Each WordPress release celebrates an artist who has made an indelible mark on the world of music. WordPress 6.7, code-named “Rollins,” pays tribute to the legendary jazz saxophonist Sonny Rollins. Known as one of the greatest improvisers and pioneers in jazz, Rollins has influenced generations of musicians with his technical brilliance, innovative spirit, and fearless approach to musical expression.

Sonny Rollins’ work is characterized by its unmatched energy and emotional depth. His compositions, such as “St. Thomas,” “Oleo,” and “Airegin,” are timeless jazz standards, celebrated for their rhythmic complexity and melodic inventiveness. Rollins’ bold and exploratory style resonates with WordPress’ own commitment to empowering creators to push boundaries and explore new possibilities in digital expression.

Embrace the spirit of innovation and spontaneity that defines Rollins’ sound as you dive into the new features and enhancements of WordPress 6.7.

Welcome to WordPress 6.7!

WordPress 6.7 debuts the modern Twenty Twenty-Five theme, offering ultimate design flexibility for any blog at any scale. Control your site typography like never before with new font management features. The new Zoom Out feature lets you design your site with a macro view, stepping back from the details to bring the big picture to life.

Introducing Twenty Twenty-Five

Endless possibility without complexity

Twenty Twenty-Five offers a flexible, design-focused theme that lets you build stunning sites with ease. Tailor your aesthetic with an array of style options, block patterns, and color palettes. Pared down to the essentials, this is a theme that can truly grow with you.

Get the big picture with Zoom Out

Explore your content from a new perspective

Edit and arrange entire sections of your content like never before. A broader view of your site lets you add, edit, shuffle, or remove patterns to your liking. Embrace your inner architect.

Connect blocks and custom fields with no hassle (or code)

A streamlined way to create dynamic content

This feature introduces a new UI for connecting blocks to custom fields, putting control of dynamic content directly in the editor. Link blocks with fields in just a few clicks, enhancing flexibility and efficiency when building. Your clients will love you—as if they didn’t already.

Embrace your inner font nerd

New style section, new possibilities

Create, edit, remove, and apply font size presets with the next addition to the Styles interface. Override theme defaults or create your own custom font size, complete with fluid typography for responsive font scaling. Get into the details!

Performance

WordPress 6.7 delivers important performance updates, including faster pattern loading, optimized previews in the data views component, improved PHP 8+ support and removal of deprecated code, auto sizes for lazy-loaded images, and more efficient tag processing in the HTML API.

Accessibility

65+ accessibility fixes and enhancements focus on foundational aspects of the WordPress experience, from improving user interface components and keyboard navigation in the Editor, to an accessible heading on WordPress login screens and clearer labeling throughout.

And much more

For a comprehensive overview of all the new features and enhancements in WordPress 6.7, please visit the feature-showcase website.

Learn more about WordPress 6.7

Plugin	Install and activate the WordPress Beta Tester plugin on a WordPress install. (Select the “Bleeding edge” channel and “Beta/RC Only” stream).
Direct Download	Download the RC3 version (zip) and install it on a WordPress website.
Command Line	Use the following WP-CLI command: `wp core update --version=6.7-RC3`
WordPress Playground	Use the 6.7 RC3 WordPress Playground instance (available within 35 minutes after the release is ready) to test the software directly in your browser without the need for a separate site or setup.

Plugin	Install and activate the WordPress Beta Tester plugin on a WordPress install. (Select the “Bleeding edge” channel and “Beta/RC Only” stream).
Direct Download	Download the RC2 version (zip) and install it on a WordPress website.
Command Line	Use the following WP-CLI command: `wp core update --version=6.7-RC2`
WordPress Playground	Use the 6.7 RC2 WordPress Playground instance (available within 35 minutes after the release is ready) to test the software directly in your browser without the need for a separate site or setup.

Plugin	Install and activate the WordPress Beta Tester plugin on a WordPress install. (Select the “Bleeding edge” channel and “Beta/RC Only” stream).
Direct Download	Download the RC1 version (zip) and install it on a WordPress website.
Command Line	Use the following WP-CLI command: `wp core update --version=6.7-RC1`
WordPress Playground	Use the 6.7 RC1 WordPress Playground instance (available within 35 minutes after the release is ready) to test the software directly in your browser without the need for a separate site or setup.

Plugin	Install and activate the WordPress Beta Tester plugin on a WordPress install. (Select the “Bleeding edge” channel and “Beta/RC Only” stream).
Direct Download	Download the Beta 3 version (zip) and install it on a WordPress website.
Command Line	Use the following WP-CLI command: `wp core update --version=6.7-beta3`
WordPress Playground	Use the 6.7 Beta 3 WordPress Playground instance to test the software directly in your browser without the need for a separate site or setup.

Learn WordPress is a free resource for new and experienced WordPress users. Learn is stocked with how-to videos on using various features in WordPress, interactive workshops for exploring topics in-depth, and lesson plans for diving deep into specific areas of WordPress.

Read the WordPress 6.7 Release Notes for information on installation, enhancements, fixed issues, release contributors, learning resources, and the list of file changes.

Explore the WordPress 6.7 Field Guide. Learn about the changes in this release with detailed developer notes to help you build with WordPress.

The 6.7 release squad

Every release comes to you from a dedicated team of enthusiastic contributors who help keep things on track and moving smoothly. The team that has led 6.7 is a cross-functional group of contributors who are always ready to champion ideas, remove blockers, and resolve issues.

Thank you, contributors

WordPress 6.7 reflects the tireless efforts and passion of more than 780 contributors in countries all over the world. This release also welcomed over 230 first-time contributors!

Their collaboration delivered more than 340 enhancements and fixes, ensuring a stable release for all—a testament to the power and capability of the WordPress open source community.

More than 40 locales have fully translated WordPress 6.7 into their language making this one of the most translated releases ever on day one. Community translators are working hard to ensure more translations are on their way. Thank you to everyone who helps make WordPress available in 200 languages.

Last but not least, thanks to the volunteers who contribute to the support forums by answering questions from WordPress users worldwide.

Get involved

Participation in WordPress goes far beyond coding, and learning more and getting involved is easy. Discover the teams that come together to Make WordPress and use this interactive tool to help you decide which is right for you.

The ongoing WordPress-WP Engine dispute has escalated with Automattic launching a new website – WP Engine Tracker, to track the number of websites leaving WP Engine hosting.

“An Automattic thingamajig,” this website tracks WP Engine hosting migrations from September 21, 2024, and also provides a downloadable CSV list of websites currently hosted on WP Engine, dubbed “sites ready for a new home.”

Other details on this single-page website include links to promotions offered by other hosting providers for migrating from WP Engine and the number of websites each hosting provider gained via migration. Pressable is the top gainer, followed by Bluehost and SiteGround.

Ironically, the site’s URL is wordpressenginetracker.com as the whole WordPress-WP Engine dispute started with Matt accusing the hosting company of misusing the WordPress trademark. Also Automattic had opposed WP Engine’s lawsuit claiming their allegations regarding lost customers should be viewed with skepticism.

Eric Karkovack of The WP Minute tweeted, “Sort of like Ford tracking everyone who switched from Chevy. Doesn’t matter to me, I’m a Honda guy.” WordPress developer Brian Coords shared this: “This has nice design/dev, but it’s sad to see talent and resources poured into increased negativity in the community, criticism without substance, tearing down instead of building up. Just sad that’s what WordPress is becoming a symbol for.”

Security researcher Daniel Ruf dubbed it “amateurish”. He continued, “I’m not sure what the goal of this website is and what Matt tries to achieve. But the community is getting increasingly annoyed of such unprofessional behavior of Matt and in the security community some also think about dropping 0days for WordPress and related plugins/themes due to this whole situation. The feedback under the tweet from the official WordPress account and in the reddit community shows, what most of us think. The whole situation hurts everyone more than needed.”

Another person commented, “So Automattic has put together a list for spammers and hackers to use to target a bunch of sites who are no longer doing business with Matt Mullenweg’s nemesis. That’s… shortsighted. This will surely result in legal action from one or more of these sites?”

As of November 12, 18,280 websites have left WP Engine according to this website.

Automattician James Koster has announced the launch of a new WordPress Design System library for Figma, the popular tool the design team uses to create mockups and prototypes for WordPress. “The intention of this resource is to streamline the design process for folks working in the WordPress ecosystem,” he explained.

The design library offers a comprehensive range of components, including buttons, forms, icons, and menus, bringing everything you need into one place. It also includes style tokens that allow you to easily manage visual details like radius, elevation, color, and typography. For added convenience, the library provides handy stickers for individual components, and more extensive UI elements like the full-screen editor and site editor.

James also revealed that the “intention is to publish a new version of the library in line with each Gutenberg release, and from 6.8 each major WordPress release too.”

For WordPress Design Team members, the library will be automatically enabled in all new design files within the WordPress.org community Figma organization. Designers working in other Figma organizations can access it by duplicating the file from the community page and publishing it in their own organization.

For those new to Figma, the WordPress Design Team recommends checking out Figma’s “Learn” platform, which offers a comprehensive “Get Started” section to help users become familiar with the tool.

The community has responded positively to the new library. WordPress committer Tammie Lister shared, “It also is a step towards the true design system needed. Figma is a part of the system, but an important piece when updated regularly.”

Courtney Robertson, Open Source Developer Advocate at GoDaddy, tweeted, “#WordPress just stepped up its design game with a brand-new Figma Library as part of its Design System. Designers, it’s time to explore a more seamless workflow!”.

Quincy Jones had such an impact on the culture that it’s impossible to summarize. His discography is amazing. I feel so lucky to have met him in 2012 when I was much earlier in my career, and he didn’t have any reason to give me time, but he treated everyone as if they were important. We talked a lot about his Count Basie and Frank Sinatra days. If you’re unfamiliar with him, the Quincy documentary on Netflix is a good start. His musical fingerprints are everywhere, including the super-catchy theme songs for Sanford and Sons and Austin Powers.

He passed away last week, on November 3^rd. As a tribute, here are ten albums he was involved in from the jazz side that have been big parts of my life. I’ll link to Spotify, but find them wherever you can:

Social media handles are your digital name tags – they help people find and connect with you across every platform. When chosen and used strategically, these identifiers do more than just label your accounts; they make your brand more recognizable and help grow your following.

From major corporations to personal brands, the right social media handle can be the difference between getting lost in the crowd and standing out online. These handles are like a unique fingerprint across platforms, and their presentation on business cards, websites, product packaging, and marketing materials can leave a lasting impression.

While it may sound like a simple thing, there is a strategy to it, and we’re here to show you exactly that. This guide walks you through seven actionable steps to list your social media handles effectively.

From crafting consistent handles to harnessing modern tools like QR codes and integrating your profiles into video content, you’ll discover practical strategies to boost your brand’s following and make your social profiles easily accessible.

Step 1: Choose consistent and memorable social media handles

Being consistent with your social media handles builds recognition and allows your audience to find you across different platforms. Think of your handle as your digital signature – the more consistent it is, the more memorable you become.

Inconsistent handles, on the other hand, could confuse your audience. Imagine a small business called “Green Leaf Gardens,” which has different handles on each platform:

The mix of abbreviations, numbers, and different business names confuses potential customers and dilutes brand recognition. Using @greenleafgardens consistently (or a close variation if the exact handle isn’t available) would create a stronger, more memorable online presence.

$\"💡\"$ Pro tip: Start with the social platforms where your audience spends most of their time. But don’t stop there – grab your handle on emerging platforms, too, even if you’re not ready to use them yet – you might need them in the future.

Use Namechk and KnowEm to ensure handle availability

Before you commit to a handle, take it for a test drive. Free tools like Namechk or KnowEm can show you if your dream handle is available across multiple social media platforms and domains.

If your first-choice handle is taken, don’t panic. Get creative with variations that still keep your brand identity intact. Maybe add your location or an industry keyword. For example, @JohnDoeBakeryNYC tells people who you are, what you do, and where you’re based.

And here’s a crucial step many folks overlook: check for potential trademark issues. The last thing you want is a legal headache down the road. A quick search of your local trademark office can save you a world of trouble.

$\"💡\"$ Pro tip: If you’re unsure about potential trademark conflicts, it’s worth chatting with a legal pro specializing in intellectual property.

Step 2: Optimize handles for each platform’s format

Each social media platform has its own handle requirements that you need to be aware of.

For example, the character limitations are different. Twitter (now X) has a 15-character limit, while Instagram gives you a bit more breathing room with 30 characters. LinkedIn takes a different approach, using URLs like linkedin.com/in/username without the “@” symbol. Sometimes, you might need to tweak your handle slightly to fit a platform’s requirements. That’s okay, but try to keep it as close to your brand name as possible.

Now, let’s talk symbols. On most platforms – Twitter, Instagram, TikTok – your handle starts with an “@” symbol. It’s like a universal “hey, this is a social media handle” sign. However, platforms like LinkedIn and Facebook often skip the “@” and use the full profile URL instead.

Here’s a hot tip: avoid unnecessary symbols or numbers in your handle unless they’re essential to your brand identity. Sure, @JaneDoe_123_NYC might be available, but it’s a mouthful to say out loud and a pain to type. Keep it clean and simple.

Different platforms have different purposes, and your handle should adapt accordingly. LinkedIn, for instance, is all about professional networking. So, your handle there might be more formal than your fun, casual Instagram handle.

Finally, don’t forget to create a custom URL where possible. On LinkedIn or Facebook, you can often set up a custom URL (like linkedin.com/in/YourBrandName) that aligns closely with your handles on other platforms. It’s an easy way to keep your brand consistent across the board.

Step 3: Display social media handles on marketing materials creatively

Your marketing materials are a great opportunity to plug your social media handles and are often the first thing people look for in business cards, brochures, and product packages. Here’s how to make the most of it:

Step 4: Display your social handles in one place with Gravatar

Promoting your social media handles across platforms can complicate things for your target audience, so the best course of action is to use a centralized page where they can find everything.

Gravatar is a free tool that lets you create a dynamic profile and include different types of information for your audience to see, including your verified social media profiles and other important links.

The most important feature of Gravatar is its automatic synchronization – update your profile in one place, and it will reflect across all connected platforms, which includes Slack, OpenAI, WordPress.com, GitHub, and more!

On top of that, Gravatar allows you to verify your accounts, adding a layer of trust and authority. This is especially valuable for online personalities, entrepreneurs, CEOs, artists, and other professionals.

In short, this is the perfect place for you to add all your social handles and easily share them across your website, email signatures, business cards, and marketing materials. You can do this by adding your personal Gravatar .link URL or generating a QR code directly from the platform.

This can be extremely useful as it provides users with instant access to all your verified social profiles with one quick scan.

Gravatar lets you create a cohesive, professional online presence that boosts your brand’s visibility and credibility. It ensures that your audience knows they’re connecting with the real you, no matter which platform they’re on.

Step 5: Leverage QR codes to simplify access

Remember, QR codes are most effective when paired with clear instructions and a compelling reason to scan. Provide context for what users will gain by scanning – whether it’s access to exclusive content, special offers, or a comprehensive view of your social profiles.

Step 6: List social media handles on your website and landing pages

Your website and landing pages are prime real estate for showcasing your social media handles. By strategically integrating these handles, you can create a true connection between your web presence and social profiles.

Include social media icons in key website locations

Social media icons are a standard and effective method to display your handles on your website. These icons typically link directly to your social profiles, allowing visitors to follow you with a single click, which is why it’s good to place them in prominent areas like the header, footer, and contact sections of your website. This ensures visitors can easily access your handles regardless of which page they’re on.

It’s also recommended that you use branded, recognizable icons to maintain a professional appearance and keep the user experience consistent. Still, make sure that they fit your website’s design and color scheme.

Embedding live social media feeds

Display live content from various platforms, such as Instagram posts, Twitter/X updates, or TikTok videos on strategic pages. For example, if you’re a food blogger, you could include an instagram feed with mouth-watering content that will entice people to follow you there.

What’s important here is to make it as easy as possible for readers to find you, and the best way to do this is through CTA buttons. Place them at the end of blog posts, on product pages, or in pop-ups. Direct visitors to your social platforms with clear, actionable prompts.

Optimize social media links for mobile users

With a significant portion of web traffic coming from mobile devices, remember to make your social media links mobile-friendly. Here’s how to do that:

Step 7: Promote social media handles in video and audio content

Incorporating your social media handles into video and audio content can significantly boost your online presence. This approach allows you to reach audiences across multiple platforms and encourages cross-platform engagement.

Display social media handles as text overlays in videos

Text overlays are an effective way to make your handles visible without disrupting the main content of your videos.

Add social media handles to the description box of video platforms

Video platforms like YouTube, TikTok, and Vimeo offer valuable space in their description boxes for promoting your handles.

Mention handles verbally in video and audio content

Verbal mentions of your social media handles can reinforce them and prompt your audience to follow you. However, you need to be strategic: Include handle mentions at the start, during transitions, or at the end of your content. For longer content like podcasts, naturally incorporate handle mentions during topic transitions.

We also recommend briefly explaining what kind of content followers can expect on each platform and using a call-to-action approach, encouraging listeners to connect with you on social media.

Include social media handles in end screens or outro segments

End screens and outros are prime locations for promoting your social media handles, as viewers often decide what to do next after finishing a video.

Promote social handles during live streams

Live streams offer real-time opportunities to promote your social media handles while interacting directly with your audience. Use a persistent on-screen graphic showing your primary social media handles and rotate different handles throughout the stream if you’re active on multiple platforms.

You can also verbally encourage follows by periodically reminding viewers to follow you on other platforms and highlighting exclusive content or benefits available on specific social media channels.

Utilize social media handle watermarks in visual content

Watermarks ensure your handle remains visible even if your video is shared across different platforms. Place the watermark in a corner of the video where it won’t distract from the content and ensure it’s noticeable enough for viewers to remember and easily read.

Remember to be consistent! Use the same watermark design across all your video content for brand recognition. Consider using your primary social media handle as the watermark for maximum impact.

Take control of your online presence with Gravatar today

Effectively listing and promoting your social media handles is crucial for building a strong online presence. Consistency and visibility are key, but so is efficiency. Managing multiple social media profiles can become time-consuming, especially when updating handles or ensuring consistency across platforms.

