E-commerce Platforms Comparison

This content was generated with the assistance of AI and should be verified against the official documentation of each platform before being relied on in production.

This section’s bibliography lists the reference material consulted while preparing these pages.

This page compares the four e-commerce platforms of this section: Shopify (Admin and Storefront API 2026-10, Shopify CLI 5.0.0), PrestaShop 9.2.0, Magento 2.4.9 (Magento Open Source and Adobe Commerce, with Mage-OS 3.6.0 as context) and WooCommerce 11.2.1 on WordPress. Every number was fetched on 2026-10-27 and every claim about a feature is explained, with examples, on the platform pages linked from the sections below. The approach follows the Documentation Tools Comparison and the Cloud Providers Comparison of this site: data kept in CSV files, charts generated from them, and a stated source and date for every figure. The page does not name a winner, because the right platform depends on who will run the store, what it must sell and who will pay for the work; the last sections turn the data into recommendations by purpose. The overview of the section, with the shared bibliography, is the E-commerce overview.

Scope, methodology and snapshot date

Scope. The four platforms are not the same kind of product. Shopify is a hosted software-as-a-service (SaaS) platform: Shopify runs the servers, the checkout and the upgrades, and the merchant configures a store and installs apps and themes. PrestaShop and Magento Open Source are free software that the merchant (or a host) installs and operates. Adobe Commerce is the licensed edition built from the Magento code base, offered on-premises, on Adobe’s cloud infrastructure and as a software-as-a-service edition. WooCommerce is a free plugin that turns a WordPress site into a store, so every WooCommerce figure also reflects WordPress, its themes, its plugins and the hosting it runs on. Mage-OS, a community distribution of the Magento Open Source code base, appears only as context.

Snapshot date. All values on this page were fetched on 2026-10-27 from the sources listed in References and in scripts/ecommerce-comparison-charts/data/sources.csv; every row of the CSV files carries its own fetch date. Time series end at the latest complete period at that date: 2026-09 for the HTTP Archive Tech Report (October is not published yet), 2026-Q4 to date for Store Leads, and 2026 to date for the yearly series. A value that could not be obtained is shown as n/a, never as zero, and a value that came from a secondary source or from a page that could not be opened from the authoring environment is marked unverified.

Where to check current values. Each table and figure names its source. The live pages are the W3Techs technology pages, the Store Leads reports, the HTTP Archive Tech Report, the Web Almanac e-commerce chapter, the GitHub, npm, WordPress.org and Stack Exchange APIs, the National Vulnerability Database (NVD) API, the official pricing pages and the official lifecycle policies listed in the References. The data and the scripts that draw the figures are in scripts/ecommerce-comparison-charts/, so the charts can be regenerated with npm run charts:ecommerce-comparison.

How the metrics are used. The sections after the feature matrix present metrics in six groups (popularity, performance, security, ease of use and maintenance, cost, and other characteristics), each with a statement of what it measures and what it does not. Three rules apply throughout:

  • Absolute values from different sources are never plotted on one axis, because they count different things: W3Techs counts the share of websites among the top sites it analyses, Store Leads counts live stores it detects, and the HTTP Archive counts origins visited by Chrome users.

  • Field data and counts are reported as measured. Where a number is a proxy (for example CVEs as a proxy for security), the section says what it cannot show.

  • The scores of the radar charts at the end combine this evidence with a stated rubric. Eight of the ten axes are editorial scores whose basis and source are written in data/radar-scores.csv; two (performance and ecosystem) are computed from the data. The rubric is given in Scores on ten axes.

Caveats that apply to the whole page.

  • The platform-comparison sources measure different populations, so a platform can lead in one and trail in another without a contradiction.

  • INP (Interaction to Next Paint) replaced FID (First Input Delay) in the Core Web Vitals definition on 2024-03-12, so pass rates before and after that date are not strictly comparable.

  • PrestaShop and Magento have shrinking populations of detected stores, so their pass rates can be biased by survivor effects (stores that were slow or unmaintained may have left the sample).

  • WooCommerce figures include the whole WordPress stack (theme, page builder, plugins, hosting).

  • Stack Overflow’s site-wide decline since 2023 affects every tag, so question counts for recent years say little about a platform on their own.

  • CVE counts measure disclosure, not real risk, and are not comparable between SaaS and self-hosted software.

  • G2 and Capterra ratings were not used: both sites returned HTTP 403 to automated clients, so the ratings are recorded as n/a (unverified), they would be self-selected user reviews, and they feed no score.

Feature matrix

The matrix lists what each platform does by itself, without extra apps, modules or plugins unless the cell says so. n/a means that no reliable public figure exists. The platform pages hold the details and the examples.

Feature Shopify PrestaShop 9.2 Magento 2.4.9 / Adobe Commerce WooCommerce 11.2

Hosting model

SaaS: Shopify hosts, secures and scales the store; headless storefronts can run on Oxygen, Shopify’s hosting

Self-hosted: you or a host run PHP, the database and the web server

Open Source and Mage-OS are self-hosted; Adobe Commerce runs on-premises, on Adobe’s cloud infrastructure (PaaS) or as a software-as-a-service edition (Adobe Commerce as a Cloud Service)

Self-hosted WordPress plugin; any WordPress host, managed or not

Licence

Proprietary service; the CLI and Hydrogen are MIT-licensed

Core under OSL 3.0, modules and themes under AFL 3.0 (open source)

Magento Open Source under OSL 3.0 and AFL 3.0 (open source); Adobe Commerce is a licensed product with a quote-based price

GPL version 3 (open source)

Languages and stack

Liquid templates, GraphQL APIs, JavaScript and TypeScript (React, Hydrogen); Shopify Functions compile to WebAssembly (Rust or JavaScript); no server code of your own inside the platform

PHP (8.1 to 8.5 on 9.1 and 9.2), Symfony 6.4, Smarty and Twig, Doctrine, MySQL 5.7 or MariaDB 10.2 and newer

PHP, Composer, MySQL or MariaDB, OpenSearch, a cache store; dependency injection, layout XML, declarative schema

PHP 7.4 or newer, WordPress 7.0 or newer, MySQL or MariaDB; JavaScript and React for blocks

Theming model

Online Store 2.0 themes: Liquid, sections and blocks, a visual theme editor; reference themes Dawn and Horizon

Hummingbird 2.1.2 (default for new shops) and the Classic theme; Smarty templates and a theme.yml descriptor

Layout XML and templates (Luma and its descendants), Hyvä (relicensed OSL 3.0 and AFL 3.0 in 2025), PWA Studio, Adobe Commerce storefront on Edge Delivery

WordPress block themes and classic themes, plus page builders; WooCommerce blocks for the shop pages

Extension model

Apps (Admin API, webhooks, embedded UI with Polaris), theme app extensions, checkout UI extensions, Shopify Functions

Modules with hooks, front and admin controllers, Symfony services and overrides

Modules with plugins (interceptors), observers, preferences and layout; out-of-process extensions on Adobe editions

Plugins with actions and filters, blocks, CRUD classes and data stores, REST endpoints

APIs

Admin GraphQL, Storefront and Customer Account APIs; versioned quarterly

Webservice API (XML and JSON) and the Admin API (API Platform, OpenAPI), which carries no stable label yet (document version 0.1.0)

REST and GraphQL APIs; webhooks and events on Adobe editions

REST API (version 3) and the Store API (wc/store/v1); GraphQL needs a community plugin

Headless

First-class: Storefront API, Hydrogen toolkit (2026-10) and Oxygen hosting

Data APIs exist; no official storefront framework

GraphQL storefront, PWA Studio and the Adobe Commerce storefront; heavy integration work

REST and Store API; no official storefront framework

Checkout customisation

Checkout Extensibility: UI extensions, Functions and branding; the information, shipping and payment steps are customisable only on Plus

