A site cleaned after a hack starts out clean, then gets taken again. This survey looks at what cleaning never changes: the number of suppliers the site depends on.
An average says nothing here, because it blends two populations. The distribution shows it at a glance.
| Extensions detected | Sites | Share |
|---|---|---|
| None visible | 395 | 11 % |
| 1 to 2 | 713 | 20 % |
| 3 to 5 | 1,195 | 34 % |
| 6 to 10 | 1,007 | 28 % |
| 11 and more | 233 | 7 % |
The median site carries 4 extensions. In the heaviest decile it carries 9, and the highest count recorded is 28. Half the estate is sober, and a clear minority carries a load on another scale entirely.
A trend can only be measured on the same sites. Of the 540 SMB WordPress sites surveyed in September, 417 are surveyed again in October, qualified the same way. The comparison covers them alone: the sites added by the wider frame do not enter it, and both columns are computed under the same reading rule, described in the method.
| On the same 417 sites | September 2026 | October 2026 |
|---|---|---|
| Extensions on the median site | 4 | 4 |
| Extensions per site, on average | 4.7 | 4.7 |
| Sites with ten extensions or more | 14.6 % | 13.9 % |
| Sites with an extension outside the repository | 66.9 % | 67.9 % |
| Sites with five identified authors or more | 22.5 % | 22.8 % |
368 sites carry exactly the same extensions as in September, 26 carry more and 23 carry fewer.
The load is stable: from one survey to the next, additions and removals almost cancel out. The only one-way movement is towards dependence: 4 sites took on an extension from outside the public repository, and none left it. A load that holds on its own is dealt with at the source, in the way the site is built.
The Tranco list ranks the most visited domains. To give smaller sites their place, the October survey adds 120,000 domains drawn at random from the active .fr names in the registry, read the same way. The two parts are shown side by side here.
| October 2026 | Tranco list | Random draw | Overall |
|---|---|---|---|
| SMB WordPress sites surveyed | 551 | 2,992 | 3,543 |
| WordPress share among identified SMBs | 29.3 % | 46.0 % | 42.3 % |
| Extensions on the median site | 4 | 4 | 4 |
| Sites with ten extensions or more | 13.2 % | 8.7 % | 9.4 % |
| Sites with an extension outside the repository | 67.3 % | 66.3 % | 66.4 % |
The randomly drawn sites, less visited, run WordPress markedly more often than those of the Tranco list. Their load has the same shape: the same median site, slightly fewer heavily loaded sites, and the same dependence outside the repository, two sites in three on each side.
An extension published on the official WordPress repository has a public page, an identifiable author and a last-updated date anyone can check. 66 % of the sites surveyed carry at least one extension absent from that repository: a paid extension, one delivered by an agency, or bespoke development.
Its updates do not arrive through the public channel. They arrive through a contract, an annual invoice, or the inbox of someone who may have left the company. Among the extensions whose author is identifiable, 23 % of sites already depend on five distinct companies or more, and that number is a floor.
When a site is hacked, what the provider is asked to do is clean it: remove the added files, reinstall the core, change every credential, restore a clean backup. That work is necessary and it works, the site starts out clean.
It acts on what got in. The tables on this page describe something else: the number of doors. A site cleaned on Monday depends on Tuesday on the same suppliers, whose future releases nobody knows. The odds that none of them publishes a flaw within the year are not computed over one draw, but over as many draws as there are suppliers.
That explains reinfection without assuming a cleaning mistake. Two sites cleaned with equal care do not face the same year if one carries three extensions and the other 28.
| Extension | Sites |
|---|---|
| Elementor | 1,148 |
| Contact Form 7 | 977 |
| Elementor Pro | 706 |
| Complianz | 536 |
| WooCommerce | 412 |
| WP Rocket | 348 |
| Slider Revolution | 341 |
| Cookie Notice | 296 |
None of these extensions is at fault. They describe what an SMB site actually does: a contact form, a page builder, caching, a shop, a slideshow, a consent banner. Each one is one more supplier.
Serenity is a website created, hosted, secured and kept up to date by Simafri, which has been creating, hosting and maintaining business websites since 2012. The domain name is registered in the customer’s name, and a Simafri Suite account is included.
Sampling frame, in two parts. The first is September’s: the 10,662 .fr domains of the Tranco list GQJJK, established on 31 August 2026, swept in full this time. The comparison with September is made on this part.
The second widens the frame: 120,000 domains drawn at random from the 4,607,211 active .fr names in the Afnic open data file, August 2026 edition. The draw is reproducible, and both parts will be read again identically every month. Swept on 23 September 2026.
Qualification chain: every reachable site (66,183) was read as a public page. The SIREN company number was looked up in the legal notice French law requires every site to publish, keeping the site publisher’s number rather than its host’s or its provider’s, then resolved against the public company API, which ties 20,474 sites to a real company. 292 public bodies were set aside, along with 437 sites whose number was that of a host, an agency or a website platform, found on several unrelated domains. A company counts once, through the first of its sites surveyed. That leaves 8,380 SMBs of 1 to 249 employees, 3,543 of them on WordPress.
What was read: the extensions and themes whose presence appears in the public code of the home page, and for each extension, the author declared on the official WordPress repository. Only traces served by the site itself or by its delivery network count: a customer-review widget loaded from its vendor’s WordPress site does not make the site displaying it a WordPress site. Since October every survey applies this rule, and the September column of the trend table is recomputed under it.
What was not read: nothing requiring access to the site, its administration or its hosting. No intrusion testing, one request per site.
Scope: an extension that loads neither script nor stylesheet on the home page stays invisible, so the numbers on this page are floors and the real load is higher. A trend is read on the sites present in two successive surveys: a site that became unreachable, left WordPress or is now tied to its actual publisher leaves the comparison.
Every survey is published in full, one row per company, with its domain, its SIREN, its employee band, the extensions detected and the part of the frame it comes from. These figures may be reused with attribution to Simafri and a link to this page.
Download the October 2026 survey (CSV)
Download the September 2026 survey (CSV)
Next survey planned for 1 November 2026, on the same frame, which will show whether the load is rising or falling across all the sites.
Simafri has been the technical ally of businesses since 2012: we create your website, host it, maintain it and keep it up to date, with your domain name registered in your own name. Write to us and we will look at your case together.
Simafri
Let's talk about your project
Tell us what you need in a few words: we will get back to you quickly.
Thank you! Your request has been sent. We'll get back to you shortly.
Prefer email? Write to us at support@simafri.com.