What 403 HVAC websites run on.

Ludic's scanner read the public homepages of 2,497 trade businesses across 16 Southeast metros in October 2026. 403 of them were HVAC companies. 233 of those, 57.8%, run on WordPress. That's the highest share of the eight trades we looked at.

Here's what that number is, what it isn't, and what it means if one of those 233 sites is yours.

The trades, side by side

The 16 metros: Knoxville, Chattanooga, Nashville, Asheville, Greenville SC, Lexington KY, Atlanta, Charlotte, Raleigh, Birmingham, Huntsville, Louisville, Memphis, Columbia SC, Charleston SC and the Tri-Cities.

Why HVAC tops the list

We can't prove why from a homepage. A reasonable guess: HVAC companies got online early, through the agencies and lead-gen shops that sell to the trades, and most of those built on WordPress because it was cheap to stand up and easy to hand off. The site gets built once, the builder moves on, and the site keeps running on whatever it was built with.

That's not a criticism of WordPress. It runs a huge share of the web for good reasons. It's a description of how these particular sites age: a theme, a page builder, a dozen plugins from a dozen vendors, and nobody whose job it is to keep them current.

What else showed up

Call tracking that goes nowhere. 24% of HVAC sites run call tracking, a deliberate monthly purchase, with no CRM signature on the site and no click ID saved with the contact form. The owner is paying to count calls, and the count stops at the phone.

Booking widgets next to forms that don't feed them. ServiceTitan, Housecall Pro and Jobber buttons sit beside WordPress contact forms that email one person and store nothing. These owners already pay for software every month. The website is the one piece nobody thinks about.

A small surprise: core is usually current

In a 12-site spot check on October 17, every HVAC site we reached was on the current WordPress release. That lines up with what happened in September: a WordPress core bug affecting versions back to 4.7 was patched on September 22, 2026, attackers probed for it within hours, and automatic core updates pushed most sites forward.

So "your WordPress is out of date" is often not the story anymore. The story is the plugins. In 2025, 91% of the 11,334 new WordPress-ecosystem vulnerabilities were in plugins, and 46% were unpatched when they were disclosed. Core updates itself. Plugins wait for someone.

A sample of 12 is a spot check, not a finding. The monthly rescans will tell us how well this holds.

What this means if you own one of the 233

Probably nothing urgent. Most of these sites work. The question is what it costs you to keep them working, and who's doing it:

• Is anyone updating the plugins? Not "is it set to auto-update," but is someone checking that nothing broke after?
• What do the plugins cost a year? A typical paid stack renews at about $635 a year. We wrote that up separately.
• How fast is your contact page on a phone? That's the page your leads land on. Open it on your phone, on cellular, and count.

If the answers are "nobody," "no idea" and "slow," that's what Ludic fixes. We move the site off WordPress, page for page, for $6,000, and nothing about how it looks changes. If the answers are fine, keep what you have.