Full control of templates and hooks; 9.2 adds a one-page checkout module

Full control through layout, JavaScript components and payment provider gateways

Checkout block with an additional-checkout-fields API, or the classic shortcode checkout

Multistore and markets

Markets: one store sells in several countries with local currencies and domains; separate stores for separate brands

Multistore: shop groups and shops on one installation, sharing a catalog and back office

Websites, store groups and store views with scoped configuration and prices

One store per site; several stores need WordPress multisite or separate sites

B2B

On all plans, with three catalogs; unlimited catalogs and direct assignment to locations on Plus

Improved B2B mode behind a feature flag (disabled by default in 9.2)

The B2B extension is Adobe Commerce only (companies, shared catalogs, negotiable quotes)

No core B2B feature; extensions provide it

Internationalisation

Markets plus translations of themes and content

Languages, currencies and locale formatting (CLDR) in core

Store views with translated content and locale per view

Interface translations through WordPress language packs; translating products and pages needs a multilingual plugin such as WPML

Marketplace

Shopify App Store, about 32,098 apps (Store Leads detection; Shopify publishes no count)

PrestaShop Addons: n/a (no reliable public count; unverified)

Adobe Commerce Marketplace: n/a (no reliable public count)

10,039 plugins tagged woocommerce on WordPress.org, plus the WooCommerce Marketplace (no official count)

Who patches security issues

Shopify, centrally, without customer action

The merchant applies core and module updates

The merchant applies patches; Adobe publishes monthly isolated builds for Adobe Commerce and Open Source

The merchant (or host) updates WooCommerce, WordPress and all plugins

Upgrade model

Automatic platform; quarterly API versions each supported for at least 12 months

Minor releases at most twice a year; the Update Assistant (autoupgrade) module

A new 2.4.x line yearly, three years of standard support; Composer and bin/magento setup:upgrade

A release about every five weeks, updated from the WordPress admin or Composer

Strengths and weaknesses

The table summarises the main strengths and weaknesses of each platform. Each cell is backed by the data later on this page or by the source named under the table.

Platform Strengths Weaknesses

Shopify

Highest Core Web Vitals pass rate of the four (76.25% mobile and 79.50% desktop in 2026-09); the vendor patches and upgrades the platform; hosting, SSL and scaling are included; headless is a documented path; a very large app store

Recurring cost (EUR 32 to 384 per month plus transaction fees); the checkout and the data model are constrained, and full checkout control is Plus-only; code runs only in apps and Functions, not in the platform; the merchant depends on one vendor (lock-in)

PrestaShop

Free and open source; the whole stack can be modified through hooks, overrides and services; multistore and multi-currency in core; a modern Symfony code base; second in the Core Web Vitals comparison (61.45% mobile)

The population of live stores has shrunk by about a third from its 2022 peak; the lowest median mobile Lighthouse score of the four (0.345); no official headless storefront framework; the core ships no Content Security Policy support (an open proposal would add one); far fewer extensions and developers than the largest ecosystems

Magento / Adobe Commerce

The most complete core for large catalogs: multiple sources and stores, scoped prices, B2B on Adobe Commerce, REST and GraphQL APIs; open source edition; deep extension points

Steepest learning curve and heaviest hosting needs; the second-lowest share of origins passing Core Web Vitals (44.57% mobile); six Adobe Commerce and Magento vulnerabilities in the CISA Known Exploited Vulnerabilities catalogue; the Adobe Commerce licence is quote-based

WooCommerce

The largest number of live stores (4,321,090 detected) and the largest share of e-commerce sites; free and open source; all of WordPress for content; the whole plugin ecosystem; a good fit for stores that are also content sites

The lowest Core Web Vitals pass rate (39.32% mobile), partly because the stack is whatever the merchant assembles; the merchant owns updates for WordPress, the theme and every plugin; the largest plugin attack surface (91% of the new WordPress vulnerabilities in 2025 were in plugins); no native multistore or B2B

Shopify. The advantage is that the operational work is someone else’s. Hosting, certificates, scaling for peak traffic and platform patches are part of the subscription, and the HTTP Archive field data shows that this translates into the highest share of origins passing Core Web Vitals (see Performance). The price of this is a constrained platform: server-side code runs only in apps and Functions, and the checkout steps beyond the basics are customisable only on Plus. See Shopify Functions and Checkout Extensibility for what can and cannot be changed.

PrestaShop. It is the open-source option with the smallest operational footprint of the PHP platforms and a code base that has been modernised with Symfony in the 9.x line. The weaknesses are scale of ecosystem and momentum: Store Leads detects 144,665 live stores in 2026-Q4 to date against a peak of 220,112 in 2022-Q3. See PrestaShop architecture and hooks.

Magento and Adobe Commerce. The most capable core and the most demanding to run. Choose the edition first: Open Source is free but lacks the B2B extension and the Adobe services, while Adobe Commerce adds them for a licence fee. See Magento editions and ecosystem and versions, lifecycle and requirements.

WooCommerce. The market leader by number of stores, with the lowest barrier to start and the broadest choice of themes and plugins. The same freedom is its main risk: quality and security depend on the plugins chosen and on the host. See WooCommerce architecture and performance and security.

Popularity and ecosystem

Popularity metrics answer a narrow question: how widely is each platform used and how large is the community around it? They do not say how good a platform is. The sources count different things, so the table gives each source’s own unit and the figures never share an axis.

Metric (date) Shopify PrestaShop Magento WooCommerce Source

Share of all websites (2026-10-27)

5.3%

0.5%

0.3%

7.8%

W3Techs

Share of websites with a known CMS (2026-10-27)

7.9%

0.7%

0.4%

11.5%

W3Techs

Share of e-commerce systems (2026-10-27)

32.4%

2.8%

1.6%

47.4%

W3Techs

Live stores (2026-Q4 to date)

3,189,134

144,665

102,287

4,321,090

Store Leads

Peak of live stores (quarter)

3,189,134 (2026-Q4, current quarter)

220,112 (2022-Q3)

163,714 (2022-Q4)

4,776,386 (2024-Q2)

Store Leads

Origins detected, mobile (2026-09)

452,270

49,565

32,588

553,677

HTTP Archive Tech Report

Origins detected, desktop (2026-09)

317,646

36,449

27,544

337,099

HTTP Archive Tech Report

Share of e-commerce sites, mobile (2025)

25.3%

3.7%

2.2%

44.4%

Web Almanac 2025

Share of e-commerce sites, desktop (2025)

21.5%

3.2%

2.1%

35.4%

Web Almanac 2025

W3Techs labels Magento as Adobe Commerce, and counts WooCommerce inside WordPress (WordPress alone is on 39.6% of all websites), so the WooCommerce figure is the share of sites that use WooCommerce as detected by W3Techs. The Store Leads quarter 2026-Q4 is partial, because it covers the days of the quarter that have passed; Store Leads detects live stores and publishes no official count.

Market share

Bar chart of the W3Techs share of all websites, of websites with a known content management system and of e-commerce systems for Shopify, PrestaShop, Magento and WooCommerce

Figure 1: W3Techs share on 2026-10-27, as a share of all websites, of websites with a known content management system and of e-commerce systems. Source: W3Techs. The three bases differ, so compare bars within one group only.

Line chart of the yearly W3Techs share of all websites using Shopify and WordPress from 2015 to 2026

Figure 2: yearly W3Techs share of all websites for Shopify and for WordPress, the platform under WooCommerce, from 2015 to 2026-10-27. Source: W3Techs. W3Techs publishes yearly history only for systems above 1% of all websites, so PrestaShop and Magento have no series (n/a). Shopify grew from 0.3% in 2015 to 5.3% in 2026; WordPress peaked at 43.6% in 2025-01 and stands at 39.6% on 2026-10-27, and its share also covers sites that have no store.

