What exactly does this index measure?

Two things: the share of French WordPress sites running a release WordPress classes as vulnerable, and the number of days a new release takes to land, measured on the sites that change version from one week to the next.

Where does the panel come from?

From a random draw in Afnic's open data file, the registry of .fr domains. The draw is reproducible: the seed and the file's date are enough to rebuild the same panel.

How often are the figures updated?

Every week. The panel is read on Monday and the index is recomputed straight after.

WordPress patch lag in France

How many sites run a knowingly vulnerable version, and how long a new release takes to land.

As of the 02/09/2026 reading, 11.5% of French WordPress sites whose version can be read are running a release WordPress classes as vulnerable.

On a vulnerable version

11.5 %

On the current release

56.2 %

Week after week

See the figures as a table

Date	On a vulnerable version
2026-09-02	11.5 %

Method

The panel: 15,000 domains drawn at random from Afnic's open data file, which lists the 4,590,553 active .fr domains. The draw orders every domain by the sha256 fingerprint of its name: with the published seed, anyone rebuilds the same panel.
The cadence: The panel is read every Monday, and it stays the same from one week to the next: that is what makes a delay measurable rather than a mere snapshot.
Reading the version: The core version is read from the generator tag and from the RSS feed, both of which state it. It is available on 71% of the panel's WordPress sites, and the index covers those.
A version's status: Vulnerable or not, each version's status comes from wordpress.org, which publishes its 884 releases and their security state. It is refreshed at every computation.
The API: GET https://api.stileex.xyz/v1/series/fr/wordpress-patch-lag/latest
Scope: WordPress accounts for 28.3% of the panel's sites that serve a page. The index speaks only of those.