Gravatar offers a straightforward solution for organizing your online presence, making it easier for others to find and follow your profiles without having to manage multiple platforms. With Gravatar, you can:

Whether you’re a small business owner, entrepreneur, or social media manager, Gravatar provides a streamlined solution to keep your social media handles up-to-date and visible across your digital footprint.

Take the first step in simplifying your online presence management. Create your Gravatar profile now and start showcasing your social media handles across all platforms with ease.

Imagine that you’re at a networking event, eager to make connections, but you’ve run out of business cards. Or worse, you hand someone a card only to realize it has outdated information. Situations like these highlight why professionals are turning to digital business cards. These modern alternatives offer a dynamic way to share your contact details and personal brand, complete with rich media content and real-time updates.

Digital business cards shine in both online (as a link in bio tool, in the footer of contact pages and emails) and offline (in-person networking and contact sharing) settings. So, whether you’re adding them to your email signature or sharing them at in-person events, they make networking and follow-ups much easier.

$\"🌱\"$ As a bonus, they’re environmentally friendly, reducing paper waste.

However, creating an effective digital business card comes with challenges. Many solutions can be costly, and designing one without the necessary skills can be daunting. Thankfully, Gravatar exists – a completely free and powerful platform for crafting digital business cards.

This guide will show you how to use Gravatar to create a professional, eye-catching digital business card – no design expertise required!

Necessary features and design elements for your digital business card

While it’s good to be creative and unique with your digital business card, you still need some essential elements. Let’s see what they are:

Create a stunning digital business card with Gravatar – no design skills needed

Enter Gravatar: your free ticket to a globally recognized digital identity. This platform is a powerful tool for managing your online presence across thousands of websites and services. Think of it as your universal digital business card and personal branding hub all rolled into one.

What sets Gravatar apart? Its simplicity. You don’t need to be a design guru to create a standout profile. Just upload an avatar and fill in your details, and you’re good to go. But don’t let the ease of use fool you – there’s plenty of room for customization. You can play with background colors, tweak button hues, or add a custom-branded header and footer.

You can even rearrange the layout to suit your style. And for those who want to go the extra mile, why not embed a video introduction? It’s all about making your digital card uniquely you.

But here’s where Gravatar really shines: automatic synchronization. Update your profile once, and those changes instantly appear across all connected platforms – no more scrambling to update multiple online profiles when you change jobs or contact details. This ensures your personal brand stays consistent everywhere you appear online, from professional forums to project collaborations.

And for those in-person networking moments, you can generate a QR code for your Gravatar profile and watch as people scan their way straight to your digital doorstep.

Android and Apple Wallet Support, Too

Never fumble for a business card again. Your Gravatar profile now lives in your phone’s wallet!

$\"🌟\"$ Here’s a neat trick: Gravatar integrates with comment systems on many blogs and news sites. This means your digital business card can pop up alongside your online contributions, turning everyday interactions into potential networking gold.

So, ready to create a digital business card that works as hard as you do? Let’s dive into how you can make Gravatar work its magic for your professional brand.

Future-proof your networking: Create a digital business card with Gravatar

Gravatar isn’t just another digital business card platform – it’s a revolution in online networking. Its unique email-based system allows you to manage multiple online identities effortlessly. And with thousands of integrated platforms, your Gravatar profile becomes a centralized hub for your digital presence.

Worried about design skills or costs? Gravatar eliminates these common hurdles. It’s free, user-friendly, and doesn’t require a degree in graphic design to look professional.

Head to Gravatar.com and create your free profile using your email address. It’s time to build a digital business card that works as hard as you do!

WooCommerce is all set to roll out a new logo in early 2025. Tamara Niesen, Chief Marketing Officer at Woo told WP Tavern, “We saw an opportunity to evolve the brand so it aligns with our new product vision and gives us a solid foundation for continuing to grow our business. The new direction helps us stand out. It’s bold, fresh, and communicates what we do and who we’re for.”

The updated logo, featuring a lively purple and white color palette, has already sparked a buzz in the WordPress community. It showcases “WOO” in white against a deep purple background, sometimes transitioning into a shopping cart, with the “O”s doubling as wheels—perfectly representing a platform that powers millions of online stores worldwide.

Jay Walsh, Director of Communications at WooCommerce.com, shared that they recently discussed plans around the Woo and WooCommerce brand and identity during the keynote session of this year’s WooSesh. The team teased a refreshed WooCommerce logo treatment during the keynote, which is part of the wider effort to make the Woo brand, voice, and identity bolder and more engaging for current and future merchants.

“Evolving our brand and our main product is crucial to our strategy of growing new stores, reaching new merchants, and maintaining our position as the world’s most popular commerce platform”, he explained.

The animated logo has been a hit, drawing comments like “one of the best logos I’ve seen in a while” to “This is so darn cool.” BobWP of Do the Woo Podcast tweeted, “In case you missed this. And coming from someone who used to design logos professionally, the simplest ideas, which now seem obvious, are the hardest. Great job!”

Remkus de Vries of Within WordPress newsletter, shared his excitement saying, “It’s very rare to see a rebrand with a new logo where I immediately go “Wow, that’s a huge improvement, I love it”, but when I saw this last week, that’s exactly what I thought.”

Despite the enthusiasm, a few critics questioned the color choice, but WooCommerce Product Lead James Kemp has assured that “the whole rebrand is super vibrant and the purple has been enhanced.”

Are you struggling with high bounce rates and lackluster conversions on your website? You’re not alone. Many businesses find it hard to create engaging, relevant experiences for their online visitors, leading to missed opportunities and lost revenue because, as shown in a recent McKinsey report, 71% of consumers now expect personalized interactions from companies.

If you don’t provide them with one, you’re losing business, plain and simple.

Thankfully, there are many website personalization tools that are transforming how businesses connect with their audience online. These tools enable companies to deliver individualized experiences that resonate with each visitor, going beyond traditional segment-based approaches.

In the following sections, we’ll explore the top 7 personalization tools and their features, showing you how to unlock new levels of engagement and business success.

Introducing the top 7 website personalization tools

1. Gravatar

Gravatar is a unique tool in the world of website personalization. It simplifies user profile management and enhances personalization based on users’ email addresses, offering a distinct advantage by utilizing data already provided by users. This approach allows developers to personalize site experiences without extensive data collection.

These APIs create a centralized hub where users can update their information once, and it syncs across all Gravatar-integrated sites. Gravatar has also introduced Interests, allowing users to list specific topics they’re interested in – something that can change the game for website owners looking to understand user preferences.

For example, an e-commerce site could show personalized product recommendations based on these interests.

For developers looking to import user profiles, integration with Gravatar’s profile API is needed. To streamline the user experience, it’s recommended to explain to users that they can control their avatar and profile information directly from their Gravatar profile.

Use cases: Gravatar is particularly beneficial for developers, bloggers, and business owners. It provides a consistent brand image across platforms and maximizes engagement by offering personalized user experiences.

Used by: Gravatar integrates with popular platforms like WordPress.com, Slack, OpenAI, Figma, and Mailchimp, demonstrating its versatility and wide-reaching impact.

Price: One of Gravatar’s standout features is its pricing model – or lack of. It’s a completely free service for site owners, developers, and users, and is run and supported by Automattic. There’s no paid version and no usage limits, making it an accessible option for businesses of all sizes.

2. Dynamic Yield

Dynamic Yield is a powerful player in the website personalization arena, known for delivering personalized onsite experiences through AI-powered targeting and real-time analytics.

Dynamic Yield integrates well with other tools to enhance personalization efforts, particularly Twilio Segment, a customer data platform enabling real-time data collection and action.

Use cases: Businesses can use Dynamic Yield to increase engagement and conversion rates, such as personalizing homepage experiences for returning visitors.

Price: Dynamic Yield offers a customized pricing model tailored to each client’s specific needs and scale. For detailed pricing information, you’ll need to contact their sales team directly.

3. Optimizely

Optimizely is a leading digital experience platform that empowers businesses to create, experiment, and personalize user experiences.

Use cases: Businesses can increase engagement and conversion rates by running A/B tests on different versions of their product pages to identify the most effective elements.

Price: Optimizely offers a customized pricing model tailored to each client’s specific needs and scale. Contact their sales team directly for detailed pricing information.

4. HubSpot

HubSpot is a popular all-in-one CRM platform offering many powerful tools for marketing, sales, and customer service, with a strong emphasis on website personalization.

Use cases: Businesses can use HubSpot to increase engagement and conversion rates by delivering targeted CTAs to specific visitor groups.

Price: HubSpot offers tiered pricing plans for their different products, which include marketing, sales, service, content, operations, and commerce. All of them start at $15/month per seat and can go up to $3,600/month, depending on what you need. They also have many free tools, so you can get a taste of the platform before you commit to subscribing.

5. Hyperise

Hyperise is a personalization platform that allows businesses to dynamically personalize images and content across various digital touchpoints.

Use cases: Businesses can use Hyperise to create personalized landing pages for different audience segments, enhancing relevance and engagement.

Price: Hyperise offers various pricing plans, depending on what you want included. Their Images plan costs $69/month per seat and lets you create personalized images for your outreach. The other two tiers include adding a website and videos.

6. Marketing Cloud Personalization by Salesforce

Salesforce, formerly known as Evergage, is a comprehensive customer data platform that now also includes a personalization engine as part of its marketing tools. Businesses can use their tools to create individualized experiences across multiple channels, including web, mobile, and email.

Use cases: Businesses can use Salesforce for personalized product recommendations and content tailored to individual shopping behaviors.

Price: This service comes in three tiers: Marketing Cloud Engagement, Marketing Cloud Account Engagement, and Marketing Cloud Growth Edition. The first two tiers go for $1,250/month, while the third is $1,500/month per organization.

7. Yieldify

Yieldify is a platform designed to optimize customer journeys through personalized experiences and conversion rate optimization, focusing on e-commerce businesses.

Use cases: Businesses can use Yieldify to reduce cart abandonment through exit-intent pop-ups and promote special offers based on user behavior.

Price: Yieldify offers customized pricing based on specific needs. Contact them directly to get started and obtain pricing information.

Selecting the ideal personalization tools for your website

Choosing the right personalization tools for your website is crucial for maximizing engagement and conversion rates. Here’s how to approach this important decision:

Step 1: Understand your needs

Before selecting a tool, identify your specific goals and challenges. Are you looking to improve user engagement, increase conversion rates, or streamline user profile management? Assess your current marketing stack and identify integration needs to ensure quick and easy implementation.

Step 2: Evaluate key features

Create a list of essential features you need in a personalization tool. Consider factors such as:

Don’t overlook the importance of data privacy and security. Tools like Gravatar emphasize user control over personal information, allowing users to edit their public profiles and share only what they’re comfortable with. Ensure the tool complies with regulations such as GDPR and CCPA for legal data handling practices.

Step 3: Analyze cost and ROI

Consider both short-term costs and long-term value when evaluating tools. Low-cost and free tools like Gravatar offer high value and low risk, making them excellent starting points for personalization efforts.

Step 4: Success stories

Look at real-world examples of companies successfully using personalization tools to drive growth. For instance, a great example of successful personalization is the plant-based cosmetics brand Clarins which increased conversions by 20% using Yieldify. Some of the strategies they implemented include:

Looking at examples like this will show you the full potential of the specific platform and maybe even give you some ideas on how you can implement similar strategies in your own business.

Step 5: Make an informed decision

Finally, whenever you can, take advantage of demos to better understand each tool’s capabilities before making a decision. Weigh the risk versus reward, keeping in mind that tools like Gravatar offer easy integration and are free to use, making them a low-risk option to start with.

Unlock the potential of your website with personalization tools

When choosing personalization tools, consider factors like powerful features, integration capabilities, and ROI measurement.

Gravatar stands out with its unique advantage of utilizing existing user data for personalization without extensive on-site data collection. Its Profile API allows developers to create more detailed and personalized user experiences by integrating additional user information into their websites.

As you explore the tools we’ve discussed, consider how they align with your business needs. Remember, Gravatar is an excellent starting point – it’s both highly useful and free.

So what are you waiting for? Take the best out of website personalization and create experiences that your users will love!

[00:00:00] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley. Jukebox is a podcast, which is dedicated to all things, WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, how the Interactivity API will transform your WordPress websites.

\n\n\n\n

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice. Or by going to wptavern.com/feed/podcast. And you can copy that URL into most podcasts players.

\n\n\n\n

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

\n\n\n\n

So on the podcast today we have Damon Cook and Seth Rubenstein.

\n\n\n\n

Damon Cook is a developer advocate with WP Engine, and previously worked as a front end developer at several WordPress focused agencies.

\n\n\n\n

Seth Rubenstein began his WordPress journey in college, and is now the lead engineer at the Pew Research Center, where he works on interactive WordPress applications.

\n\n\n\n

This is the last of the podcast recorded at WordCamp, us 2024, and our focus today is the interactivity API. You may not be familiar with what this is and why it matters, so Damon and Seth will break it down, and explain how it might transform your WordPress websites in the future.

\n\n\n\n

Damon starts off by defining what an interactive website is, giving examples such as single page applications, and dynamic elements like tabs and accordions. Seth adds his perspective on how interactivity aids both the end user, and website editors. Making for a more compelling user experience and efficient content creation.

\n\n\n\n

We get into why WordPress needed an interactivity API, even though the platform already supports libraries, like React. The interactivity API provides a standardized way to create dynamic content, which is essential for modern web expectations.

\n\n\n\n

We also highlight real-world examples, including faceted searching and filtering, which have been successfully implemented using this API.

\n\n\n\n

The conversation also touches on performance improvements brought by the API, emphasizing how it can offload server resources by only updating necessary content.

\n\n\n\n

Towards the end we explore how the API is being used in Gutenberg blocks, and how it supports both developers and site builders.

\n\n\n\n

Damon and Seth also discussed the project’s development, encouraging more contributions and feedback from the community.

\n\n\n\n

If you’re intrigued by improving your websites’ interactivity and performance, this episode is for you.

\n\n\n\n

If you’d like to find out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

\n\n\n\n

And so without further delay, I bring you Damon Cook and Seth Rubenstein.

\n\n\n\n

I am joined on the podcast today by Damon Cook and Seth Rubenstein. Hello.

\n\n\n\n

[00:03:40] Damon Cook: Hey, how’s it going?

\n\n\n\n

[00:03:41] Nathan Wrigley: Yeah, really, really nice thank you. That’s Damon.

\n\n\n\n

[00:03:44] Seth Rubenstein: Hello, I’m Seth.

\n\n\n\n

[00:03:45] Nathan Wrigley: Thank you so much. We’re at WordCamp US, it’s happening in Oregon. It is the month of September 2024, and I’m being joined by Damon and Seth so that we can talk about the Interactivity API.

\n\n\n\n

Before we get into that, I think it’s probably important to paint a picture of both of you, what your background is with WordPress technology, et cetera. So we’ll just keep this very brief. Let’s go for Damon first. Damon, just tell us a little bit about you, your potted bio, if you like.

\n\n\n\n

[00:04:10] Damon Cook: Sure, yeah. Well, I started out as a WordPress front end developer at WordPress. There’s several different WordPress focused agencies, and now I’m a developer advocate with WP Engine.

\n\n\n\n

[00:04:21] Nathan Wrigley: Thank you very much. And Seth?

\n\n\n\n

[00:04:23] Seth Rubenstein: My first time using WordPress was in college. I converted all of our websites to WordPress multi-site, as like the assistant web developer. And from there I just kept going, and that was just my career track from then on, just WordPress all the time. And now I am the lead engineer at the Pew Research Center, where we have a WordPress platform that we’ve made ourselves, and we work on a lot of interactive WordPress applications.

\n\n\n\n

[00:04:43] Nathan Wrigley: Just staying on your bios just for a moment, what does the Pew Research Center do? I’ve not heard of them before.

\n\n\n\n

[00:04:49] Seth Rubenstein: We are a non-partisan, non advocacy social science research organisation. So we basically study the American public and where they are, what they think on certain issues. And we do a lot of public polling and things like that, and we report that back. So we’re kind of like a nonprofit news organisation.

\n\n\n\n

[00:05:04] Nathan Wrigley: Gosh, okay thank you. That’s really interesting.

\n\n\n\n

Okay, let’s open it up and talk about the subject at hand today. So we’ve got both of these gentlemen here to talk about the Interactivity API. I think probably we should first deal with the topic of, what is an interactive website?

\n\n\n\n

Probably, dear listener, if you’re listening to this, you might know this already, but I have an intuition that some people won’t. So, what are the benefits of having an interactive website? And whoever wants to answer that, pick up the mic and go for it.

\n\n\n\n

[00:05:30] Damon Cook: I think the classic example is that of a single page application. So the idea of being able to navigate from page to page, or section to section even, and just have things that seem seamless, so the page isn’t refreshing, that is a pretty common scenario. But there’s also lots of other interactive pieces like tabs, accordions, all that stuff gets really helpful when you reach for the Interactivity API in creating stuff like that.

\n\n\n\n

[00:05:59] Seth Rubenstein: I don’t have anything to add to that. I guess what I would say is, on the other side of it besides the front end user, the kind of, your visitor, I think the interactivity part of a website kind of also can help out your editors, and how they’re building content, and making more engaging content.

\n\n\n\n

I think this will be interesting because I think, you know, Damon might have a kind of perspective of the front end user, and I’m definitely coming from a perspective of, how can I scale up my editorial team’s ability to create interactive content? And not so much like what it looks like on the front end.

\n\n\n\n

[00:06:27] Nathan Wrigley: So there’s an interesting distinction there. So, does the work that you are doing touch on both the front end and the back end? So it’s not just for the forward facing, user facing part of a WordPress website. This is things that you can do in the back end, the admin side of things too.

\n\n\n\n

[00:06:40] Seth Rubenstein: Yeah, it’s how editors create interactive bits of content, and how those interactive bits of content might interact with each other. Because I think right now, without the Interactivity API, that kind of content is static and siloed on the page.

\n\n\n\n

[00:06:52] Nathan Wrigley: We will link in the show notes to all of the different places, and no doubt one of the first links will be to the project itself, the Interactivity, API. But I guess I have to ask the question, why is this even a project in WordPress? Is it that WordPress historically wasn’t particularly adapted towards interactive content?