Live stores and detected origins

Bar chart of live stores detected by Store Leads in 2026-Q4 to date for Shopify, PrestaShop, Magento and WooCommerce

Figure 3: live stores in the current quarter to date (2026-Q4). Source: Store Leads. WooCommerce has about 4.3 million live stores, Shopify about 3.2 million, PrestaShop about 145,000 and Magento about 102,000.

Line chart of live stores per quarter detected by Store Leads for the four platforms from 2019-Q1 to 2026-Q4

Figure 4: live stores per quarter, 2019-Q1 to 2026-Q4 to date. Source: Store Leads. The Shopify series starts in 2019-Q1 (753,977 stores), Magento in 2019-Q3 and PrestaShop and WooCommerce in 2020-Q1. Since the peaks, PrestaShop has lost about 34% of its detected stores (220,112 to 144,665), Magento about 38% (163,714 to 102,287) and WooCommerce about 9.5% (4,776,386 to 4,321,090), while Shopify has kept growing.

Line chart of origins detected on mobile in the HTTP Archive crawl for the four platforms, monthly from 2020-01 to 2026-09

Figure 5: origins detected as using each platform on mobile, monthly from 2020-01 to 2026-09. Source: HTTP Archive Tech Report. On mobile Shopify grew from 60,749 to 452,270 origins, WooCommerce from 144,155 to 553,677 and PrestaShop from 34,514 to 49,565, while Magento fell from 44,880 to 32,588.

Line chart of origins detected on desktop in the HTTP Archive crawl for the four platforms, monthly from 2020-01 to 2026-09

Figure 6: the same series on desktop. Source: HTTP Archive Tech Report. On desktop the 2026-09 values are 317,646 (Shopify), 36,449 (PrestaShop), 27,544 (Magento) and 337,099 (WooCommerce). The HTTP Archive crawls the origins in the Chrome UX Report, so it undercounts small stores that Chrome users rarely visit.

Developer activity and downloads

Repository (2026-10-27) Stars Forks Contributors (including anonymous) Role

magento/magento2

12,212

9,358

3,202

Magento Open Source

woocommerce/woocommerce

10,570

10,660

2,149

WooCommerce

PrestaShop/PrestaShop

9,237

5,049

1,351

PrestaShop core

Shopify/dawn

3,104

4,499

107

Shopify reference theme

Shopify/hydrogen

2,159

452

146

Shopify headless toolkit

Shopify/cli

764

297

353

Shopify CLI

mage-os/mageos-magento2

321

91

3,204 (history inherited from Magento)

Mage-OS (context)

Source: GitHub REST API

Shopify’s platform is closed, so its repositories hold only the tooling and the reference theme, and a star count for them says nothing about the size of the platform. Contributors are counted with the anon=1 option of the GitHub API, which includes anonymous and unlinked authors; without it the API returns about a seventh of these numbers.

Bar chart of GitHub stars of the main repositories of Magento, WooCommerce, PrestaShop and the Shopify CLI, Hydrogen and Dawn

Figure 7: GitHub stars on 2026-10-27. Source: GitHub REST API. Stars measure attention, not production use.

Bar chart of GitHub contributors of the main repositories of Magento, WooCommerce, PrestaShop and the Shopify CLI, Hydrogen and Dawn

Figure 8: GitHub contributors including anonymous authors on 2026-10-27. Source: GitHub REST API.

Line chart of yearly npm downloads of the Shopify CLI and Hydrogen packages and of the WooCommerce components, data and settings packages from 2020 to 2026

Figure 9: npm downloads per year of @shopify/cli and @shopify/hydrogen and of the @woocommerce/components, @woocommerce/data and @woocommerce/settings packages, 2020 to 2026 year to date (up to 2026-10-26). Source: npm downloads API. PrestaShop and Magento are distributed with Composer, so they have no npm count (n/a). The counts include continuous integration and mirror traffic, and the packages are not the same kind of thing (a command-line tool against libraries for WooCommerce admin pages), so the lines show trends, not a comparison. @shopify/cli grew from 303,839 downloads in 2022 to 8,288,916 in 2025 and 15,661,749 in 2026 to date.

Line chart of weekly downloads of the WooCommerce plugin from WordPress.org for the last 180 days

Figure 10: weekly downloads of the WooCommerce plugin from WordPress.org for the complete weeks of the last 180 days, from early May to late October 2026. Source: WordPress.org plugins API (the API returns no longer window). Weekly counts range from 338,996 to 2,933,941 with sharp spikes, which are probably automated updates and not new stores. WordPress.org reports active installs only as a rounded band: 7,000,000+ sites, a rating of 90 out of 100 from 4,832 ratings (self-selected reviews) and 10,039 plugins tagged woocommerce on 2026-10-27.

Community questions

Line chart of Stack Overflow questions per year for the shopify, prestashop, magento plus magento2 and woocommerce tags from 2014 to 2025

Figure 11: Stack Overflow questions per year for the tags shopify, prestashop, magento plus magento2 (summed, a question with both tags counts twice) and woocommerce, 2014 to 2025. Source: Stack Exchange API. Every tag falls steeply after 2023 (the woocommerce tag from 1,665 questions in 2023 to 216 in 2025), because the whole site declined, so the decline says nothing about a particular platform.

Line chart of questions per year on magento.stackexchange.com and on wordpress.stackexchange.com tagged woocommerce, with all wordpress.stackexchange.com questions as context

Figure 12: questions per year on magento.stackexchange.com (all questions), on wordpress.stackexchange.com tagged woocommerce and on wordpress.stackexchange.com overall as context, 2014 to 2025. Source: Stack Exchange API. The Magento site peaked at 17,969 questions in 2016 and received 408 in 2025.

Total questions with each tag on 2026-10-27: shopify 8,766 and liquid 4,018 (Shopify); prestashop 5,807; magento 37,173 and magento2 4,962 (plus 113,253 questions on magento.stackexchange.com); woocommerce 32,810 and woocommerce-rest-api 941. Source: Stack Exchange API. Shopify’s developers also use the Shopify Community forums and Discord, and WordPress developers use the WordPress.org support forums, which this count does not include.

Reading the popularity data. WooCommerce leads every count of stores (4,321,090 live stores, 47.4% of e-commerce systems on W3Techs and 44.4% of e-commerce sites on mobile in the Web Almanac), Shopify is second and still growing, and PrestaShop and Magento are an order of magnitude smaller and shrinking. Magento has the largest developer community by cumulative questions (by far when its dedicated Stack Exchange site is counted) and contributors, a legacy of its peak years. None of these numbers measures revenue: the sources used here support no statement about sales volume or about the quality of the stores counted.

Performance

Performance here means field data: how real visitors experienced the origins (sites) that the HTTP Archive detected as running each platform, taken from the Chrome UX Report and from Lighthouse runs on the HTTP Archive crawl. It is not a controlled benchmark. An origin passes the Core Web Vitals when its 75th percentile values are good for Largest Contentful Paint (LCP), Interaction to Next Paint (INP) and Cumulative Layout Shift (CLS). The numbers describe the whole population of stores built on a platform, including their themes, apps, plugins, hosting and content, so they say how stores on a platform tend to perform, not how fast the platform could be if tuned. The pass rate is the number of origins with good results divided by the number of origins with enough traffic data to be tested.

