Is WordPress Still Relevant for Lawyers?

Is WordPress still relevant for a law firm website in 2026? Yes, but it is no longer the safe default. We moved our own site, roisociety.com, off WordPress and the Elementor page builder, and a simple edit that used to take our team two days now takes minutes. You’re reading this on the new site.

Our advice to law firms: if your WordPress site is fast and your forms and tracking work, there is no rush, but start planning a move. Move sooner if updates keep breaking pages or simple edits take days, and use our 7-step checklist to protect your leads, rankings and tracking.

WordPress used to be the industry standard, and its plugins are now where it breaks: reported WordPress vulnerabilities rose 42% in 2025, mostly in plugins (Patchstack). That is why we are moving our clients to AI-built websites as fast and as affordably as we can.

By AI-built, I mean a site our team builds and changes with Claude, an AI coding assistant, on the Astro web framework. In my experience these sites are faster, safer and easier to optimize for search, and their design holds its own against a custom agency build.

Key takeaways

• Keep or move: a fast WordPress site with working forms and tracking can wait, but start planning a move. Move sooner if updates keep breaking pages or simple edits take days.
• WordPress runs 39.6% of all websites, down from 43.6% in January 2025 (W3Techs).
• Patchstack counted 11,334 new WordPress vulnerabilities in 2025, 91% of them in plugins. In July 2026, WordPress.org forced an update to fix a critical flaw in WordPress core itself (WordPress.org).
• By Astro’s own count, 71% of real Astro sites pass Core Web Vitals versus 48% of WordPress sites.
• In a move, keep or redirect every URL (Google) and test every form and tracking tag before launch.

Contents

1. WordPress is still relevant, but its share is falling
2. Plugins are where WordPress sites break
3. Elementor turned simple edits into two-day jobs
4. Astro vs WordPress: fewer moving parts, faster pages
5. A law firm website redesign must protect leads, rankings and tracking
6. AI drafts about 80 percent of a new site and designers finish the rest
7. An agency still matters for conversion, tracking and campaign fit
8. FAQ
9. Sources

WordPress is still relevant, but its share is falling

WordPress remains the most used website platform. It powers 58.3% of sites with a known content management system, more than all the others combined (W3Techs).

Plenty of business websites still use WordPress, but its share of all websites has turned: 43.1% on January 1, 2024, 43.6% in 2025, 43.0% in 2026 and 39.6% now (W3Techs).

Stability worries me more. In September 2024, WordPress.org banned the host WP Engine, a move announced by WordPress co-creator and Automattic CEO Matt Mullenweg (TechCrunch). WP Engine customers could not install or update plugins from their dashboards.

On October 12, 2024, WordPress.org forked the popular Advanced Custom Fields plugin and moved sites with auto-updates to its copy. A judge ordered WP Engine’s access restored that December. In a ruling reported in September 2026, a federal judge let WP Engine’s antitrust claims against Automattic and Mullenweg go forward (Search Engine Journal).

My take: none of this breaks your site tomorrow, but I would not pick a platform with this much uncertainty for the page that brings in your cases.

Plugins are where WordPress sites break

Most WordPress risk lives in plugins, the add-ons that run forms, caching and page building. Patchstack’s 2026 report counted 11,334 new WordPress vulnerabilities in 2025, up 42% on 2024. Plugins accounted for 91% and themes for 9%, while WordPress core itself had only 6.

Nearly half of those flaws, 46%, had no developer fix when they went public. Patchstack puts the weighted median time from public disclosure to the first attacks at 5 hours (Patchstack).

Not every flaw is an emergency. Wordfence rated over 68% of 2024’s disclosed flaws low risk for most site owners. Both reports come from companies that sell WordPress security, so read their counts as a warning light.

Even WordPress core had a critical hole in 2026

On July 17, 2026, WordPress 7.0.2 fixed one critical and one high severity flaw in core, and WordPress.org forced the update. Chained together, a REST API bug and an SQL injection flaw let an attacker run their own code on the server.