\n\n\n\n

I mean, we know how to publish posts and pages, and once you’ve done that, that’s kind of it. You’ve done it, and there’s no interactivity there. Is this something that has been, I don’t know, more recently thought was necessary? Is this something that you think should be in Core? Let’s just take that. Has WordPress been bad at interactivity historically?

\n\n\n\n

[00:07:28] Damon Cook: I don’t think that it’s been bad historically, I think that it’s more of kind of a, I guess a technology trend of leaning into libraries like React or Preact, which Interactivity is built upon. So I think it’s more of a trend, but also, yeah, a necessity in Core, because folks are trying to build these types of experiences, and we want to have a standardised way for them to be able to do that, and not have to pull in a bunch of different libraries. And although they still can, you know, there’s a standardised and backwards compatible way for them to do it. So that’s the idea.

\n\n\n\n

[00:08:05] Nathan Wrigley: Thank you. Seth, anything to add?

\n\n\n\n

[00:08:06] Seth Rubenstein: Yeah. I don’t think WordPress has done a bad job on interactivity in the past, you know, ships with jQuery, ships with React, that’s all available to you. I think the Interactivity API is kind of looking at how developers have been creating front end experience with React, and narrowing that down to be like the right tool set for blocks and for block developers specifically.

\n\n\n\n

[00:08:26] Nathan Wrigley: So it’s about having the right tooling. Something standardised that everybody can get their teeth into, that every developer understands.

\n\n\n\n

[00:08:32] Seth Rubenstein: Yeah, and something that fits the blocks kind of model I think, a little bit better than some of these other frameworks.

\n\n\n\n

[00:08:38] Nathan Wrigley: Okay, that’s great. So give us some examples of good interactivity on the internet. So we could limit ourselves to WordPress, but let’s not do that. Let’s just go out there and try to pick good examples.

\n\n\n\n

Really, I guess we could be talking about Google Docs, we could be talking about websites, we could be talking about anything. Do you want to just rattle off a few things where you’ve seen and you’ve been impressed, and thought, ah okay, there’s a good example. The only reason I’m asking this really is so that the listener can just get an idea of what interactivity means.

\n\n\n\n

[00:09:05] Damon Cook: Sure. And I’m actually going to set up Seth, because I think a lot of the things that his organisation is creating are representative of what folks kind of need. So I’ll set him up for that.

\n\n\n\n

[00:09:17] Seth Rubenstein: And I’ll say the word that he’s probably thinking of, facets. Amazon, you’re browsing Amazon, you want to narrow down the content that you’re looking at. Those facets on the left hand side, filters, aggregations, whatever you want to call them. I think this has probably been our biggest success with the Interactivity API, is developing out facet blocks.

\n\n\n\n

And with the Interactivity API what that would let you do is just server side hydrate data before it gets back to the client. And you can browse through all this content, and do it in a performant way that you just couldn’t do before. Or you could, but it would take a lot of work on your part to build out the framework and the technology to handle all that.

\n\n\n\n

And so now that’s just in the box in WordPress free to use. So we can probably touch on facets a little bit more later, but I think that’s probably the best use case for the Interactivity API thus far.

\n\n\n\n

[00:10:00] Nathan Wrigley: Let’s dig into that a little bit. So when you say facets, my head is immediately going to things like, I don’t know, the posts and pages, table layout, or something like that. And the fact that, if I want to get to post number 11, I might have to click a button, wait for a moment whilst the page refreshes, there’s obviously something going on there, page refresh, I’m contacting the server and what have you. Is the idea here that, a bit like, I don’t know, if I scroll on Google, I would be able to automatically upload more pages, more posts, that kind of thing? And then be able to, I don’t know, say filter them, show me only the ones that are authored by me, or ones with featured images, and that would all happen on the fly.

\n\n\n\n

[00:10:35] Seth Rubenstein: Yeah. So, you know, you can filter by author, by taxonomies, category, custom taxonomies, whatever, date, et cetera. And those results just update in real time, without you having to refresh the page.

\n\n\n\n

You can paginate through those results without having to refresh the page. That, of course, is great for the end user, but it’s also great on the backend because you’re saving server resources without having to re-render that entire page every single time. So you’re only rendering out what’s changed.

\n\n\n\n

So in that way, great for the end user and great for you as a website operator, because the Interactivity API kind of offloads some of that performance overhead that way.

\n\n\n\n

[00:11:07] Nathan Wrigley: Yeah, okay. I have children, and they have been born in a world where the mobile phone is completely ubiquitous. And the idea of anything refreshing to them just seems like an anathema, just a pointless thing. You know, you want to open an app, and from that moment just everything happens. You scroll, there’s more to see, you press back, it just immediately loads and what have you.

\n\n\n\n

Is that kind of where we’re going with the internet? And what I mean by that is, sites where you’ve got to click a button to see another further piece of content, or for your shopping cart to be updated, or whatever it may be, that just seems like the 1990s almost.

\n\n\n\n

Is it a bit of that? Is it just we’re kind of keeping up with the times? And the expectation from the next generation of users is going to be, well, if it isn’t interactive, I’m not sticking around. So if I’ve got a, I don’t know, a WooCommerce store or something like that, it’s going to be painful for a user to have to refresh, click a button to go to a cart, wait for it to load and all that. It’s just, like I said, the 1990s.

\n\n\n\n

[00:12:05] Damon Cook: Yeah, I think a lot of it does touch on that and, yeah, just reaching out to that kind of experience. But, yeah, I think Seth touched on this, but the performance impact is pretty great about the Interactivity API because you’re only updating the sections, or components on the page that are really relevant to what the user is doing. So that has a performance impact. It makes things feel seamless, faster, and I think that’s a lot of probably what we’re all looking for at the end of the day.

\n\n\n\n

[00:12:30] Nathan Wrigley: It feels like something more native to the device that you are on. So it feels like a Mac app, or a Windows app, or an Android, or an iPhone app. Does that kind of make sense? It just feels like we’re in the modern world, not in the old world where any kind of refresh just seems bizarre, frankly. Anything to add, Seth?

\n\n\n\n

[00:12:46] Seth Rubenstein: You know, I think the coolest part about this is it basically lets you take a PHP application and turn it into a single page JavaScript app. I mean, that’s really what the Interactivity API as a whole is doing. And I think that’s what developers are looking for these days. Look at, you know, Next.js, and frameworks like that that are really grown and are really popular. And I think that this kind of API just is an answer to those for WordPress developers.

\n\n\n\n

[00:13:06] Nathan Wrigley: So if I were a developer and I was, I don’t know, creating plugins, themes, blocks, whatever it may be, where do I go and find out about this? How do I get my teeth into the project? So you might want to drop a URL at this point, wherever you want to point us.

\n\n\n\n

[00:13:20] Damon Cook: Sure. Well, I can tell you how I find it because I Google it. I Google it myself. Interactivity API Handbook, I’m pretty sure that’s where you’ll find it, and developer.wordpress.org. The documentation is very thorough, and up to date, and complete. And I think that’s what’s excites me about this API because it’s a very discreet project that kind of got pulled together and, yeah, the documentation is really up to date and great, so that’s where I’d go.

\n\n\n\n

[00:13:47] Nathan Wrigley: Okay, I will link to that in the show notes. And probably a good idea, dear listener, to pause at this point, go and check that out and then come back and hit play.

\n\n\n\n

So from the developer sort of point of view, how baked is it? How complete is it? Is there a lot that you have achieved already? Is there a big roadmap for things that you want to achieve?

\n\n\n\n

I know that’s going to be difficult to encapsulate in a few sentences, but just tell us the state of the project now for developers listening to this, they might have some intuitions as, okay, that sounds like something I could use right now, as opposed to the roadmap features that are still going to come.

\n\n\n\n

[00:14:17] Damon Cook: Sure. No, it is quite complete and ready to use, and the documentation can even step you through how to integrate it into an existing block. You can even spin up a new block with the Interactivity API already baked in.

\n\n\n\n

Some of the future roadmap areas is, I know that we’re still working on like client side navigation, and then pulling in kind of different modules. Like I know one experiment that’s being explored is, there’s a package for accessibility. So just the general idea of speaking, screen reader, passing along. So these APIs have been in WordPress for a while, like some of the accessibility packages. So there’s explorations in kind of porting that over, and pulling it in, because the Interactivity APIs uses JavaScript modules for a lot of this. So it’s kind of re jigging, I guess, some of the code and pulling in some of these packages so that developers can use kind of those old, not old, but accessibility features, and have all that compatibility baked in.

\n\n\n\n

So that’s some of the areas that are still getting integrated, and I’m excited for them. And I think that’s on the roadmap right now, and there’s folks contributing towards it.

\n\n\n\n

[00:15:24] Seth Rubenstein: The modules area is probably, I think probably the area that it needs the most work, and hopefully the most amount of work is going into. I would say that’s probably one of the roughest parts of the Interactivity API right now is, if you need to use an external script, or kind of library, or framework, it’s a little difficult to get that in. So I think that’s probably where the most amount of work’s going to be going.

\n\n\n\n

And I think there’s some work going on WordPress URL, bringing that in as well. And there’s a few more directives too, to the API, that are being added like wp-show which should be interesting, that should let you dynamically hydrate elements on the page in a different way. I won’t go to like all the technical details on that, but there are some additional features that are coming to the Interactivity API, beyond just the module stuff. So there are, in the Interactivity API parlance, there are new directives coming soon.

\n\n\n\n

[00:16:05] Nathan Wrigley: I think for anybody who is a developer, you’re going to be fine looking at the documentation. But if I say any acronym on this podcast, I always get some pushback from people who are not developers, WordPress end users. So let’s address that.

\n\n\n\n

Is there going to be functionality within the Interactivity API, although it’s there, and it is part of the Interactivity API, will be available to just builders of websites? People who have their own blog, or their own property, they’re not interested in WordPress from a technical point of view. Is there anything that they can do with it so that they can have this sort of dynamic content? Or is it mainly going to be through the work that developers do, through plugins, and blocks, and what have you?

\n\n\n\n

[00:16:44] Seth Rubenstein: Right now. It’s live, already on your site if you’re running kind of the latest version of WordPress. The light box in the image block is using the Interactivity API. So site builders are already gaining that Core query, already has interactivity built in. So does the pagination block. So your publication pages can already be kind of a single page JavaScript app. So Core is adding that stuff in and, yeah, obviously plugin developers will also hopefully add interactivity to their plugins, but it’s already there for site builders.

\n\n\n\n

[00:17:11] Nathan Wrigley: It feels like we’ve gone down the road in WordPress where everybody’s done their own thing with interactivity. The page builders have done, well, not just the page builders as one block, but each page builder has done a different thing. You’ve got these multitude of plugins that do the sort of facet searching and all of that kind of thing.

\n\n\n\n

The idea that there’s just going to be this one thing, I suppose in a sense you kind of want the Interactivity API to not really be that well known about. The idea is for it to sort of fade into the background and nobody even realise that there’s a thing. Is that sort of doing down the project a little bit, or is that kind of the point? If nobody knows it exists, but it works, that’s kind of the ideal.

\n\n\n\n

[00:17:45] Damon Cook: Yeah, I mean these APIs are in the background, yeah, for developers to explore, and use, and pull in, and integrate. But yeah, at the end of the day, the end user shouldn’t know about it, have to know about any of this, and just, have a great experience. So yeah, I think that’s the idea.

\n\n\n\n

[00:18:00] Nathan Wrigley: Where do you learn what you should be working on? So the team of volunteers and seconded people that are working on the Interactivity API, who are you listening to? Where do you get your feedback from? And I know in the open source world, it’s hard to get that feedback. And you might be just listening to a dozen voices, interested people, or there may be, I don’t know, hundreds of people talking to you. But to drive it forward, who are you listening to? Where do you get your intuitions as to what should be on the roadmap?

\n\n\n\n

[00:18:25] Damon Cook: There is a Make Slack Group, it’s Interactivity API I believe, or Core Interactivity API room. But there’s some great contributors in there, and I’m probably going to mess up all their names but there’s Jon Surrell, I believe, and Greg Ziółkowski. I apologise Greg, I tried. But they are very active contributors and I probably feel like the least contributor. But, yeah, they’ve been doing a great job.

\n\n\n\n

I think what it comes down to historically, the Frontity team, I’m not sure if you’re familiar with that project, but back in the day they kind of got integrated. All these smart folks into Automattic as full-time contributors, and a lot of them have been driving this project daily and contributing towards it, and they’ve been doing an amazing job. Some other folks, I think from Google, also contribute a lot towards Interactivity API. So that’s what I follow, they’re all in that room a lot and very active.

\n\n\n\n

[00:19:20] Seth Rubenstein: That’s almost everybody. I don’t know if you mentioned Luis, he’s kind of my main point of contact. I ping him with questions, or ideas or, hey, we’re going to try to do this, does this sound crazy to do with the Interactivity API? And he’s pretty receptive.

\n\n\n\n

[00:19:32] Nathan Wrigley: Would it be fair to say that you could do with some more helpers though? I think in the open source world we could always use some more people flocking around any particular given project. Is that something that you’d be interested in? I don’t know, one of the intentions of a podcast like this is to make things like that happen but, yeah, is that a thing?

\n\n\n\n

[00:19:47] Seth Rubenstein: I would like to see a lot more people using an API. You know, we’re trying to push the limits of the API, and I think it’s important that we all kind of try to push the limits and see where it needs additional work, or where we might need extra functionality. So I’d love to see a lot more people using it because I just don’t think it’s gotten kind of the critical mass yet.

\n\n\n\n

[00:20:04] Nathan Wrigley: Can you give us some nice examples that I could link to in the show notes of situations where you’ve seen, specifically the Interactivity API. We mentioned earlier about, you know, general websites and what have you.

\n\n\n\n

Are there any good examples where you’ve seen somebody using it, so that if there is a developer looking at this, they can go, oh okay, that’s the kind of thing we’re talking about.

\n\n\n\n

[00:20:21] Damon Cook: I certainly can share some links. I have some repos on GitHub where I’ve built custom blocks and I’ve done, I believe there’s a YouTube, at least a recording of a presentation where I’ve gone step through building, some of these custom blocks and they’re all in my repo.

\n\n\n\n

I was going to hand it off to Seth, I guess again, because I know one block that stood out to me that him and his team have created is like a, well, I think you have a poll, but also like a table filtering. I mean, I think those are pretty common experiences that we see on sites, and they’ve done a great job in creating that seamless experience of filtering.

\n\n\n\n

[00:20:56] Seth Rubenstein: I can just gush for a moment. If you want a good example, www.pewresearch.org, almost everything that you’re going to see there is using the Interactivity API. Mega Menus, MailChimp newsletter signups, facets, pagination, table of contents. That updates as you scroll through the page, because the chapter blocks report using the Interactivity API to the table of contents block, which is separate, their position. Data tables, charts, quizzes, you name it, pretty much everything that we have on our website is using the Interactivity API at this point.

\n\n\n\n

There’s a few plugins that we still have to convert, it’s actually only two. But almost everything that you see there is using the API, and almost all that code is available for free open source on github.com/pewresearch.

\n\n\n\n

[00:21:39] Nathan Wrigley: Did you do that yourself because you are knee deep in the weeds of this, and so you could understand easily how to do that? Or would it be true to say that the developer documents that you’ve just mentioned would steer any, air quotes, competent developer to be able to achieve that? Or is it just that you know, you’ve got the Interactivity API, you also work for this organisation, so the two met.

\n\n\n\n

[00:21:58] Seth Rubenstein: I think it’s because we wanted to provide learning resources, we wanted to provide a use case of, here’s what is possible. Obviously I’m talking about a lot of blocks that are interactive, but one of the things that I could really go into is our concept around the Interactivity API.

\n\n\n\n

I think a lot of examples that people can point to, it’s a very specific use case. This block is a collapsible block, you click on it and it expands. We’ve taken a different approach, something that we call Atomic Interactive Blocks. And so we’ll make a block and it will have some interactivity instructions and functionality, but the point of that is to be dropped into another block, which has its own interactivity, and instructions, and functionality, and so on and so forth.

\n\n\n\n

And so what we’ve really done is made a library of interactive blocks that kind of act like React components, and that you can drop them in other use cases and style them however you want, but what they do is defined maybe higher up.

\n\n\n\n

Yeah, so I think to me that’s really the power of the Interactivity API, because what that allows us to do is, as developers, is just maintain a small library of blocks that are programmed to do a lot of things, and interact with a lot of other blocks, but then hand off styling, and content, and all that stuff to designers and other people.

\n\n\n\n

For me, that’s been the coolest part about the Interactivity API, is this abstraction out of a block of what it does. We can go into it more, but the interactive stores can communicate with one another, and so you can have block A do a very specific thing, you click on it and it opens. And maybe you put that inside of block B, and block B is aware, well, when block A is set to be open, when its state is set to be open, I need to do this. And so, you know, you can imagine, you can make a button block, and use that in infinite applications.

\n\n\n\n

The way that we approach it though, that block can dynamically target an interactive store rather than statically being set to just do this one thing in this one interactive store. So all of those GitHub repos will provide examples of how that kind of system works, and how you might approach the same thing for your organisation or website.

\n\n\n\n

[00:23:48] Damon Cook: I think what Seth touched upon is interesting because I think it says a lot kind of to how the API has been built to abstract some of these ideas, and just shared state between components. So like you touched on, a button can be shared, and so many are used in so many contexts, but to be able to abstract that and share state, and the interactivity between these components is, it shows a lot of, the API has been built smartly so that it can be explored and experimented with, which is neat.

\n\n\n\n

[00:24:19] Nathan Wrigley: I think one thing about this topic is that it is possible, probably, to go a bit overboard with being interactive. I’ve got the API, I know how to use it now, I’m going to make everything interactive. And I guess there’s a point where you’ve got to tell yourself, slow down, not everything needs to be interactive. So let’s just go into that. Are there any uses which you would say, yeah, you could do that interactively but we probably shouldn’t? Are there any times where you think, let’s put the brakes on?

