E-commerce Platforms Comparison
|
This content was generated with the assistance of AI and should be verified against the official documentation of each platform before being relied on in production. This section’s bibliography lists the reference material consulted while preparing these pages. |
This page compares the four e-commerce platforms of this section: Shopify (Admin and Storefront API 2026-10, Shopify CLI 5.0.0), PrestaShop 9.2.0, Magento 2.4.9 (Magento Open Source and Adobe Commerce, with Mage-OS 3.6.0 as context) and WooCommerce 11.2.1 on WordPress. Every number was fetched on 2026-10-27 and every claim about a feature is explained, with examples, on the platform pages linked from the sections below. The approach follows the Documentation Tools Comparison and the Cloud Providers Comparison of this site: data kept in CSV files, charts generated from them, and a stated source and date for every figure. The page does not name a winner, because the right platform depends on who will run the store, what it must sell and who will pay for the work; the last sections turn the data into recommendations by purpose. The overview of the section, with the shared bibliography, is the E-commerce overview.
Scope, methodology and snapshot date
Scope. The four platforms are not the same kind of product. Shopify is a hosted software-as-a-service (SaaS) platform: Shopify runs the servers, the checkout and the upgrades, and the merchant configures a store and installs apps and themes. PrestaShop and Magento Open Source are free software that the merchant (or a host) installs and operates. Adobe Commerce is the licensed edition built from the Magento code base, offered on-premises, on Adobe’s cloud infrastructure and as a software-as-a-service edition. WooCommerce is a free plugin that turns a WordPress site into a store, so every WooCommerce figure also reflects WordPress, its themes, its plugins and the hosting it runs on. Mage-OS, a community distribution of the Magento Open Source code base, appears only as context.
Snapshot date. All values on this page were fetched on 2026-10-27 from the sources listed in
References and in scripts/ecommerce-comparison-charts/data/sources.csv; every row of the CSV files
carries its own fetch date. Time series end at the latest complete period at that date: 2026-09 for the HTTP Archive
Tech Report (October is not published yet), 2026-Q4 to date for Store Leads, and 2026 to date for the yearly series. A
value that could not be obtained is shown as n/a, never as zero, and a value that came from a secondary source or from
a page that could not be opened from the authoring environment is marked unverified.
Where to check current values. Each table and figure names its source. The live pages are the W3Techs
technology pages, the Store Leads reports, the HTTP Archive Tech Report, the Web Almanac e-commerce chapter, the GitHub,
npm, WordPress.org and Stack Exchange APIs, the National Vulnerability Database (NVD) API, the official pricing pages and
the official lifecycle policies listed in the References. The data and the scripts that draw the figures are in
scripts/ecommerce-comparison-charts/, so the charts can be regenerated with npm run charts:ecommerce-comparison.
How the metrics are used. The sections after the feature matrix present metrics in six groups (popularity, performance, security, ease of use and maintenance, cost, and other characteristics), each with a statement of what it measures and what it does not. Three rules apply throughout:
-
Absolute values from different sources are never plotted on one axis, because they count different things: W3Techs counts the share of websites among the top sites it analyses, Store Leads counts live stores it detects, and the HTTP Archive counts origins visited by Chrome users.
-
Field data and counts are reported as measured. Where a number is a proxy (for example CVEs as a proxy for security), the section says what it cannot show.
-
The scores of the radar charts at the end combine this evidence with a stated rubric. Eight of the ten axes are editorial scores whose basis and source are written in
data/radar-scores.csv; two (performance and ecosystem) are computed from the data. The rubric is given in Scores on ten axes.
Caveats that apply to the whole page.
-
The platform-comparison sources measure different populations, so a platform can lead in one and trail in another without a contradiction.
-
INP (Interaction to Next Paint) replaced FID (First Input Delay) in the Core Web Vitals definition on 2024-03-12, so pass rates before and after that date are not strictly comparable.
-
PrestaShop and Magento have shrinking populations of detected stores, so their pass rates can be biased by survivor effects (stores that were slow or unmaintained may have left the sample).
-
WooCommerce figures include the whole WordPress stack (theme, page builder, plugins, hosting).
-
Stack Overflow’s site-wide decline since 2023 affects every tag, so question counts for recent years say little about a platform on their own.
-
CVE counts measure disclosure, not real risk, and are not comparable between SaaS and self-hosted software.
-
G2 and Capterra ratings were not used: both sites returned HTTP 403 to automated clients, so the ratings are recorded as n/a (unverified), they would be self-selected user reviews, and they feed no score.
Feature matrix
The matrix lists what each platform does by itself, without extra apps, modules or plugins unless the cell says so. n/a means that no reliable public figure exists. The platform pages hold the details and the examples.
| Feature | Shopify | PrestaShop 9.2 | Magento 2.4.9 / Adobe Commerce | WooCommerce 11.2 |
|---|---|---|---|---|
Hosting model |
SaaS: Shopify hosts, secures and scales the store; headless storefronts can run on Oxygen, Shopify’s hosting |
Self-hosted: you or a host run PHP, the database and the web server |
Open Source and Mage-OS are self-hosted; Adobe Commerce runs on-premises, on Adobe’s cloud infrastructure (PaaS) or as a software-as-a-service edition (Adobe Commerce as a Cloud Service) |
Self-hosted WordPress plugin; any WordPress host, managed or not |
Licence |
Proprietary service; the CLI and Hydrogen are MIT-licensed |
Core under OSL 3.0, modules and themes under AFL 3.0 (open source) |
Magento Open Source under OSL 3.0 and AFL 3.0 (open source); Adobe Commerce is a licensed product with a quote-based price |
GPL version 3 (open source) |
Languages and stack |
Liquid templates, GraphQL APIs, JavaScript and TypeScript (React, Hydrogen); Shopify Functions compile to WebAssembly (Rust or JavaScript); no server code of your own inside the platform |
PHP (8.1 to 8.5 on 9.1 and 9.2), Symfony 6.4, Smarty and Twig, Doctrine, MySQL 5.7 or MariaDB 10.2 and newer |
PHP, Composer, MySQL or MariaDB, OpenSearch, a cache store; dependency injection, layout XML, declarative schema |
PHP 7.4 or newer, WordPress 7.0 or newer, MySQL or MariaDB; JavaScript and React for blocks |
Theming model |
Online Store 2.0 themes: Liquid, sections and blocks, a visual theme editor; reference themes Dawn and Horizon |
Hummingbird 2.1.2 (default for new shops) and the Classic theme; Smarty templates and a |
Layout XML and templates (Luma and its descendants), Hyvä (relicensed OSL 3.0 and AFL 3.0 in 2025), PWA Studio, Adobe Commerce storefront on Edge Delivery |
WordPress block themes and classic themes, plus page builders; WooCommerce blocks for the shop pages |
Extension model |
Apps (Admin API, webhooks, embedded UI with Polaris), theme app extensions, checkout UI extensions, Shopify Functions |
Modules with hooks, front and admin controllers, Symfony services and overrides |
Modules with plugins (interceptors), observers, preferences and layout; out-of-process extensions on Adobe editions |
Plugins with actions and filters, blocks, CRUD classes and data stores, REST endpoints |
APIs |
Admin GraphQL, Storefront and Customer Account APIs; versioned quarterly |
Webservice API (XML and JSON) and the Admin API (API Platform, OpenAPI), which carries no stable label yet (document version 0.1.0) |
REST and GraphQL APIs; webhooks and events on Adobe editions |
REST API (version 3) and the Store API ( |
Headless |
First-class: Storefront API, Hydrogen toolkit (2026-10) and Oxygen hosting |
Data APIs exist; no official storefront framework |
GraphQL storefront, PWA Studio and the Adobe Commerce storefront; heavy integration work |
REST and Store API; no official storefront framework |
Checkout customisation |
Checkout Extensibility: UI extensions, Functions and branding; the information, shipping and payment steps are customisable only on Plus |