BleepingComputer reported on July 21 that attackers had used the chain, known as wp2shell, to install webshells, hidden backdoors into a site, without logging in. Probing began the day of the patch. A tracker of 124,580 sites cited in the report showed 81.6% patched, leaving about 1 in 5 exposed.

Plugins have done this before. In 2024, a flaw in LiteSpeed Cache, a plugin on over 5 million sites, let attackers create admin accounts, and Wordfence blocked over 48,500 attacks in one day (BleepingComputer).

Should you turn on auto-updates?

Yes. Every client of ours still on WordPress has automatic theme and plugin updates turned on, because without them, security falls out of date.

Updates break things too. A payment page on one client’s WordPress site broke about three times in a single month, each time reported after automatic updates. If you stay on WordPress, keep off-site backups so you can roll back a bad update, and delete plugins you do not use.

Elementor turned simple edits into two-day jobs

Elementor is a drag-and-drop page builder for WordPress with 10+ million active installations on WordPress.org. Our old site was built on WordPress with it.

Elementor used to be the industry standard too, and in my view it has fallen hard. On our old site, a simple change could take two days, because we had to disable other plugins to edit anything. The whole build was an unoptimized mess.

Page builders also add weight. Elementor’s own 3.24 update promised “a CSS size reduction of up to 668kb on every loaded page” by loading widget styles only where they are used.

That weight drags on site speed and Core Web Vitals, Google’s measures of how fast a page loads, responds and stays steady (Google). We rebuilt roisociety.com on Astro and retired Elementor.

If your site is slow, hard to change, or you are unsure your forms survived the last update, get a law firm growth evaluation.

Astro vs WordPress: fewer moving parts, faster pages

Astro is a modern web framework for “content-driven websites like blogs, marketing, and e-commerce” (Astro docs). One of its listed features is “Zero JS, by default”: no JavaScript loads unless a feature needs it. Our sites prebuild every page and serve it as a file, so no plugin code runs when someone opens your practice area page.

The table compares a typical law firm WordPress website with how we build now. The last row is our view.

Is Astro faster than WordPress?

On average, yes: Astro sites pass Core Web Vitals more often. The 71% comes from Astro’s own site, so read it with care. An independent Search Engine Journal analysis put Astro at 67%, fourth among the platforms it compared, and WordPress last at about 49%.

My guess is that part of the gap comes from who builds Astro sites: mostly developers. Speed is not everything, either: Google says good Core Web Vitals do not “guarantee that your pages will rank at the top” (Google Search Central). Our take: treat speed as a tiebreaker in search results and a win for conversions.

What an AI-built site gives your firm

• SEO control. Good SEO needs control over titles, headings and schema. We set every one in code, with no plugin settings in the way, which also supports AI search optimization.
• Design. I put our design on par with a $10,000 to $20,000 custom build, the range where PaperStreet’s 2026 prices move from the Plus tier to the Custom tier.
• Portable code. Astro is open source under the MIT license, and the site is a folder of code files another developer or host can pick up.
• Fast changes. A simple edit takes our team minutes. We build our Command Center, the dashboard behind our client campaigns, with Claude too.

A law firm website redesign must protect leads, rankings and tracking

A redesign is an easy place to lose leads without noticing. The new site looks better, but a form posts nowhere, a call tracking number disappears, or old URLs return errors. Hold any web team to this checklist, including us.

1. List every URL first. Pages, posts, PDFs and images that rank all count. Keep the same URLs where you can.
2. Redirect every URL that changes. Google recommends server-side permanent redirects from each old URL to its new one, kept for at least a year.
3. Carry over what ranks. Titles, meta descriptions, headings, schema and internal links on top pages move over unchanged unless you improve them on purpose.
4. Test every lead path. Send a test lead through each form to your inbox and intake system, call each tracking number and open the chat widget.
5. Rebuild tracking, then verify it. Move Google Tag Manager, GA4 key events, Google Ads conversions, the Meta pixel and any hidden form fields that store the ad click ID.
6. Update links that point at the site. Google Ads final URLs, sitelinks, your Google Business Profile and directory listings should reach live pages, not redirects.
7. Clear staging blocks and watch. Remove any noindex or robots.txt block left from development, keep Search Console verification working and submit the new sitemap (Google). Google says a small to medium-sized site “can take a few weeks for most pages to move, and larger sites take longer.”