\n\n\n\n

[00:24:45] Damon Cook: I mean, I think any developer will kind of realise when they’ve maybe over-engineered something. There’s always going too far and making everything, yeah. You’ll know I think if you’re trying to make everything interactive, every paragraph or, you know, it’s just kind of pointless. But the exciting part is that you can experiment and explore, interact with these APIs and see what you can do. And find the edges of what you can do, and what you should do, or shouldn’t do, that’s the fun part.

\n\n\n\n

[00:25:10] Seth Rubenstein: Yeah, I will say that, is it possible that you can do too much? For sure. Technically speaking though, is it possible that you can do too much? I don’t think so. Like I said, we have a lot of interactivity blocks on a page, and the performance has been great. So I don’t think there should be a concern of like, oh, I’m overdoing it with using the Interactivity API in terms of performance. I think the more things you make with the Interactivity API, the better performance you’re going to get.

\n\n\n\n

[00:25:33] Nathan Wrigley: Let’s just speak to the performance side of things because you mentioned technically how it’s achieved a little bit, but could we just develop that a little bit? And you’ve definitely said performance isn’t affected, or performance is really great a number of times. What does that actually mean? So if I’m using this, is it a more performant website because it’s, I don’t know, it’s loading content asynchronously or what have you?

\n\n\n\n

Has there been any situations where you’ve had to, I don’t know, refactor things because the performance took a dip. Performance at the moment is everybody’s big worry, isn’t it? Because, you know, Google takes those metrics and ranks you accordingly. So we kind of want to know that if we make this thing interactive, it’s not going to suddenly impact our score. And I know that Google does take note of these kind of things.

\n\n\n\n

[00:26:11] Seth Rubenstein: Yeah, I think on the performance bit, I mean, to get a little technical, what makes it so performant is kind of that idea of server side hydration, right? You click on something and that element changes, and that can happen client side, but if it needs a new data, that in the past has meant refreshing the page or doing something really kind of complex and technical.

\n\n\n\n

Now when the data changes and when that element needs to change, that one element re renders on the server, and then it’s returned back to the client, not the whole page. So that right there is an immediate performance savings because you’re not having to render a whole page out again, just to get this one little bit of changed information on a page.

\n\n\n\n

[00:26:45] Nathan Wrigley: Let’s get into probably the final thing for today, and that is the accessibility perspective of things. It’s become the watch word I think of 2023, 2024, and probably it’ll carry on, rightly so.

\n\n\n\n

Has there been any accessibility concerns? Because obviously if you’re updating content live on the page, is there anything that we need to be concerned about if we’re developing with the Interactivity API in terms of the accessibility, I don’t know, screen readers or other assistive technologies.

\n\n\n\n

[00:27:12] Damon Cook: Sure, yeah. I think it’s always a challenge in building your components, and making sure they’re interactive. So I think that it’s really kind of just abstracting things, trying to figure out what your HTML is, what your CSS is, and then layering on the Interactivity API. I know that some of the extensions of pulling in like strings of information that are being updated on the page, like some of the older packages, like the accessibility, or a11y, for the acronym. Some of these packages that have been in Core for a while, they’re being ported over into the Interactivity API.

\n\n\n\n

That’s something that’s kind of on the roadmap and being explored right now, so that we can have some of these screen reader updates for components, and on the page be integrated with the Interactivity API. So that’s, yeah, definitely something that’s being explored.

\n\n\n\n

But also, yeah, a lot of it is more of just the approach because just the markup and the CSS alone, having the knowledge of how to make that accessible is always a practice, an art form, and something that is always, can be improved.

\n\n\n\n

[00:28:17] Nathan Wrigley: Okay, thank you. Anything, Seth?

\n\n\n\n

[00:28:19] Seth Rubenstein: I think that there’s actually probably better accessibility that you’re going to get out of the Interactivity API. You know, I know that screen readers and assistive technologies have come a long way, but if a lot of your website relied on React, and other JavaScript frameworks that render after the page has been rendered, that could pose a problem for accessibility technologies. Here, all that stuff is pre-hydrated and pre-rendered before the page even loads. So your markup’s ready to go as soon as the page loads, which is actually great.

\n\n\n\n

[00:28:46] Nathan Wrigley: I think probably time has caught up with us. But before we go, we did mention the URLs and where you can find the project. Let’s just, firstly, go through where we can find you individually. So that might be an email, a Twitter handle, or whatever it might be. So let’s go to Damon first. Where can people find you if they’re interested in catching up?

\n\n\n\n

[00:29:03] Damon Cook: I think probably the easiest is X, I still call it Twitter. I am dcook. I’m always open. Yeah, reach out. I think 99% of my Twitter timeline is sharing WordPress ideas, outreach links. So yeah, you’ll find me for any WordPress stuff there.

\n\n\n\n

[00:29:21] Nathan Wrigley: Thank you so much. And, Seth?

\n\n\n\n

[00:29:22] Seth Rubenstein: You can also find me on Twitter, which I refuse to call X. Twitter.com/sethrubenstein. And I also share a bunch of Interactivity API and WordPress stuff.

\n\n\n\n

[00:29:29] Nathan Wrigley: Thank you. So this is the bit where I ask, is there anything that we missed? Is there something that you desperately wanted to get across that I failed to ask?

\n\n\n\n

[00:29:36] Damon Cook: To go back just a little bit, he was touching on performance. So one thing actually I wanted to speak to was the idea of the Interactivity API is a standard means for developers to pull in these kind of libraries and do interactivity experiences. And so using this API, you’re relying on, you know, a simple small bit of source code that is going to be integrated on every page. So that performance impact of not having to pull in an entire library, so it makes it a smaller source code that’s being pulled in, so that has a huge performance impact as well.

This is the last of the podcasts recorded at WordCamp US 2024, and our focus today is the Interactivity API. You may not be familiar with what this is and why it matters, so Damon and Seth will break it down, and explain how it might transform your WordPress websites in the future.

Damon starts off by defining what an interactive website is, giving examples such as single-page applications and dynamic elements like tabs and accordions. Seth adds his perspective on how interactivity aids both the end-user and website editors, making for a more compelling user experience and efficient content creation.

We get into why WordPress needed an Interactivity API, even though the platform already supports libraries like React. The Interactivity API provides a standardised way to create dynamic content, which is essential for modern web expectations.

We also highlight real-world examples, including faceted searching and filtering, which have been successfully implemented using this API. The conversation also touches on performance improvements brought by the API, emphasising how it can offload server resources by only updating necessary content.

Towards the end, we explore how the API is already being used in Gutenberg blocks and how it supports both developers and site builders. Damon and Seth also discuss the project’s development, encouraging more contributions and feedback from the community.

If you’re intrigued by improving your WordPress site’s interactivity and performance, this episode is for you.

Useful links

As announced at the 2024 WordPress Foundation Meeting, the Kim Parsell Memorial Scholarship has been expanded to include WordCamp Europe and WordCamp Asia. Traditionally supporting a woman WordPress contributor to attend WordCamp US, the scholarship now assists women facing financial challenges in attending these three flagship WordCamp events.

The scholarship honors Kim Parsell, a cherished member of the WordPress community and regarded as one of the first “women of WordPress”. Known fondly as #wpmom, Kim was a dedicated volunteer who devoted countless hours to the WordPress project and was a strong advocate for women entering the tech industry.

In 2014, Kim received a travel stipend from the WordPress Foundation, allowing her to attend the WordPress Community Summit held alongside WordCamp San Francisco—a transformative experience she cherished.The WordPress Foundation now offers this scholarship in her memory.

The announcement post states: “ This expansion honors Kim’s legacy and her dedication to inclusivity and diversity within the WordPress community, making it possible for more community members to attend these inspiring events.”

Applications are open until November 30, 2024, for both WordCamp Asia and WordCamp Europe, with notifications sent by December 21, 2024. Applications for WordCamp US will open in the coming months. The scholarship covers travel to the host city, hotel accommodation for the event duration, and a WordCamp ticket. It does not include airport transfers, meals, or other incidental expenses.

The scholarship’s inaugural recipient in 2015 was Anyssa Ferreira, a Brazilian designer, feminist, and WordPress community activist. Last year, it was awarded to Cynthia Norman, a WordPress developer and Web designer, with a background in training and education.

It was a huge pain in the butt, because my mail-in ballot didn’t register properly, but I found a last-minute flight to Houston and this morning walked over to Congregation Emanu El and voted. It is our most sacred duty as a citizen. I encourage every American to vote.

The third release candidate (RC3) for WordPress 6.7 is ready for download and testing!

This version of the WordPress software is under development. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, it’s recommended that you evaluate RC3 on a test server and site.

Reaching this phase of the release cycle is an important milestone. While release candidates are considered ready for release, testing remains crucial to ensure that everything in WordPress 6.7 is the best it can be.

What’s in WordPress 6.7 RC3?

Plugin	Install and activate the WordPress Beta Tester plugin on a WordPress install. (Select the “Bleeding edge” channel and “Beta/RC Only” stream).
Direct Download	Download the RC3 version (zip) and install it on a WordPress website.
Command Line	Use the following WP-CLI command: `wp core update --version=6.7-RC3`
WordPress Playground	Use the 6.7 RC3 WordPress Playground instance (available within 35 minutes after the release is ready) to test the software directly in your browser without the need for a separate site or setup.

Get a recap of WordPress 6.7’s highlighted features in the Beta 1 announcement. For more technical information related to issues addressed since RC2, you can browse the following links:

How you can contribute

WordPress is open source software made possible by a passionate community of people collaborating on and contributing to its development. The resources below outline various ways you can help the world’s most popular open source web platform, regardless of your technical expertise.

Get involved in testing

Testing for issues is critical to ensuring WordPress is performant and stable. It’s also a meaningful way for anyone to contribute. This detailed guide will walk you through testing features in WordPress 6.7. For those new to testing, follow this general testing guide for more details on getting set up.

If you encounter an issue, please report it to the Alpha/Beta area of the support forums or directly to WordPress Trac if you are comfortable writing a reproducible bug report. You can also check your issue against a list of known bugs.

Search for vulnerabilities

Update your theme or plugin

For plugin and theme authors, your products play an integral role in extending the functionality and value of WordPress for all users.

Thanks for continuing to test your themes and plugins with the WordPress 6.7 beta releases. With RC3, you’ll want to conclude your testing and update the “Tested up to” version in your plugin’s readme file to 6.7.

If you find compatibility issues, please post detailed information to the support forum.

Help translate WordPress

Release the haiku

We are thrilled to announce that following the latest WordPress Foundation Board meeting, the Kim Parsell Memorial Scholarship will now be available for WordCamp Asia and WordCamp Europe, in addition to WordCamp US. This expansion honors Kim’s legacy and her dedication to inclusivity and diversity within the WordPress community, making it possible for more community members to attend these inspiring events.

The scholarship is designed to support those who are passionate about contributing to WordPress, especially individuals who might otherwise face financial barriers to attending. By extending the scholarship to WordCamp Asia and WordCamp Europe, we aim to further empower community members around the globe to engage with and grow the WordPress community.

Scholarship Requirements and Application

The requirements for applying and the application forms for WordCamp Asia and WordCamp Europe are available below.

There is one scholarship position available to each flagship event (WordCamp Asia, Europe and WordCamp US). To be considered, applicants must meet the following criteria:

If you meet the above requirements and would like to be considered, please apply as soon as possible. Applications will be accepted until the closing date of 30 November 2024 for both WordCamp Asia and WordCamp Europe.

Stay tuned, as applications for the Kim Parsell Memorial Scholarship for WordCamp US will open in the coming months!

We look forward to welcoming more of you to these incredible WordPress events and celebrating Kim’s legacy together.

WordCamp Europe is now seeking a host city for its 2026 event. Teams with experience organizing one or more WordCamps in a European city are encouraged to apply. Although hosting the world’s largest WordPress event may seem challenging, applicants will have the support of an experienced core organizing team. The organizing team will work collaboratively for around nine months before the event to ensure all preparations run smoothly.

Applications are open until Friday, 15 November 2024. The final decision on the 2026 host city is expected by Friday, 29 November 2024. Applicants should consider an appropriate venue that can accommodate 1,500 seats in a main auditorium-style layout, with additional spaces for breakout tracks and workshops, as well as around 15 rooms for support functions.

The Host City Selection Committee is committed to fairness, providing equal assistance to all applicants. Applications will be evaluated based on survey responses, with rankings used to determine the final selection. Preference will be given to countries that have not previously hosted WordCamp Europe, as past events have taken place in the Netherlands, Bulgaria, Spain, Austria, France, Serbia, Germany, Portugal, Greece, Italy, and Switzerland.

The team from the selected city will be invited to join the organizing team for WordCamp Europe 2025 in Basel, where they will gain valuable insights. The current organizing team will provide guidance on processes, offer ongoing support, and ensure a smooth handover for the 2026 event.

I’ve been obsessed with Jacob Collier since I first saw his Don’t You Worry ‘Bout A Thing cover on YouTube, and one of my favorite genres of videos is genius musicians breaking down the incredible musical stuff Jacob is doing. (He even has his own instrument now.) This reaction and breakdown from Michael Palmisano, who is an incredible musician, go through Jacob’s amazing Little Blue video is amazing.

This week, I started my month-long hiatus from social media. It’s a completely arbitrary timing of my bi-annual ritual. Gutenberg Times post will be shared on LinkedIn and Mastodon, automatically posted using the built-in Jetpack feature. I’ll be back after Thanksgiving Nov 29th for a few weeks before I start my year-end vacation. You might see me posting from Core Days in Rome, Italy, though. I am excited to meet contributors there and post one or two selfies.

Speaking of Rome: it will be my first time there, and I booked a tour of Vatican City at 7am to beat the crowds. I got a few chuckles of disbelieve from hubby and other family members as I am normally not an early riser… I’ll let you know how it turns out.

PS: Voting for WP Awards 2024 is now open, produced by Davinder Singh Kainth. Consider giving your vote to the “Gutenberg Times” in the blog category and to “Gutenberg Changelog” in the podcast category, please. 🤗

Developing Gutenberg and WordPress

Nathan Wrigley of WP Builds invited me to start a new podcast series called “At the Core” and to discuss with him what next for WordPress. The first episode arrived on people’s podcast app this week: At The Core with Birgit Pauli-Haack – Episode 1. Wrigley is a master moderator and host. It was a great pleasure being on this show with him. We discussed a heap of information: about WordPress 6.7, WordPress Playground, Gutenberg experiments, and the 2025 default theme. And a lot more. Listen in.

Collaborative Editing: Inline comments

Pooja Bhimani, developer and project manager at Mulidots, together with other core contributors released the first and experimental version for inline commenting to the block editor. Before you can explore it, you need to enable the experiment “Block comments” on the Gutenberg plugin. It will be released with Gutenberg 19.6 next week. You can already take a peak via the Gutenberg Nightly on Playground.

Once enabled, you see an new menu item on the 3-dot-menu from the block toolbar, that opens a box in the sidebar to add your comment. A new icon appears in the toolbar once a comment is associated with a block. Then you can open, edit, delete or reply to the comment or ‘resolve’ the issue. When you click on the canvas, you can view all the comments for this particular post. Using the star on top of the comment sidebar, you can pin the icon to the top of the screen for easy access. You can use comments on pages or posts or any other custom post types. Once the post is published, inline comments are disabled.

As an MVP (minimally viable product) it works very well, apart from a few tiny quirks. Make sure to share your findings on GitHub or in the #outreach channel. The team also provides a list of what’s next for the inline commenting in this GitHub tracking issue

Plugins, Themes, and Tools for #nocode site builders and owners

On YouTube, Jamie Marsland, teaches you in WordPress Layouts! A Beginner’s Guide, how to master content widths and page widths for stunning layouts. Discover the 4 essential widths: Normal width, Wide content width, Full width and Custom width via Global Styles and learn how your various container blocks adapt to the settings.

At our friends over at WordPress.com, Tanya Thibodeau shared Five Powerful Gutenberg Blocks for Developers to Create Custom Layouts and explained how best to use the Group, Columns, Cover, Spacer and – my new favorite – the Query Loop block. Thibodeau has instructions and demos for each of them.

Justin Tadlock has updated the free X3P0: Breadcrumbs plugin with the option to remove the first breadcrumb. He also added a Markup Style option for selecting between plain HTML, Microdata, and RDFa (default) markup. Developer can also find new hooks that act as extension points.

Rob O’Rourke, principal engineer at HumanMade, introduced Lottie Lite for WordPress animations It’s a lightweight alternative to the Lottie Files plugin and is designed to offer a simpler, more efficient solution for WordPress users. O’Rourke shared in his post the genesis of the project as its key features and how they work. Check out Lottie Lite over on Human Made’s GitHub.

Theme Development for Full Site Editing and Blocks

Carolina Nymark, core contributor sponsored by Yoast, and Juanfra Aldasoro are the lead developers for this year’s WordPress default theme, Twenty-Twenty-Five. During this week’s Developer Hours they gave a behind-the-scenes insight into the making of the theme. The recording is available on WordPress TV: Developer Hours: Exploring the Twenty Twenty-Five Theme.

“Keeping up with Gutenberg – Index 2024”
A chronological list of the WordPress Make Blog posts from various teams involved in Gutenberg development: Design, Theme Review Team, Core Editor, Core JS, Core CSS, Test, and Meta team from Jan. 2024 on. Updated by yours truly. The previous years are also available: 2020 | 2021 | 2022 | 2023

Building Blocks and Tools for the Block editor.

In his tutorial, Building Custom Block Theme Templates: A Plugin Developer’s Guide, Ajay D’Souza, walks plugin developer through the process to providing templates to block themes. WordPress 6.7 will come with a new API for this use case, though. However what are plugin developers to do when they want to support older WordPress version, too? D’Souza has you covered. You learn about the nature of block theme templates and how to build a template handler, define your loading methods, and put it all together in an real-life examples.

ICYMI: The Recap: Hallway Hangout DataViews and DataForm Components is now available with the recording, a summary, details, shared resources and a transcript. Riad Benguella, André Maneiro, and I discussed with Nick Diego the evolution and future of DataViews and DataForms in WordPress. The overall focus of the demonstration was to showcase the current capabilities of DataViews and DataForm, as well as the plans for future extensibility and integration with the broader WordPress admin experience. The recording is available on YouTube

In Justin Tadlock‘s latest tutorial on the WordPress Developer blog, Getting and setting Block Binding values in the Editor, he walks you through making the data from your custom binding sources appear in the Editor and also letting users edit that data from the connected blocks.

