The State of WordPress Agencies in 2026: Why Retainers Aren't Dead

Nick d

Welcome back to WPfavs. Today we're checking our own homework. In earlier episodes we said routine maintenance retainers were basically obsolete, because terminal agents could run updates in seconds. Then CloudLinux and WebPros published the State of WordPress Agencies in 2026, a survey of 210 agency founders and freelancers run in April and May. It says the real world is messier than our take.

Ido

And I'll own it, I got carried away. The demos are real. Novamira CLI lets Claude Code, Codex CLI or Gemini CLI run shell commands, PHP and database operations against a WordPress site. But look at who's doing the work. 78% of agencies are solo operators or small shops with ten people or fewer, and about one in five manage more than 100 client sites. That's not a team that has time to experiment on production.

Ben cohen

The part that surprised me is that headcount doesn't predict workload. 47% of solo and small agencies manage more than 20 client sites, while 34% of agencies with ten or more staff manage 20 or fewer. So a freelancer can be carrying a hundred sites alone. That is exactly the person everyone says agents will rescue.

Nick d

Here's the number that matters most for this debate. Among agencies managing more than 100 sites, 45% still update manually, one site at a time. And across the board, 65% name keeping plugins and themes updated as their top security challenge, rising to three in four at the largest portfolios. That ranks far above responding to an actual breach. The daily grind is patching, not hacking.

Ido

But that makes my case, not yours. If patching is the pain, that's the perfect job for an agent. Run the updates, check the result, move on. Why is nearly half of the biggest shops still clicking through sites by hand?

Nick d

Because an update isn't done when the command finishes. It's done when someone knows the checkout still works and the header didn't shift. The survey backs that up. 92% of agencies say they use AI, but only 16% use it for monitoring or maintenance automation. They use it for content at 59%, code at 53% and SEO at 39%. Creative output is easy to review. Operational risk isn't.

Ben cohen

And look at what they say they want next. 38% want automated WordPress updates with intelligent testing before the update goes live. 35% want automated security across their client sites. Nobody is asking for blind updates. They're asking for updates they can trust. That's a verification problem, and it's still open.

Ido

Okay, but I'd push back on one thing. This is a snapshot. 38% of these agencies are already running agents like Cursor, Claude Code or Windsurf for multi step coding tasks, and 63% call AI and automation the defining force for the next two to three years. The direction is obvious even if the maintenance layer lags.

Nick d

I agree on direction. I disagree on timing. Right now, a maintenance retainer isn't dead, it's the product with the biggest gap between what clients need and what's automated. If you can sell updates plus proof that nothing broke, you've got something agents haven't delivered yet.

Ben cohen

Let's talk about what's squeezing these agencies besides patching. 37% describe performance work as significant, heavy or overwhelming. That's heavier than security at 28%. And the causes are mostly client decisions. 59% blame plugin bloat. Slow third party scripts that clients add after launch and tight budgets for CDN or hosting tiers come right behind.

Ido

That connects to what I care about, how sites get read by AI assistants. A bloated site with five tracking scripts isn't only slow for humans. It's noisy for everything that has to interpret it. The agency that cleans that up is doing performance work and AI visibility work in the same pass.

Nick d

That's a real service you can sell, and it turns a complaint into a package. Audit the scripts, cut the plugin pile, then monitor it. In just a few clicks, a client sees what's slowing them down. It's the same shape as the update story. The value isn't the action, it's the evidence that the site is healthy.

Ben cohen

Now the part agencies should worry about. 50% of hosting providers say they plan to expand professional services, like site builds, maintenance and security remediation, to raise revenue per customer. Hosts are becoming competitors. And 90% of agencies managing more than 100 sites run at least some of them on self managed VPS or dedicated servers, so agencies are moving closer to infrastructure while hosts move closer to clients.

Ido

So the border war is real. If a host bundles maintenance and an agent, the agency can't compete on running updates. It has to compete on judgment, on knowing which client can't break on a Friday and which plugin always conflicts.

Nick d

Agreed. And the tooling is heading that way. The Abilities API and experiments like Benjamin Intal's Ahentic AI workspace let agents act inside WordPress without external middleware. Dashboard tools like WPadmin.AI promise bulk edits and troubleshooting. But agencies are still cautious about autonomous updates on client production sites without verified visual safety. Whoever solves visual and regression testing wins this category.

Ben cohen

One caution on the numbers. This is a survey of 210 people, so treat it as a strong signal, not the whole market. And 70% of these agencies also build on React, Next.js or Shopify. Only 30% are WordPress only. So the agency of 2026 isn't loyal to a platform. It's loyal to outcomes.

Ido

My takeaway, then. Use agents everywhere they're cheap to check, like drafts, code and audits. Be slower where a failure costs a client money. And don't tell clients maintenance is automated until you can show them it's verified.

Nick d

Mine is simpler. Pick one maintenance workflow this week, add a visual check before and after, and time it. If it saves hours across your portfolio, you've found your first real agent job. Thanks for listening to WPfavs.