Full control of templates and hooks; 9.2 adds a one-page checkout module |
Full control through layout, JavaScript components and payment provider gateways |
Checkout block with an additional-checkout-fields API, or the classic shortcode checkout |
Multistore and markets |
Markets: one store sells in several countries with local currencies and domains; separate stores for separate brands |
Multistore: shop groups and shops on one installation, sharing a catalog and back office |
Websites, store groups and store views with scoped configuration and prices |
One store per site; several stores need WordPress multisite or separate sites |
B2B |
On all plans, with three catalogs; unlimited catalogs and direct assignment to locations on Plus |
Improved B2B mode behind a feature flag (disabled by default in 9.2) |
The B2B extension is Adobe Commerce only (companies, shared catalogs, negotiable quotes) |
No core B2B feature; extensions provide it |
Internationalisation |
Markets plus translations of themes and content |
Languages, currencies and locale formatting (CLDR) in core |
Store views with translated content and locale per view |
Interface translations through WordPress language packs; translating products and pages needs a multilingual plugin such as WPML |
Marketplace |
Shopify App Store, about 32,098 apps (Store Leads detection; Shopify publishes no count) |
PrestaShop Addons: n/a (no reliable public count; unverified) |
Adobe Commerce Marketplace: n/a (no reliable public count) |
10,039 plugins tagged woocommerce on WordPress.org, plus the WooCommerce Marketplace (no official count) |
Who patches security issues |
Shopify, centrally, without customer action |
The merchant applies core and module updates |
The merchant applies patches; Adobe publishes monthly isolated builds for Adobe Commerce and Open Source |
The merchant (or host) updates WooCommerce, WordPress and all plugins |
Upgrade model |
Automatic platform; quarterly API versions each supported for at least 12 months |
Minor releases at most twice a year; the Update Assistant (autoupgrade) module |
A new 2.4.x line yearly, three years of standard support; Composer and |
A release about every five weeks, updated from the WordPress admin or Composer |
Source: Shopify API versioning, Shopify pricing, PrestaShop system requirements, PrestaShop repository (licence statement), Magento 2 repository, Adobe Commerce lifecycle policy, WooCommerce on WordPress.org and WooCommerce Store API
The platform pages explain each row: Shopify plans and Plus, Shopify checkout extensibility, Shopify markets and internationalization, PrestaShop architecture, PrestaShop multistore and i18n, Magento editions and ecosystem, Magento catalog, multistore and B2B, WooCommerce architecture and WooCommerce taxes, currencies and i18n.
Strengths and weaknesses
The table summarises the main strengths and weaknesses of each platform. Each cell is backed by the data later on this page or by the source named under the table.
| Platform | Strengths | Weaknesses |
|---|---|---|
Shopify |
Highest Core Web Vitals pass rate of the four (76.25% mobile and 79.50% desktop in 2026-09); the vendor patches and upgrades the platform; hosting, SSL and scaling are included; headless is a documented path; a very large app store |
Recurring cost (EUR 32 to 384 per month plus transaction fees); the checkout and the data model are constrained, and full checkout control is Plus-only; code runs only in apps and Functions, not in the platform; the merchant depends on one vendor (lock-in) |
PrestaShop |
Free and open source; the whole stack can be modified through hooks, overrides and services; multistore and multi-currency in core; a modern Symfony code base; second in the Core Web Vitals comparison (61.45% mobile) |
The population of live stores has shrunk by about a third from its 2022 peak; the lowest median mobile Lighthouse score of the four (0.345); no official headless storefront framework; the core ships no Content Security Policy support (an open proposal would add one); far fewer extensions and developers than the largest ecosystems |
Magento / Adobe Commerce |
The most complete core for large catalogs: multiple sources and stores, scoped prices, B2B on Adobe Commerce, REST and GraphQL APIs; open source edition; deep extension points |
Steepest learning curve and heaviest hosting needs; the second-lowest share of origins passing Core Web Vitals (44.57% mobile); six Adobe Commerce and Magento vulnerabilities in the CISA Known Exploited Vulnerabilities catalogue; the Adobe Commerce licence is quote-based |
WooCommerce |
The largest number of live stores (4,321,090 detected) and the largest share of e-commerce sites; free and open source; all of WordPress for content; the whole plugin ecosystem; a good fit for stores that are also content sites |
The lowest Core Web Vitals pass rate (39.32% mobile), partly because the stack is whatever the merchant assembles; the merchant owns updates for WordPress, the theme and every plugin; the largest plugin attack surface (91% of the new WordPress vulnerabilities in 2025 were in plugins); no native multistore or B2B |
Source: the figures are those of the tables below, with sources HTTP Archive Tech Report, Store Leads, Patchstack State of WordPress Security 2026, PrestaShop issue 42441 (no Content-Security-Policy in core) and CISA Known Exploited Vulnerabilities catalog
Shopify. The advantage is that the operational work is someone else’s. Hosting, certificates, scaling for peak traffic and platform patches are part of the subscription, and the HTTP Archive field data shows that this translates into the highest share of origins passing Core Web Vitals (see Performance). The price of this is a constrained platform: server-side code runs only in apps and Functions, and the checkout steps beyond the basics are customisable only on Plus. See Shopify Functions and Checkout Extensibility for what can and cannot be changed.
PrestaShop. It is the open-source option with the smallest operational footprint of the PHP platforms and a code base that has been modernised with Symfony in the 9.x line. The weaknesses are scale of ecosystem and momentum: Store Leads detects 144,665 live stores in 2026-Q4 to date against a peak of 220,112 in 2022-Q3. See PrestaShop architecture and hooks.
Magento and Adobe Commerce. The most capable core and the most demanding to run. Choose the edition first: Open Source is free but lacks the B2B extension and the Adobe services, while Adobe Commerce adds them for a licence fee. See Magento editions and ecosystem and versions, lifecycle and requirements.
WooCommerce. The market leader by number of stores, with the lowest barrier to start and the broadest choice of themes and plugins. The same freedom is its main risk: quality and security depend on the plugins chosen and on the host. See WooCommerce architecture and performance and security.
Popularity and ecosystem
Popularity metrics answer a narrow question: how widely is each platform used and how large is the community around it? They do not say how good a platform is. The sources count different things, so the table gives each source’s own unit and the figures never share an axis.
| Metric (date) | Shopify | PrestaShop | Magento | WooCommerce | Source |
|---|---|---|---|---|---|
Share of all websites (2026-10-27) |
5.3% |
0.5% |
0.3% |
7.8% |
W3Techs |
Share of websites with a known CMS (2026-10-27) |
7.9% |
0.7% |
0.4% |
11.5% |
W3Techs |
Share of e-commerce systems (2026-10-27) |
32.4% |
2.8% |
1.6% |
47.4% |
W3Techs |
Live stores (2026-Q4 to date) |
3,189,134 |
144,665 |
102,287 |
4,321,090 |
Store Leads |
Peak of live stores (quarter) |
3,189,134 (2026-Q4, current quarter) |
220,112 (2022-Q3) |
163,714 (2022-Q4) |
4,776,386 (2024-Q2) |
Store Leads |
Origins detected, mobile (2026-09) |
452,270 |
49,565 |
32,588 |
553,677 |
HTTP Archive Tech Report |
Origins detected, desktop (2026-09) |
317,646 |
36,449 |
27,544 |
337,099 |
HTTP Archive Tech Report |
Share of e-commerce sites, mobile (2025) |
25.3% |
3.7% |
2.2% |
44.4% |
Web Almanac 2025 |
Share of e-commerce sites, desktop (2025) |
21.5% |
3.2% |
2.1% |
35.4% |
Web Almanac 2025 |
W3Techs labels Magento as Adobe Commerce, and counts WooCommerce inside WordPress (WordPress alone is on 39.6% of all websites), so the WooCommerce figure is the share of sites that use WooCommerce as detected by W3Techs. The Store Leads quarter 2026-Q4 is partial, because it covers the days of the quarter that have passed; Store Leads detects live stores and publishes no official count.