When we moved roisociety.com off WordPress, we redirected our old WordPress blog addresses to their new pages, so old links still land on the right post.

AI drafts about 80 percent of a new site and designers finish the rest

If your firm is on WordPress, I think it is time to start planning a move to an AI-built site. AI gives you a head start: it scans your entire site, builds a draft and gets you about 80% of the way there. That figure is my rule of thumb, not a measured benchmark.

Professional web designers finish the rest, and web design now takes a fraction of the time it used to. In our process, the AI keeps your WordPress content and structure. People then fix layout details, brand fit, forms, tracking and the copy on the pages that bring in cases.

My prediction, and it is only my opinion: people will soon design sites entirely on their own, and web designers will become obsolete.

An agency still matters for conversion, tracking and campaign fit

For now, our agency’s value is the setup and the finish: building the structure and foundation, installing everything, and fine-tuning the last 20% of design and functionality. Long term, I think the value is the vision for the site.

That vision starts with knowing what converts. A website built as a funnel puts the call button, practice areas and proof where a stressed person finds them in seconds. It includes consulting on direction, fitting the site to your marketing campaigns and setting up tracking that ties ads to signed cases.

It also means stopping an owner from putting brand ahead of conversion and losing their lead flow to an over-agreeing AI. Ask an AI tool for a bigger logo, a video header and less text, and it can do all three without pushing back. Your phone number can end up below the fold.

In my view, an AI builder is not aware of these trade-offs on its own. Only a tech-savvy business owner with the time to handle all of it can make sure everything is in place.

We are also building two features, and neither is live yet:

• Self-improving blogs that refresh posts as rankings shift.
• Self-repairing sites where a scan catches anything that breaks and restores the last working version.

Today, our Weekly Audit checks each client site every week for downtime, mobile speed, changed tracking tags and conversions. It alerts our team to critical problems, and we fix what it finds.

FAQ

Is WordPress dying or dead?

No. WordPress continues to run about 4 in 10 websites (W3Techs), and its core software still gets security fixes, including a forced update in July 2026 (WordPress.org). Its share is shrinking, though: down about 4 points since the start of 2025.

What are people using instead of WordPress?

After WordPress, the most used systems are Shopify (5.3% of all websites) and the website builders Wix (4.2%) and Squarespace (2.4%), per W3Techs. Astro, the framework we use, runs 0.2%. You can also keep WordPress only as the editor and let Astro serve the pages, a setup called headless WordPress (Astro docs).

Will I lose rankings if I move my site off WordPress?

Expect some temporary movement, even with a good plan. Google’s site move guide says: “Expect temporary fluctuation in site ranking during the move.” For a small to medium-sized site, most pages can take a few weeks to move. To protect what ranks, keep or redirect every URL and carry over your content, titles and schema.

How much does a law firm website cost?

PaperStreet’s 2026 prices run about $3,000 to $5,000 for its Essentials templates, $9,500 to $15,000 for Plus, which adds a custom home page, and $18,000 to $25,000 for Custom. Juris Digital put a modest custom build at $6,000 to $10,000 in 2025. Both companies sell law firm websites.

WordPress is no longer the default choice for a law firm

WordPress is still relevant, but for a firm that needs a fast, secure site that turns visitors into consultations, it now has to earn its place.

If your firm is on WordPress and changes are slow, plugins keep breaking, or you are unsure your tracking survived the last update, talk to us about a website move. We will review your site, lead paths and tracking before anything changes, and tell you whether WordPress still fits your firm.