Metric (HTTP Archive Tech Report) Shopify PrestaShop Magento WooCommerce

Core Web Vitals pass rate, mobile, 2026-09

76.25%

61.45%

44.57%

39.32%

Core Web Vitals pass rate, desktop, 2026-09

79.50%

62.27%

45.59%

39.26%

Core Web Vitals pass rate, mobile, 2020-01

16.97%

18.94%

11.63%

8.73%

Core Web Vitals pass rate, desktop, 2020-01

26.01%

32.59%

20.73%

12.74%

Good LCP, mobile, 2026-09

87.67%

73.62%

58.05%

43.46%

Good INP, mobile, 2026-09

86.67%

90.39%

84.38%

91.39%

Good CLS, mobile, 2026-09

92.37%

85.81%

70.89%

88.67%

Median Lighthouse performance score, mobile, 2026-09 (0 to 1)

0.475

0.345

0.35

0.37

Median Lighthouse performance score, desktop, 2026-09 (0 to 1)

0.545

0.515

0.55

0.565

Core Web Vitals over time

Line chart of the share of origins passing all Core Web Vitals on mobile for the four platforms, monthly from 2020-01 to 2026-09

Figure 13: share of origins passing all Core Web Vitals on mobile, monthly from 2020-01 to 2026-09. Source: HTTP Archive Tech Report. The vertical marker is the replacement of FID by INP on 2024-03-12. Every platform improved: Shopify from 16.97% to 76.25%, PrestaShop from 18.94% to 61.45%, Magento from 11.63% to 44.57% and WooCommerce from 8.73% to 39.32%.

Line chart of the share of origins passing all Core Web Vitals on desktop for the four platforms, monthly from 2020-01 to 2026-09

Figure 14: the same series on desktop. Source: HTTP Archive Tech Report. Desktop pass rates are close to mobile in 2026-09 (Shopify 79.50%, PrestaShop 62.27%, Magento 45.59%, WooCommerce 39.26%), although they were far higher than mobile in 2020 (Shopify 26.01% against 16.97%).

The INP break. On 2024-03-12 INP replaced FID as the responsiveness metric of the Core Web Vitals. The effect on the series is small but not uniform: between 2024-02 and 2024-03 the mobile pass rate moved from 68.11% to 65.38% for Shopify, from 43.92% to 41.76% for PrestaShop and from 24.79% to 23.28% for Magento, but rose from 26.10% to 26.47% for WooCommerce. A change of definition therefore does not shift all platforms the same way, and changes of a point or two around the marker should not be read as a real change in performance. Nowadays INP is rarely the limiting metric: in 2026-09 between 84.38% and 91.39% of mobile origins have a good INP on every platform, so the pass rate is decided mostly by LCP, where Shopify (87.67% good) leads WooCommerce (43.46%) by more than 44 points.

Survivor bias. The PrestaShop and Magento populations are shrinking (see Live stores and detected origins). If the stores that left were disproportionately the slow and unmaintained ones, the remaining origins look better than the average store of earlier years. The data cannot rule this out, so the rise of the PrestaShop and Magento lines may overstate the improvement of a typical store. The WooCommerce population grew, and its figures include every WordPress theme, page builder and plugin combination.

Current pass rate and Lighthouse

Bar chart of the share of origins passing all Core Web Vitals in 2026-09 on mobile and desktop for the four platforms

Figure 15: share of origins passing all Core Web Vitals in 2026-09, mobile and desktop. Source: HTTP Archive Tech Report.

Bar chart of the median Lighthouse performance score of origins detected for each platform in 2026-09, mobile and desktop

Figure 16: median Lighthouse performance score (0 to 100) of the origins detected for each platform in 2026-09, mobile and desktop. Source: HTTP Archive Tech Report. Lighthouse is a lab test on a throttled device and a simulated network, and it measures the home page only, so it can disagree with field data: on desktop WooCommerce has the highest median (56.5) although its Core Web Vitals pass rate is the lowest. On mobile the scores are 47.5 (Shopify), 34.5 (PrestaShop), 35 (Magento) and 37 (WooCommerce); the table above gives the same medians on the 0 to 1 scale.

The HTTP Archive also reports the other Lighthouse categories. Medians for 2026-09 on mobile are accessibility 0.91 (Shopify), 0.815 (PrestaShop), 0.82 (Magento) and 0.875 (WooCommerce); best practices 0.73, 0.77, 0.73 and 0.77; and SEO 0.92, 0.885, 0.92 and 0.92 in the same order.

Web Almanac 2025 vitals

The Web Almanac 2025 e-commerce chapter publishes its own cut of the same data, by metric and device. The tables were transcribed from its Figures 13.4 to 13.13 (the first table of each pair is desktop and the second is mobile), and the numbers are percentages of origins with a good result, rounded to whole numbers.

Mobile origins with a good result (Web Almanac 2025) Shopify PrestaShop Magento WooCommerce

LCP

86%

65%

52%

39%

INP

90%

89%

87%

88%

CLS

92%

81%

64%

85%

All three Core Web Vitals

76%

50%

35%

35%

Origins tested

567,932

87,486

50,983

995,782

Median Lighthouse performance (0 to 100)

55

36

34

38

Desktop origins with a good result (Web Almanac 2025) Shopify PrestaShop Magento WooCommerce

LCP

92%

74%

59%

45%

INP

99%

99%

99%

99%

CLS

82%

72%

55%

68%

All three Core Web Vitals

76%

54%

36%

33%

Origins tested

289,885

45,256

36,988

394,462

Median Lighthouse performance (0 to 100)

71

59

60

61

Grouped bar chart of the share of mobile origins with a good LCP, INP, CLS and all three together for the four platforms in the Web Almanac 2025

Figure 17: share of mobile origins with a good LCP, INP, CLS and all three together, per platform. Source: Web Almanac 2025, e-commerce chapter (HTTP Archive data of 2025).

Grouped bar chart of the share of desktop origins with a good LCP, INP, CLS and all three together for the four platforms in the Web Almanac 2025

Figure 18: the same on desktop. Source: Web Almanac 2025, e-commerce chapter. INP is good for 99% of desktop origins on all four platforms, so desktop differences come from LCP and CLS.

Reading the performance data. Stores on Shopify pass the Core Web Vitals about 1.7 to 1.9 times as often as stores on Magento or WooCommerce, and the gap is mainly in LCP, the loading of the largest element. Shopify controls the infrastructure, the CDN and the base theme code of every store, which narrows the spread between stores. On the self-hosted platforms the spread is wide: a store with good hosting, caching and an optimised theme can pass easily, and the median store does not. The data does not say that Shopify is necessarily faster for a given store, nor that the open-source platforms cannot be fast; see Shopify theme performance, PrestaShop performance and caching, Magento caching, indexing and performance and WooCommerce performance and security for the levers each platform offers.

Security

Security data is the hardest to compare, so this section reports what is counted, says what each count can and cannot show, and explains why the totals for the platforms are not comparable. Three kinds of evidence are used: CVE records in the National Vulnerability Database (NVD), security advisories published by the vendors and the community, and notable incidents with their CVSS v3.1 base score and their status in the CISA Known Exploited Vulnerabilities (KEV) catalogue.

CVEs per year

A CVE (Common Vulnerabilities and Exposures) record identifies one publicly disclosed vulnerability. The NVD lists each by publication year. Two kinds of series are shown for every platform. The core series counts CVEs filed against the platform’s own product (a CPE, the standard product identifier, for PrestaShop, for Magento Open Source and Adobe Commerce, and for the WooCommerce plugin). The ecosystem series counts CVEs that mention the platform, found by keyword search in the NVD, which brings in third-party modules, extensions and plugins, plus, for WooCommerce, the CVEs filed against the products of the WooCommerce vendor. For Shopify the series is the CVEs of the vendor shopify in the NVD, which belong to its open-source libraries and command-line tools; the Shopify platform itself has no core series (n/a).

CVEs published in the year (NVD) PrestaShop core Magento (Open Source and Adobe Commerce) WooCommerce plugin core Shopify (vendor libraries)

2020

32

39

2

1

2021

6

48

2

0

2022

4

12

1

1

2023

14

32

1

0

2024

7

63

4

0

2025

3

45

1

0

2026 to date

3

64

0

19

CVEs published in the year (NVD keyword search) PrestaShop Magento WooCommerce WooCommerce vendor products Shopify

2020

42

46

7

5

0

2021

11

57

26

4

0

2022

8

3

87

2

2

2023

111

9

271

33

0

2024

61

2

650

13

1

2025

10

4

709

1

5

2026 to date

17

15

893

0

21

Source: NVD CVE API 2.0, queried by CPE prefix and by keyword and counted by publication year, fetched on 2026-10-27

The Magento core series is the union of the product identifiers magento:magento, adobe:commerce and adobe:magento_open_source, de-duplicated. The 2026 WooCommerce core value of 0 is probably a delay: the NVD had not yet listed a WooCommerce core CVE for 2026 on the fetch date although WooCommerce 11.2.0 was a security release. The 2019 Magento value (137) is a batch of records for Magento 2.x. The 2026 Shopify spike (19) comes from its open-source libraries and CLI, and not from the platform.

