WordPress development company: 7 checks before the 19 August 2026 release

Summary. WordPress 7.1 is scheduled for 19 August 2026, timed with WordCamp US, and it carries a hard-deprecation wave across roughly 20 components in the @wordpress/components package. WordPress runs 40.8% of all websites and holds 59.0% of the CMS market as of August 2026, according to W3Techs. Patchstack recorded 11,334 new vulnerabilities in the WordPress ecosystem during 2025, a 42% rise on 2024, with 91% of them in plugins and only 6 in core. The weighted median time from disclosure to first exploitation is 5 hours. Hosting-layer defences blocked just 26% of vulnerability attacks in Patchstack's own pentest of major hosts. Those four numbers, not a portfolio page, are what separate a WordPress development company that can run an enterprise build from one that cannot.

Most buyer guides for this decision compare hourly rates. That is the wrong axis. A managed WordPress.com Business plan is published at $40 per month billed monthly, falling to $17.50 per month on the longest term, while WordPress VIP publishes no rate card at all and quotes every contract individually. The spread between those two is not really about hosting. It is about who absorbs the upgrade, security and integration work that WordPress generates continuously. The seven checks below are the ones we use ourselves, and each maps to a decision your team will otherwise make by accident.

Check 1: can they name what breaks in 7.1?

WordPress 7.1 was confirmed for 19 August 2026 in the Roadmap to 7.1, following Beta 1 on 15 July and Release Candidate 1 on 5 August. Ask a prospective partner what in your stack breaks. A team that has actually read the dev notes will raise these without prompting:

• The __next40pxDefaultSize prop is hard-deprecated across roughly 20 components including TextControl, BoxControl, RangeControl, UnitControl and CustomSelectControl. The 40px control size becomes the permanent default and the prop becomes a no-op.
• All 330 icons in @wordpress/icons v15 now declare fill="currentColor". Any CSS that tints icons through the fill property stops working and must move to color.
• The useResizeCanvas() hook is deprecated and no longer operational, though getDeviceType() and setDeviceType() still work.
• The @wordpress/reusable-blocks package is deprecated and on a path to becoming a no-op.
• Speculative loading moves from conservative to moderate by default when a caching solution is detected.

None of these are catastrophic on their own. Together they are a fortnight of regression testing on a site with custom blocks, and they are invisible to anyone who has not been reading Make WordPress Core weekly.

Check 2: do they know which roadmap items did not ship?

This is the question that separates depth from summary reading, and it is worth asking verbatim.

The iframed editor is the example. Roadmap coverage repeatedly lists "enforced iframed editor for block themes" as a 7.1 item. But the dev note on iframed editor changes states plainly that the iframe is not enforced in WordPress 7.0 and that the enforcement timeline was revised for a gradual rollout. What actually changed in 7.0 is narrower: core now checks the block API version of blocks inserted in the post rather than all registered blocks across every plugin. Insert a version 2 block into a post and the editor drops out of the iframe. Gutenberg plugin 22.6 enforces the iframe for classic themes, but that is the plugin, not core.

A partner who tells you "the iframe is enforced in 7.1" has read a roundup. A partner who can explain the inserted-versus-registered distinction has read the ticket. We wrote up the migration path in detail in our note on the WordPress 7.1 iframed editor and block API v3 migration.

Similarly, the plan to hide the Classic block from the inserter in 7.1 was announced in June 2026 and then reverted in July. The Classic block stays. Any migration plan built on its removal is already wrong.

Check 3: how do they handle plugin risk?

Plugin risk is the dominant security exposure in WordPress, and the numbers are unambiguous.

Metric (2025 ecosystem data)	Figure	What it means for a build
New vulnerabilities disclosed	11,334 (+42% YoY)	Volume alone defeats manual tracking
Share found in plugins	91%	Your plugin inventory is your attack surface
Vulnerabilities in WordPress core	6, all low priority	Core is not the problem
High-severity share	1,966 (17%)	Roughly one high-risk item per working day
Unpatched at public disclosure	46%	Updating promptly is not sufficient
Weighted median time to first exploit	5 hours	Manual patching cycles are too slow

All figures are from Patchstack's State of WordPress Security in 2026, data updated 25 February 2026.

Two findings deserve particular weight when you are choosing a partner. First, premium components are riskier than free ones, which inverts the usual procurement instinct: Patchstack received 1,983 valid reports for premium or freemium components, 76% of which were exploitable in real attacks, and premium components carried three times more known exploited vulnerabilities than free ones. Second, hosting will not save you. In two separate pentests of major hosting providers, traditional defences blocked 12% of known exploited vulnerability attacks in the narrower study and 26% of attacks in the broader one.

The practical consequence is that a credible WordPress development company runs a plugin allowlist with named owners, tracks a software bill of materials for both PHP and JavaScript dependencies, and has a mitigation path that does not depend on a vendor shipping a patch. Ask how many plugins they would remove from your current site. A partner who answers "none" has not looked.

Check 4: are they building for the Abilities API?