Market share
Figure 1: W3Techs share on 2026-10-27, as a share of all websites, of websites with a known content management system and of e-commerce systems. Source: W3Techs. The three bases differ, so compare bars within one group only.
Figure 2: yearly W3Techs share of all websites for Shopify and for WordPress, the platform under WooCommerce, from 2015 to 2026-10-27. Source: W3Techs. W3Techs publishes yearly history only for systems above 1% of all websites, so PrestaShop and Magento have no series (n/a). Shopify grew from 0.3% in 2015 to 5.3% in 2026; WordPress peaked at 43.6% in 2025-01 and stands at 39.6% on 2026-10-27, and its share also covers sites that have no store.
Live stores and detected origins
Figure 3: live stores in the current quarter to date (2026-Q4). Source: Store Leads. WooCommerce has about 4.3 million live stores, Shopify about 3.2 million, PrestaShop about 145,000 and Magento about 102,000.
Figure 4: live stores per quarter, 2019-Q1 to 2026-Q4 to date. Source: Store Leads. The Shopify series starts in 2019-Q1 (753,977 stores), Magento in 2019-Q3 and PrestaShop and WooCommerce in 2020-Q1. Since the peaks, PrestaShop has lost about 34% of its detected stores (220,112 to 144,665), Magento about 38% (163,714 to 102,287) and WooCommerce about 9.5% (4,776,386 to 4,321,090), while Shopify has kept growing.
Figure 5: origins detected as using each platform on mobile, monthly from 2020-01 to 2026-09. Source: HTTP Archive Tech Report. On mobile Shopify grew from 60,749 to 452,270 origins, WooCommerce from 144,155 to 553,677 and PrestaShop from 34,514 to 49,565, while Magento fell from 44,880 to 32,588.
Figure 6: the same series on desktop. Source: HTTP Archive Tech Report. On desktop the 2026-09 values are 317,646 (Shopify), 36,449 (PrestaShop), 27,544 (Magento) and 337,099 (WooCommerce). The HTTP Archive crawls the origins in the Chrome UX Report, so it undercounts small stores that Chrome users rarely visit.
Developer activity and downloads
| Repository (2026-10-27) | Stars | Forks | Contributors (including anonymous) | Role |
|---|---|---|---|---|
|
12,212 |
9,358 |
3,202 |
Magento Open Source |
|
10,570 |
10,660 |
2,149 |
WooCommerce |
|
9,237 |
5,049 |
1,351 |
PrestaShop core |
|
3,104 |
4,499 |
107 |
Shopify reference theme |
|
2,159 |
452 |
146 |
Shopify headless toolkit |
|
764 |
297 |
353 |
Shopify CLI |
|
321 |
91 |
3,204 (history inherited from Magento) |
Mage-OS (context) |
Source: GitHub REST API
Shopify’s platform is closed, so its repositories hold only the tooling and the reference theme, and a star count for
them says nothing about the size of the platform. Contributors are counted with the anon=1 option of the GitHub API,
which includes anonymous and unlinked authors; without it the API returns about a seventh of these numbers.
Figure 7: GitHub stars on 2026-10-27. Source: GitHub REST API. Stars measure attention, not production use.
Figure 8: GitHub contributors including anonymous authors on 2026-10-27. Source: GitHub REST API.
Figure 9: npm downloads per year of @shopify/cli and @shopify/hydrogen and of the @woocommerce/components,
@woocommerce/data and @woocommerce/settings packages, 2020 to 2026 year to date (up to 2026-10-26). Source: npm
downloads API. PrestaShop and Magento are distributed with Composer, so they have no npm count (n/a). The counts include
continuous integration and mirror traffic, and the packages are not the same kind of thing (a command-line tool against
libraries for WooCommerce admin pages), so the lines show trends, not a comparison. @shopify/cli grew from 303,839
downloads in 2022 to 8,288,916 in 2025 and 15,661,749 in 2026 to date.
Figure 10: weekly downloads of the WooCommerce plugin from WordPress.org for the complete weeks of the last 180 days, from early May to late October 2026. Source: WordPress.org plugins API (the API returns no longer window). Weekly counts range from 338,996 to 2,933,941 with sharp spikes, which are probably automated updates and not new stores. WordPress.org reports active installs only as a rounded band: 7,000,000+ sites, a rating of 90 out of 100 from 4,832 ratings (self-selected reviews) and 10,039 plugins tagged woocommerce on 2026-10-27.
Community questions
Figure 11: Stack Overflow questions per year for the tags shopify, prestashop, magento plus magento2 (summed, a question with both tags counts twice) and woocommerce, 2014 to 2025. Source: Stack Exchange API. Every tag falls steeply after 2023 (the woocommerce tag from 1,665 questions in 2023 to 216 in 2025), because the whole site declined, so the decline says nothing about a particular platform.
Figure 12: questions per year on magento.stackexchange.com (all questions), on wordpress.stackexchange.com tagged woocommerce and on wordpress.stackexchange.com overall as context, 2014 to 2025. Source: Stack Exchange API. The Magento site peaked at 17,969 questions in 2016 and received 408 in 2025.
Total questions with each tag on 2026-10-27: shopify 8,766 and liquid 4,018 (Shopify); prestashop 5,807; magento 37,173 and magento2 4,962 (plus 113,253 questions on magento.stackexchange.com); woocommerce 32,810 and woocommerce-rest-api 941. Source: Stack Exchange API. Shopify’s developers also use the Shopify Community forums and Discord, and WordPress developers use the WordPress.org support forums, which this count does not include.
Reading the popularity data. WooCommerce leads every count of stores (4,321,090 live stores, 47.4% of e-commerce systems on W3Techs and 44.4% of e-commerce sites on mobile in the Web Almanac), Shopify is second and still growing, and PrestaShop and Magento are an order of magnitude smaller and shrinking. Magento has the largest developer community by cumulative questions (by far when its dedicated Stack Exchange site is counted) and contributors, a legacy of its peak years. None of these numbers measures revenue: the sources used here support no statement about sales volume or about the quality of the stores counted.
Performance
Performance here means field data: how real visitors experienced the origins (sites) that the HTTP Archive detected as running each platform, taken from the Chrome UX Report and from Lighthouse runs on the HTTP Archive crawl. It is not a controlled benchmark. An origin passes the Core Web Vitals when its 75th percentile values are good for Largest Contentful Paint (LCP), Interaction to Next Paint (INP) and Cumulative Layout Shift (CLS). The numbers describe the whole population of stores built on a platform, including their themes, apps, plugins, hosting and content, so they say how stores on a platform tend to perform, not how fast the platform could be if tuned. The pass rate is the number of origins with good results divided by the number of origins with enough traffic data to be tested.
| Metric (HTTP Archive Tech Report) | Shopify | PrestaShop | Magento | WooCommerce |
|---|---|---|---|---|
Core Web Vitals pass rate, mobile, 2026-09 |
76.25% |
61.45% |
44.57% |
39.32% |
Core Web Vitals pass rate, desktop, 2026-09 |
79.50% |
62.27% |
45.59% |
39.26% |
Core Web Vitals pass rate, mobile, 2020-01 |
16.97% |
18.94% |
11.63% |
8.73% |
Core Web Vitals pass rate, desktop, 2020-01 |
26.01% |
32.59% |
20.73% |
12.74% |
Good LCP, mobile, 2026-09 |
87.67% |
73.62% |
58.05% |
43.46% |
Good INP, mobile, 2026-09 |
86.67% |
90.39% |
84.38% |
91.39% |
Good CLS, mobile, 2026-09 |
92.37% |
85.81% |
70.89% |
88.67% |
Median Lighthouse performance score, mobile, 2026-09 (0 to 1) |
0.475 |
0.345 |
0.35 |
0.37 |
Median Lighthouse performance score, desktop, 2026-09 (0 to 1) |
0.545 |
0.515 |
0.55 |
0.565 |
Source: HTTP Archive Tech Report, endpoints https://cdn.httparchive.org/v1/cwv, https://cdn.httparchive.org/v1/lighthouse and https://cdn.httparchive.org/v1/adoption, fetched on 2026-10-27
Core Web Vitals over time
Figure 13: share of origins passing all Core Web Vitals on mobile, monthly from 2020-01 to 2026-09. Source: HTTP Archive Tech Report. The vertical marker is the replacement of FID by INP on 2024-03-12. Every platform improved: Shopify from 16.97% to 76.25%, PrestaShop from 18.94% to 61.45%, Magento from 11.63% to 44.57% and WooCommerce from 8.73% to 39.32%.
