A site cleaned after a hack starts out clean, then gets taken again. This survey looks at what cleaning never changes: the number of suppliers the site depends on.
An average says nothing here, because it blends two populations. The distribution shows it at a glance.
| Extensions detected | Sites | Share |
|---|---|---|
| None visible | 115 | 21 % |
| 1 to 2 | 122 | 23 % |
| 3 to 5 | 142 | 26 % |
| 6 to 10 | 107 | 20 % |
| 11 and more | 54 | 10 % |
The median site carries 3 extensions. In the heaviest decile it carries 11, and the highest count recorded is 28. Half the estate is sober, and a clear minority carries a load on another scale entirely.
An extension published on the official WordPress repository has a public page, an identifiable author and a last-updated date anyone can check. 66 % of the sites surveyed carry at least one extension absent from that repository: a paid extension, one delivered by an agency, or bespoke development.
Its updates do not arrive through the public channel. They arrive through a contract, an annual invoice, or the inbox of someone who may have left the company. Among the extensions whose author is identifiable, 20 % of sites already depend on five distinct companies or more, and that number is a floor.
When a site is hacked, what the provider is asked to do is clean it: remove the added files, reinstall the core, change every credential, restore a clean backup. That work is necessary and it works, the site starts out clean.
It acts on what got in. The tables on this page describe something else: the number of doors. A site cleaned on Monday depends on Tuesday on the same suppliers, whose future releases nobody knows. The odds that none of them publishes a flaw within the year are not computed over one draw, but over as many draws as there are suppliers.
That explains reinfection without assuming a cleaning mistake. Two sites cleaned with equal care do not face the same year if one carries three extensions and the other twenty-eight.
| Extension | Sites |
|---|---|
| Contact Form 7 | 102 |
| Elementor | 87 |
| WP Rocket | 82 |
| Elementor Pro | 61 |
| WooCommerce | 58 |
| WPML | 37 |
| Complianz | 35 |
| Brevo | 33 |
None of these extensions is at fault. They describe what an SMB site actually does: a contact form, a page builder, caching, a shop, translation, a consent banner, a newsletter. Each one is one more supplier.
Serenity is a website created, hosted, secured and kept up to date by Simafri, which has been creating, hosting and maintaining business websites since 2002. The domain name is registered in the customer’s name, and a Simafri Suite account is included.
Sampling frame: the 10,662 .fr domains of the Tranco list GQJJK, established on 31 August 2026. The first 9,144 by rank were swept on 1 September 2026, that is 86 % of the frame.
Qualification chain: every reachable site (6,791) was read as a public page. The SIREN company number was looked up in the legal notice French law requires every site to publish, then resolved against the public company API, which ties 3,061 sites to a real company. 157 public bodies were set aside, along with 27 sites attributed to their host, whom the legal notice is required to name. That leaves 1,778 SMBs of 1 to 249 employees, 540 of them on WordPress.
What was read: the extensions and themes whose presence appears in the public code of the home page, and for each extension, the author declared on the official WordPress repository.
What was not read: nothing requiring access to the site, its administration or its hosting. No intrusion testing, one request per site.
Scope: an extension that loads neither script nor stylesheet on the home page stays invisible, so the numbers on this page are floors and the real load is higher. As the frame is a list of the most visited domains, very small sites are under-represented in it. The next survey will widen the frame and read the publisher’s SIREN rather than the host’s when both appear.
The full survey is published, one row per company, with its domain, its SIREN, its employee band and the extensions detected. These figures may be reused with attribution to Simafri and a link to this page.
Download the full survey (CSV)
Next survey planned for 1 October 2026, on a wider frame, which will show whether the load is rising or falling.
Simafri has been the technical ally of businesses since 2002: we create your website, host it, maintain it and keep it up to date, with your domain name registered in your own name. Write to us and we will look at your case together.
Simafri
Let's talk about your project
Tell us what you need in a few words: we will get back to you quickly.
Prefer email? Write to us at support@simafri.com.
The form is not displaying? Write to us directly:
support@simafri.com