Matt Mullenweg Leaked 729K WP Engine Websites—Here’s What I Discovered

The ongoing dispute between Automattic and WP Engine escalated with the launch of the WP Engine Tracker, a website that tracks sites migrating away from WP Engine. Controversially, the tracker also provides a downloadable CSV file containing over 844,000 domains hosted by WP Engine.

This post was updated on November 21st 2024 with some comments from Automattic and my response to them.

This dataset includes staging domains, websites that no longer run WordPress, and thousands of domains marked with <meta name="robots" content="noindex">, indicating they were not meant to be indexed or exposed. This raises serious ethical and privacy-related questions about the publication of such sensitive data.

It’s ironic that Automattic positions itself as a defender of the WordPress “movement” while leaking a database of WP Engine clients. How does exposing private information help the community or the movement? It feels counterproductive and damages the trust that WordPress thrives on.

WordPress is built on the GPL, a license Matt Mullenweg has always championed, even during early disputes like the one with Chris Pearson over the Thesis theme. The GPL is about freedom—freedom to use, modify, and share WordPress, whether or not you contribute back. This leak goes against that spirit and risks alienating the very community Automattic claims to protect.

While the leak itself conflicts with the principles of openness and trust that the GPL embodies, it does offer a rare opportunity to analyze trends across a significant portion of WordPress websites.

Using this dataset, I deployed a crawler to analyze these websites. While this allowed me to identify themes, fonts, and plugins that load resources like JavaScript or CSS on the front end, it could not detect plugins that operate exclusively in the back end or without loading front-end assets. Despite this limitation, the findings still offer valuable insights.

In addition to identifying the most popular themes, plugins, and Google Fonts, my analysis also uncovered other key details, such as:

• Whether sites use HTTP or HTTPS.
• Links to social media profiles (Facebook, Instagram, and Twitter).
• CMS distribution, including Joomla, Drupal, Wix, Weebly, and Squarespace.
• Use of analytics tools like Google Analytics, Google Tag Manager, and Facebook Pixel.
• WordPress versions in use.

In the past, I’ve analyzed and published similar datasets for other niches on the Resources page, and this seemed like another opportunity to uncover useful insights.

The CSV file provided by the WP Engine Tracker included some duplicate domains and many domains that redirect to others, which impacted the accuracy of the dataset. After removing duplicates and handling redirects, the total number of unique domains was reduced from 844,000 to approximately 726,000. Among these, about 626,000 were confirmed to be powered by WordPress, representing the majority of the dataset.

As of November 20th, 2024, this blog post has been updated with new numbers following additional crawling and improved identification of plugins that don’t load front-end-facing assets.

Key Metrics and Insights

Here’s a breakdown of the key findings:

The inclusion of thousands of domains that no longer use WordPress raises significant questions about how long identifiable information about WordPress installations has been collected and stored. It suggests that Matt Mullenweg may have been compiling this data for years, retaining information about domains that potentially stopped using WordPress long ago. The decision to leak this dataset through the WP Engine Tracker highlights a troubling precedent—making sensitive, identifiable information public at will.

Among the dataset, 75,000 websites are marked with <meta name="robots" content="noindex">, likely indicating staging sites or private domains. These sites were clearly not intended to be indexed or publicly accessible, yet their inclusion in this leaked data compromises the privacy these site owners expected.

This situation underscores the importance of protecting your staging or private websites. If you manage WordPress sites, always password-protect your staging environments and private domains. Relying solely on noindex directives is not enough to ensure privacy, as this case demonstrates how easily such sites can be exposed in unexpected ways.

WordPress Themes

The combined share of the top themes is as follows:

• Top 3 themes (Divi, Hello Elementor, Astra): 25.32%
• Top 5 themes (adding Avada and Beaver Builder Framework Theme): 31.04%
• Top 10 themes (adding Genesis, Salient, Pro, GeneratePress, and Genesis Block Theme): 38.67%

It’s incredible to see that just 10 WordPress themes power close to 40% of all WordPress websites hosted by WP Engine.

WordPress Plugins

Yoast SEO is installed on nearly 1 in 2 websites, making it the most widely used plugin on WordPress websites. Similarly, Elementor powers 1 in 5 websites, showcasing the growing preference for visual, drag-and-drop page builders.

WooCommerce stands out with adoption on about 1 in 10 websites, reflecting the increasing importance of e-commerce in the WordPress ecosystem.

Google Fonts

The dataset for The Most Used Google Fonts on WP Engine Websites includes only websites that load fonts directly from the Google Fonts CDN. This means the data reflects HTTP requests made to Google Fonts, capturing the font names used in these requests.

Websites that self-host Google Fonts are not included in this analysis. This distinction is important to keep in mind, particularly given the increasing adoption of self-hosting solutions in response to GDPR and other privacy regulations.

In Conclusion

This data gives a clear look at how WordPress is being used, but the decision by Matt Mullenweg to leak this database has caused significant controversy.