Figure 14: the same series on desktop. Source: HTTP Archive Tech Report. Desktop pass rates are close to mobile in 2026-09 (Shopify 79.50%, PrestaShop 62.27%, Magento 45.59%, WooCommerce 39.26%), although they were far higher than mobile in 2020 (Shopify 26.01% against 16.97%).
The INP break. On 2024-03-12 INP replaced FID as the responsiveness metric of the Core Web Vitals. The effect on the series is small but not uniform: between 2024-02 and 2024-03 the mobile pass rate moved from 68.11% to 65.38% for Shopify, from 43.92% to 41.76% for PrestaShop and from 24.79% to 23.28% for Magento, but rose from 26.10% to 26.47% for WooCommerce. A change of definition therefore does not shift all platforms the same way, and changes of a point or two around the marker should not be read as a real change in performance. Nowadays INP is rarely the limiting metric: in 2026-09 between 84.38% and 91.39% of mobile origins have a good INP on every platform, so the pass rate is decided mostly by LCP, where Shopify (87.67% good) leads WooCommerce (43.46%) by more than 44 points.
Survivor bias. The PrestaShop and Magento populations are shrinking (see Live stores and detected origins). If the stores that left were disproportionately the slow and unmaintained ones, the remaining origins look better than the average store of earlier years. The data cannot rule this out, so the rise of the PrestaShop and Magento lines may overstate the improvement of a typical store. The WooCommerce population grew, and its figures include every WordPress theme, page builder and plugin combination.
Current pass rate and Lighthouse
Figure 15: share of origins passing all Core Web Vitals in 2026-09, mobile and desktop. Source: HTTP Archive Tech Report.
Figure 16: median Lighthouse performance score (0 to 100) of the origins detected for each platform in 2026-09, mobile and desktop. Source: HTTP Archive Tech Report. Lighthouse is a lab test on a throttled device and a simulated network, and it measures the home page only, so it can disagree with field data: on desktop WooCommerce has the highest median (56.5) although its Core Web Vitals pass rate is the lowest. On mobile the scores are 47.5 (Shopify), 34.5 (PrestaShop), 35 (Magento) and 37 (WooCommerce); the table above gives the same medians on the 0 to 1 scale.
The HTTP Archive also reports the other Lighthouse categories. Medians for 2026-09 on mobile are accessibility 0.91 (Shopify), 0.815 (PrestaShop), 0.82 (Magento) and 0.875 (WooCommerce); best practices 0.73, 0.77, 0.73 and 0.77; and SEO 0.92, 0.885, 0.92 and 0.92 in the same order.
Web Almanac 2025 vitals
The Web Almanac 2025 e-commerce chapter publishes its own cut of the same data, by metric and device. The tables were transcribed from its Figures 13.4 to 13.13 (the first table of each pair is desktop and the second is mobile), and the numbers are percentages of origins with a good result, rounded to whole numbers.
| Mobile origins with a good result (Web Almanac 2025) | Shopify | PrestaShop | Magento | WooCommerce |
|---|---|---|---|---|
LCP |
86% |
65% |
52% |
39% |
INP |
90% |
89% |
87% |
88% |
CLS |
92% |
81% |
64% |
85% |
All three Core Web Vitals |
76% |
50% |
35% |
35% |
Origins tested |
567,932 |
87,486 |
50,983 |
995,782 |
Median Lighthouse performance (0 to 100) |
55 |
36 |
34 |
38 |
| Desktop origins with a good result (Web Almanac 2025) | Shopify | PrestaShop | Magento | WooCommerce |
|---|---|---|---|---|
LCP |
92% |
74% |
59% |
45% |
INP |
99% |
99% |
99% |
99% |
CLS |
82% |
72% |
55% |
68% |
All three Core Web Vitals |
76% |
54% |
36% |
33% |
Origins tested |
289,885 |
45,256 |
36,988 |
394,462 |
Median Lighthouse performance (0 to 100) |
71 |
59 |
60 |
61 |
Figure 17: share of mobile origins with a good LCP, INP, CLS and all three together, per platform. Source: Web Almanac 2025, e-commerce chapter (HTTP Archive data of 2025).
Figure 18: the same on desktop. Source: Web Almanac 2025, e-commerce chapter. INP is good for 99% of desktop origins on all four platforms, so desktop differences come from LCP and CLS.
Reading the performance data. Stores on Shopify pass the Core Web Vitals about 1.7 to 1.9 times as often as stores on Magento or WooCommerce, and the gap is mainly in LCP, the loading of the largest element. Shopify controls the infrastructure, the CDN and the base theme code of every store, which narrows the spread between stores. On the self-hosted platforms the spread is wide: a store with good hosting, caching and an optimised theme can pass easily, and the median store does not. The data does not say that Shopify is necessarily faster for a given store, nor that the open-source platforms cannot be fast; see Shopify theme performance, PrestaShop performance and caching, Magento caching, indexing and performance and WooCommerce performance and security for the levers each platform offers.
Security
Security data is the hardest to compare, so this section reports what is counted, says what each count can and cannot show, and explains why the totals for the platforms are not comparable. Three kinds of evidence are used: CVE records in the National Vulnerability Database (NVD), security advisories published by the vendors and the community, and notable incidents with their CVSS v3.1 base score and their status in the CISA Known Exploited Vulnerabilities (KEV) catalogue.
CVEs per year
A CVE (Common Vulnerabilities and Exposures) record identifies one publicly disclosed vulnerability. The NVD lists each
by publication year. Two kinds of series are shown for every platform. The core series counts CVEs filed against the
platform’s own product (a CPE, the standard product identifier, for PrestaShop, for Magento Open Source and Adobe
Commerce, and for the WooCommerce plugin). The ecosystem series counts CVEs that mention the platform, found by
keyword search in the NVD, which brings in third-party modules, extensions and plugins, plus, for WooCommerce, the CVEs
filed against the products of the WooCommerce vendor. For Shopify the series is the CVEs of the vendor shopify in the
NVD, which belong to its open-source libraries and command-line tools; the Shopify platform itself has no core series
(n/a).
| CVEs published in the year (NVD) | PrestaShop core | Magento (Open Source and Adobe Commerce) | WooCommerce plugin core | Shopify (vendor libraries) |
|---|---|---|---|---|
2020 |
32 |
39 |
2 |
1 |
2021 |
6 |
48 |
2 |
0 |
2022 |
4 |
12 |
1 |
1 |
2023 |
14 |
32 |
1 |
0 |
2024 |
7 |
63 |
4 |
0 |
2025 |
3 |
45 |
1 |
0 |
2026 to date |
3 |
64 |
0 |
19 |
| CVEs published in the year (NVD keyword search) | PrestaShop | Magento | WooCommerce | WooCommerce vendor products | Shopify |
|---|---|---|---|---|---|
2020 |
42 |
46 |
7 |
5 |
0 |
2021 |
11 |
57 |
26 |
4 |
0 |
2022 |
8 |
3 |
87 |
2 |
2 |
2023 |
111 |
9 |
271 |
33 |
0 |
2024 |
61 |
2 |
650 |
13 |
1 |
2025 |
10 |
4 |
709 |
1 |
5 |
2026 to date |
17 |
15 |
893 |
0 |
21 |
Source: NVD CVE API 2.0, queried by CPE prefix and by keyword and counted by publication year, fetched on 2026-10-27
The Magento core series is the union of the product identifiers magento:magento, adobe:commerce and
adobe:magento_open_source, de-duplicated. The 2026 WooCommerce core value of 0 is probably a delay: the NVD had not
yet listed a WooCommerce core CVE for 2026 on the fetch date although WooCommerce 11.2.0 was a security release. The 2019
Magento value (137) is a batch of records for Magento 2.x. The 2026 Shopify spike (19) comes from its open-source
libraries and CLI, and not from the platform.