The Abilities API shipped as infrastructure in WordPress 6.9, and a merge proposal adds the first practical abilities to core: core/read-settings, core/read-content and core/read-users. All three are read-only and built on existing capability checks, with core/manage-* abilities planned later.

This matters commercially. Abilities are the surface through which AI agents and automation will read and act on a WordPress site, and WordPress Playground has already gained MCP support with a playground_ability meta-tool that lets agents list, inspect and execute abilities through a single tool. The AI team has confirmed that streaming and embeddings are coming to the AI Client in 7.1, aimed at plugin developers rather than end users.

If your site will be read by AI assistants, and for most publishers it already is, the integration work belongs in the build rather than in a later phase. Patchstack's own outlook notes that the Parrot TDS malware family now detects AI training crawlers and serves them clean content, which is a reminder that this surface is contested rather than theoretical.

Check 5: managed platform, or build and run?

There are three defensible operating models and one common mistake, which is picking a platform tier by price and discovering the governance gap after launch.

Model	Published cost signal	Best fit
WordPress.com Business	$40/month monthly, $17.50/month on longest term	Single marketing site, SFTP and WP-CLI needed
WordPress.com Commerce	$70/month monthly, $31.50/month on longest term	WooCommerce storefront, one team
WordPress VIP Standard	No published price, custom quote	Up to 10 network sites, 99.95% uptime SLA
WordPress VIP Enhanced	No published price, custom quote	Up to 100 network sites, 99.99% uptime SLA
WordPress VIP Signature	No published price, custom quote	Up to 1,000 network sites, regulated environments
Self-hosted with an engineering partner	Contracted, varies by scope	Custom integrations, data residency control

Prices from WordPress.com pricing and tier limits from WordPress VIP pricing, both as published in August 2026. Note what is absent: WordPress VIP publishes SLA and capacity limits but no numbers. Third-party figures circulating as "WordPress VIP starts at $25,000 a year" do not appear on any Automattic page we could retrieve, so treat them as unverified.

The SLA gaps are the part buyers underestimate. VIP Standard commits to a 60-minute urgent ticket response and 99.95% uptime. Enhanced moves to 30 minutes and 99.99%. Signature commits to 15 minutes urgent and 4 hours non-urgent. Those tiers describe how fast someone answers, not how fast your site is fixed, which is why the engineering relationship matters independently of the platform contract.

Remy Stern, Chief Digital Officer at the New York Post, describes the outcome a well-run platform migration should produce: "Our hosting costs have not gone up as we've more than quadrupled the size of our audience." That is a platform and architecture result, not a hosting-plan result.

Check 6: can they prove the editorial workflow?

WordPress 7.1 extends Notes, the in-editor collaboration feature, with suggestion mode and emoji reactions, and the release roadmap keeps real-time collaboration as a focus area. Real-time collaboration can now be disabled per post type, which matters if legal or compliance review requires a locked draft.

Responsive styling is the change most likely to affect your editors. Following the call for testing published on 3 July 2026, blocks can be styled per viewport directly in the editor, and Gutenberg 23.5 replaced the fixed desktop/tablet/mobile toggle with a freely resizable device preview. The catch is specific: blocks using standard block supports get responsive styles for free, while blocks with custom controls do not. If your site runs bespoke blocks, and most enterprise WordPress sites do, that gap is real work.

Ask to see a staging environment with your own content in it before you sign. WordPress Playground makes this cheap, and version 1.10 of WordPress Studio added Linux support.

Check 7: compliance, data residency and the EU deadline

Patchstack's outlook states that in 2026 every commercial WordPress plugin will need a vulnerability disclosure programme in place under EU law to make its software available to European users, under the Cyber Resilience Act. If your plugin vendors sell into the EU, that obligation propagates into your supply chain, and a partner should be able to tell you which of your paid plugins have a published VDP.

India-specific considerations

For Indian businesses, the Digital Personal Data Protection Act 2023 shapes where WordPress form submissions, comment data and WooCommerce customer records are stored and how consent is captured. WordPress collects personal data in more places than teams expect: contact forms, comment authors, user registration, analytics integrations and any CRM connector. Data-flow mapping belongs at architecture time. eCorpIT designs applications aligned with DPDP requirements, and we hold ISO 27001:2022 certification for our own information security management.

Unicode email support is a smaller but relevant change for Indian and multilingual sites. WordPress now accepts UTF-8 local parts on sites with utf8mb4 database support, handles internationalised domains through Punycode, and introduces a WP_Email_Address class, closing a ticket opened in 2015. Any plugin that validates email through is_email() or sanitize_email() needs retesting.

What we build, and how

eCorpIT builds and maintains WordPress sites for organisations that treat the CMS as production infrastructure rather than a brochure. The work divides into five steps.