Line chart of CVEs published per year in the NVD for the core of PrestaShop, Magento Open Source plus Adobe Commerce and the WooCommerce plugin

Figure 19: CVEs per year for the core of each self-hosted platform. Source: NVD CVE API 2.0. Magento has the highest core counts in most years (64 in 2026 to date); PrestaShop peaked at 32 in 2020; the WooCommerce plugin has at most four a year.

Line chart of CVEs published per year in the NVD that mention each platform, found by keyword search, and the open-source libraries of Shopify

Figure 20: CVEs per year that mention each platform, found by keyword search (modules, extensions and plugins), and the open-source libraries of Shopify (vendor CPE). Source: NVD CVE API 2.0. The WooCommerce keyword series climbs from 87 in 2022 to 893 in 2026 to date.

Why WooCommerce’s keyword series climbs. The WooCommerce core product has at most four CVEs a year, yet the keyword search grows from 87 in 2022 to 893 in 2026 to date. The growth reflects WordPress CVE Numbering Authorities (CNAs) such as Patchstack, Wordfence and WPScan filing CVEs in bulk for plugins that mention WooCommerce, so it measures the number of plugins whose vulnerabilities are being disclosed more than a decline of WooCommerce itself.

Security advisories

Advisories published in the year PrestaShop core (GitHub repository advisories) PrestaShop modules (Friends-of-Presta posts) Magento (GitHub global advisories, magento/community-edition) Adobe Commerce bulletins (APSB) Source of the last two

2020

26

2

0

5

GitHub, Adobe

2021

4

3

0

4

GitHub, Adobe

2022

3

6

217

4

GitHub, Adobe

2023

13

141

32

4

GitHub, Adobe

2024

5

71

62

6

GitHub, Adobe

2025

1

5

45

6

GitHub, Adobe

2026 to date

9

2

0 (not listed yet)

7

GitHub, Adobe

Source: PrestaShop repository security advisories, Friends-of-Presta security advisories, GitHub global advisory database and the Adobe security bulletins for Adobe Commerce (the Adobe site returned HTTP 403 to automated clients, so the yearly counts are unverified; APSB26-153 was read on the Adobe Trust Center)

The GitHub value of 217 for Magento in 2022 is a backfill date: the advisory database added old records in that year, so it is not a spike in vulnerabilities. The 2026 value of 0 contradicts the seven bulletins of the same year, which probably means that the global database had not yet received the 2026 Magento records on the fetch date. Friends-of-Presta is a community group, and most of its advisories (141 in 2023) concern third-party modules, not the core. Adobe’s seven bulletins of 2026 include APSB26-146, an out-of-band hotfix of 2026-09-07 for CVE-2026-75650 that was exploited in the wild.

Line chart of security advisories per year for PrestaShop core, PrestaShop modules and Adobe Commerce security bulletins

Figure 21: security advisories per year: PrestaShop core (GitHub repository advisories), PrestaShop modules (Friends-of-Presta posts, 141 in 2023) and Adobe Commerce security bulletins (APSB, between four and seven a year). Source: GitHub, Friends-of-Presta, Adobe.

Notable incidents

The table lists incidents with a documented CVE and the CVSS v3.1 base score from the NVD, and the status in the CISA KEV catalogue, which lists vulnerabilities known to be exploited. The CISA catalogue lists six Adobe Commerce and Magento entries on 2026-10-27; the table shows the four that have an incident row here.

Platform and incident CVE CVSS v3.1 Published CISA KEV (date added) Summary

Magento: checkout input validation

CVE-2022-24086

9.8

2022-02-16

yes (2022-02-15)

Unauthenticated remote code execution, patched out of band (APSB22-12)

Magento: CosmicSting

CVE-2024-34102

9.8

2024-06-13

yes (2024-07-17)

Unauthenticated XML external entity injection chained to read secrets and gain code execution (APSB24-40)

Magento: SessionReaper

CVE-2025-54236

9.1

2025-09-09

yes (2025-10-24)

Improper input validation in the REST API allowing session takeover and, in some set-ups, code execution (APSB25-88)

Magento: template injection

CVE-2026-75650

10

2026-09-07

yes (2026-09-08)

Unauthenticated code execution exploited in the wild (APSB26-146)

Magento: Magecart skimming

n/a

n/a

2015 onwards

n/a

Groups inject JavaScript skimmers into checkout pages, often through vulnerable or compromised extensions; not a single vulnerability

PrestaShop: SQL injection chain

CVE-2022-31181

9.8

2022-08-01

no

Unauthenticated SQL injection in 1.6.0.10 to 1.7.8.6 that can lead to code execution; fixed in 1.7.8.7

PrestaShop: faceted search module

CVE-2026-54159

10

2026-07-17

no

Critical vulnerability in the bundled ps_facetedsearch module (3.0.0 to 4.0.4); a module, not the core

WooCommerce: WooCommerce Payments

CVE-2023-28121

9.8

2023-04-12

no

Authentication bypass that lets an unauthenticated attacker impersonate an administrator through a request header in WooCommerce Payments 5.6.1 and lower; attacked actively in 2023

WooCommerce: July 2021 forced update

CVE-2021-32789

7.5

2021-07-14

no

SQL injection through the Store API in WooCommerce Blocks 2.5.0 to 2.5.15; WooCommerce pushed an automatic update to affected stores from 2021-07-14

The names CosmicSting and SessionReaper were coined by the security firm Sansec. The WooCommerce Payments case is a plugin vulnerability, and the 2021 case concerned the WooCommerce Blocks package, not the plugin core.

Why self-hosted PHP platforms and plugin-heavy stores have a larger attack surface

Three facts in the data explain why the exposure of PrestaShop, Magento and WooCommerce stores is larger:

  • The merchant is the patch manager. On a self-hosted platform a fix does not protect a store until someone applies it. Adobe publishes monthly isolated builds and out-of-band hotfixes, but the CISA catalogue added CosmicSting five weeks and SessionReaper six weeks after their publication, which shows that exploitation continued after fixes existed. WooCommerce pushed an automatic update to affected stores in July 2021 for the same reason.

  • Third-party code runs with the privileges of the store. Modules, extensions and plugins execute inside the same PHP process, with access to orders and customers. Patchstack’s State of WordPress Security 2026 reports 11,334 new vulnerabilities in the WordPress ecosystem in 2025, of which 91% were in plugins, 9% in themes and 6 in WordPress core. Friends-of-Presta published 141 advisories in 2023, nearly all for modules, and the Magecart campaigns inject skimmers through vulnerable or compromised extensions.

  • The stack is larger. The web server, PHP, the database, the search engine, the cache and the operating system are the merchant’s (or the host’s) responsibility, together with the platform and every extension.

A SaaS platform removes the first and third of these for the merchant, but not the risk of third-party apps (an app with excessive access scopes can still leak data) or of staff accounts. See PrestaShop security, Magento security and WooCommerce performance and security for the measures on each platform.