Figure 19: CVEs per year for the core of each self-hosted platform. Source: NVD CVE API 2.0. Magento has the highest core counts in most years (64 in 2026 to date); PrestaShop peaked at 32 in 2020; the WooCommerce plugin has at most four a year.
Figure 20: CVEs per year that mention each platform, found by keyword search (modules, extensions and plugins), and the open-source libraries of Shopify (vendor CPE). Source: NVD CVE API 2.0. The WooCommerce keyword series climbs from 87 in 2022 to 893 in 2026 to date.
Why WooCommerce’s keyword series climbs. The WooCommerce core product has at most four CVEs a year, yet the keyword search grows from 87 in 2022 to 893 in 2026 to date. The growth reflects WordPress CVE Numbering Authorities (CNAs) such as Patchstack, Wordfence and WPScan filing CVEs in bulk for plugins that mention WooCommerce, so it measures the number of plugins whose vulnerabilities are being disclosed more than a decline of WooCommerce itself.
Security advisories
| Advisories published in the year | PrestaShop core (GitHub repository advisories) | PrestaShop modules (Friends-of-Presta posts) | Magento (GitHub global advisories, magento/community-edition) |
Adobe Commerce bulletins (APSB) | Source of the last two |
|---|---|---|---|---|---|
2020 |
26 |
2 |
0 |
5 |
GitHub, Adobe |
2021 |
4 |
3 |
0 |
4 |
GitHub, Adobe |
2022 |
3 |
6 |
217 |
4 |
GitHub, Adobe |
2023 |
13 |
141 |
32 |
4 |
GitHub, Adobe |
2024 |
5 |
71 |
62 |
6 |
GitHub, Adobe |
2025 |
1 |
5 |
45 |
6 |
GitHub, Adobe |
2026 to date |
9 |
2 |
0 (not listed yet) |
7 |
GitHub, Adobe |
Source: PrestaShop repository security advisories, Friends-of-Presta security advisories, GitHub global advisory database and the Adobe security bulletins for Adobe Commerce (the Adobe site returned HTTP 403 to automated clients, so the yearly counts are unverified; APSB26-153 was read on the Adobe Trust Center)
The GitHub value of 217 for Magento in 2022 is a backfill date: the advisory database added old records in that year, so it is not a spike in vulnerabilities. The 2026 value of 0 contradicts the seven bulletins of the same year, which probably means that the global database had not yet received the 2026 Magento records on the fetch date. Friends-of-Presta is a community group, and most of its advisories (141 in 2023) concern third-party modules, not the core. Adobe’s seven bulletins of 2026 include APSB26-146, an out-of-band hotfix of 2026-09-07 for CVE-2026-75650 that was exploited in the wild.
Figure 21: security advisories per year: PrestaShop core (GitHub repository advisories), PrestaShop modules (Friends-of-Presta posts, 141 in 2023) and Adobe Commerce security bulletins (APSB, between four and seven a year). Source: GitHub, Friends-of-Presta, Adobe.
Notable incidents
The table lists incidents with a documented CVE and the CVSS v3.1 base score from the NVD, and the status in the CISA KEV catalogue, which lists vulnerabilities known to be exploited. The CISA catalogue lists six Adobe Commerce and Magento entries on 2026-10-27; the table shows the four that have an incident row here.
| Platform and incident | CVE | CVSS v3.1 | Published | CISA KEV (date added) | Summary |
|---|---|---|---|---|---|
Magento: checkout input validation |
CVE-2022-24086 |
9.8 |
2022-02-16 |
yes (2022-02-15) |
Unauthenticated remote code execution, patched out of band (APSB22-12) |
Magento: CosmicSting |
CVE-2024-34102 |
9.8 |
2024-06-13 |
yes (2024-07-17) |
Unauthenticated XML external entity injection chained to read secrets and gain code execution (APSB24-40) |
Magento: SessionReaper |
CVE-2025-54236 |
9.1 |
2025-09-09 |
yes (2025-10-24) |
Improper input validation in the REST API allowing session takeover and, in some set-ups, code execution (APSB25-88) |
Magento: template injection |
CVE-2026-75650 |
10 |
2026-09-07 |
yes (2026-09-08) |
Unauthenticated code execution exploited in the wild (APSB26-146) |
Magento: Magecart skimming |
n/a |
n/a |
2015 onwards |
n/a |
Groups inject JavaScript skimmers into checkout pages, often through vulnerable or compromised extensions; not a single vulnerability |
PrestaShop: SQL injection chain |
CVE-2022-31181 |
9.8 |
2022-08-01 |
no |
Unauthenticated SQL injection in 1.6.0.10 to 1.7.8.6 that can lead to code execution; fixed in 1.7.8.7 |
PrestaShop: faceted search module |
CVE-2026-54159 |
10 |
2026-07-17 |
no |
Critical vulnerability in the bundled |
WooCommerce: WooCommerce Payments |
CVE-2023-28121 |
9.8 |
2023-04-12 |
no |
Authentication bypass that lets an unauthenticated attacker impersonate an administrator through a request header in WooCommerce Payments 5.6.1 and lower; attacked actively in 2023 |
WooCommerce: July 2021 forced update |
CVE-2021-32789 |
7.5 |
2021-07-14 |
no |
SQL injection through the Store API in WooCommerce Blocks 2.5.0 to 2.5.15; WooCommerce pushed an automatic update to affected stores from 2021-07-14 |
Source: NVD CVE-2022-24086, NVD CVE-2024-34102, NVD CVE-2025-54236, NVD CVE-2026-75650, NVD CVE-2022-31181, NVD CVE-2026-54159, NVD CVE-2023-28121, WooCommerce, critical vulnerability detected in July 2021, Magecart (secondary source) and CISA Known Exploited Vulnerabilities catalog, checked on 2026-10-27
The names CosmicSting and SessionReaper were coined by the security firm Sansec. The WooCommerce Payments case is a plugin vulnerability, and the 2021 case concerned the WooCommerce Blocks package, not the plugin core.
Why self-hosted PHP platforms and plugin-heavy stores have a larger attack surface
Three facts in the data explain why the exposure of PrestaShop, Magento and WooCommerce stores is larger:
-
The merchant is the patch manager. On a self-hosted platform a fix does not protect a store until someone applies it. Adobe publishes monthly isolated builds and out-of-band hotfixes, but the CISA catalogue added CosmicSting five weeks and SessionReaper six weeks after their publication, which shows that exploitation continued after fixes existed. WooCommerce pushed an automatic update to affected stores in July 2021 for the same reason.
-
Third-party code runs with the privileges of the store. Modules, extensions and plugins execute inside the same PHP process, with access to orders and customers. Patchstack’s State of WordPress Security 2026 reports 11,334 new vulnerabilities in the WordPress ecosystem in 2025, of which 91% were in plugins, 9% in themes and 6 in WordPress core. Friends-of-Presta published 141 advisories in 2023, nearly all for modules, and the Magecart campaigns inject skimmers through vulnerable or compromised extensions.
-
The stack is larger. The web server, PHP, the database, the search engine, the cache and the operating system are the merchant’s (or the host’s) responsibility, together with the platform and every extension.
A SaaS platform removes the first and third of these for the merchant, but not the risk of third-party apps (an app with excessive access scopes can still leak data) or of staff accounts. See PrestaShop security, Magento security and WooCommerce performance and security for the measures on each platform.