November 21st 2024 Update: A Letter from Automattic

On November 20th 2024 I received the following email from a Automattic communications representative:

Hi Dumitru and I Love WordPress editors,

[Redacted] here from Automattic comms. While we appreciate your attention to the WP Engine tracker site, I am hopeful you are amenable to correcting a few errors present throughout the coverage, including the headline. I appreciate your review and look forward to reading the corrected article.

“Leaked 729K WP Engine Websites”
This is factually incorrect and should be removed. All domains included on the CSV are publicly available. The predominant sources used include:
https://trends.builtwith.com/websitelist/WP-Engine,
https://trends.builtwith.com/websitelist/FlyWheel, and
https://w3techs.com/technologies/details/ho-groupwpengine

Regarding domains marked with <meta name="robots" content="noindex">
To state they were not intended to be indexed OR publicly available is factually incorrect and should be removed. Whether or not a site gets indexed on a search engine has nothing to do with a listing of where sites are hosted.

“The inclusion of thousands of domains that no longer use WordPress raises significant questions about how long identifiable information about WordPress installations has been collected and stored. It suggests that Matt Mullenweg may have been compiling this data for years, retaining information about domains that potentially stopped using WordPress long ago. The decision to leak this dataset through the WP Engine Tracker highlights a troubling precedent—making sensitive, identifiable information public at will.”

Again, this is factually incorrect. To allege that Matt has been compiling this data for years is inappropriate. All information on the site is also on publicly available sources, including:
https://trends.builtwith.com/websitelist/WP-Engine,
https://trends.builtwith.com/websitelist/FlyWheel, and
https://w3techs.com/technologies/details/ho-groupwpengine

I greatly appreciate your consideration and am happy to think through alternative ways to phrase some of the inaccurate items. That said, this is of course your content and Automattic is purely focused on correcting false information.

Here’s my response to Automattic:

Response to Point 1: “Leaked 729K WP Engine Websites”

Even if the CSV was compiled using sources like BuiltWith and W3Techs, the accessibility of such data is not as trivial as Automattic suggests.

For example, BuiltWith requires at least a Pro plan, costing $495 per month (or $4,950 annually) to download detailed lists of domains associated with specific technologies or providers.

Similarly, a W3Techs report costs 499 € (excluding VAT) for a single report.

By aggregating and providing this data for free, the WP Engine Tracker essentially bypasses the barrier of cost and accessibility. This act is far from trivial and arguably undermines the value of services like BuiltWith while distributing data that, while technically public, was never intended to be available in such a freely downloadable and actionable format. The term “leaked” reflects this context, as the dataset was made vastly more accessible than it was through its original sources.

Response to Point 2: Domains Marked with <meta name="robots" content="noindex">

The claim that stating these domains were “not intended to be indexed OR publicly available” is factually incorrect deserves clarification.

The <meta name="robots" content="noindex"> directive explicitly indicates a site owner’s intention not to have their website indexed by search engines. While hosting information itself may not be directly tied to indexing, the inclusion of these domains disregards the site owners’ intent for privacy. Aggregating and distributing such data still raises ethical concerns, regardless of its availability through public sources.

Response to Point 3: Compilation of Data Over Years

The WP Engine Tracker website does not disclose the sources used to compile the list of WP Engine client domains, making it reasonable to assume that Matt Mullenweg may have relied on internal data sources, such as WordPress.org APIs. While I agree that Matt did not manually collect these domains one by one, the effort to gather, aggregate, and compile this dataset clearly required resources and intent.

If Automattic’s claim is true—that all domains were sourced from services like BuiltWith and W3Techs—this raises a new issue. The dataset includes many domains that are no longer powered by WordPress or have nothing to do with WordPress at all. These domains and their owners are now inadvertently part of this situation, despite having no involvement in WordPress or this dispute. In this case, Matt Mullenweg targeted individuals and businesses who were simply minding their own business, making this situation even more questionable.

So, how is this explanation better than the assumption I made? Whether the data was sourced internally or externally, the aggregation and public release of domains—including non-WordPress sites—creates unnecessary fallout for those caught in the crossfire.

Closing Thoughts

While I appreciate Automattic’s attempt to address what they label as “inaccurate” or “false information,” it is notable that they did not attempt to dispel any of the larger concerns I raised. Instead, their response seems to downplay the significant efforts and resources that clearly went into creating the WP Engine Tracker website, almost as if it were a 30-minute student project.

It is important to clarify that the purpose of my blog post was not to take sides or comment on the ongoing battle between Matt Mullenweg and WP Engine. Multi-billion-dollar companies engaged in disputes hardly need my input. Instead, my goal was to share useful statistics, as I’ve done in the past, and to highlight a major concern: this database of WP Engine clients, now made publicly available, could easily be exploited by bad actors.

From social engineering attacks to targeted hacking attempts, this dataset opens up vulnerabilities for thousands of websites, WordPress or not.