1. Audit. Plugin inventory with vulnerability status, block API version census, theme and custom block review, Core Web Vitals baseline.
2. Architecture. Hosting and platform selection against your SLA and data-residency constraints, integration map, data-flow mapping for DPDP.
3. Build. Block development at API version 3, theme work in theme.json, custom integrations, staging on Playground or Studio.
4. Hardening. Plugin allowlist, dependency SBOM, mitigation rules that do not wait on vendor patches, backup and restore rehearsal.
5. Run. Release-cycle tracking against the WordPress core calendar, regression suites ahead of each major version, monitoring.

Our engagement model is straightforward: a fixed-scope audit and architecture phase first, then either a fixed-scope build or a retained senior engineering team for continuous work. We do not quote a build before the audit, because the plugin inventory is what determines the cost and nobody can see it from outside.

eCorpIT is a Gurugram-based technology company founded in 2021, assessed at CMMI Level 5, MSME certified and ISO 27001:2022 certified, working with AWS, Microsoft, Google and Shopify as technology partners. Teams are senior-led and multi-disciplinary. Related work is described on our pages for custom software development, web development in Gurgaon and ecommerce app development.

FAQ

When is WordPress 7.1 released?

WordPress 7.1 is scheduled for 19 August 2026, timed with WordCamp US. The cycle ran Beta 1 on 15 July, Beta 2 on 22 July, Beta 3 on 29 July and Release Candidate 1 on 5 August 2026, according to the official roadmap published on Make WordPress Core in June.

Is the iframed editor enforced in WordPress 7.0?

No. The official dev note states the iframe is not enforced in WordPress 7.0 and that the enforcement timeline was revised for a gradual rollout. What changed is that core checks the block API version of blocks inserted in a post rather than all registered blocks across every installed plugin.

How many WordPress vulnerabilities were found in 2025?

Patchstack recorded 11,334 new vulnerabilities across the WordPress ecosystem in 2025, a 42% increase on 2024. Of those, 91% were in plugins and 9% in themes, with only 6 reported in WordPress core, all of them low priority issues requiring no urgent action.

Are premium WordPress plugins safer than free ones?

No. Patchstack received 1,983 valid vulnerability reports for premium or freemium components during 2025, and 76% of those were exploitable in real attacks. Premium components carried three times more known exploited vulnerabilities than free components, because researchers have less access to the code.

Does managed hosting protect against plugin vulnerabilities?

Largely no. In two Patchstack pentests of major hosting providers, traditional defences blocked 12% of known exploited vulnerability attacks in the first study and 26% of a broader attack set in the second. Block rates varied widely between hosts depending on internal firewall configuration.

What does WordPress VIP cost?

WordPress VIP publishes no prices. Its pricing page lists three packages, Standard, Enhanced and Signature, with capacity and SLA limits but no figures, and directs buyers to request a custom quote. Third-party starting-price figures circulating online do not appear on any Automattic page we could retrieve.

What share of the web runs on WordPress?

W3Techs reported in August 2026 that WordPress is used by 40.8% of all websites and holds a content management system market share of 59.0%. The next largest platforms are Shopify at 5.3%, Wix at 4.2%, Squarespace at 2.4%, Joomla at 1.2% and Drupal at 0.7%.

How fast are new WordPress vulnerabilities exploited?

Patchstack measured a weighted median of 5 hours between public disclosure and the first observed exploitation attempt for heavily targeted vulnerabilities. Roughly half of high-impact vulnerabilities are exploited within 24 hours, which makes scheduled monthly patching windows an inadequate defence on their own.

How eCorpIT can help

We audit your existing WordPress estate against the 7.1 changes, produce a plugin inventory with current vulnerability status, and give you a costed remediation and upgrade plan before any build work starts. For teams already committed to a replatform, we handle architecture, block development at API version 3, integration work and the hardening that hosting alone does not cover. eCorpIT is CMMI Level 5 assessed and ISO 27001:2022 certified, and designs applications aligned with DPDP requirements. Tell us what you are running at /contact-us/ and we will start with the audit.

References

1. Roadmap to 7.1 — Make WordPress Core, 19 June 2026.
2. What's new for developers (July 2026) — WordPress Developer Blog, 10 July 2026.
3. Iframed Editor Changes in WordPress 7.0 — Make WordPress Core, 24 February 2026.
4. The Classic block stays in the inserter for WordPress 7.1 — Make WordPress Core, 7 July 2026.
5. State of WordPress Security in 2026 — Patchstack, data updated 25 February 2026.
6. Usage statistics and market share of content management systems — W3Techs, August 2026.
7. WordPress VIP pricing — WordPress VIP, updated 13 August 2026.
8. WordPress.com pricing — Automattic, August 2026.
9. Merge proposal: expanding WordPress Core abilities — Make WordPress Core, 2 July 2026.
10. What's coming to the AI Client in WP 7.1 — Make WordPress AI, 19 June 2026.
11. Call for testing: responsive styling — Make WordPress Test, 3 July 2026.
12. What's new in Gutenberg 23.5 — Make WordPress Core, 1 July 2026.
13. Call for testing: Unicode email addresses — Make WordPress Core, 10 June 2026.
14. Myth of secure hosting: only 26% of vulnerability exploits blocked by hosts — Patchstack.

Last updated: 16 August 2026.