Sources

1. Patchstack, “State of WordPress Security in 2026”, https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/, checked 2026-10-20
2. W3Techs, “Historical yearly trends in the usage statistics of content management systems”, https://w3techs.com/technologies/history_overview/content_management/all/y, checked 2026-10-20
3. WordPress.org, “WordPress 7.0.2 Release”, https://wordpress.org/news/2026/07/wordpress-7-0-2-release/, checked 2026-10-20
4. Astro, “Astro”, https://astro.build/, checked 2026-10-20
5. Google Search Central, “Site Moves and Migrations”, https://developers.google.com/search/docs/crawling-indexing/site-move-with-url-changes, checked 2026-10-20
6. W3Techs, “Usage Statistics and Market Share of WordPress”, https://w3techs.com/technologies/details/cm-wordpress, checked 2026-10-20
7. TechCrunch, “WordPress.org bans WP Engine, blocks it from accessing its resources”, https://techcrunch.com/2024/09/25/wordpress-org-bans-wp-engine-blocks-it-from-accessing-its-resources/, checked 2026-10-20
8. WP Tavern, “ACF Plugin Forked to ‘Secure Custom Fields’ Plugin”, https://wptavern.com/acf-plugin-forked-to-secure-custom-fields-plugin, checked 2026-10-20
9. The Register, “WP Engine wins injunction against Automattic”, https://www.theregister.com/2024/12/11/wp_engine_wins_injunction_against/, checked 2026-10-20
10. Search Engine Journal, “Automattic & Matt Mullenweg Fail To Dismiss WP Engine Antitrust Claims”, https://www.searchenginejournal.com/automattic-matt-mullenweg-fail-to-dismiss-wp-engine-antitrust-claims/591210/, checked 2026-10-20
11. Wordfence, “2024 Annual WordPress Vulnerability and Threat Report by Wordfence”, https://www.wordfence.com/wp-content/uploads/2025/04/2024-Annual-WordPress-Security-Report-by-Wordfence.pdf, checked 2026-10-20
12. BleepingComputer, “Critical wp2shell WordPress flaws exploited to install webshells”, https://www.bleepingcomputer.com/news/security/critical-wp2shell-wordpress-flaws-exploited-to-install-webshells/, checked 2026-10-20
13. BleepingComputer, “Hackers are exploiting critical bug in LiteSpeed Cache plugin”, https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-critical-bug-in-litespeed-cache-plugin/, checked 2026-10-20
14. WordPress.org, “Elementor Website Builder: more than just a page builder”, https://wordpress.org/plugins/elementor/, checked 2026-10-20
15. Elementor, “Elementor 3.24 Developers Update”, https://developers.elementor.com/elementor-3-24-developers-update/, checked 2026-10-20
16. Google Search Central, “Understanding Core Web Vitals and Google search results”, https://developers.google.com/search/docs/appearance/core-web-vitals, checked 2026-10-20
17. Astro Docs, “Why Astro?”, https://docs.astro.build/en/concepts/why-astro/, checked 2026-10-20
18. WordPress.org, “Requirements”, https://wordpress.org/about/requirements/, checked 2026-10-20
19. Jamstack.org, “Why Use the Jamstack?”, https://jamstack.org/why-jamstack/, checked 2026-10-20
20. Search Engine Journal, “Core Web Vitals: WordPress And Astro Versus Everyone Else”, https://www.searchenginejournal.com/core-web-vitals-wordpress-and-astro/575818/, checked 2026-10-20
21. Google Search Central, “Understanding Google Page Experience”, https://developers.google.com/search/docs/appearance/page-experience, checked 2026-10-20
22. PaperStreet, “Law Firm Web Design Costs and Pricing (2026 Update)”, https://www.paperstreet.com/blog/pricing-for-law-firm-web-sites/, checked 2026-10-20
23. GitHub (withastro/astro), “LICENSE”, https://github.com/withastro/astro/blob/main/LICENSE, checked 2026-10-20
24. W3Techs, “Usage Statistics and Market Share of Content Management Systems”, https://w3techs.com/technologies/overview/content_management, checked 2026-10-20
25. Astro Docs, “Headless WordPress & Astro”, https://docs.astro.build/en/guides/cms/wordpress/, checked 2026-10-20
26. Juris Digital, “How Much Will a Law Firm Website Cost?”, https://jurisdigital.com/guides/law-firm-website-cost/, checked 2026-10-20

Header image: AI-generated.