The WordPress community has long valued openness, collaboration, and honest discussions. That’s why when a report titled “WordPress in 2025” appeared on the official WordPress.org website, many of us, including myself, expected a comprehensive look at the current state and future of the platform. Instead, I received something that resembles a polished corporate presentation rather than a thorough analysis of the project’s state.
Karol Krol of WPShout reached the same conclusion in his piece “I Read the ‘Official’ WordPress in 2025 Report, It’s Just a Piece of Enterprise PR” (17 February 2025). This review looks at what the document actually says, what it leaves out, and what a report published under the WordPress.org name would need to contain to be useful to the people who build and maintain WordPress sites. The criticism below is my opinion. The descriptions of the report are taken from the report itself and from WordPress.org.
What the WordPress in 2025 report says, chapter by chapter
The announcement on WordPress.org News is dated 15 February 2025. It links to a PDF whose full title is “WordPress in 2025 and the massive enterprise opportunity it presents”. The author is Noel Tock, described in the post as co-owner of Human Made, “a WordPress VIP Gold Partner specializing in DXP, headless, AI and more”. The PDF has 15 numbered pages and five chapters.
Chapter 1, the CMS trade. The argument is that spending by newer proprietary CMS vendors is drying up while enterprise budgets move to generative AI, customer data platforms and cybersecurity. The report compares this to Apache overtaking Microsoft IIS during the dotcom bubble and to MySQL and PostgreSQL gaining on Oracle during the subprime crisis. It shows a fundraising chart for eight vendors (Optimizely, Contentful, Contentstack, Sanity, Bloomreach, Kentico, Storyblok and Sitecore) and cites a CIO.com article saying Salesforce considered charging $2 or more per AI conversation. Its headline figure is that the block editor has 34,000 commits, footnoted to the Gutenberg repository on GitHub. It names NASA, Disney, CNN, The New York Post, Harvard and Amnesty International as new or refreshed WordPress platforms from the past year.
Chapter 2, the no-code editor. Full Site Editing and block themes are presented as the way to let marketing teams build templates without developers. The recommended actions are to adopt FSE, convert existing themes to block themes, and evaluate the two-to-four-year cost of doing so. One line says this can “remove the need for development teams entirely” on microsites and landing pages.
Chapter 3, AI. The report describes a future multi-agent, LLM-agnostic ecosystem in which every plugin exposes an agent and an orchestrator chains them together. Its example is a request for a contact page with a PDF upload field, handled by Pages, Blocks, Forms and SEO agents. It notes that Drupal has already launched a basic prototype and admits that WordPress, because it is open source, “will be slower to release such an ecosystem”. It also warns that AI-written articles produce average content that will not rank.
Chapter 4, headless. WordPress is described as supporting API-driven builds through its REST API, with hybrid sites using templates for most pages and a headless front end for high-traffic sections. Contentful Studio, Sanity Studio and dotCMS Universal Visual Editor are called basic block editor implementations, and the chapter points to Contentful’s reduced ad spend and negative Glassdoor reviews.
Chapter 5, advice. The closing page predicts that open-source CMSs will bring “true AI depth” in the second and third quarters of 2025 and recommends a hybrid CMS for multi-team enterprise work.
What does the WordPress in 2025 report cover
The title “WordPress in 2025” raises expectations: a broad, forward-looking assessment of the platform as it stands today, February 23, 2025, and where it’s heading. Given the publication on WordPress.org, one might assume the report reflects the collective voice of the community, addressing both successes and challenges. Instead, the report by Noel Tock of Human Made focuses on WordPress as an enterprise solution, praising its scalability, AI potential, and appeal to large brands.
There’s nothing wrong with highlighting corporate adoption: the report lists NASA, Disney, CNN, The New York Post, Harvard and Amnesty International. However, presenting this as the only WordPress story in 2025 seems reductive. Large-scale enterprise use is a real technical achievement. But the document skips the debates that shaped the platform in the preceding months and gives readers a version that leaves out most of the people who work with WordPress every day.
In my own work as a WordPress developer, the viability of a project depends on three things together: the core code, the stability of the plugins it relies on, and the predictability of open-source leadership. A report that calls itself the state of WordPress and leaves out two of those three loses credibility.
What is missing from the WordPress 2025 report
What’s missing from the report is as telling as what’s included. A plain text search of the PDF makes the point: the words “community”, “governance”, “WordCamp”, “trademark” and “Automattic” do not appear in it at all.