Why Shopify’s CVE count is not comparable

Shopify has 21 NVD CVEs by vendor identifier (1 in 2020, 1 in 2022 and 19 in 2026 to date), and a total of 29 by keyword search. These records belong to Shopify’s open-source libraries and command-line tools, such as the CLI, and not to the hosted platform. When Shopify fixes a vulnerability in the platform, it deploys the fix on its own servers and the merchants take no action, so the fix does not appear as a CVE: CVEs exist to tell users of installed software what to update. Shopify instead runs a public bug bounty program on HackerOne, as Automattic does for WooCommerce (Automattic on HackerOne). A CVE count of zero or near zero for a SaaS product therefore does not mean it has fewer vulnerabilities; it means that its vulnerabilities do not need to be announced to the customers. The same applies in reverse: a large number of CVEs for a self-hosted platform shows transparent disclosure as much as a large number of vulnerabilities. Counts should be compared only within one deployment model, and even then they measure disclosure effort, not risk.

Reading the security data. The evidence supports three statements. First, a merchant on Shopify delegates platform patching, which removes a whole class of risk. Second, of the incidents tracked here only Magento’s are in the CISA catalogue (four of its six entries are in the table above), so patching it quickly is not optional. Third, PrestaShop and WooCommerce have few core CVEs a year, and their exposure is concentrated in modules and plugins, so what counts is how many third-party extensions a store installs and how it vets them.

Ease of use

Ease of use has no objective public metric. This page does not use user-review ratings: G2 and Capterra could not be opened from the authoring environment (HTTP 403), their ratings would be self-selected reviews, and they are recorded as n/a (unverified) for all four platforms. The ease-of-use scores in the radar charts are editorial and rest on what a new merchant or developer has to do before the first sale:

  • Shopify (9). Hosting, SSL, a custom domain and upgrades are part of every plan; no server or command line is needed to open a store, and the theme editor and apps cover most needs. Source: Shopify pricing.

  • WooCommerce (7). A plugin installed on an existing WordPress site with a setup wizard in the admin, a familiar editor and a large page-builder ecosystem; the merchant still owns hosting, themes and plugin choices. Source: WooCommerce on WordPress.org.

  • PrestaShop (6). A web installer and a back office with guided onboarding, but the merchant must provide PHP and MySQL hosting and choose modules. Source: PrestaShop system requirements.

  • Magento (3). A Composer installation plus a search engine (OpenSearch), a cache store, cron and database tuning; the admin is powerful but large, and the learning curve is the steepest for merchants and developers. Source: Adobe Commerce system requirements.

For developers the learning curve follows the extension model: Shopify asks you to learn Liquid, the GraphQL APIs and the app and Functions model, and gives no access to the server; PrestaShop and Magento ask for PHP and Symfony or the Magento object manager and configuration (the learning path is on the Magento overview); WooCommerce asks for WordPress hooks and PHP, with React for the block-based admin and checkout. The platform sections start at the Shopify, PrestaShop, Magento and WooCommerce overviews, each with a learning path.

Maintenance

Maintenance is the recurring work to keep a store running: applying releases and security patches, upgrading dependencies such as PHP, and migrating when a version leaves support. The release and support policies are official and dated, so this is the best documented of the human-effort metrics. The table summarises the policies and the Gantt chart that follows draws them.

Policy (2026-10-27) Shopify PrestaShop Magento / Adobe Commerce WooCommerce

Who upgrades the platform

Shopify

The merchant, with the Update Assistant or by hand

The merchant, with Composer

The merchant, from the WordPress admin or with Composer

Release cadence

A new API version every three months (2026-01, 2026-04, 2026-07, 2026-10; a release candidate 2027-01)

A major or minor release, at most twice a year (8.0 on 2022-10-26, 8.1 on 2023-06-26, 8.2 on 2024-09-26, 9.0 on 2025-06-10, 9.1 on 2026-03-23, 9.2 on 2026-09-30)

A 2.4.x line each year (2.4.5 on 2022-08-09, 2.4.6 on 2023-03-14, 2.4.7 on 2024-04-09, 2.4.8 on 2025-04-08, 2.4.9 on 2026-05-12)

A minor line about every five weeks, from 8.5 (2024-01-09) to 11.2 (2026-10-07)

Support window

Each stable API version is supported for at least 12 months, and consecutive versions overlap for at least nine months

Each minor is maintained until the next minor ships; 8.2 has extended support (critical bug and security fixes) until 10.0.0; PrestaShop publishes no end-of-life dates, so these windows are inferred (n/a for official end dates)

Standard support is three years from general availability; Adobe Commerce customers get extended support and then security-only fixes (for example 2.4.6: standard until 2026-08-11, extended until 2027-08-31 and security fixes until 2028-05-31)

Security patches are backported to the last 21 major versions when the CVSS score is 9 or higher; older versions may be patched as a courtesy

Security patches between releases

Applied by Shopify

Patch releases and module updates

Monthly security bulletins (seven in 2026 to date) and isolated builds named by month, such as 2.4.9-2026-oct

Patch releases such as 11.2.1 and plugin updates

The WooCommerce repository’s own SECURITY.md says that only the latest version has continued support; the developer documentation page cited above gives the longer backport policy and is the one used here. The month-based names of the Adobe patch builds are described by bulletin APSB26-153 (2026-10-13), and the Experience League version table had not yet been updated for them on the fetch date (unverified).

Timeline of PrestaShop minor releases, Magento 2.4.5 to 2.4.9 support phases and Shopify API versions 2025-01 to 2026-10

Figure 22: release lines and support windows. PrestaShop minor releases 8.0 to 9.2, each maintained until the next minor shipped (inferred, no official dates), with 8.2 in extended support until 10.0.0 and no end date; Magento 2.4.5 to 2.4.9 with three years of standard support and then the extended and security-only phases; Shopify API versions 2025-01 to 2026-10, each supported for at least 12 months. Source: PrestaShop, Adobe and Shopify lifecycle policies.

Timeline of every WooCommerce minor release line from 8.5 in January 2024 to 11.2 in October 2026

Figure 23: every WooCommerce minor release line from 8.5 (2024-01-09) to 11.2 (2026-10-07), about one every five weeks; each line is current until the next one ships. Source: GitHub releases API of woocommerce/woocommerce, fetched on 2026-10-27.

Taken together, the policies show two very different maintenance loads. A Shopify merchant migrates API versions in the apps and custom code that use them, about once a year if the code is kept on the oldest supported version, and takes no action for the platform. A WooCommerce store sees a minor release every five weeks, and its plugins and WordPress add their own releases; the support policy backports only critical security fixes. A Magento store follows a three-year line with monthly bulletins, and moving between lines (2.4.7 to 2.4.9, for example) is a project. PrestaShop ships a new major or minor line about as often as Magento ships a 2.4.x line (six since 2022 against five), but its minor releases are short-lived, so a store is expected to move to the next minor (8.2 is the exception, with extended support until 10.0.0). See PrestaShop versions and support, Magento upgrades, WooCommerce versions, requirements and release cadence and Shopify what is new and deprecation timeline.

Cost and total cost of ownership

The price list is only part of the cost. The fees that can be compared are platform subscription or licence and payment fees. The costs that cannot be charted are the merchant’s own: hosting, themes, extensions or apps, development, maintenance and payment provider fees. For the open-source options these costs vary too much for a reliable figure, so they are n/a here and the charts show a zero licence price, not a zero total cost.

Shopify plan (EUR page, 2026-10-27) Per month, billed monthly Per month, billed yearly Card rate (Shopify Payments, online) Fee with a third-party payment provider

Basic

EUR 32

EUR 24

2.1% plus EUR 0.30

2%

Grow

EUR 92

EUR 69

1.8% plus EUR 0.30

1%

Advanced

EUR 384

EUR 289

1.6% plus EUR 0.30

0.6%

Plus

from EUR 2,100

n/a (no yearly price shown)

1.3% plus EUR 0.30

0.2%

Source: Shopify pricing and Shopify Plus pricing, rendered in euro on 2026-10-27; the prices exclude taxes, apps, themes and the domain. The trial is three days free and then EUR 1 a month for three months (promotional).