This week in WordPress Playground

WordPress Playground is an exciting new platform that is the basis of a few features and tools around WordPress. Recently, it received a new, much more intuitive interface, that looks familiar to site editor users. You can learn more about this change from the new Make Blog of the Playground team. Running Multiple Playgrounds with WordPress Playground by Brandon Payton.

New Blueprints in the Gallery

Jonathan Bossenger, developer educator on the WordPress training team, added a blueprint to load the Create Block Theme plugin automatically to the next Playground instance. That way you can instantly start working on a new theme. Try it out.

Alex Kirk, web developer from Vienna, added a blueprint to turn Playground into a feed reader with the Friends Plugin. Using it allows you to read feeds from the web in Playground, and even via ActivityPub. Start reading (Add the Gutenberg Times via it’s feed URL https://gutenbergtimes.com/feed)

There are a few other blueprints for Playground are waiting to be discovered in the Blueprint Gallery. You can browse the list on GitHub or on any new Playground instance.

Now also available via WordPress Playground. There is no need for a test site locally or on a server. Have you been using it? Email me with your experience

Questions? Suggestions? Ideas?
Don’t hesitate to send them via email or
send me a message on WordPress Slack or Twitter @bph.

An interior decoration of a restaurant by wooden pieces. Malappuram, Kerala, India, by Sithara Koramparambil on WordPress Photos.

Automattic and Matt Mullenweg have filed a response asking the court to dismiss counts 1-6 and 9-11 of WP Engine’s lawsuit. WP Engine had filed a motion on October 18, 2024 for a preliminary injunction in a Northern California court, seeking restored access to WordPress.org and a reversion to conditions as of September 20, 2024.

In response, Automattic has filed three key documents: a Motion to Dismiss WP Engine’s Complaint, a Motion to Strike, and the Opposition to WP Engine’s Preliminary Injunction.

Automattic also tweeted, “Today, in order to protect the community from the threat posed by @WPEngine’s conduct, we have filed three documents with the court. These documents respond to WP Engine’s cherry-picked versions of events with critical context not found in their legal filings.”

Motion to Dismiss WP Engine’s Complaint

The Motion to Dismiss begins with the introduction, “Contrary to the allegations in WP Engine’s Complaint, the perpetrator responsible for the harms against the WordPress community is not Automattic or Matt Mullenweg (“Matt”). It is WP Engine itself. Despite its own (mis)conduct, WP Engine’s Complaint now asks this Court to compel Matt to provide various resources and support to private equity-backed WP Engine for free, in the absence of any contract, agreement, or promise to do so. The Complaint also seeks to restrict Matt’s ability to express openly his perspective that WP Engine’s practices negatively impact the WordPress software platform and community—a platform and community that has been his life’s work. There is no legal or factual basis for the Court to compel such access or restrict such speech.”

The motion argues that “WP Engine’s complaint is full of sound and fury, but WP Engine’s allegations ultimately signify nothing. Beneath the Complaint’s tone of indignation lies an utter absence of any factual allegations that do or could plausibly state a claim for relief. The Complaint strains mightily and misleadingly to conflate the WordPress software with Matt’s Website and with the WordPress trademarks, but it is devoid of any facts establishing that Matt has any obligation to provide the resources on the Website to WP Engine.”

It states that “WP Engine’s misleadingly curated Complaint focuses solely on the events of the last two months, but this story actually begins over two decades ago, when Matt created a new way to build websites.”

“Contrary to the allegations of the Complaint, Automattic, founded by Matt in 2005, does not own the WordPress software but rather offers three managed WordPress hosting services, WordPress.com for everyday users; Pressable, for agencies and developers; and WordPress VIP, for high-end enterprise sites including WhiteHouse.gov, NASA, Salesforce, and CNN. The WordPress ecosystem is also supported by the WordPress Foundation (“Foundation”)—a 501(c)(3) public benefit corporation dedicated to educating the public about WordPress and open source software. The role of the Foundation is charitable, educational, and scientific.”

The motion details the significant time and resources that Matt and Automattic contribute to WordPress.org. “Matt is the owner of the WordPress.org domain name. Matt created the Website to support the WordPress community and software. Over time, the content the Website provides has become more robust. It takes significant resources from Matt and others to maintain the Website. For example, Matt and other employees of Automattic contribute over 3,500 hours weekly to support and maintain the Website, including the core software and other features offered through the Website.”

The motion accuses WP Engine of leveraging WordPress resources for profit while failing to contribute meaningfully back to the community and profiting off the goodwill of the WordPress and WooCommerce trademarks. It alleges that WP Engine’s shift in practices began in 2018 when private equity firm Silver Lake took majority control, leading to intensified trademark use and an increased profit-driven focus.

Alleging trademark violations since 2021, the motion claims that WP Engine and Silver Lake have attempted to profit from WordPress’s reputation without bearing a share of the responsibilities. Matt had requested that WP Engine either license the WordPress trademarks or dedicate eight percent of its revenue to the further development of the open source WordPress software, but WP Engine declined.

When it became abundantly clear to Matt that WP Engine had no interest in giving back, Matt was left with two choices: (i) continue to allow WP Engine to unfairly exploit the free resources of the Website, use the WordPress and WooCommerce trademarks without authorization, which would also threaten the very existence of those trademarks, and remain silent on the negative impact of its behavior or (ii) refuse to allow WP Engine to do that and demand publicly that WP Engine do more to support the community.

The motion also states, “The mere fact that WP Engine made the risky decision to base its growing business on a site to which it has no rights or guarantee of access, without making backup plans, is not enough for it to conjure a claim out of legal thin air. Similarly, WP Engine’s business decision to rely on Matt’s Website does not provide any legal or factual basis for muzzling Matt and preventing him from criticizing WP Engine for acts that he believes are damaging the WordPress community.”

It continues, “The real unlawful activity here is WP Engine’s infringement of the WordPress and WooCommerce trademarks. This infringement was so egregious that in the days prior to filing this lawsuit, WP Engine scurried to delete various unauthorized uses of the WordPress and WooCommerce trademarks from its website—a tacit acknowledgement of their infringing nature.”

In short, WP Engine’s complaint fails to state claims concerning intentional interference with contractual relations, tortious interference with prospective economic advantage, Computer Fraud and Abuse Act violations, attempted extortion, and unfair competition under California Business and Professions Code § 17200.

Motion to Strike

Automattic and Matt Mullenweg have moved to strike parts of WP Engine’s complaint, citing California’s anti-SLAPP law. They argue that WP Engine’s “claims fail as a matter of law and must be struck under California’s anti-SLAPP law because they improperly seek to impose liability for commentary and debate on an issue of public interest—namely, WP Engine’s commitment (or lack thereof) to the WordPress community – without any valid basis. WP Engine’s attempt to stifle public discussion of those issues via these claims violates California law and should be stopped here.”

The motion also asserts, “Matt was speaking and writing in his individual capacity as WordPress’s co-founder, and not as CEO of Automattic. There is no basis to impute his statements to the company. For these and other reasons, WP Engine’s ninth, tenth, and eleventh causes of action should be stricken.”

WP Engine’s defamation claims are based on statements Mullenweg made on public platforms, which his attorneys argue are protected by the First Amendment and California law.

Mullenweg’s comments about WP Engine’s “parasitic” behavior were part of a broader conversation on the tragedy-of-the-commons theory, explaining the critical importance of meaningful, sustained contributions to the WordPress community through the Five for the Future initiative. Besides, WP Engine does not challenge any of Matt’s statements.

WP Engine’s trade libel claim fails to plausibly allege another required element: WP Engine has not identified any specific third party who was deterred from conducting business with WP Engine as a result of Matt’s Statements.

Opposition to WP Engine’s Preliminary Injunction

Automattic and Matt have requested the denial of WP Engine’s motion, arguing that “WP Engine conflates the open source WordPress software with a website located at wordpress.org (“Website”) that is provided by Matt. The Website is distinct from the WordPress open source software platform and both are distinct from Automattic and the WordPress Foundation, a nonprofit public benefit corporation that was organized exclusively for charitable, scientific and educational purposes, not commercial endeavors. WP Engine’s CEO Heather Brunner feigns ignorance and reliance on a false understanding that an educational foundation was responsible for the Website that provides resources for commercial endeavors.”

WP Engine has always had unrestricted access to the open-source WordPress software and plugins, which do not require login credentials. The only resources it cannot access are certain developer tools on WordPress.org, previously used to manage plugin versions. WP Engine quickly restored its lost functionality by hosting its plugins independently on its own website.

WP Engine also seeks to limit competition by asking the Court to prevent Matt from criticizing its actions and to restrict Automattic from offering promotional incentives to consumers. Automattic contends that WP Engine’s purported damages, such as customer losses, result from WP Engine’s service quality rather than any actions by the defendants.

Also “Matt does not and never has had any contracts, agreements, or obligations to provide WP Engine access to the Website. Nor did WP Engine pay any operating costs towards the Website or to access the Website for this convenience.”

After losing access, WP Engine implemented a solution restoring its workflow by linking its plugins to its own servers. This setup has been operational for over a month, making any claimed harm from access denial either nonexistent or resolved.

Since ACF plugin has over two million active installs, so any security vulnerability within ACF would threaten a substantial portion of the WordPress community, the WordPress security team forked that plugin, and named that fork SCF. The public was also notified of the developments.

“WP Engine experienced a loss of income or capital in that intervening period, these losses are the result of its decision to freeride off the Website and Matt’s extensive efforts to support and maintain the Website, all the while knowing it had no contractual agreement entitling it to the continued receipt of those resources. WP Engine gambled, for the sake of profit, on Matt’s continued maintenance and provision of the Website for free. Having lost that bet, it cannot now come to the Court complaining of the consequences.”

If an injunction is considered, the defendants argue that it should only cover access to WordPress software and plugins. WP Engine should also be required to post a bond compensating Matt for any services he might be compelled to provide, as well as Automattic for any lost revenue due to restricted competition. Maintaining WordPress.org involves annual administrative and operational costs estimated at $800,000. If WP Engine is granted ongoing access, a bond of at least $1.6 million should be posted to cover these services for the case’s expected two-year duration.

“After engaging in conduct that undermines the WordPress community, WP Engine and its private equity owner, Silver Lake, have resorted to making unfounded allegations against the founder and vanguard of the open source software.”

“WordPress open source software remains freely available to all. But WP Engine is not entitled, either legally or morally, to have unfettered access to WordPress.org—a website Matt Mullenweg built for the benefit of a robust community.”

“Preserving and maintaining the resources made available on WordPress.org requires considerable effort, investment, and a shared sense of mission that the plaintiff does not embrace. WP Engine and Silver Lake should not expect to profit off the back of others without carrying some of the weight, and that is all that Matt is asking.”

The court will next hold a hearing on November 26, 2024 and WP Engine has until November 4 to respond to Automattic and Mullenweg’s filings.

On Wednesday I had a great chat with Connie Loizos, the editor in chief of TechCrunch, you can view the video here:

During that chat, I talked briefly about a trademark infringer that was also distributing nulled plugins. I said “Not illegal. Legal under the GPL. But they weren’t changing the names. They were selling their customers Pro Plugins with the licensing stuff nulled out.”

I want to be clear that my reference to legality and GPL was solely focused on the copying and modifying of the code. That is one of the key freedoms of open source and GPL: the right to copy and modify GPL code.

I was not speaking about their right to charge money for nulled plugins. GPLv2 prohibits that because they aren’t providing physical copies or support. This is very different from reputable web hosts, who provide hosting and support for websites and e-commerce stores.

We’re excited to announce the release of native integrations for the Gravatar Mobile SDK, now available for both iOS and Android. These SDKs make it easier than ever to integrate Gravatar’s powerful avatar and profile management features into your mobile applications.

What’s New?

Our platform-specific SDKs leverage native UI frameworks – Compose for Android and Swift UI for iOS – to provide seamless integration with your existing mobile applications. Each SDK is carefully crafted to follow platform-specific best practices while maintaining consistent functionality across ecosystems.

One of the more exciting additions is our new native Avatar Change Flow – a complete, ready-to-use UI component that can be embedded directly into your app. This feature eliminates the need to build your own avatar management system, saving you valuable development time. Users can easily update their Gravatar image through a polished, platform-native interface that handles all the complexity of image selection, cropping, and uploading.

Key Features

Platform-Specific Benefits

Android SDK

iOS SDK

Getting Started

Visit our GitHub repositories to start integrating Gravatar into your mobile apps:

Security and Privacy

Your users’ privacy and security are our top priority. The SDK implements secure data handling via oAuth and gives users full control over their profile visibility.

Coming Soon

We’re actively working on expanding the SDK’s capabilities with full profile editing support. This upcoming feature will allow users to manage additional profile fields and user information directly within your app, making it even easier to provide a comprehensive Gravatar integration experience.

We’re committed to improving the developer experience and would love to hear your feedback. Try out the new SDKs and let us know what you think!

[00:00:00] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley.

\n\n\n\n

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, how education and WordPress can work hand in hand.

\n\n\n\n

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

\n\n\n\n

So on the podcast today, we have Aaron Reimann and Keith Osburn.

\n\n\n\n

Keith is the chief information officer and Deputy Superintendent for Tech Services at the Georgia Department of Education. With a rich background in both education and technology, he’s been instrumental in driving tech innovation within the state’s education system.

\n\n\n\n

Aaron runs ClockworkWP, a WordPress agency, and boasts extensive experience in web development dating back to 1996.

\n\n\n\n

Together, they’ve been leveraging WordPress to tackle some of Georgia’s most pressing educational needs.

\n\n\n\n

We start off by discussing the financial advantages of using WordPress to achieve cost efficiencies compared to pricier alternatives. Keith shares his insights into how Georgia has successfully rolled out community focused sites and specialized platforms for the state’s educational staff.

\n\n\n\n

The conversation moves on to their collaboration with other states, advocating for open source solutions to solve enterprise level problems.

\n\n\n\n

We get into the infrastructure choices, including dedicated Azure servers for individual WordPress instances, ensuring better control and scalability.

\n\n\n\n

We also touch on their strategic approach to resource discoverability and user engagement. Highlighting significant traffic and potential for growth through grants and professional learning events.

\n\n\n\n

Aaron and Keith elaborate on the importance of accessibility, GDPR compliance, and the role of collaboration in addressing security and legal concerns.

\n\n\n\n

One standout part of this episode features the culinary sites they created, aimed at helping Georgia schools manage cafeteria recipes and nutritional information. Streamlining a previously manual task, and saving significant time for school staff.

\n\n\n\n

Towards the end, we discuss the cultural shift towards open source platforms, emphasizing the flexibility, cost-effectiveness, and community driven spirit of WordPress in education.

\n\n\n\n

If you’re curious to learn about how technology can enhance educational systems and promote global collaboration, this episode is for you.

\n\n\n\n

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

\n\n\n\n

And so without further delay, I bring you Aaron Reimann and Keith Osburn.

\n\n\n\n

I am joined on the podcast today by Aaron Reimann and Keith Osburn. How are you both doing?

\n\n\n\n

[00:03:47] Aaron Reimann: I am doing well, thank you.

\n\n\n\n

[00:03:49] Nathan Wrigley: You’re welcome.

\n\n\n\n

[00:03:50] Keith Osburn: Nathan, thank you so much for having us today. Really excited to be with you today. Doing very, very well.

\n\n\n\n

[00:03:55] Nathan Wrigley: Thank you so much. We’re here at WordCamp US. We’re in Portland, Oregon. We’re going to be talking today about education in the state of Georgia in particular, and how WordPress is being used to, well, hopefully make the job of teaching, the profession of teaching, a little bit more straightforward with the benefit of technology.

\n\n\n\n

Before we begin that, I wonder if you would both in turn like to give us your little bio, because I know you have very different roles in life. So maybe if we start with you, Keith, just a short bio about who you are and what you do.

\n\n\n\n

[00:04:22] Keith Osburn: Absolutely. So thank you so much Nathan. So, again, my name is Keith Osburn. I serve as the Chief Information Officer and the Deputy Superintendent for Tech Services for the Georgia Department of Education. And so my team is both responsible for the technology that the department uses, but also helping ensure that educational technology has a purpose, a meaningful purpose, if you will, in the school systems throughout Georgia.

\n\n\n\n

[00:04:45] Nathan Wrigley: Is your background then more in tech, or more in education, or a bit of both?

\n\n\n\n

[00:04:49] Keith Osburn: It’s actually a bit of both. So I was a classroom teacher for a number of years. I taught chemistry and physics at the high school level. Again, I’ve been in education for 35 years, and so I was there long enough to see really the first introductions of technology into the classroom, and just became really fascinated with that, and began to ultimately merge into that, and became a technology specialist, and a Chief Information Technology Director, and then ultimately moved to the State Department.

\n\n\n\n

[00:05:14] Nathan Wrigley: Thank you so much. So I guess we’ll hand the mic to Aaron and, yeah, tell us a little bit about yourself.

\n\n\n\n

[00:05:19] Aaron Reimann: So my name’s Aaron Reimann and I run an agency called ClockworkWP, and we specialise in pretty much anything WordPress. We’ve grown a lot in the past year and a half or so, and we’re about, depending on how you count everybody, we’re about 14, 15 people or so. And I’ve been doing WordPress since 2008, and been doing web development since 96. So I have got a lot of gray hair because I’ve been doing it for a long time.

\n\n\n\n

[00:05:44] Nathan Wrigley: How did you two hook up, if you don’t mind me asking? Do you both have some sort of hobby that crosses, or did you go out looking?

\n\n\n\n

[00:05:51] Keith Osburn: That’s an interesting, love that question, and it’s a great story that we love to tell. So I do have an interest in both the open source community, and certainly WordPress in addition to that. But actually there’s a unique event that happened. We had an event, a WordPress meetup that happened to be virtual, and one Aaron Riemann happened to be speaking that night. And as it turns out, I had a situation that had arisen within Georgia, and it was during the time of the pandemic, where obviously as you well know, we as a society completely socially distanced.

