WordPress Due Diligence

Run due diligence on WordPress: check compliance and get alerts when suppliers change.

United States · wordpress.org · 9 vendors

The WordPress Foundation is a 501(c)(3) public charity established to ensure free and perpetual access to the open-source WordPress software. Its mission is to democratize publishing through open-source, GPL software. The Foundation is responsible for protecting the WordPress, WordCamp, and related trademarks.

Resilience scores

Technology vendors

Services catalogue

15 services in catalogue across 6 categories; runs on 9 sub-vendors.

Insights

Last updated 2026-06-10 · revision 8

9 direct vendors, 133 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

3 in-scope frameworks identified; showing 3.

GDPR (source) — Evidence found

Evidence: https://wordpress.org/about/privacy/

SOC 2 (source) — No public evidence

ISO 27001 (source) — No public evidence

Evidence: https://wordpress.org/about/security/

Financials

Three-year financials

Financial Resilience Score: 7/10

Automattic, the commercial entity behind WordPress.com and the broader WordPress ecosystem, demonstrates strong qualitative financial resilience despite limited public disclosure. The company benefits from a dominant market position, with WordPress powering over 40% of all websites globally, creating a substantial moat for its commercial offerings. Its diversified product portfolio spans consumer hosting, enterprise hosting, e-commerce (WooCommerce), security/performance tools (Jetpack), social platforms (Tumblr), and messaging apps (Beeper, Texts), reducing dependency on any single revenue stream. The company is well-capitalized, having raised approximately US$288 million in its Series E round in February 2021 at a reported ~US$7.5 billion valuation, backed by reputable investors including Salesforce Ventures, BlackRock, and Insight Partners. The open-source WordPress.org project serves as a powerful funnel into Automattic's paid services, providing a sustainable customer acquisition advantage. However, resilience is tempered by significant risks. The lack of audited financial transparency makes independent verification difficult. The 2024-2025 public dispute with WP Engine raised governance concerns and triggered an employee buyout program where approximately 8.4% of staff departed. Tumblr has reportedly been loss-making, and the company faces competitive pressure from Shopify, Wix, Squarespace, and headless CMS vendors like Contentful and Sanity.

Key strengths: Dominant market position with WordPress powering 40%+ of all websites globally, Diversified product portfolio across hosting, e-commerce, security, and consumer apps, Well-capitalized with multiple large funding rounds (Series D ~US$300m in 2019, Series E ~US$288m in 2021), Strong investor backing from Salesforce Ventures, BlackRock, and Insight Partners, Open-source community moat creating sustainable customer acquisition funnel, Reported ~US$7.5 billion valuation at last funding round

Risk factors: Lack of audited financial transparency as a private company, Governance overhang from 2024-2025 WP Engine dispute, Employee departures (~8.4% of staff) via late-2024 alignment offer buyouts, Tumblr reportedly loss-making since 2019 acquisition, Concentration risk on WordPress ecosystem health, Competitive pressure from Shopify, Wix, Squarespace, and headless CMS vendors, Community/governance debate over relationship between WordPress.org and Automattic

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report