The dollar prices are unverified: the US page could not be fetched, and values from third-party summaries (tech.co and ecommerce-platforms.com) are USD 39 (Basic), USD 105 (Grow), USD 399 (Advanced) and from USD 2,300 (Plus) a month billed monthly, and USD 29, USD 79 and USD 299 billed yearly for the first three. Re-check them on a US-locale browser before relying on them.

Open-source and licensed options Licence price per month What the merchant pays on top

PrestaShop

EUR 0 (free software)

Hosting, paid modules from Addons and development; n/a (no reliable figure)

Magento Open Source

EUR 0 (free software)

Heavy hosting and specialist development, extensions; n/a

Adobe Commerce

n/a (quote-based licence, unverified)

Everything above plus the licence

WooCommerce

EUR 0 (free plugin)

Hosting, theme, paid extensions and development; payment fees of WooPayments are 2.9% plus USD 0.30 for US cards (plus 1.5% for international cards, plus 1% for currency conversion and a USD 15 dispute fee), and 1.5% plus EUR 0.25 for European cards (Austria as the example), with no monthly fee for online payments

Bar chart of the platform subscription or licence price per month in euro for Shopify plans, PrestaShop, Magento Open Source, Adobe Commerce and WooCommerce

Figure 24: platform subscription or licence price per month, billed monthly, in euro: Shopify Basic 32, Grow 92, Advanced 384 and Plus from 2,100; PrestaShop, Magento Open Source and WooCommerce are free software (0) but need hosting, extensions and development; Adobe Commerce is quote-based (n/a). Source: official pricing pages.

Bar chart of the percentage part of the online card rate for Shopify Payments plans and WooPayments

Figure 25: percentage part of the online card rate per transaction (a fixed fee of 0.30 is added): Shopify Payments 2.1% on Basic down to 1.3% on Plus; WooPayments 2.9% for US cards and 1.5% for European cards (with a fixed 0.25). Source: Shopify pricing and WooPayments fees. Rates are country specific, and other payment providers charge their own fees.

Reading the cost data. Shopify’s cost is visible and predictable: a store that sells EUR 20,000 a month with Shopify Payments on the Grow plan pays EUR 92 for the subscription plus the card rate, and nothing for hosting. For the open-source platforms the licence is free and the cost is distributed over hosting, developers and extensions, which is cheap for a small catalogue on shared hosting and expensive for a Magento store that needs a cluster and specialists. The page therefore scores Shopify 5 on low cost (a subscription plus fees, with hosting included), PrestaShop and WooCommerce 8 (no licence, moderate infrastructure), and Magento 3 (heavy infrastructure, quote-based licence on Adobe Commerce); the reasoning is in the rubric.

Tools, functionality and other characteristics

Tools and functionality. The scores are editorial and their basis is in data/radar-scores.csv: Magento 9 (the most complete core: multiple sources and stores, B2B on Adobe Commerce, GraphQL and REST), Shopify 8 (built-in checkout, point of sale, Markets, B2B, Flow automation, Functions and an app store with about 32,000 apps; advanced checkout control is Plus-only), WooCommerce 7 (the core covers catalog, orders and the blocks checkout, and most advanced features come from the 10,039 plugins tagged woocommerce and from WordPress itself) and PrestaShop 6 (catalog, multistore and, from 9.2, a one-page checkout and improved B2B behind flags, with breadth beyond the core from paid Addons modules).

Scalability. Shopify 9 (managed infrastructure that scales with traffic, with API rate limits and plan caps as the limits), Magento 8 (designed for large catalogs and traffic with indexers, message queues and cloud editions, at the cost of infrastructure and tuning), WooCommerce 6 (scales with WordPress hosting and caching; high order volumes need HPOS, the custom order tables, and careful plugin selection) and PrestaShop 5 (scales by sizing hosting and caching yourself; the platform targets small and mid-size catalogs and has the lowest median mobile Lighthouse score, 0.345).

Production deployment complexity. Shopify has none: the vendor runs the infrastructure. The three self-hosted platforms can all run as stateless containers on several Kubernetes nodes with a managed database, but the amount of state to move out of the server differs. WooCommerce inherits WordPress: uploads, the object cache, cron and the session table (WooCommerce: Cloud Deployment Overview). PrestaShop core has no S3 media option and no TLS setting for its database client, so images stay on shared storage and an encrypted database connection needs a workaround (PrestaShop: Cloud Reference Architecture). Magento needs the most: managed OpenSearch, Valkey and RabbitMQ in addition to the database, Varnish with purge fan-out, and separate consumers, cron and indexers (Magento: Cloud Reference Architecture). The WordPress-side design that the WooCommerce store builds on is in WordPress: Cloud Reference Architecture.

Customisation flexibility. WooCommerce and Magento 9 (open code with actions, filters and block extensibility, or with dependency injection, plugins, preferences, observers and layout XML), PrestaShop 8 (open PHP and Symfony code, hooks, overrides and services) and Shopify 6 (Liquid, theme blocks, apps and Functions allow wide changes, but server code, the checkout and the data model are constrained).

Vendor lock-in and data portability. Shopify is proprietary: the themes use Liquid, the apps use Shopify’s APIs and the data lives on Shopify’s servers, so leaving means exporting data and rebuilding the theme and the integrations. The open-source platforms keep the code and the database under the merchant’s control and can move between hosts, at the price of operating them. No numeric lock-in metric exists, so it does not appear in the radar charts.

Headless readiness. Shopify 9 (Storefront API, Customer Account API, Hydrogen and Oxygen: a documented first-class path), Magento 8 (GraphQL and REST APIs, PWA Studio and the headless Adobe Commerce storefront, with heavy integration work), WooCommerce 7 (REST API v3 and the Store API; GraphQL needs a community plugin) and PrestaShop 5 (data APIs only, with no official storefront framework or storefront API).

Internationalisation and B2B. Shopify Markets, the PrestaShop multistore with CLDR locales, Magento store views and WooCommerce through WordPress language packs and a multilingual plugin all support several languages and currencies, with different depth (see the feature matrix). B2B is built into Shopify on all plans with limits, into Adobe Commerce as an extension, behind a flag in PrestaShop 9.2, and only through plugins in WooCommerce.

Developer job demand. Not reported: no trusted public source with a comparable method was found.

Scores on ten axes

The radar charts condense the comparison into ten axes scored from 0 to 10, higher being better. Two axes are computed from the data of this page and eight are editorial scores whose basis and source are recorded next to each value in data/radar-scores.csv. The scores summarise the evidence on the page; they are not a benchmark, they are not weighted or summed into a total, and moving a score by one point is within the uncertainty of the method.

Axis Kind How it is scored

Ease of use

editorial

9-10 hosted with no infrastructure work; 7-8 simple install on common hosting; 5-6 installer plus own hosting and module choices; 3-4 specialist infrastructure and long learning curve; 0-2 expert-only

Low maintenance effort (inverted: 10 is the least effort)

editorial

9-10 the vendor patches and upgrades the platform; 7-8 occasional merchant action; 5-6 the merchant applies minor releases and module updates; 3-4 frequent security bulletins and heavy upgrades; 0-2 continuous dedicated effort

Performance

computed

The mean of the mobile and desktop Core Web Vitals pass rate divided by 10 and the mobile and desktop median Lighthouse performance score times 10, for the latest HTTP Archive month (2026-09)

Tools and functionality

editorial

Built-in features, APIs, developer tooling and marketplace breadth: 9-10 broad core plus enterprise features; 7-8 broad core or a very large app ecosystem; 5-6 solid catalog and checkout with extras from paid modules; below 5 limited

Security posture

editorial

Who patches, vendor response, exploited vulnerabilities (CISA KEV) and the attack surface of third-party code: 8-10 centrally patched SaaS; 5-7 predictable patches but exploited or module-heavy; 3-4 a very large third-party plugin attack surface