Community health and governance
The year 2025 was pivotal for WordPress, with ongoing discussions about project governance and community dynamics. Yet the report doesn’t address these issues. How are contributor retention rates changing across the Make teams (Core, Docs, Accessibility, Polyglots)? How does dependence on corporate sponsorship shape roadmap decisions? These questions matter to the professionals whose income depends on the ecosystem, and the report gives them no space.
Recent controversies
Let’s not pretend the period was calm. The WordPress community faced numerous debates: changes in the plugin ecosystem, licensing disputes, the evolving role of Automattic. By ignoring them, the report presents an incomplete picture. These are not public relations footnotes. They change how companies assess compliance and supply-chain risk in their own projects.
Small businesses and independent users
WordPress isn’t just a corporate tool. It’s the foundation for countless small businesses, bloggers, and freelancers worldwide. Their story deserves a voice too. In my reading of the market, they face rising managed hosting costs and resource limits, more plugins that moved essential features such as forms or backups behind annual subscriptions, and block and theme development that now expects build tooling (Node.js, webpack, Vite) many site owners never used before. None of this appears in the report.
The block editor, Full Site Editing and performance
The report leans on phrases such as an “intelligent content operating system” and a “multi-agent and LLM-agnostic ecosystem”. Without technical detail on how such agents would work with open web standards, the phrases stay vague. What about the practical evolution of the block editor? How many production sites actually run Full Site Editing compared with classic themes? What did the Interactivity API, added in WordPress 6.5, change in measured performance? How is DOM size from complex navigation blocks being kept in check? These are the variables that move Core Web Vitals scores, and the report does not touch them.
How often the report sends readers to Human Made
The clearest evidence that the document is marketing is not its tone but its calls to action, which can be counted in the PDF:
- the Full Site Editing chapter: “Work with partners such as ourselves to conduct an audit of your existing platform”,
- the AI chapter: “Work with an agency such as ours to understand what is compatible with the future of WordPress”,
- the closing chapter: “Talk to an agency like ours to understand how to implement interactivity, personalisation, experimentation, analytics, and more”,
- a banner for WP:25, Human Made’s virtual conference on 6 March 2025, on page 2 and again on the last page, each with “Register now”,
- the author’s email address for sales enquiries on the last page.
The WordPress.org post itself repeats the event invitation, and the link to the WP:25 registration page carries tracking parameters that include utm_medium=Noel sales outreach.
The report also contains no data about WordPress.org: no download figures, no plugin or theme directory numbers, no contributor counts, no release history, no security statistics. Its only project metric is the Gutenberg commit count. Krol drew the same conclusion and wrote that the content “should be labeled as an ad or some form of ‘partner content’”. I agree. Publishing vendor material on the project’s own news site is a choice the project can make, but readers should be told what it is.
To be fair to the author’s company: Human Made does give back. Its Five for the Future pledge page, checked in October 2026, lists 16 sponsored contributors and 118 hours a week across 13 teams, including Core, Core Performance, Accessibility, Polyglots and the Core AI team. The criticism here is about where and how the report was published, not about the agency’s contribution to the project.
Is the WordPress 2025 report enterprise PR
This report feels more like a corporate PR campaign than a thorough industry analysis. Published on WordPress.org, it carries an aura of authority, yet its scope is tailored to Human Made clients rather than the broader community.
There is nothing illegitimate about an agency promoting its view of the market or sharing case studies on its own channels. But presenting those conclusions as the official state of the whole platform changes what WordPress.org is. Open-source projects do well when they show their imperfections, explain failed releases and involve users in fixing bottlenecks. When the main portal of an open ecosystem adopts polished corporate language, it spends the trust of its developers.
For enterprise buyers, it’s an attractive pitch: WordPress is mature, flexible, and C-suite ready. But for the rest of us, developers, small agency owners, hobbyists, it’s a missed opportunity to see where WordPress truly stands in 2025. As Krol suggested, a study titled “WordPress in the Enterprise Sector in 2025” on Human Made’s own website would have been fine and equally useful.
What WordPress.org published in the months before the report
The omissions are easier to judge against what WordPress.org’s own news site carried in the five months before the report appeared.
On 21 September 2024 Matt Mullenweg published “WP Engine is not WordPress”. The post says WP Engine “needs a trademark license to continue their business”, criticises the host for disabling post revisions by default, and compares Five for the Future pledges: according to the post, WP Engine contributed 40 hours a week while Automattic contributed 3,915 hours a week.
