Published November 2026·last updated 3 November 2026·crawl of 17 August 2026 to 23 August 2026
Half the sector runs WordPress. WordPress ships security releases that install themselves - unless something is switched off, broken or too old to update. We read the version each site printed and counted how many were current on the day.
Of 55,300 charity homepages that answered and could be read, 27,041 run WordPress. The hosted builders come next: Wix on 11.1% and Squarespace on 6.0%. The long tail is the rest of the web - Drupal, Joomla, Google Sites, Webflow - and a sizeable group of hand-built or unidentifiable sites.
Detection reads the page a site serves: WordPress asset paths and its REST API link, or each builder's own fingerprint. A site that shows none of them is "no platform detected", which includes bespoke builds and platforms the detector does not know.
WordPress 7.0.4 shipped on 12 August 2026, two days before the crawl began. It was a security release, and its fix was backported to every supported branch at the same time. Point releases like it install themselves by default, so a site still missing one when it was read, between two and eleven days later, has automatic updates switched off, failing, or blocked by its host.
Being on an older branch is a different matter. WordPress 7.1 was released on 19 August 2026, while the crawl was running, and major releases do not install themselves. A site on 7.0.4 or on 6.4's last point release was as patched as one on 7.1 the day it was read. The two violet rungs are sites on the latest security release for whatever branch they run; the pink rungs are not; the darkest is a branch nobody patches any more.
Note: 74.1% of WordPress sites print a readable version, in their generator tag or on a core asset URL; the other 7,004 sites strip it. They are in the WordPress share above and out of every version figure. Sites that hide their version may be better looked after, or may simply run a security plugin that removes the tag - this page does not guess which.
WordPress ships a major release roughly three times a year, so the branch a site runs is a rough clock: 6.4 dates from late 2023, 6.0 from 2022, the 5.x series from 2018 to 2021 and 4.x from before that. 5,278 of the 20,037 version-readable sites are on a branch older than 7.0.
Most of those still receive security fixes by backport, and most had taken them. The exception is the oldest group: WordPress stopped providing security updates for versions 4.0 to 4.6 in July 2025, and 56 charity sites were still running one of them.
The share of version-readable WordPress sites that were missing security releases, or on an unsupported branch, by the linked charity's income. Income is known for England and Wales registrations only; Scottish and Northern Irish sites sit in "income not reported".
How a WordPress site is built shapes how easily a small team can change it and who can maintain it later. Each site is counted once, under the first builder its page reveals; a site that shows only the block editor's own markup is "block editor, no page builder".
WooCommerce, the shop plugin, is present on 6,213 WordPress charity sites (23.0%) - often for memberships, tickets and merchandise rather than a shop as such.
WordPress and most other platforms run on PHP, and a PHP
branch stops receiving security fixes four years after release. A site
reveals its branch only when its host leaves the X-Powered-By
header on: 11,067 of the 55,300 readable homepages
(20.0%) do, which makes this the one figure on this page drawn from a
minority of sites.
Of those, 4,925 run a branch older than 8.2 - end of life, no fixes for any newly found flaw - and a further 1,520 run 8.2, whose security support ends on 31 December 2026. Among WordPress sites that reveal their PHP, 41.5% of 9,513 are on an end-of-life branch.
Note: a host that advertises its PHP version is usually a shared host on default settings, so this sample is likely to lean older than the sector as a whole. The page does not scale it up.
48.9% of 55,300 readable UK charity homepages run WordPress (November 2026).
13.6% of the 20,037 UK charity WordPress sites whose version is readable had not installed the latest security release for their branch, two to eleven days after WordPress 7.0.4 shipped.
56 UK charity websites run a WordPress branch (4.0 to 4.6) that stopped receiving security updates in July 2025.
26.3% of version-readable UK charity WordPress sites are on a branch older than 7.0.
Wix (11.1%) and Squarespace (6.0%) are the largest platforms after WordPress among UK charity websites.
44.5% of the 11,067 UK charity websites that advertise their PHP version run a branch that no longer receives security fixes.
Method, reproducibility and licence
What we measured. One homepage per charity website, read
once between 17 August 2026 to 23 August 2026 by an identified crawler that honours robots.txt
(nebula.design/bot). Platform detection runs on the HTML
the site served. A WordPress version is recorded only where the site prints
one: the generator meta tag (17,392 sites) or the version query
string on a core-owned asset such as the block-library stylesheet
(2,645 sites). Plugin and theme version strings are never read as the
core version, and a version string above the current release (1
sites printed one) is treated as unreadable.
What we did not do. No site was probed: no request for a readme, a version file, a login page or anything beyond the homepage and the donation path other papers in this series describe. No vulnerability check of any kind was run, and no figure on this page says that any site is exploitable. "Missing security releases" means exactly that a site printed a version older than the latest point release of its own branch.
The ladder. The latest security release for each branch is the highest point release observed on that branch in the crawl itself. WordPress 7.0.4 and its backports to older branches shipped on 12 August 2026, before the crawl began, and automatic updates had been applying them since, so the observed maximum is the real one on every branch with enough sites to see it; branches with fewer than 20 version-readable sites give every site the benefit of the doubt. The current branches are 7.0 and 7.1: 7.1 was released on 19 August 2026, during the crawl, and 7.0.4 remained fully patched on both sides of that day. Branches 4.0 to 4.6 stopped receiving security updates in July 2025. Release history: WordPress releases; policy: Dropping security updates for WordPress versions 4.1 through 4.6.
PHP. Read from the X-Powered-By response
header the homepage was served with, where present; nothing was requested to
find it. Support status per php.net's supported versions
page: 8.2 to 8.5 receive security fixes; every older branch is end of
life.
Population. Charities whose declared purpose is religious activity are excluded from every figure on this page. The rule is recall-first, so it removes a borderline record rather than keeping one.
Denominator. Readable homepages: every crawled domain in the working set whose homepage answered and parsed, the same population as the cookies-and-consent paper. Sites whose robots.txt declined the crawler were never requested and are not in it. Version figures are over WordPress sites whose version is readable, and every such figure says so.
Aggregates only. No charity, domain or address appears on this page, and the generator refuses to write a file that contains one.
Quote any figure freely with credit. For a formal reference:
Nebula Design (2026). What the UK's charity websites are built on. Platforms and WordPress version currency across 55,300 charity homepages. Nebula Design Research, November 2026. Version 1.0, crawl of 17 August 2026 to 23 August 2026. https://nebula.design/research/uk-charity-website-platforms-2026/
The aggregate table behind every figure is data.csv - every number on this page can be recomputed from it. All aggregate figures are released under CC BY 4.0; register data is used under the Open Government Licence v3.0 (Crown Copyright). This page carries no information about any individual charity.