\n\n\n\n

But training needed to happen. And specifically our bus drivers throughout the state of Georgia needed annual security training, safety training. And we were trying to think, how do we train them? But at the same time, we can’t get them together. And so obviously technology became an opportunity for us. And so my team and I, we built a small WordPress instance. We used a plugin called Learn Dash. I’m sure you’re probably familiar with that.

\n\n\n\n

What happened was nothing less than just stellar growth that happened. You know, we had 50 people one day, we had 500 people in the next couple of days. And then it just really became quite asymptotic. As it turns out, you know, I just was in the event just because of my interest there, and as I listened to Aaron talk, and he began to talk about hosting some types of things, it just really formatted my mind that he and I needed to talk. So I said, Aaron, will you remain on the call after you’re done, please. You and I need to talk. And that formed a lasting bond, and a great public private partnership, if you will, of which all the stuff that we’ll probably talk about today has materialised from. So, great event.

\n\n\n\n

[00:07:21] Nathan Wrigley: Nice. That’s really great. Is there anything you want to add?

\n\n\n\n

[00:07:25] Aaron Reimann: I would just say, I lead the Atlanta WordPress meetup, and that to me is just a big plug. If you’re trying to get into a WordPress community, you can get good clients by doing that. So I love the WordPress community. So doing a little plug there.

\n\n\n\n

[00:07:37] Nathan Wrigley: Well that’s great. Thank you so much. Now, in the UK, which is the only educational format, for want of a better word, the only educational locale that I can talk about, I don’t know if it in any way resembles how it is in the US, but my impression of the US is that it’s atomised by state. So the things that you do in Georgia may well be different from how they’re done here in Oregon, and Portland, and all over the place.

\n\n\n\n

But in the UK, I don’t know, probably about 20 years ago, the technological area of education was kind of flooded by proprietary, paid for services. You know, Microsoft stepped in and dominated the kind of desktop space, and a whole bunch of other things. But then there was a move much more recently to free and open source software. I think there was a thought that in the future we want to be educating our children in how to do open sourcey things, and we had this lovely thing called a Raspberry Pi which came along, which really kind of opened the technology of the hardware up to children.

\n\n\n\n

But I just wondered if we could get into the open source nature, and whether or not that’s an important part of the Georgia landscape, free, open source software? Or do you find yourself being compelled by state legislation to use proprietary, paid for software?

\n\n\n\n

[00:08:46] Keith Osburn: Wow, great question. And you’re right, it could very well vary by state. Every state has something that’s probably unique about them, and in regards to education that could be driven by legislation law, or policy procedures, those types of things. In this particular case, and certainly, you know, an enterprise organisation as large as we are, Georgia’s population as a whole is about 10.8 million people. We have 2 million students. 230 plus districts. 2,500 schools. Each one of those, by the way, have some degree of local control. And so, we as a state, our job is to provide service and support.

\n\n\n\n

I think what started this conversation for me as a state chief was really beginning to notice a change in the landscape, especially as it relates to technology. And you’re right, the big enterprise organisations still have a footprint, and a necessary footprint in there. However, I think the conversation gets interesting because, around the time of the pandemic, I think the mentality about the purposes of software and software solutions changed. And I say in yesteryear, oftentimes there were solutions that were built, and then people begin to look for, hey, how do we apply this? Where’s a problem? Let’s find a problem.

\n\n\n\n

Today there are problems already, and so we build towards that. Which means that really what we need to do is look for opportunities to be much more agile and responsive, because we’ve identified a need. This is what’s strong within the open source community, and certainly whenever you think about the culture of WordPress, this is what makes them such a strong, and what I consider to be a viable opportunity and solution for us.

\n\n\n\n

And so I specifically went because I appreciated that that culture was going to give me what I needed. That really agile opportunity for me to be responsive to solutions that were already needed, and thus the community could customise, highly customise, I should say, solutions for exactly what the problem happened to be.

\n\n\n\n

[00:10:35] Nathan Wrigley: It’s interesting, in the UK about 15 years ago, children were being taught how to use Microsoft products. That was the curriculum. How do you create a Word document? How do you use a spreadsheet? Now it’s more, how do you program? How do you learn fundamentals of programming? How can you use Python? How can you use PHP and things like that? So there’s a real shift. And whilst it may not be pointing the finger directly at WordPress, it’s definitely moved in that kind of direction. And obviously the more open source things that you can put into the institutions, the more value for money you’re going to get out because you don’t have to pay these giant software licenses.

\n\n\n\n

But getting to the topic at hand today, and I should just point out that both Aaron and Keith have done a presentation at WordCamp US, and I’ll link to that in the show notes, that kind of will outline the conversation that we’re having. But what was the problem in Georgia that you wanted to solve, that you needed WordPress for? So I’m just going to leave it as open as that. What were you trying to fix with WordPress?

\n\n\n\n

[00:11:28] Keith Osburn: Yeah, yeah, absolutely. It goes back to that first story I told that as, you know, education in and of itself is a communication based, people driven thing, right? And so as our teachers, the 300,000 teachers and staff across Georgia became socially distanced, they still had at their primary need to educate children. In order to do that, communication has to happen.

\n\n\n\n

And you can imagine that natural communication between you and I sitting across the table is quite easy. When you put technology, or you need to put technology in there, there need to be some guardrails, there need to be some opportunities to allow for that growth that doesn’t necessarily kind of stymie what needs to happen.

\n\n\n\n

We begin to kind of conceptualise on this idea of saying, hey, we’ve got now 300,000 staff members that are dispersed, socially distanced from one another, but they still need to communicate.

\n\n\n\n

And so we concocted this idea that now has become what we call our community project, where we found a specific WordPress solution, coupled with some plugins that we used, that enabled us to really facilitate both synchronous now, and asynchronous conversations, that were content and topic specific. So that we could link together math teachers, or we could link together science teachers regardless of their location, geography, and enable that conversation to still happen.

\n\n\n\n

So that site, literally again, we had no idea that it would grow the way that it did. We were probably anticipating that we would have literally linear year growth, but it became quite asymptotic. To this day we now have a WordPress instance of a community that has 88,000 viable ongoing conversations inside of that with about 500 people adding to that each week. 240 unique groups that exist inside of this platform. So it is truly this new technical society, if you will, that supports the communication needs of teachers across the totality of the state.

\n\n\n\n

[00:13:18] Nathan Wrigley: Given that this all was promoted by the pandemic, or at least that’s the takeaway that I got, was this a case of suddenly scrambling around for a solution that had to be implemented yesterday, more or less? And I’m curious because in the UK at the moment, and this has nothing to do with education, a lot of those solutions are now beyond their sell by date, if you know what I mean. You know, things were cobbled together ever so quickly, they worked for a period of time, they were sort of hanging together, and then it’s turned out that actually, probably with hindsight, if we’d have had six months lead time on this, we probably would’ve done something different.

\n\n\n\n

But it sounds like what you have has stayed the test of time, has managed to keep going, and it wasn’t a cobbled together solution. It worked exactly as you’d expected, or has it been an iteration and an evolution?

\n\n\n\n

[00:13:59] Keith Osburn: And that’s absolutely where interstates left Aaron, because the initial iterations of that were right. My team at the time didn’t necessarily have say WordPress engineers, or experts in that. I probably was the one, and I already had a day job being a CIO. And so we quickly outgrew what the initial iteration of that was, and began to recognise. That’s that serendipitous event where Aaron just happened to be doing a WordPress meetup, and I happened to be on that, and I recognised, just listening to him, I was like, I need that guy, and I need his team.

\n\n\n\n

And so thus begin that union. And I remember our first conversations were like, listen, we’ve built something and we’ve outgrown it almost overnight. We need some real help, and we really need to begin to kind of strategise and strategically plan on this thing because, again, it’s not growing linear, it’s growing asymptotically, and so we need to plan for that.

\n\n\n\n

And that’s I think really important point to be going back to that first question that we had about this idea of public private partnerships now, are critically important, because you see that expertise in a particular area who can listen to somebody whose expertise happens to be in this case education and saying, here’s where our problems at, here’s our soft spots. And he says, okay, this is what me and my team do, this is the way that we’re going to collaborate to build a solution that will meet the needs today, but ongoing with that in the future as well.

\n\n\n\n

[00:15:15] Nathan Wrigley: So maybe this question is going now to Aaron. We know that it’s got something to do with WordPress, we know it’s got to do with Georgia, and we know it’s got to do with education, but beyond that, what are the specific things that you’ve had to build? Is this like a portal for children? Is it a portal for the teachers to get together and communicate lesson plans? What have you had to build?

\n\n\n\n

[00:15:33] Aaron Reimann: There’s been I think a total of nine projects that we’ve done. The first project was the community project where they basically had a WordPress install on a server that just couldn’t handle the traffic, it grew overnight. We split that up into two different servers where MySQL’s on its own little thing, and nginx is on its own. That was just a quick little fix to split it up. We’ve moved it into the Azure framework since then.

\n\n\n\n

We’ve done some marketing sites to, I guess the PHP list is an application that we are using that we’ve internally converted, basically they have a LISTSERV. There’s an old school LISTSERV that the state was using and has nothing to do with WordPress, but I was like, well, we probably can help in that situation.

\n\n\n\n

I picked this open source project, PHP list, and then realised later that it doesn’t have everything that we needed built in. So my team has built that application out. So that’s not necessarily WordPress, but I mean it’s open source and PHP. But we’ve done marketing sites to the culinary site.

\n\n\n\n

[00:16:36] Nathan Wrigley: That’s interesting, culinary.

\n\n\n\n

[00:16:37] Aaron Reimann: So basically we have built, there was a need for the schools, how many cafeterias are there in Georgia?

\n\n\n\n

[00:16:45] Keith Osburn: Well, there’s 230 districts, there’s about 2,500 schools, so you can imagine. We’ll go with that number because every one of those schools is going to have a cafeteria. And that’s a nutrition program.

\n\n\n\n

[00:16:54] Aaron Reimann: Okay. So they don’t have, up until recently, they didn’t have a way to share recipes. And now there’s an application where anybody in the school can go in and set up a five day schedule with all the recipes that has all of the nutritional information about each vegetable, and meat, and all that. And so they can basically print that out, and say that, and use that for the school. And there was nothing like that out there. It’s not super complex what was built, but I mean, we’re using WordPress with custom post types, and WordPress gives us a lot of flexibility to build those things out.

\n\n\n\n

[00:17:30] Nathan Wrigley: So it sounds like it’s mainly for staff. It’s not forward facing for children to access content. It’s like a CMS for bits and pieces that educators and people, I don’t know, it sounds like people working in the kitchens and things like that might need to use. So it’s not directly forward facing to the children, but it’s all of the minutiae of how to manage a school, and how to get teachers communicating with each other, that kind of thing.

\n\n\n\n

[00:17:54] Keith Osburn: Absolutely. And I think probably a value add is to say that we strongly believe, and I think all of us probably here do that the power is in the teacher. The power is in the school staff. They’re the ones that are doing the work. Our jobs are to provide services and support, certainly at a state agency as well. That’s probably a primary role for us.

\n\n\n\n

And so specifically we were targeting solutions specifically for teachers, for the wraparound staff so that they could do the great work that they do. In this case, one of the things that was mission critical to us was trying to find out that we could use technology as a way to ultimately save them time.

\n\n\n\n

There are a lot of mundane things that happen, a lot of reiterations of things that really technology, if we’re innovative, can take that time, and do that task, and give that back to either the teacher, or the staff member, or whatnot.

\n\n\n\n

Again, here’s an opportunity where nutrition staff we’re probably laboriously sitting down spending countless hours looking at products that says, what are their nutritional values, and how do we pair that with this over here? And now what we’ve done is we’ve implemented a technological solution that literally does what normally would’ve required hours. We’re doing that in now mere minutes and seconds. That’s a win-win. That’s a huge win-win.

\n\n\n\n

[00:19:03] Nathan Wrigley: So it’s reducing the amount of paperwork. It sounds like you’re moving away from a paper-based system into a more technologically, everything is data basically. And WordPress’ motto if you like is democratising publishing, but this feels like democratising information, democratising education. And I can barely think of a better use of WordPress than education. It just ticks every single box, doesn’t it? It’s perfect.

\n\n\n\n

[00:19:28] Keith Osburn: We totally agree in that. And you know, again, that goes back to the very start of our conversation where it’s like, what was it about free and open source software? It was like, again, the opportunity for us to, from my world as a CIO in an education vertical, say, I see this problem, and then say, how do I with experts in this case, Aaron and team say, here’s my problem. I can pretty much verbalise that. And he says, okay, I understand that, I can wrap a solution around that, and we can do this working together in a very responsive fashion. That’s the win-win, I think from this.

\n\n\n\n

And now for us, we’ve seen so many wins immediately, I don’t think that we’ve had any where we’re saying, oh, it was a good try, but no, that’s not going to work. It’s every one has been something that we’ve built on the previous one. And every one of those solutions has been incredibly effective.

\n\n\n\n

You heard Aaron talk about the fact that we’ve got several projects. We’re in the midst now of taking our state website, and we’re going to bifurcate that because there’s information that’s destined for public stakeholders. There’s also information that’s really pertinent to our school districts and whatnot.

\n\n\n\n

And so we’re, one more time we’re using WordPress in this instance to build a website that is unique and able to deliver for our public stakeholders the information that they find viable, and that they need.

\n\n\n\n

It doesn’t have to be all so complex with other information that’s really destined for school leaders, or school district personnel, or teachers in this case instead. Now, through a bifurcated process, we’re able to deliver information that is necessary for the time for that specific individual. So this highly customised solution, suddenly WordPress has helped us achieve.

\n\n\n\n

[00:21:00] Nathan Wrigley: Yeah, I know that there’ll be instances where WordPress will not be the best fit because there’ll be proprietary software, which is just superior. And there’ll probably be data protection concerns and things like that for, I don’t know, salaries, and payroll, and all sorts of things that I can imagine.

\n\n\n\n

But would your intention be to get WordPress’s foot in the door for many more things in Georgia, or are you happy with where you’ve got to so far? Or would the idea be to keep going back to Aaron and say, actually, here’s another area where we might be able to squeeze WordPress into the mix.

\n\n\n\n

[00:21:27] Keith Osburn: I’ll answer that by saying, a few years back when we began to kind of realise that, in the world of education, I say that technology changed from a gee whiz bank state to become mission critical. We recognised that that was a pertinent question to ask ourselves.

\n\n\n\n

And so we created a team called Knowledge and Resource Management, and that’s all that they do. Their job is to think about digital and data that’s constructed as a result of these technological processes. And think about, how does this enable us to better understand what we’re doing today, but also begin to think about what’s our innovation schedule as we kind of move forward?

\n\n\n\n

And so that’s what they do is really sit down in advance. We as a leadership team, we sit down and we begin to kind of strategically plan. Obviously the student and the teacher, if you will, is at the center of our planning. Our job is to think about, how do we customise solutions that will help them better.

\n\n\n\n

And at this point in time, it’s not ever that free and open source is just a, I’ve run out of tricks, let me go see if this thing can do it. It’s a vital part of the conversation during the strategic planning process. And if that’s the solution, that’s the solution. And it’s just like, we look at that on the same level and the same ground as we do, various other enterprise solutions.

\n\n\n\n

The one thing that I believe that’s really important to note that we’ve proven here is that there could have been this perception of many that say, WordPress can’t obviously meet up to this enterprise need. Actually, we’ve kind of blown that out the water. We literally have staggering numbers. 88,000 and hundreds of thousands of people that hit the website, and those types of things. And we’re showing WordPress is absolutely capable of working in the enterprise. And so it needs to be considered a viable part of strategic plan if it’s the one that fits that need.

\n\n\n\n

[00:23:05] Nathan Wrigley: One of the best things about WordPress is the fact that somebody’s very often built the very thing that you need. There’s a plugin that fits the bill. And I’m just wondering if that was the case in this scenario Aaron. Were you able to take pre-built things and thereby save the state a bunch of money because actually somebody’s already built the CMS, or the plugin that would handle the recipe side of things, or was this a ton of custom code right from the ground up?

\n\n\n\n

[00:23:28] Aaron Reimann: We used a lot of plugins at the beginning to get, I guess I can promote, we use Gravity Forms all the time. It gives us so much flexibility and it’s so easy to integrate. Hook into filters, and send information out.

\n\n\n\n

So we’ll use a lot of plugins at the beginning, and then we have to, not always, but most of the time we have to tweak it a little bit. We need to add, oh, we need it to do this thing so we might write a plugin to hook in and modify the way Gravity Forms works. Or it might be a totally, this doesn’t exist, and we have to build it. But I mean, we always will vet plugins, make sure that they’re going to be safe, and secure, and give us the stability we need. And if it doesn’t, we’ll write it.

\n\n\n\n

I would say every site that we build, we do use basic, common plugins. I mean, Yoast and things like that. I mean, just plugins that everyone uses. And then most of the time we have to do a little customisation.

\n\n\n\n

[00:24:22] Nathan Wrigley: Have you been talked to by the Georgia authorities in terms of, well, we use the term GDPR because that’s just the one that we’ve got, but it’s this overarching privacy legislation, which really gets its teeth into more or less everything that you do with websites. Is there anything like that that you’ve had to, I don’t know, you’ve had to build something custom because the plugin doesn’t seem to satisfy this privacy thing, or it doesn’t do this particular thing?

\n\n\n\n

So in the UK the GDPR and things like that really do compel you to look really hard, especially when it’s public sector stuff. You’ve got to look really hard at the code and make sure, okay, it definitely isn’t keeping data. It definitely isn’t sending data somewhere else. I can a hundred percent vouch for it. It’s not a case of, yeah, I’ve used Gravity Forms before, that’s fine.

\n\n\n\n

[00:25:05] Aaron Reimann: I’ll just say GDPR. I know all of that stuff is coming, and more and more states are requiring it. I mean, one of the things I think about is accessibility. That’s becoming super important, and we always want to make sure when we build a site, specifically for the state, that we go through and we hit whatever level. There’s multiple levels of accessibility that we try to meet. And that, I would say that’s probably more important for us now than any type of GDPR stuff. But I know that’s coming probably in every state.