Four days later, on 25 September 2024, a second post, “WP Engine is banned from WordPress.org”, announced that “pending their legal claims and litigation against WordPress.org, WP Engine no longer has free access to WordPress.org’s resources”. The post lists what that covers, from update servers and the plugin and theme directories to translations, forums and the bug tracker.
On 12 October 2024 the WordPress security team announced “Secure Custom Fields”. The post invokes point 18 of the plugin directory guidelines to fork Advanced Custom Fields into a new plugin. It states that sites with WordPress.org auto-updates enabled would be switched from ACF to Secure Custom Fields automatically, and that WP Engine had moved ACF updates to its own servers. The post calls the situation “rare and unusual” and attributes it to “WP Engine’s legal attacks”.
So in the half year before February 2025, WordPress.org News itself published posts about a trademark dispute with a major host and the takeover of one of the most widely installed plugins in the directory. A report on the state of WordPress that appears on the same site a few months later and never mentions either is not neutral. It is selective.
What a real state-of-the-ecosystem report should contain
For an annual report to serve software architects, CTOs and end users, it would need auditable metrics. A rigorous model for 2025 and 2026 should cover at least three areas.
Security telemetry and the vulnerability lifecycle
- the total number of vulnerabilities reported in plugins and themes through coordinated disclosure and bug bounty programmes,
- the distribution of the most common attack vectors, such as cross-site scripting and CSRF in legacy extensions,
- the average time between a critical vulnerability report and a fixed release in the official directory,
- the share of active installs still running code that has not been updated for more than two years, with clear guidance on a WordPress security audit.
Architecture adoption and real-world performance
- aggregated Chrome UX Report data comparing Full Site Editing sites with classic themes on Largest Contentful Paint and Interaction to Next Paint,
- migration rates to current PHP versions (8.2 and 8.3),
- real figures for decoupled builds that use a headless CMS developer approach with Astro or Next.js.
Economics and the sustainability of contributions
- hours pledged to Five for the Future each week, split between sponsoring companies and independent contributors,
- concentration in the plugin and hosting markets and the effect of acquisitions on choice for site owners,
- satisfaction and the main barriers reported by junior and senior developers submitting code for review.
The scale of money involved is not in doubt. In the September 2024 post quoted above, Mullenweg wrote that WP Engine alone does “about half a billion in revenue on top of WordPress”. A report that wants to explain where WordPress stands should show how much of that value flows back into the project.
Beyond the big brands, how are small sites doing? Is there growth in Poland or other markets? What do posts and forums say about satisfaction or frustration in 2025? Beyond the AI trend, what is planned for core features, security and technical improvements? Those are the questions readers of WPPoland.com, developers, business owners and enthusiasts, would expect a report with this title to answer.
What WordPress teams should take from the report in 2026
Given the polarisation and the promotional narratives of early 2025, companies and developers working with WordPress should keep their architecture cautious and their technical options open.
The first rule is to avoid lock-in. Depending on closed solutions or on infrastructure providers that control access to external repositories carries contractual risk. Keeping source code in independent Git repositories, running CI/CD outside the host’s dashboard and using standard container images means an application can move to another provider within hours if a relationship breaks down. The ACF episode shows why: sites that relied on one update channel were switched to a different plugin without anyone on the project team touching them.
Second, manage the software supply chain. Unchecked growth in third-party plugins should give way to custom blocks built with Gutenberg components where that is practical. Fewer external dependencies mean a smaller attack surface, fewer breakages on update and lower maintenance cost over the life of the project.
Finally, critical community dialogue matters. Taking part in local meetups and WordCamps, contributing to documentation and asking the project’s leadership for clarity are how WordPress stays an open, shared platform.
Strengths and weaknesses of the WordPress 2025 report
The “WordPress in 2025” report has its merits. It highlights real strengths like open-source flexibility and growing enterprise adoption. Its points on hybrid headless builds and on block themes are practical, and its warning that mass-produced AI articles will not rank is sound. However, its narrow focus and strategic omissions mean I get a boardroom-tailored version rather than a comprehensive picture. For a platform built on openness, that’s a significant trade-off.
If your organisation needs to assess the security of its WordPress infrastructure, plan an architecture that survives vendor disputes or modernise a complex corporate site, see my WordPress development services or contact me.