Why Shopify’s CVE count is not comparable
Shopify has 21 NVD CVEs by vendor identifier (1 in 2020, 1 in 2022 and 19 in 2026 to date), and a total of 29 by keyword search. These records belong to Shopify’s open-source libraries and command-line tools, such as the CLI, and not to the hosted platform. When Shopify fixes a vulnerability in the platform, it deploys the fix on its own servers and the merchants take no action, so the fix does not appear as a CVE: CVEs exist to tell users of installed software what to update. Shopify instead runs a public bug bounty program on HackerOne, as Automattic does for WooCommerce (Automattic on HackerOne). A CVE count of zero or near zero for a SaaS product therefore does not mean it has fewer vulnerabilities; it means that its vulnerabilities do not need to be announced to the customers. The same applies in reverse: a large number of CVEs for a self-hosted platform shows transparent disclosure as much as a large number of vulnerabilities. Counts should be compared only within one deployment model, and even then they measure disclosure effort, not risk.
Reading the security data. The evidence supports three statements. First, a merchant on Shopify delegates platform patching, which removes a whole class of risk. Second, of the incidents tracked here only Magento’s are in the CISA catalogue (four of its six entries are in the table above), so patching it quickly is not optional. Third, PrestaShop and WooCommerce have few core CVEs a year, and their exposure is concentrated in modules and plugins, so what counts is how many third-party extensions a store installs and how it vets them.
Ease of use
Ease of use has no objective public metric. This page does not use user-review ratings: G2 and Capterra could not be opened from the authoring environment (HTTP 403), their ratings would be self-selected reviews, and they are recorded as n/a (unverified) for all four platforms. The ease-of-use scores in the radar charts are editorial and rest on what a new merchant or developer has to do before the first sale:
-
Shopify (9). Hosting, SSL, a custom domain and upgrades are part of every plan; no server or command line is needed to open a store, and the theme editor and apps cover most needs. Source: Shopify pricing.
-
WooCommerce (7). A plugin installed on an existing WordPress site with a setup wizard in the admin, a familiar editor and a large page-builder ecosystem; the merchant still owns hosting, themes and plugin choices. Source: WooCommerce on WordPress.org.
-
PrestaShop (6). A web installer and a back office with guided onboarding, but the merchant must provide PHP and MySQL hosting and choose modules. Source: PrestaShop system requirements.
-
Magento (3). A Composer installation plus a search engine (OpenSearch), a cache store, cron and database tuning; the admin is powerful but large, and the learning curve is the steepest for merchants and developers. Source: Adobe Commerce system requirements.
For developers the learning curve follows the extension model: Shopify asks you to learn Liquid, the GraphQL APIs and the app and Functions model, and gives no access to the server; PrestaShop and Magento ask for PHP and Symfony or the Magento object manager and configuration (the learning path is on the Magento overview); WooCommerce asks for WordPress hooks and PHP, with React for the block-based admin and checkout. The platform sections start at the Shopify, PrestaShop, Magento and WooCommerce overviews, each with a learning path.
Maintenance
Maintenance is the recurring work to keep a store running: applying releases and security patches, upgrading dependencies such as PHP, and migrating when a version leaves support. The release and support policies are official and dated, so this is the best documented of the human-effort metrics. The table summarises the policies and the Gantt chart that follows draws them.
| Policy (2026-10-27) | Shopify | PrestaShop | Magento / Adobe Commerce | WooCommerce |
|---|---|---|---|---|
Who upgrades the platform |
Shopify |
The merchant, with the Update Assistant or by hand |
The merchant, with Composer |
The merchant, from the WordPress admin or with Composer |
Release cadence |
A new API version every three months (2026-01, 2026-04, 2026-07, 2026-10; a release candidate 2027-01) |
A major or minor release, at most twice a year (8.0 on 2022-10-26, 8.1 on 2023-06-26, 8.2 on 2024-09-26, 9.0 on 2025-06-10, 9.1 on 2026-03-23, 9.2 on 2026-09-30) |
A 2.4.x line each year (2.4.5 on 2022-08-09, 2.4.6 on 2023-03-14, 2.4.7 on 2024-04-09, 2.4.8 on 2025-04-08, 2.4.9 on 2026-05-12) |
A minor line about every five weeks, from 8.5 (2024-01-09) to 11.2 (2026-10-07) |
Support window |
Each stable API version is supported for at least 12 months, and consecutive versions overlap for at least nine months |
Each minor is maintained until the next minor ships; 8.2 has extended support (critical bug and security fixes) until 10.0.0; PrestaShop publishes no end-of-life dates, so these windows are inferred (n/a for official end dates) |
Standard support is three years from general availability; Adobe Commerce customers get extended support and then security-only fixes (for example 2.4.6: standard until 2026-08-11, extended until 2027-08-31 and security fixes until 2028-05-31) |
Security patches are backported to the last 21 major versions when the CVSS score is 9 or higher; older versions may be patched as a courtesy |
Security patches between releases |
Applied by Shopify |
Patch releases and module updates |
Monthly security bulletins (seven in 2026 to date) and isolated builds named by month, such as |
Patch releases such as 11.2.1 and plugin updates |
Source: Shopify API versioning, PrestaShop minor release lifecycle, PrestaShop 8.2 extended support, Adobe Commerce lifecycle policy and WooCommerce security support policy
The WooCommerce repository’s own SECURITY.md says that only the latest version has continued support; the developer documentation page cited above gives the longer backport policy and is the one used here. The month-based names of the Adobe patch builds are described by bulletin APSB26-153 (2026-10-13), and the Experience League version table had not yet been updated for them on the fetch date (unverified).
Figure 22: release lines and support windows. PrestaShop minor releases 8.0 to 9.2, each maintained until the next minor shipped (inferred, no official dates), with 8.2 in extended support until 10.0.0 and no end date; Magento 2.4.5 to 2.4.9 with three years of standard support and then the extended and security-only phases; Shopify API versions 2025-01 to 2026-10, each supported for at least 12 months. Source: PrestaShop, Adobe and Shopify lifecycle policies.
Figure 23: every WooCommerce minor release line from 8.5 (2024-01-09) to 11.2 (2026-10-07), about one every five weeks;
each line is current until the next one ships. Source: GitHub releases API of woocommerce/woocommerce, fetched on
2026-10-27.
Taken together, the policies show two very different maintenance loads. A Shopify merchant migrates API versions in the apps and custom code that use them, about once a year if the code is kept on the oldest supported version, and takes no action for the platform. A WooCommerce store sees a minor release every five weeks, and its plugins and WordPress add their own releases; the support policy backports only critical security fixes. A Magento store follows a three-year line with monthly bulletins, and moving between lines (2.4.7 to 2.4.9, for example) is a project. PrestaShop ships a new major or minor line about as often as Magento ships a 2.4.x line (six since 2022 against five), but its minor releases are short-lived, so a store is expected to move to the next minor (8.2 is the exception, with extended support until 10.0.0). See PrestaShop versions and support, Magento upgrades, WooCommerce versions, requirements and release cadence and Shopify what is new and deprecation timeline.
Cost and total cost of ownership
The price list is only part of the cost. The fees that can be compared are platform subscription or licence and payment fees. The costs that cannot be charted are the merchant’s own: hosting, themes, extensions or apps, development, maintenance and payment provider fees. For the open-source options these costs vary too much for a reliable figure, so they are n/a here and the charts show a zero licence price, not a zero total cost.
| Shopify plan (EUR page, 2026-10-27) | Per month, billed monthly | Per month, billed yearly | Card rate (Shopify Payments, online) | Fee with a third-party payment provider |
|---|---|---|---|---|
Basic |
EUR 32 |
EUR 24 |
2.1% plus EUR 0.30 |
2% |
Grow |
EUR 92 |
EUR 69 |
1.8% plus EUR 0.30 |
1% |
Advanced |
EUR 384 |
EUR 289 |
1.6% plus EUR 0.30 |
0.6% |
Plus |
from EUR 2,100 |
n/a (no yearly price shown) |
1.3% plus EUR 0.30 |
0.2% |
Source: Shopify pricing and Shopify Plus pricing, rendered in euro on 2026-10-27; the prices exclude taxes, apps, themes and the domain. The trial is three days free and then EUR 1 a month for three months (promotional).
