Security, Performance and WordPress Analysis of Top 1 Million Sites

Are you interested in learning facts about the top 1 million sites in the world? In this extensive report, we examine WordPress usage, security analysis, and performance factors across the most popular websites on the planet.

Did you know that there are more than 1.5 billion hostnames in circulation and roughly 180 million active websites? If you love these types of statistics, check out the monthly Web Server Survey report from Netcraft. The survey focuses on monitoring the web for all active sites and domain names.

The total number of hostnames and active websites as of January 2019.

With so many sites active at any given time, there are clearly many winners and losers. Sites like The Internet Map illustrate just how dominant certain websites are compared to those in the top 10 million range.

If you started a new website today, how long would it take to break into the top 1 million sites? Or even the top 10,000 or 1,000? It could take years of hard work.

But it doesn‘t have to be such a long, difficult road. By analyzing the major trends across the most popular websites worldwide, you can optimize your site to grow faster.

That‘s the premise of this analysis. We examined the top 1 million websites from Alexa to understand the most popular technologies.

Let‘s dive in!

How Popular is WordPress?

We know WordPress has a 60% market share as a CMS, but what about in the top 1 million sites?

To find out, we searched for:

wp-content, wp-json, and wp-includes in the source code
wp-json in the response headers
The meta-generator tag

Our analysis shows WordPress powers 26.5% of the top 1 million sites, with a 2% margin of error for sites hiding information.

WordPress supports sites of any size, as evidenced by big names like TechCrunch, Marks & Spencer, and Quartz using it to serve millions of visitors.

Are you using WordPress on your site? It‘s easy to start and access thousands of themes and plugins. Check out our WordPress tutorials if you need help getting set up!

Speaking of which, let‘s look at the most popular WordPress themes and plugins.

Most Popular Plugins

WordPress relies heavily on plugins for dynamic features. While custom code is an option, most users can simply install a plugin.

Accurately gauging popularity is difficult since many sites minify and obfuscate code, blocking plugin paths. But here are the most widely used plugins based on our analysis:

These results make sense. Contact Form 7 is the most widely recommended contact plugin. Jetpack adds social features to blogs. Visual Composer enables easy custom site design.

Cookie Notice relates to GDPR, the EU data protection law enacted in 2018. OneSignal also made the top 10 – it‘s a great WordPress push notification plugin.

Now let‘s look at popular themes.

Most Popular Themes

Like plugins, theme paths also get obscured during minification. But our data reflects expectations:

Divi leads in popularity, likely due to ElegantThemes‘ heavy promotion. Newspaper and Avada follow. With over 490,000 ThemeForest sales, Avada‘s prominence is no surprise.

Avada theme demo designs — One of the many demo designs provided by the Avada theme.

Themes often come with various demos now, so one can gain hundreds of thousands of users.

Surprisingly, we don‘t see Thrive or Genesis here. Both have grown enormously, but apparently not as steadily as expected.

WordPress 4.x Slowly Losing Its Grasp

In December 2018, WordPress released 5.0 with the new Gutenberg editor.

The community has been reluctant to embrace Gutenberg‘s rigid, difficult nature. While Matt Mullenweg has promised improvements, many have not upgraded. Per WordPress, the Classic Editor will be supported through 2021.

Here‘s the version data:

WordPress version usage — Two months after its release, 60,000 top 1 million sites have updated to 5.0. But WordPress 4.x maintains dominance.

WordPress 4.x likely dominates because many sites are built by agencies and developers. Upgrading can cause major issues.

Now let‘s examine other interesting trends.

Most Popular Web Server

Analyzing Server headers shows the top web servers and proxies:

While Apache leads in some surveys, our analysis focuses on the top 1 million sites. As the fastest web server, Nginx powers high-traffic websites. Its rapid evolution and performance benefits ensure its continued dominance.

PHP Dominates Server-Side Languages

Analyzing X-Powered-By headers shows PHP‘s dominance:

"X-Powered-By" is a common non-standard response header indicating the technology powering a site‘s backend. It can be disabled or manipulated.

We see ASP.NET for Windows, Express and Passenger for Node.js, and EasyEngine – an Nginx-based tool for WordPress sites utilizing caching and performance technologies like Redis, Let’s Encrypt, and Docker.

PHP 7 Usage Still Lagging

PHP 7 came out in 2015, but most sites still use PHP 5.x:

PHP version usage — Of 207,399 sites stating their PHP version, 146,227 still use PHP 5.x despite 7‘s performance gains.

This is surprising since support for PHP 5.6 ended in 2018. Now is the time to upgrade!

We also found 40% of the 82,000+ WordPress sites showing PHP versions already use PHP 7 or higher. The tide is slowly turning.

Use of Secure HTTP Headers

With large-scale attacks so prevalent, securing your site is crucial. We checked implementation of OWASP secure headers to mitigate attacks:

Usage of OWASP secure headers — Most major headers are implemented by 20-35% of sites. Feature-Policy is newer and not widely adopted yet.

This data shows decent adoption, but there‘s still room for improvement.

HTTP/2 Adoption Still Lagging

HTTP/2 growth chart — Image credit: coolicehost

Introduced in 2015, HTTP/2 adoption has been slow. Our analysis found ~260,000 of the top 1 million sites use HTTP/2 – about 1/3.

Many sites still use old servers without HTTP/2 support. But enabling it on Apache and NGINX is easy. Most modern hosts and CDNs like Sucuri support HTTP/2 already. If you haven‘t switched, now may be the time!

SSL Adoption Still Catching Up

Google wants all sites to use HTTPS and Chrome marks HTTP as non-secure. Still, only 50% of the top sites use HTTPS.

You can get a free SSL certificate from Let’s Encrypt. Read our guide on setting up Let‘s Encrypt. There‘s no good reason not to switch to HTTPS!

Website Performance Analysis

For you performance geeks, here‘s an analysis of TTFB (time to first byte):

343,328 sites have TTFB under 300ms
284,070 sites are between 301-600ms
261,629 sites are between 601-1000ms
110,973 sites are over 1000ms

The goal is under 200ms. Most modern sites fall between 200-500ms. If your site is over 600ms consistently, investigate and tune your server!

Key Takeaways

Data source: Alexa Top 1 Million sites as of Dec 23, 2018
Tests conducted January 2019 using Python
Security respected – no scraping of sites blocking bots

The web is constantly evolving. By analyzing trends across popular sites, we can learn how to optimize our own websites for performance, security, and growth. Implementing best practices from successful sites is a proven strategy for improving your online presence.