Low cost

editorial

10 is the lowest total cost of entry: 8-9 free software with moderate infrastructure; 5-6 subscription plus fees; 3-4 heavy infrastructure or a quote-based licence; 1-2 enterprise pricing

Customisation flexibility

editorial

How much of the stack can be changed: 9-10 open code with deep extension points; 7-8 open code; 5-6 constrained by the platform (checkout, data model)

Scalability

editorial

9-10 managed elastic infrastructure; 7-8 designed for large catalogs but needing tuning; 5-6 dependent on self-chosen hosting and caching

Ecosystem

computed

The mean of three log-scaled measures: live stores (10,000 scores 0 and 10,000,000 scores 10), Stack Overflow questions of the platform’s tags (1,000 scores 0 and 1,000,000 scores 10; dedicated Stack Exchange sites such as magento.stackexchange.com are not counted, because not every platform has one) and GitHub stars of the main repositories (100 scores 0 and 100,000 scores 10)

Headless readiness

editorial

9-10 a documented storefront API and framework; 7-8 full APIs without an official storefront framework; 5-6 data APIs only

The resulting scores, with the two computed axes rounded to one decimal:

Axis Shopify PrestaShop Magento WooCommerce

Ease of use

9

6

3

7

Low maintenance effort

9

5

3

4

Performance (computed)

6.4

5.2

4.5

4.3

Tools and functionality

8

6

9

7

Security posture

8

5

5

4

Low cost

5

8

3

8

Customisation flexibility

6

8

9

9

Scalability

9

5

8

6

Ecosystem (computed)

6

4.3

5.3

6.9

Headless readiness

9

5

8

7

Source: scripts/ecommerce-comparison-charts/data/radar-scores.csv and scores.mjs, computed from the metrics of this page on 2026-10-27; the basis of each editorial score is written beside it in the CSV file.

Radar chart of scores on ten axes for Shopify, PrestaShop, Magento and WooCommerce

Figure 26: the four platforms on ten axes. The scores are editorial except Performance and Ecosystem, which were computed from the metrics of 2026-10-27 (sources as in the figures above, rubric in data/NOTES.md).

Radar chart of Shopify scores

Figure 27: Shopify. Ease of use, maintenance, scalability and headless readiness are the strengths; cost and customisation flexibility are the lowest scores.

Radar chart of PrestaShop scores

Figure 28: PrestaShop. Low cost and customisation flexibility lead; the ecosystem is the smallest of the four.

Radar chart of Magento and Adobe Commerce scores

Figure 29: Magento and Adobe Commerce. The profile is the most lopsided: the top scores are tools and functionality and customisation flexibility; ease of use, maintenance and cost are the lowest.

Radar chart of WooCommerce scores

Figure 30: WooCommerce. The largest ecosystem, low cost and deep customisation, against the weakest security posture and performance scores.

Decision flowchart

The flowchart follows the recommendations below. Start from who will operate the store.

flowchart TD A["Who will operate the store?"] --> B{"Do you want the vendor to host, patch and upgrade the platform?"} B -- yes --> C{"Do you need full control of the checkout or of server code?"} C -- no --> SHO["Shopify"] C -- yes --> D{"Is the budget for the Plus plan or for self-hosting a platform?"} D -- "Plus plan" --> SHO D -- "self-hosting" --> E B -- no --> E{"Is the store part of an existing WordPress site, or content-led?"} E -- yes --> WOO["WooCommerce"] E -- no --> F{"Large catalog, several sources, B2B and a team of specialists?"} F -- yes --> MAG["Magento Open Source or Adobe Commerce"] F -- no --> G{"Do you want an open-source store with multistore in core and modest hosting?"} G -- yes --> PRE["PrestaShop"] G -- no --> H["Re-check the use cases below: headless, B2B, data residency"]

Figure 31: decision flowchart for choosing a platform. It is a starting point; check the metrics and caveats above before deciding.

Recommendations by purpose

The data snapshot date for every figure below is 2026-10-27. The recommendations are justified only by the data on this page. They name the option the evidence favours first and what to check, and they are not rankings: a team with deep experience of one platform can reasonably choose it against the table.

Use case Fits best Evidence on this page What to check, and where to read more

Small merchant, no technical staff

Shopify; WooCommerce on managed WordPress hosting

Shopify scores 9 on ease of use and maintenance and has the highest Core Web Vitals pass rate (76.25% mobile); Basic costs EUR 32 a month plus 2.1% and EUR 0.30 per card payment. WooCommerce has no licence fee and the largest number of live stores (4,321,090).

Recurring costs of apps and fees on Shopify; who updates WooCommerce and its plugins. See Shopify store setup and WooCommerce store setup.

Fast-growing direct-to-consumer brand

Shopify

Scalability 9 (managed infrastructure), API versions supported for 12 months or more, 32.4% of e-commerce systems on W3Techs and the fastest growth in live stores (3,189,134, up from 753,977 in 2019-Q1). Advanced and Plus add lower card rates (1.6% and 1.3%).

Plan caps and API rate limits; checkout customisation beyond the basics needs Plus. See Plans and Shopify Plus and Shopify Functions.

Full code ownership on a budget

PrestaShop or WooCommerce

Both are free software (EUR 0 licence), customisation flexibility 8 and 9, and neither charges a platform fee. PrestaShop has multistore and multi-currency in core; WooCommerce has the largest plugin ecosystem (10,039 tagged plugins).

Hosting and maintenance are yours: the self-hosted platforms have the heavier maintenance load and, for WooCommerce, the lowest security-posture score (4). See PrestaShop module basics, WooCommerce extension development and the Laravel route in Laravel for a store you build yourself.

Content-led store on an existing WordPress site

WooCommerce

WordPress is on 39.6% of all websites, WooCommerce is the e-commerce plugin with 7.8% of all websites, and ease of use is 7.

Core Web Vitals pass rate is the lowest (39.32% mobile), so budget for hosting, caching and an optimised theme. See WooCommerce performance and security.

Large catalog or B2B enterprise

Magento / Adobe Commerce; Shopify Plus for teams that prefer SaaS

Tools and functionality 9, scalability 8, B2B extension on Adobe Commerce; Shopify supports B2B on all plans (three catalogs) with unlimited catalogs on Plus.

Heavy infrastructure, specialist developers and the security record: six CISA KEV entries and seven Adobe bulletins in 2026 to date. See Magento catalog, multistore and B2B and Shopify B2B.

Headless storefront

Shopify; Magento

Headless readiness 9 (Shopify: Storefront API, Hydrogen, Oxygen) and 8 (Magento: GraphQL, PWA Studio); WooCommerce 7 with the Store API; PrestaShop 5 (data APIs, no storefront framework). Pair a headless storefront with a React framework such as Next.js.

Headless adds a front-end team and its own performance and security work. See Storefront API and Hydrogen, Magento REST and GraphQL APIs and WooCommerce Store API.

Regulated sector or data-residency requirements

A self-hosted platform (PrestaShop, Magento or WooCommerce), or a SaaS contract that satisfies the rules

The self-hosted platforms let the merchant choose the host and the region and audit the code. This page has no dataset on data residency (n/a), so a SaaS option must be checked against the vendor’s contract and certifications.

The merchant owns patching and compliance work on a self-hosted platform. See PrestaShop security and Magento security.

Two points matter in every case. First, the cheapest choice on the price list is often not the cheapest in total, because hosting, development and maintenance fall on the merchant for self-hosted platforms, and fees and apps accumulate on Shopify. Second, the performance and security figures describe populations of stores. A well-run Magento, PrestaShop or WooCommerce store can match the Shopify numbers, and a poorly configured Shopify store with many apps can fall behind them, so these recommendations are starting points that a short proof of concept on the shortlisted platforms should confirm.

The comparison pages for other choices of this site use the same method: the Documentation Tools Comparison and the Cloud Providers Comparison. The section overview and its bibliography are at E-commerce.

References