\n\n\n\n

[00:25:34] Nathan Wrigley: Yeah, so the accessibility piece. Well, you can’t build any of these things unless there is accessibility. And I don’t know what the WCAG standard is that you have to adhere to, but I’m guessing you have to be pretty mindful of the accessibility piece.

\n\n\n\n

[00:25:47] Aaron Reimann: Absolutely.

\n\n\n\n

[00:25:48] Keith Osburn: Yeah, and if I go back to that, it’s so important, and you heard me mention our Knowledge and Resource Management Team. Whenever the project for rebuilding the website happened. I’ll tell you that, we planned for more than a year before we ever even began to kind of think about code, because of that.

\n\n\n\n

One of the things that’s really important for us today is, number one, again, you heard me say earlier, we’re producing digital data far more than we ever have in past. And as a result of that, you’re right, the game’s changed. We have to think about that. Think about where that’s going to reside.

\n\n\n\n

Who were those data generated as a result of? If it’s a student, obviously we take great concerns because we’re considered to be the stewards of their data, right?

\n\n\n\n

All that happened during project planning. And I remember us specifically, part of Aaron’s team sitting down with my team in that respect and saying, okay, we’re going to talk about this, we’re going to talk about the fabric that we’re going to build this on top of. We’re going to talk about any kind of security concerns, accessibility, those things. That’s part of the culture now. And I think that’s really a great question that you ask because I think that is of paramount importance.

\n\n\n\n

Now, to Aaron’s point. Before a project ever starts, we should know all that in advance, right? We’re all going to sit down. And while there are unique needs per state, by and far, I think we’re all moving towards the same area. And that is that accessibility should be always covered. That’s just a non question, it’s got to be done.

\n\n\n\n

The other’s really data privacy, those types of things. It’s going to be taken care of beforehand. And then at that point in time, now Aaron knows that we’ve taken care of that, so now as he begins to kinda look at the various plugins, he now has a little opportunity to begin to kinda look into the T’s and C’s of those plugins and say, hey, if there’s something unique about this, he’ll bring that question back.

\n\n\n\n

I have a data privacy officer and say, hey, what’s going on with this? Is this something that’s in congruence with state law in Georgia, or is this something that we need to look at from that? So prior planning has enabled us to really be able to make sure that whenever we begin to write code, that we’re very aggressive, very responsive, and we’ve kind of already taken care of the hiccups if you will.

\n\n\n\n

[00:27:41] Nathan Wrigley: Financially, does free and open source software like WordPress, does that impress the bean counters, the accountants on your side of things? Is it a fairly compelling argument to go to them and say, look, we could pay hundreds of thousands of dollars for this thing over here, but look, we’ve got this WordPress thing and the software itself is completely free, there’s a bunch of plugins that are a few hundred dollars? I’m guessing there’s some fairly compelling argument.

\n\n\n\n

[00:28:03] Keith Osburn: Yeah, that’s a great question. I’d say that’s probably a growing question. I don’t know that it’s gotten to the point now where like all the accountants come to me and say specifically this versus that. But I will say that, as a state chief, I’m ethically and from an advocacy standpoint, responsible for ensuring the good stewardship of tax dollars because that’s what I’m spending.

\n\n\n\n

That is factored into every conversation that we have to say, is this a good spend, and are we going to get the solution based on the strategic initiative that we needed to address? And so that really is a part of my team. When we begin to sit down and strategically plan, we have identified that there’s a need. And then we begin to say, what’s the best way for us to get there?

\n\n\n\n

It’s just now, as I said earlier, WordPress isn’t one of those things that we consider whenever we’ve run out of options. Now, it’s really a part of the ongoing conversation to say, we’ve proven that this could be a viable solution. If this is the viable solution, this is the path that we’re going to take. And by the way, we found out that this is a very cost efficient way for us to do something and still get efficacy when we’re done with that.

\n\n\n\n

[00:29:05] Nathan Wrigley: And do you speak to people who have the equivalent job to you in the other states?

\n\n\n\n

[00:29:10] Keith Osburn: Absolutely.

\n\n\n\n

[00:29:11] Nathan Wrigley: And they found this conversation to be of interest, and have they looked favorably on what you are doing in Georgia?

\n\n\n\n

[00:29:16] Keith Osburn: Yeah, I will say that there’s a couple of states that we now have really begun to kind of work as a group to really showcase the opportunity for us to kind of expand our own vision and say, don’t think that the big box, aisle seven, row three solution is just the only way to go. But instead, maybe Chief Information Officer should also be considered to be Chief Innovation Officer now.

\n\n\n\n

And we should just begin to kind of look and say, our job is to figure out the best way to solve that problem, or provide that solution, not look for an opportunity to buy something that maybe fits that. Maybe, or maybe not, or maybe 70%. But instead say, no, let’s figure out the way to solve that problem over there. Open source, free open source solutions could very well be a very viable, and we’ve proven that it could solve enterprise level problems.

\n\n\n\n

[00:30:05] Nathan Wrigley: I’m just going to a quote something from the blurb of the presentation that you’ve both been involved in at WordCamp US, and it says the following. In the past three years, Georgia established a community focused site for statewide education staff using a strategic set of plugins and custom modifications within WordPress to produce the functionality needed. And I think we’ve covered that.

\n\n\n\n

Once that site was launched, it opened the door for multiple additional WordPress sites under the GADOE, which I’m presuming is the Georgia Department of Education umbrella. Including continuing education events for staff across the state, a better menu builder with state approved recipes for cafeteria staff, and rebuilding the main GADOE site using a headless WordPress setup with Next.js.

\n\n\n\n

So the bit that I want to focus on there is the words multiple additional WordPress sites. And this is probably squarely aimed at Aaron. How are you tying these multiple sites together? Is this like a, we’ve got a WordPress site over here, and another one over here, and another one over here. Or are we dealing with multi-site? Is it all connected in some way? Have you got single sign on so that the teachers can get in with one set of user credentials? How’s it all hanging together?

\n\n\n\n

[00:31:11] Aaron Reimann: So right now we have multiple websites that are WordPress, they’re not multi-site. It’s not multi-tenancy or anything like that. We have individual WordPress instances on individual virtual servers on Azure.

\n\n\n\n

That gives us a little control to be able to scale it up and down. I’ve had environments before where we’ve had multiple WordPress sites, and the way the infrastructure is built, it is, if you only need to scale up one, it has to scale up everything. And I like the fact that we have it split up individually, allows us to scale up and down.

\n\n\n\n

There isn’t anything that is unique, except for the headless WordPress site. That infrastructure is going to be different than all of the kind of more like marketing WordPress sites.

\n\n\n\n

[00:31:59] Keith Osburn: Maybe the one thing I’ll add is that, one of the things that we’re certainly, we don’t expect anybody to understand the technology behind that. What we were looking for early days, and again, what Aaron’s team have been helping us build is this idea to purposely, if you will, almost bottleneck the way that people get access to resources that we find.

\n\n\n\n

We could probably all agree on is that if you build the best resource on planet Earth, it’s still valueless if nobody can find it. And that’s been a challenge for us in the past is that we’re a large organisation, you can tell we have these siloed teams within the department, and they all produce resources. But unless you know, you didn’t necessarily know where to find those. You didn’t know how to go about that.

\n\n\n\n

We began to say, this is an opportunity again for technology to help us save time of that individual. So we begin to say, we’ve got a very successful event, the community project. We have 80,000 people that are visiting that. That’s slightly more than 50% of our teachers, but we still got some room to grow.

\n\n\n\n

And, hey, there’s these other things like strategic grants that we provide, or maybe policy and guidance. Maybe there’s some professional learning events, and if people don’t know that we do all these things, they’re for nought.

\n\n\n\n

So we said, why don’t we figure out ways to hone that together and we begin to use, for instance, the communities, dare I say storefront, as a way to provision those, so that those are immediately visible. So now somebody that could be a public stakeholder, or a practitioner, educational practitioner comes to the site to log in, but they say, oh, I see that there are new things up here, let me click on those. And now it’s just simply the convenience of us reusing something that they’re vastly familiar with already, as a way for us to share more resources with them.

\n\n\n\n

So the technology behind the scenes, obviously we’re working to make sure that those work tandem. And you talk about SSO and those types of things, those are strategically part of what we’re doing. But ultimately, right now, the whole idea continues to be, how do we get critically important information rapidly to that stakeholder that needs that? And that’s the reason why they came to visit that site, right? And so that’s, again, what we’re driving towards.

\n\n\n\n

[00:33:58] Nathan Wrigley: I know that I said this earlier, but I can barely think of a better example where technology, WordPress, meets humanity, education. It’s just this perfect, perfect relationship. And it just encapsulates everything which is wonderful about, well, open source software, but in this case, we’re at a WordPress event and we nerd out on WordPress. So it just seems like the perfect way to use that technology.

\n\n\n\n

And think that’s all of the questions that I’ve got. I just applaud you for what you’ve been doing. And obviously the fact that you’re here talking about it at an enormous WordPress event means that you must both be pretty proud of what you’ve done as well. So congratulations.

\n\n\n\n

[00:34:35] Keith Osburn: Well, thank you. Aaron and I both will tell you that I think one of the other attributes, one of the strong features of the open source community is that we recognise that we’re a culture and we need to share. And if you have successes, you’re right, there are a lot of children outside of Georgia that need to be educated. And if we found a solution and it works, we should talk about that. And here’s an opportunity to say to another state, or another organisation that’s in this business to say, here’s a great opportunity that has been very successful for us. Look and study the partnership that’s happened from private to public from that instance.

\n\n\n\n

And we don’t mind talking about that. We’re certainly proud that we’ve done something that is a viable solution. But at the same time, I think we also have that responsibility to share what’s been working. And if there have been pitfalls that we hit along the way, or soft spots that we needed to iterate around, we should be willing to talk about that.

\n\n\n\n

[00:35:24] Nathan Wrigley: Yeah, I know we’ve talked about the technology a lot in this podcast episode, but underlying the whole thing feels like there’s morals. There’s just like a real moral basis to what you’re doing. That just feels really nice.

\n\n\n\n

And also you mentioned state boundaries, and it feels like this conversation goes beyond that even. You know, there’s no reason why what you are doing couldn’t be applicable in Canada, or the UK, or Poland, or Australia, or any other place you mentioned. So it’s a big conversation for sure.

\n\n\n\n

[00:35:48] Keith Osburn: I would love to see this conversation become global because, again, I think that any educator is in the business. They trained to do that thing of educate children, not educate children in this specific spot, but just say to educate children.

\n\n\n\n

We as technologists have had a responsibility to figure out ways, in this case, for me, because of that’s my vertical, to figure out technological solutions that will support them.

\n\n\n\n

Well, my technologist peers, irregardless of location, I know that they desire to do the same thing. So I want to share with them. And I know that they’ll do the same thing with me, and we do. We have a very collaborative, non-competitive partnership that exists. And you’re right, it’s not bound by state, it’s not bound by nation, but instead, it’s like all of us saying, let’s link together, let’s figure out how we solve this problem if one exists, because we all desire to do the same thing. Ensure that every kid, irregardless of location, gets an opportunity to be successful.

\n\n\n\n

[00:36:42] Nathan Wrigley: Technologically important stuff that kind of gets out of the teacher’s way. Yeah, that’s perfect. Thank you Aaron, and thank you Keith for chatting to me today.

\n\n\n\n

[00:36:50] Keith Osburn: Absolutely. Thank you, Nathan.

\n\n\n\n

[00:36:51] Nathan Wrigley: Appreciate it.

\n\n\n\n

[00:36:51] Aaron Reimann: Yeah, thank you very much.

Keith is the Chief Information Officer and Deputy Superintendent for Tech Services at the Georgia Department of Education. With a rich background in both education and technology, he’s been instrumental in driving tech innovation within the state’s education system. Aaron runs Clockwork WP, a WordPress agency, and boasts extensive experience in web development dating back to 1996. Together, they’ve been leveraging WordPress to tackle some of Georgia’s most pressing educational needs.

We start off by discussing the financial advantages of using WordPress to achieve cost efficiencies compared to pricier alternatives. Keith shares his insights into how Georgia has successfully rolled out community-focused sites and specialised platforms for the state’s educational staff.

The conversation moves on to their collaboration with other states, advocating for open-source solutions to solve enterprise-level problems. We get into the infrastructure choices, including dedicated Azure servers for individual WordPress instances, ensuring better control and scalability.

We also touch on their strategic approach to resource discoverability and user engagement, highlighting significant traffic and potential for growth through grants and professional learning events. Aaron and Keith elaborate on the importance of accessibility, GDPR compliance, and the role of collaboration in addressing security and legal concerns.

One standout part of this episode features the culinary site they created, aimed at helping Georgia schools manage cafeteria recipes and nutritional information, streamlining a previously manual task and saving significant time for school staff.

Towards the end we discuss the cultural shift towards open-source platforms, emphasising the flexibility, cost-effectiveness, and community-driven spirit of WordPress in education.

If you’re curious to learn more about how technology can enhance educational systems and promote global collaboration, this episode is for you.

Useful links

I wanted to go to this one, I really did, but it didn’t work out. Part of the reason I was looking forward to it is that I’d have to take the train for the last leg, check out where camp is:

Bucharest is where almost all international flights end, and then we take the train north.

The Speakers!

As tradition suggests, the speaker lineup is excellent. Here are just a few examples.

The Venue

The Poiana Brasov Leisure & Entertainment Center is a delightful place full of fun things, including a video arcade, pool tables, hiking and biking areas and most importantly, session rooms!

Talk to me!

If you go to WordCamp Romania I’d love to talk with you about it. We can do a text chat, or a video chat and we can talk all about it. You can email topher at this site’s domain, or leave a comment!

The second release candidate (RC2) for WordPress 6.7 is ready for download and testing!

What’s in WordPress 6.7 RC2?

Plugin	Install and activate the WordPress Beta Tester plugin on a WordPress install. (Select the “Bleeding edge” channel and “Beta/RC Only” stream).
Direct Download	Download the RC2 version (zip) and install it on a WordPress website.
Command Line	Use the following WP-CLI command: `wp core update --version=6.7-RC2`
WordPress Playground	Use the 6.7 RC2 WordPress Playground instance (available within 35 minutes after the release is ready) to test the software directly in your browser without the need for a separate site or setup.

Get a recap of WordPress 6.7’s highlighted features in the Beta 1 announcement. For more technical information related to issues addressed since RC1, you can browse the following links:

How you can contribute

Get involved in testing

Search for vulnerabilities

Update your theme or plugin

For plugin and theme authors, your products play an integral role in extending the functionality and value of WordPress for all users.

Thanks for continuing to test your themes and plugins with the WordPress 6.7 beta releases. With RC2, you’ll want to conclude your testing and update the “Tested up to” version in your plugin’s readme file to 6.7.

If you find compatibility issues, please post detailed information to the support forum.

Help translate WordPress

Release the haiku

Thank you to the following contributors for collaborating on this post: @jorbin.

This is kind of funny because I’m obviously in the midst of the big battle with Silver Lake and WP Engine. I am a huge proponent of kindness, but sometimes you have to stand up for what’s right if someone is taking advantage of you.

WP Engine filed a motion on October 18, 2024 for a preliminary injunction in a Northern California court, seeking restored access to WordPress.org and a reversion to conditions as of September 20, 2024. The hearing is set for November 26, 2024.

The Injunction filed claims that Matt and Automattic have “engaged in a self-proclaimed “nuclear” war aimed at destroying WPE’s business because WPE dared to stand up and speak out against Defendants’ extortionate demand for tens of millions of dollars annually for a purported “license” WPE does not even need.”

It went on to say that Matt and Automattic’s action included “blocking WPE’s access to business resources including those used to service its customers, blocking WPE’s customers from accessing important security updates, making a litany of false and disparaging statements, and even expropriating one of WPE’s most popular software products as its own. Facing this onslaught of retaliatory actions, WPE had no choice but to file suit to protect its business, its employees, its customers, and the entire community in which it operates.”

The injunction also mentions that WP Engine has suffered losses as “the data show a 14% increase in cancellation requests, 333 fewer new contracts than expected from the “sales-assisted” channel, and a 29% drop in new customers from the “self-service” channel.”

In response, Automattic and Mullenweg stated, “This case is not about Plaintiff’s access to WordPress… this case instead is about WordPress.org – a website owned and run by Defendant Matt Mullenweg individually, for the benefit of the community he loves. WordPress.org is not WordPress. WordPress.org is not Automattic or the WordPress Foundation, and is not controlled by either. To the contrary, as Plaintiff itself acknowledges, WordPress.org is Mr. Mullenweg’s responsibility.”

It continues, “Mr. Mullenweg has no contracts, agreements, or obligation to provide WP Engine access to the network and resources of WordPress.org. WP Engine points to no terms, conditions, or permissions that entitle them to such access. Nevertheless, WP Engine, a private equity-backed company, made the unilateral decision, at its own risk, to build a multi-billion dollar business around Mr. Mullenweg’s website. In doing so, WP Engine gambled for the sake of profit that Mr.Mullenweg would continue to maintain open access to his website for free. That was their choice.”

On his blog, Matt published this about WP Engine, “They say this is about community or some nonsense, but if you look at the core, what they’re trying to do is ask a judge to curtail my First Amendment rights.” he also said, “I will refrain from personally commenting on the WP Engine case until a judge rules on the injunction. I will continue to exercise my First Amendment rights to promote others’ speech.”

This has drawn much concern from the WordPress community. Jeff Chandler (WP Tavern founder) tweeted, “The words in this document can not be over emphasized enough to current and future WordPress builders. These statements generate shock waves to the core of what has been built and maintained over the last 21 years. Honestly, I don’t see Matt doing these things to any other plugin or business in the future. But the fact that he has done it at all means it’s a risk that has to be accounted for.”

AspirePress published If WordPress.org is not for the community, then we will be while web developer Brian Coords tweeted, “WordPress/.org is not WordPress” is a good reminder that only the code is open source. When you build something online, you should treat all platforms and distribution channels as someone else’s sandbox and plan accordingly.”

Andrew Palmer (entrepreneur and co-founder of Bertha AI) shared another point of view in his tweet, “Do you really want someone else running WordPress? If so, be careful what you wish for. Have a look at the open source projects that are no longer Open Source and let me know. https://en.wikipedia.org/wiki/List_of_formerly_open-source_or_free_software”.