The dollar prices are unverified: the US page could not be fetched, and values from third-party summaries (tech.co and ecommerce-platforms.com) are USD 39 (Basic), USD 105 (Grow), USD 399 (Advanced) and from USD 2,300 (Plus) a month billed monthly, and USD 29, USD 79 and USD 299 billed yearly for the first three. Re-check them on a US-locale browser before relying on them.
| Open-source and licensed options | Licence price per month | What the merchant pays on top |
|---|---|---|
PrestaShop |
EUR 0 (free software) |
Hosting, paid modules from Addons and development; n/a (no reliable figure) |
Magento Open Source |
EUR 0 (free software) |
Heavy hosting and specialist development, extensions; n/a |
Adobe Commerce |
n/a (quote-based licence, unverified) |
Everything above plus the licence |
WooCommerce |
EUR 0 (free plugin) |
Hosting, theme, paid extensions and development; payment fees of WooPayments are 2.9% plus USD 0.30 for US cards (plus 1.5% for international cards, plus 1% for currency conversion and a USD 15 dispute fee), and 1.5% plus EUR 0.25 for European cards (Austria as the example), with no monthly fee for online payments |
Source: PrestaShop project, Magento 2 repository, Adobe Commerce documentation and WooPayments fees, checked on 2026-10-27
Figure 24: platform subscription or licence price per month, billed monthly, in euro: Shopify Basic 32, Grow 92, Advanced 384 and Plus from 2,100; PrestaShop, Magento Open Source and WooCommerce are free software (0) but need hosting, extensions and development; Adobe Commerce is quote-based (n/a). Source: official pricing pages.
Figure 25: percentage part of the online card rate per transaction (a fixed fee of 0.30 is added): Shopify Payments 2.1% on Basic down to 1.3% on Plus; WooPayments 2.9% for US cards and 1.5% for European cards (with a fixed 0.25). Source: Shopify pricing and WooPayments fees. Rates are country specific, and other payment providers charge their own fees.
Reading the cost data. Shopify’s cost is visible and predictable: a store that sells EUR 20,000 a month with Shopify Payments on the Grow plan pays EUR 92 for the subscription plus the card rate, and nothing for hosting. For the open-source platforms the licence is free and the cost is distributed over hosting, developers and extensions, which is cheap for a small catalogue on shared hosting and expensive for a Magento store that needs a cluster and specialists. The page therefore scores Shopify 5 on low cost (a subscription plus fees, with hosting included), PrestaShop and WooCommerce 8 (no licence, moderate infrastructure), and Magento 3 (heavy infrastructure, quote-based licence on Adobe Commerce); the reasoning is in the rubric.
Tools, functionality and other characteristics
Tools and functionality. The scores are editorial and their basis is in data/radar-scores.csv: Magento 9 (the most
complete core: multiple sources and stores, B2B on Adobe Commerce, GraphQL and REST), Shopify 8 (built-in checkout,
point of sale, Markets, B2B, Flow automation, Functions and an app store with about 32,000 apps; advanced checkout
control is Plus-only), WooCommerce 7 (the core covers catalog, orders and the blocks checkout, and most advanced
features come from the 10,039 plugins tagged woocommerce and from WordPress itself) and PrestaShop 6 (catalog,
multistore and, from 9.2, a one-page checkout and improved B2B behind flags, with breadth beyond the core from paid
Addons modules).
Scalability. Shopify 9 (managed infrastructure that scales with traffic, with API rate limits and plan caps as the limits), Magento 8 (designed for large catalogs and traffic with indexers, message queues and cloud editions, at the cost of infrastructure and tuning), WooCommerce 6 (scales with WordPress hosting and caching; high order volumes need HPOS, the custom order tables, and careful plugin selection) and PrestaShop 5 (scales by sizing hosting and caching yourself; the platform targets small and mid-size catalogs and has the lowest median mobile Lighthouse score, 0.345).
Production deployment complexity. Shopify has none: the vendor runs the infrastructure. The three self-hosted platforms can all run as stateless containers on several Kubernetes nodes with a managed database, but the amount of state to move out of the server differs. WooCommerce inherits WordPress: uploads, the object cache, cron and the session table (WooCommerce: Cloud Deployment Overview). PrestaShop core has no S3 media option and no TLS setting for its database client, so images stay on shared storage and an encrypted database connection needs a workaround (PrestaShop: Cloud Reference Architecture). Magento needs the most: managed OpenSearch, Valkey and RabbitMQ in addition to the database, Varnish with purge fan-out, and separate consumers, cron and indexers (Magento: Cloud Reference Architecture). The WordPress-side design that the WooCommerce store builds on is in WordPress: Cloud Reference Architecture.
Customisation flexibility. WooCommerce and Magento 9 (open code with actions, filters and block extensibility, or with dependency injection, plugins, preferences, observers and layout XML), PrestaShop 8 (open PHP and Symfony code, hooks, overrides and services) and Shopify 6 (Liquid, theme blocks, apps and Functions allow wide changes, but server code, the checkout and the data model are constrained).
Vendor lock-in and data portability. Shopify is proprietary: the themes use Liquid, the apps use Shopify’s APIs and the data lives on Shopify’s servers, so leaving means exporting data and rebuilding the theme and the integrations. The open-source platforms keep the code and the database under the merchant’s control and can move between hosts, at the price of operating them. No numeric lock-in metric exists, so it does not appear in the radar charts.
Headless readiness. Shopify 9 (Storefront API, Customer Account API, Hydrogen and Oxygen: a documented first-class path), Magento 8 (GraphQL and REST APIs, PWA Studio and the headless Adobe Commerce storefront, with heavy integration work), WooCommerce 7 (REST API v3 and the Store API; GraphQL needs a community plugin) and PrestaShop 5 (data APIs only, with no official storefront framework or storefront API).
Internationalisation and B2B. Shopify Markets, the PrestaShop multistore with CLDR locales, Magento store views and WooCommerce through WordPress language packs and a multilingual plugin all support several languages and currencies, with different depth (see the feature matrix). B2B is built into Shopify on all plans with limits, into Adobe Commerce as an extension, behind a flag in PrestaShop 9.2, and only through plugins in WooCommerce.
Developer job demand. Not reported: no trusted public source with a comparable method was found.
Scores on ten axes
The radar charts condense the comparison into ten axes scored from 0 to 10, higher being better. Two axes are computed
from the data of this page and eight are editorial scores whose basis and source are recorded next to each value in
data/radar-scores.csv. The scores summarise the evidence on the page; they are not a benchmark, they are not weighted
or summed into a total, and moving a score by one point is within the uncertainty of the method.
