins are created equal. When choosing a new plugin, site administrators should do research on how securely it was developed. Plugins from trusted developers and with an active support community are likely more secure than plugins that have not been updated in over a year. 

With thousands of plugins available, the options for WordPress site administrators are nearly limitless. However, it's essential to pick reputable plugins, keep them up to date, and be aware of any security risks. Used properly, plugins are a great way to customize a site. Whether it is to boost traffic, engage readers, sell products, or build community, the right plugins can help any WordPress site to become successful.

A few weeks ago, we wrote about WordPress, the content management system that powers nearly a quarter of all websites on the web. Today, we are taking a look at WordPress plugins. These third-party tools add functionality and optimizations to a WordPress site. We'll dive into the data to discover the most popular WordPress plugins and their share today.

The top 15 installed WordPress plugins

With its roots as a blogging platform, WordPress dominates the .blog top-level domain (TLD): 84% of .blog domains are created with WordPress. But, due to its versatility, including a range of themes, plugins and an ever-growing community of developers, WordPress has a wide appeal to all kinds of website creators. Nowadays, WordPress-powered websites have a large share among all TLDs. In Figure 1, you can see the percentage of domains by TLD that were created with WordPress. Among .nl, 43% of domains are WordPress built, .br has 35%, and nearly a third of all .com domains also use WordPress.

In today's digital age, having a website is crucial for any business. WordPress is especially attractive for small businesses due to its affordability and versatility. With thousands of free and premium themes and plugins available, businesses can easily create a website that reflects their unique brand and meets their specific needs. WordPress also allows for easy integration with third-party tools and services, such as social media platforms and email marketing tools. In Figure 2, you can see that among business websites, WordPress is clearly the go-to CMS: 64% of business websites worldwide use WordPress. Wix and Squarespace, which rank 2nd and 3rd respectively, only have a combined 15% share of the market.

One of the biggest advantages of Squarespace and Wix is that they allow the user to  create and customize their website without any coding knowledge. Additionally, both platforms offer 24/7 customer support, which can be crucial for users who encounter technical difficulties or have questions about their website. WordPress users, on the other hand, must rely on forums and community support to troubleshoot any issues they may encounter. As a WordPress website owner you also are responsible for keeping your website up-to-date to the latest version. 

Due to its popularity, WordPress frequently attracts attention from cybercriminals. WordPress websites can be vulnerable to various attacks, such as brute force attacks, SQL injections and cross-site scripting. These attacks can occur due to outdated versions of WordPress, plugins and themes. Older versions are more susceptible to security risks because they lack the necessary security patches and updates. Hackers can exploit these vulnerabilities and gain access to the website's data and files. 

According to our data a whopping 1.3 million websites globally have a WordPress version older than 5.0. That’s 7.9% of all WordPress websites identified in our data. These versions no longer receive any active security support and are vulnerable to attacks. Table 1 below gives an overview of the number of domains by WordPress version. 7.6 million (45%) websites run on the latest version (6.2.2), which was released earlier this month (May 2023). That leaves 3.8 million websites running on a version of WordPress 5. These versions still receive security support but will eventually have to be updated when WordPress decides to no longer release security updates.

One solution to address security risks is to use managed WordPress hosting services. Managed WordPress hosting is a specific type of web hosting service optimized for WordPress websites. With this service, all technical aspects of running a WordPress site are managed by the hosting provider. This includes not only security management but also aspects such as website loading speed and performance, control updates and back-ups as well as general support. Over the years, numerous Managed WordPress hosting providers have entered the market. In Figure 3 below, you can see the monthly number of WordPress websites maintained by three companies that offer managed WordPress services: WP-Engine, Kinsta and Siteground. All three companies show growth in the number of managed websites ranging from 25% (WP-Engine) to 69% (Kinsta) over the past two years.

WordPress has become a true internet giant over the past two decades, growing from a humble blogging platform to a CMS that powers a quarter of the entire web. However, its popularity also puts websites at risk of cyber-attacks. Older versions of WordPress, plugins and themes are particularly vulnerable to security risks. A whole industry has emerged that supports website owners in the maintenance of their WordPress sites. At the same time, the rise of headless CMSs and competition from website builders that require minimal technical knowledge may prove to be real competition for WordPress in the long term. Only time will tell whether WordPress will maintain its dominance or give way to newer and more innovative platforms.

Domains

WordPress is one of the most widely used content management systems (CMS) by web developers, bloggers and businesses. Celebrating its 20 year anniversary this year, WordPress began as a simple open-source user led project in 2003 but has since grown into the largest CMS on the web. According to our data, 28.3 million active websites worldwide are powered by WordPress, which accounts for roughly a quarter of the entire web.

Follow us

Questions?

WordPress

In top form: the 10 most-used form builders across the web

The CMS market faces uncertainty: the complicated case of WordPress

The top 10 most-used WordPress Themes

The top 15 installed WordPress plugins

Breaking down the numbers: WordPress' dominance on the web

Start today