| Axis | Kind | How it is scored |
|---|---|---|
Ease of use |
editorial |
9-10 hosted with no infrastructure work; 7-8 simple install on common hosting; 5-6 installer plus own hosting and module choices; 3-4 specialist infrastructure and long learning curve; 0-2 expert-only |
Low maintenance effort (inverted: 10 is the least effort) |
editorial |
9-10 the vendor patches and upgrades the platform; 7-8 occasional merchant action; 5-6 the merchant applies minor releases and module updates; 3-4 frequent security bulletins and heavy upgrades; 0-2 continuous dedicated effort |
Performance |
computed |
The mean of the mobile and desktop Core Web Vitals pass rate divided by 10 and the mobile and desktop median Lighthouse performance score times 10, for the latest HTTP Archive month (2026-09) |
Tools and functionality |
editorial |
Built-in features, APIs, developer tooling and marketplace breadth: 9-10 broad core plus enterprise features; 7-8 broad core or a very large app ecosystem; 5-6 solid catalog and checkout with extras from paid modules; below 5 limited |
Security posture |
editorial |
Who patches, vendor response, exploited vulnerabilities (CISA KEV) and the attack surface of third-party code: 8-10 centrally patched SaaS; 5-7 predictable patches but exploited or module-heavy; 3-4 a very large third-party plugin attack surface |
Low cost |
editorial |
10 is the lowest total cost of entry: 8-9 free software with moderate infrastructure; 5-6 subscription plus fees; 3-4 heavy infrastructure or a quote-based licence; 1-2 enterprise pricing |
Customisation flexibility |
editorial |
How much of the stack can be changed: 9-10 open code with deep extension points; 7-8 open code; 5-6 constrained by the platform (checkout, data model) |
Scalability |
editorial |
9-10 managed elastic infrastructure; 7-8 designed for large catalogs but needing tuning; 5-6 dependent on self-chosen hosting and caching |
Ecosystem |
computed |
The mean of three log-scaled measures: live stores (10,000 scores 0 and 10,000,000 scores 10), Stack Overflow questions of the platform’s tags (1,000 scores 0 and 1,000,000 scores 10; dedicated Stack Exchange sites such as magento.stackexchange.com are not counted, because not every platform has one) and GitHub stars of the main repositories (100 scores 0 and 100,000 scores 10) |
Headless readiness |
editorial |
9-10 a documented storefront API and framework; 7-8 full APIs without an official storefront framework; 5-6 data APIs only |
The resulting scores, with the two computed axes rounded to one decimal:
| Axis | Shopify | PrestaShop | Magento | WooCommerce |
|---|---|---|---|---|
Ease of use |
9 |
6 |
3 |
7 |
Low maintenance effort |
9 |
5 |
3 |
4 |
Performance (computed) |
6.4 |
5.2 |
4.5 |
4.3 |
Tools and functionality |
8 |
6 |
9 |
7 |
Security posture |
8 |
5 |
5 |
4 |
Low cost |
5 |
8 |
3 |
8 |
Customisation flexibility |
6 |
8 |
9 |
9 |
Scalability |
9 |
5 |
8 |
6 |
Ecosystem (computed) |
6 |
4.3 |
5.3 |
6.9 |
Headless readiness |
9 |
5 |
8 |
7 |
Source: scripts/ecommerce-comparison-charts/data/radar-scores.csv and scores.mjs, computed from the metrics of this page on 2026-10-27; the basis of each editorial score is written beside it in the CSV file.
Figure 26: the four platforms on ten axes. The scores are editorial except Performance and Ecosystem, which were computed
from the metrics of 2026-10-27 (sources as in the figures above, rubric in data/NOTES.md).
Figure 27: Shopify. Ease of use, maintenance, scalability and headless readiness are the strengths; cost and customisation flexibility are the lowest scores.
Figure 28: PrestaShop. Low cost and customisation flexibility lead; the ecosystem is the smallest of the four.
Figure 29: Magento and Adobe Commerce. The profile is the most lopsided: the top scores are tools and functionality and customisation flexibility; ease of use, maintenance and cost are the lowest.
Figure 30: WooCommerce. The largest ecosystem, low cost and deep customisation, against the weakest security posture and performance scores.
Decision flowchart
The flowchart follows the recommendations below. Start from who will operate the store.
Figure 31: decision flowchart for choosing a platform. It is a starting point; check the metrics and caveats above before deciding.
Recommendations by purpose
The data snapshot date for every figure below is 2026-10-27. The recommendations are justified only by the data on this page. They name the option the evidence favours first and what to check, and they are not rankings: a team with deep experience of one platform can reasonably choose it against the table.
| Use case | Fits best | Evidence on this page | What to check, and where to read more |
|---|---|---|---|
Small merchant, no technical staff |
Shopify; WooCommerce on managed WordPress hosting |
Shopify scores 9 on ease of use and maintenance and has the highest Core Web Vitals pass rate (76.25% mobile); Basic costs EUR 32 a month plus 2.1% and EUR 0.30 per card payment. WooCommerce has no licence fee and the largest number of live stores (4,321,090). |
Recurring costs of apps and fees on Shopify; who updates WooCommerce and its plugins. See Shopify store setup and WooCommerce store setup. |
Fast-growing direct-to-consumer brand |
Shopify |
Scalability 9 (managed infrastructure), API versions supported for 12 months or more, 32.4% of e-commerce systems on W3Techs and the fastest growth in live stores (3,189,134, up from 753,977 in 2019-Q1). Advanced and Plus add lower card rates (1.6% and 1.3%). |
Plan caps and API rate limits; checkout customisation beyond the basics needs Plus. See Plans and Shopify Plus and Shopify Functions. |
Full code ownership on a budget |
PrestaShop or WooCommerce |
Both are free software (EUR 0 licence), customisation flexibility 8 and 9, and neither charges a platform fee. PrestaShop has multistore and multi-currency in core; WooCommerce has the largest plugin ecosystem (10,039 tagged plugins). |
Hosting and maintenance are yours: the self-hosted platforms have the heavier maintenance load and, for WooCommerce, the lowest security-posture score (4). See PrestaShop module basics, WooCommerce extension development and the Laravel route in Laravel for a store you build yourself. |
Content-led store on an existing WordPress site |
WooCommerce |
WordPress is on 39.6% of all websites, WooCommerce is the e-commerce plugin with 7.8% of all websites, and ease of use is 7. |
Core Web Vitals pass rate is the lowest (39.32% mobile), so budget for hosting, caching and an optimised theme. See WooCommerce performance and security. |
Large catalog or B2B enterprise |
Magento / Adobe Commerce; Shopify Plus for teams that prefer SaaS |
Tools and functionality 9, scalability 8, B2B extension on Adobe Commerce; Shopify supports B2B on all plans (three catalogs) with unlimited catalogs on Plus. |
Heavy infrastructure, specialist developers and the security record: six CISA KEV entries and seven Adobe bulletins in 2026 to date. See Magento catalog, multistore and B2B and Shopify B2B. |
Headless storefront |
Shopify; Magento |
Headless readiness 9 (Shopify: Storefront API, Hydrogen, Oxygen) and 8 (Magento: GraphQL, PWA Studio); WooCommerce 7 with the Store API; PrestaShop 5 (data APIs, no storefront framework). Pair a headless storefront with a React framework such as Next.js. |
Headless adds a front-end team and its own performance and security work. See Storefront API and Hydrogen, Magento REST and GraphQL APIs and WooCommerce Store API. |
Regulated sector or data-residency requirements |
A self-hosted platform (PrestaShop, Magento or WooCommerce), or a SaaS contract that satisfies the rules |
The self-hosted platforms let the merchant choose the host and the region and audit the code. This page has no dataset on data residency (n/a), so a SaaS option must be checked against the vendor’s contract and certifications. |
The merchant owns patching and compliance work on a self-hosted platform. See PrestaShop security and Magento security. |
Two points matter in every case. First, the cheapest choice on the price list is often not the cheapest in total, because hosting, development and maintenance fall on the merchant for self-hosted platforms, and fees and apps accumulate on Shopify. Second, the performance and security figures describe populations of stores. A well-run Magento, PrestaShop or WooCommerce store can match the Shopify numbers, and a poorly configured Shopify store with many apps can fall behind them, so these recommendations are starting points that a short proof of concept on the shortlisted platforms should confirm.
The comparison pages for other choices of this site use the same method: the Documentation Tools Comparison and the Cloud Providers Comparison. The section overview and its bibliography are at E-commerce.
References
-
Store Leads reports (Shopify, PrestaShop, Magento and WooCommerce)
-
HTTP Archive Tech Report, with the endpoints adoption, cwv and lighthouse
-
HackerOne: Shopify bug bounty program and HackerOne: Automattic bug bounty program
-
PrestaShop issue 42441: Add Content Security Policy (Report-Only) for the back office
-
Adobe security bulletins for Adobe Commerce (unverified: HTTP 403 to automated clients; APSB26-153 is on the Adobe Trust Center)
-
tech.co: Shopify pricing and ecommerce-platforms.com: Shopify pricing (third-party summaries of USD prices, unverified)
-
PrestaShop minor release lifecycle and PrestaShop 8.2 extended support phase
-
PrestaShop system requirements and Adobe Commerce system requirements
-
G2 and Capterra (not used: unverified, HTTP 403 to automated clients)