Katie Keith (CEO of BARN2 Plugins) tweeted about the injunction, “I hope it brings some stability to the WordPress ecosystem, as people won’t be constantly wondering what will happen next $\"🤞\"$ .”

The dispute has now attracted broader media attention, with coverage from outlets including BBC News.

In this episode, Birgit Pauli-Haack and Joni Halabi discuss Gutenberg 19.5, WordPress 6.7, Create Block Theme Plugin and a Thousand Block Themes at the Repository

Special guest: Joni Halabi

Announcements

1000 Block Themes

What’s released

What’s in the works

Birgit Pauli-Haack: Hello, and welcome to our 110th episode of the Gutenberg Changelog podcast. In today’s episode we will talk about Gutenberg 19.5, WordPress 6.7, Create Block Theme plugin, and thousand block themes at the repository. Yay! I’m your host, Birgit Pauli-Haack, curator at the Gutenberg Times and full-time core contributor for the WordPress Open Source project sponsored by Automattic.

Today’s special guest has been on the show before and I’m thrilled to have her again, it’s the wonderfully smart Joni Halabi from Georgetown University in D.C. She was a guest on episodes 97 and 91. And she’s also the author of the article Static vs. Dynamic Blocks: What’s the difference? on the WordPress Developer blog. Welcome back, Joni. How are you today?

Birgit Pauli-Haack: Awesome. Awesome. So for our new listeners, maybe you can briefly introduce yourself and your connection to WordPress. And I know you changed responsibilities at Georgetown, so what are you working on now?

Joni Halabi: Yeah, so hi everybody. My name is Joni Halabi. I have been working at Georgetown University for the past eight and a half years. I started at Georgetown as a senior web developer with our web services group. And most of my responsibility was developing custom blocks and other post editor customizations in WordPress for our now over 500 sites that we support, which is super exciting.

I recently, as of about three and a half weeks ago, just switched roles and I am now the senior web manager for the office of the president. So I’ve gone from development to content. My primary role right now is to basically update the content for our president’s website and make sure that it has all of the information people need in terms of our university initiatives and other things that are important to our office.

Birgit Pauli-Haack: Oh, no, absolutely. Always great to have you on the show, Joni. So 500 websites, that’s one number that I’m in awe of. Then going from custom block development to using as a content creator is probably a total different challenge because you can look back on so and so, “Oh, did we do this right?” kind of thing, yeah? And so bug reports.

Joni Halabi: Yeah, I think my old team is not going to be very happy with me because it is such a different perspective. As the developer, I never really got that 1,000 foot view of our websites in terms of how a content editor really sees these blocks. And to be on the other side of that and to be using these blocks and thinking about, “Okay, this is the story that I want to tell. How can I use these blocks,” it is such a different perspective. It’s an exciting perspective, but I already have ideas for new blocks that I want to exist.

Birgit Pauli-Haack: Yeah. So I’m not drilling down into that, but there’s certainly something to unpack for the next time you’re on the show. But it’s so great that you actually can change the perspective and kind of feel, “All right, now I get a 360 view on the whole WordPress content creation experience and block development.” So the next hurdle would be to tap your toes into block themes and kind of see how that works for your organization, for the web team, yeah?

Joni Halabi: I would love to. I did some experimentation with block themes while I was there, and I could speak for the next 40 minutes about this, but the high level overview was I did an experiment where I created a block theme but connected it to our external patterns for different blocks in different parts of our pages because we were using KSS node for that to create a pattern library. And I’ve actually given a couple of talks on this topic. I did one at WP Campus last year. They’re all linked to you for my website, but yeah, it was a fascinating experiment. It’s complicated and not complicated. Like I said, I could talk for 40 minutes.

Birgit Pauli-Haack: Yeah. We’ll share the links in the show notes for our listeners to have a different perspective on things, so that’s really good. So you did get a 360 view on WordPress with all the experience that you have. Excellent, yeah.

Announcements

And for the show, we have a few announcements today for you, dear listeners. One is the developer blog or the contributors at the developer blog, we are starting something new, and that’s kind of a snippet library. We have one snippet online, that’s the first one because we need to iterate on the layout as well as on the editorial process for that. But it’s conditionally unregistered patterns. And Justin Tadlock put that up and he has a few use cases. One of them is, okay, you build your own custom blocks on the theme and use patterns for that, but if that block is not available on your site, you need to unregister the pattern too. So it’s not going to come in with, “Oh, this block is not available kind of thing.” So I think a lot of people who curate the editor experience for the clients can definitely use that as well to unregister some patterns from my block theme or so they haven’t built themselves. Yeah.

So if you have ideas about that, you can comment on that either on the Gutenberg Times on the podcast show or on Storify, where our podcast also landed and has a few listeners. So there is a little comment button on your mobile app where you can comment what other ideas you would need for snippets. I know that Nick Diego and Justin and myself and Ryan, we will probably brainstorm the first hundred snippets for that relatively fast.

Community Contributions – 1,000 Block Themes

And then as from the intro, we have the announcement, a thousand block themes are now in the WordPress theme directory, yes. And it’s really amazing how fast. It took a little while. The first hundred took, I don’t know, a year, the second hundred another year, but then it kind of sped up until now. And we have three people who actually covered that this week. One is Ganga Kafle, he’s the co-team rep for the theme team, and he had statistics and that is that the first theme was done by Carolina Nymark early on. And then Automattic has 116 block themes in the repository. That’s about less than 10. Well, a little bit over 10%. And then there are other theme shops that have 20, 28, 30. Really the first 10 theme producers I think come up with about 400 or so. I haven’t ended up, maybe it might be 500. And then the rest is divided up by other people from the community. So yeah, bring your blog theme to the repository too.

Joni Halabi: Yeah, this is amazing to me because these only count the block themes that are in their repository. And I’m sure that there are so many authors and companies and organizations out there that have their own custom theme just for them that is probably a block theme. They’re just not in the theme repository. And it is so impressive that the adoption of block themes has happened this fast because it feels… I know it’s been a few years, but it feels like it’s only yesterday when block themes were introduced.

Birgit Pauli-Haack: Yeah. And I think they’re only kind of viable now with the theme parts and the site editor where you can edit the templates. And then have the query loop has really emerged as a power tool for theme developers.

Birgit Pauli-Haack: And there’s a lot of designers who don’t have to touch code to build themes and they use the site editor. So it’s just really amazing.

Joni Halabi: Yeah, it’s fabulous. I mean, you can start with the Twenty Twenty Four theme. I did this recently with the site. You can start with the Twenty Twenty Four theme, use that site editor and then copy. If you want to save all of your customizations, you can do everything that you want to in the site editor and then copy the HTML for your new templates, your new template parts, and paste it into a theme. And you have that saved if you need it. And it is so powerful. You don’t need the code. Somebody like me, I need the code. But somebody who’s not familiar with HTML or CSS or is intimidated by it, you don’t need to know it anymore. And it’s game changing.

What’s Released – Create Block Theme Plugin 2.6

Birgit Pauli-Haack: Absolutely. And the global styles and design tools that come with it, you can really say change the default look of blocks and it’s going to be saved. So the next thing that I wanted to point out here on this show is, and we talked about it before, but it seems that we talked, Joni, that you haven’t really used the Create Block Theme plugin yet. And that really helps theme developers to use the site editor to have everything that’s stored in the database, then exported into the theme files. And that is the most powerful thing that I’ve seen, that you can create a child theme, you can create or clone an existing theme on the site, or you start with a very bare bone skeleton, but then you can use the site editor to style your blocks, your sections, create patterns, and it all kind of comes together with saving the theme, exporting the theme, and have it outside.

Because the layer of having core styles then having theme styles, and then the user styles can only all come together in one theme if you want to reuse it. And that’s kind of the gap that the plugin really closes for that.

Joni Halabi: Yeah, that sounds amazing. I don’t know if you would know the answer to this, but has there been any talk about bringing that plugin into core because that feels like eventual core functionality?

Birgit Pauli-Haack: Yeah, there is talk about it. And that plugin is pretty much like the Gutenberg plugin, kind of the beta version of what might come into core. I think it’s more the explanation while everything in core that touches the theme and the styles and the section styles and variations, those are still in active development. So the plugin is kind of following along in core and even goes a little bit further in core with the patterns, for instance, saving the patterns. But yeah, it would definitely be something that the developers kind of looking at, maybe bringing some of the features into core that are a little bit more mature once the features are kind of set in their ways, because some of that data views and some of the global styles that’s still so active in development that I think otherwise you couldn’t test the concepts if you put it in core because then it would be released and then it would be backwards compatible, and you don’t want to kind of be tied down to backwards compatibility.

Joni Halabi: Yeah, that’s a lot of work. But I do. That’s great to hear. And I also do love this pattern of actively developing and testing something in a separate plugin with an eventual goal or a thought of bringing it to core. And it’s something that I always thought was unique to the Gutenberg plugin, but it’s nice to see that it’s also happening with other pieces, like larger pieces of functionality.

Birgit Pauli-Haack: Yeah. Yeah. That happens actually also with improvements for the media library. The performance team has actually published, or Pascal from the performance team has some media experiments on his repo that are in the plugin. They’re not officially kind of WordPress. The Create Block Theme is on the WordPress organization, separate repo. But yeah, some of the contributors have done that with their own experimentation. So it’s really good to see.

Dave Smith has a plugin. He’s a core contributor, and he just released a plugin for the responsive navigation that’s not in core yet, but it’s kind of testing it out outside of the Gutenberg repo to get faster to feedback. And so I will share the links and also in the show notes, so you can explore those too dear listeners. But yeah, use the Create Block theme plugin to create your theme for the repository. You can then, I think there’s even some instructions on how to get it then into the repository, but that’s kind of with the SVN version control, it kind of is a different level of complexity, I would think. So having it rather than GitHub.

We also had a… And that might be interesting for you too. We had a hallway hangout with the designer of the Twenty Twenty Five theme, and she also works on some of the automatic themes. They have a process that uses Playground, the Create Block plugin and GitHub, to push changes to a theme from the site editor to a pull request on GitHub. And that’s just amazing. That process really amazed me and how that’s even possible, but there are magicians behind it, but it works.

Birgit Pauli-Haack: Yeah, yeah. I will share that in the show notes. And there’s a little video also with were Beatriz Fialho, who designed Twenty Twenty Four as well as Twenty Twenty Five, shows the process. It has one single little change, and then kind of from playground to GitHub, how that also works. Yeah, it’s really, really great to see.

Joni Halabi: Oh, I will definitely be checking out that hangout. That sounds amazing. Yeah.

Birgit Pauli-Haack: So when I kept a close watch on the numbers throughout the last three years, and I always looked at some and also on the Gutenberg Times on the weekend edition, I sometimes said, “Okay, there are six new block themes. Who developed that?” So I looked at them. Some of them I really tried out. Carolina Nymark was one of the first theme developers. Who really embraced the process was Anders Noren from Norway. These a very successful theme developer, and he had a few quite interesting designs. But what I have noticed is that many, many block themes not only have some interesting style variations. And you can see them in the repository. You can see how the theme changes also has some of them have 30 patterns in there. It’s just amazing what creativity can do to the block themes now. So you don’t need to put one block at a time into your canvas. You can kind of take five patterns and your page is done. So it’s really good.

Birgit Pauli-Haack: Yeah. I see many, many themes that are actually focused on certain verticals. So there are restaurant themes, there are for certain shops, there are for digital pieces for recipes. It’s very focused on the use case. And those make the patterns as well as the imagery that comes with it and the look and feel so much more focused to get a person from zero to hero on their own website. It’s really a great phenomenon.

Birgit Pauli-Haack: You and I, we can talk more than 40 minutes about block themes.

Joni Halabi: I think we could. But this is not just the block theme show, we promise.

Birgit Pauli-Haack: So well, two more things. The Create Block Theme plugin is in a new version, 2.6 came out this week. And it fixes two bugs, important bugs, that fix the image URL localization when you make a child theme so that the images come over from the patterns into the child theme. And the URL is the right one. The other one was that if you had in your blocks, HTML, it would escape. So when you use that pattern, you had all the HTML code in there and not the rendering from the browser, and that was fixed as well. So that was kind of an interesting bug to fix.

Joni Halabi: Yeah, those are always tricky, the encoding, encoding bugs. Yeah.

WordPress 6.7

We had a bigger release that was the WordPress 6.7 Release Candidate came out. And with it, also the field guide. So if you haven’t tested 6.7 yet, now is the time you only have three weeks to test it against whatever product you have, your themes, your plugins, your maintenance processes, or just the sites that you have. And with playground, you can actually do a staging site, but there’s also InstaWP to kind of have a staging site.

And if you want to know the highlights from WordPress 6.7, there will be a YouTube live stream on November 5th at 18:00 UTC, and it’s with Jamie Marsland, Nick Diego and Rich Tabor kind of walk you through all the different things. We will talk a little bit later about them, the highlights that I see for 6.7 after we cover the Gutenberg 19.5 release.

Joni Halabi: Sounds good. Yeah, I’m excited for 6.7. Like you said, it’s coming November… Looks like November 12th.

Joni Halabi: And I know especially for my previous team, it’s so important to start that testing now, especially if you have a lot of custom code on your sites. This is something that has burned our team in the past. Sometimes custom code is not backwards compatible with changes that are happening in core, like our own custom code that we write.

Joni Halabi: Yeah, we’ve needed to make a few changes, and it’s just important to get all that testing in.

Birgit Pauli-Haack: Definitely the dev notes will help you. They’re in the field guide. And there are quite a few changes, not breaking changes, but additional feature in there for developers where APIs are expanded, like the block bindings API and the interactivity API, block books, some performance tweaks as well. So definitely look at the field guide. And the links will be in the show notes. And I also will link all the block editor relevant dev notes individually in the show notes. We have space on our show notes. Anyway, yeah, well, let’s go into the Gutenberg 19.5 plugin release.

Gutenberg 19.5

Birgit Pauli-Haack: So release-lead Hector Prieto wrote in his release post, “This release focuses on stabilizing existing features, but also brings some improvements to the general UI and the zooming, editing experience with 116 PRs from 47 contributors.”

So yeah, let’s get going. General interface changes. One is the right design tool. Now you can persist your user preference through the preference option on the plugin, in the plugin editor. So that’s good.

Joni Halabi: Yeah. That one I have been waiting for because I often switch between the visual editor and the code editor, and I don’t always remember that I do that. So if I go into a page and I switch into the code editor and then I have to edit another page, I expect to go into the visual editor. Sometimes I’m surprised when I am somehow in the code editor because I just forget that, “Oh yeah, right. The last page I was in, I was in the code editor.” But I always found it interesting that WordPress made the assumption that because I went into the code editor last, that is something I will continue to do. So I love that this is a setting now.

Enhancements

Birgit Pauli-Haack: Yeah. And I’m not quite sure it is actually the setting that you’re thinking about because the editor has now on top of the toolbar, there’s also a write and design tool. There was previously the select and edit tool where you can switch, especially for those who are traveling with a keyboard instead of the mouse, there was a difference between getting into a block to work in the block or to travel from one block to the next. So that was the select was the traveling from one block to the next. And then the writing part or the editing part was actually the block part where you can use the toolbar or you added content to a particular block.

Joni Halabi: I think I interpreted the Git, the pull request wrong then. Interesting.

Birgit Pauli-Haack: Yeah. And there is also a change in how those two modes behave when you are in the zoom out mode.

Birgit Pauli-Haack: 6.7 brings us the zoom out mode, but not the editing of design switches to it, only for the pattern. So that is the next thing on our list, is that the zoom out mode in 6.7 is just with a toggle button. With a new Gutenberg release, if you have that, it will also automatically zoom out when you use the pattern tab in the inserter when you want to drag and drop a pattern over to your site and you need a little bit better of a bird’s eye view on your page instead of just having that one kind of block in front of you. It’s a much better way to add. So you can now kind of drag and drop patterns over and move them up and down without having to deal with all the blocks around it or in it.

Joni Halabi: Yeah, yeah, no, there’s a great animation of this in the pull request that it’s nice to be able… Because when you’re talking about a pattern, you are talking about more than one block that can stand a good chunk of your page depending on the pattern. So it is nice to be able to see that in context, to see your entire page as it stands. Now if you’re trying to add another pattern and it just helps you think about, “Okay, well where can this new pattern go?” with respect to the entire page.

Joni Halabi: That is definitely one of the important ones. There are a number of changes to that zoom out functionality in this release, but that when you select the pattern tab, but that’s definitely one of the biggies.

The next, I guess, really two sets of changes have to do with the component storybook. So there are a couple of changes to note. One, adding type tokens to storybook. And the other one is just stubbing out documentation on existing colors in a theme. And I think these are so fundamental because storybook talks about design in terms of the components in the UI. And I guess it just surprised me that it wasn’t there before, but color and photography are so basic to any design for anything that it is. I think it’s a wonderful change that these both are being added into storybook now. You can see basically the colors that exist in the base styles now, and then having the type tokens, you can see all of the register of typography. So you can see semantic tokens, like what are your different heading levels, for example. What does body text look like? And these are just fundamental design elements that I’m glad they’re there now.

Birgit Pauli-Haack: Yeah. You have been part of our live Q&A and design systems. Now the WordPress design team is actually building out their design system through that storybook because the admin design now needs also the funds. And not only just the data views, how they’re in the site editor, but when you go to the next level and have the admin move over to the new design, you need to have standardized colors and standardized funds and all that. And that’s where the storybook comes in to have a unified system and standard for all the contributors that are either back end or front end or plugin developers to kind of figure out. So none of the developers have to make all the design decisions. Again, it speeds up the plugin development or the core development quite a bit when there is a design system there, yeah.

Birgit Pauli-Haack: For the global styles, contributors improved the navigation logic for the revision screen. That had quite a change in a few of the plugin releases before and how do you get to the revisions of your styles. It’s a great change to see how you can see the revisions for your styles that are a little compressed and much easier to navigate in the animation. So it talks about the global styles are in the right-hand sidebar, and that’s also where you find the revisions of your changes. I’m so happy that we have those revisions because after playing around with a theme or with a site for, I don’t know, 30 minutes, I don’t know, I reversed some of my decisions because, “Oh, that looked nice 20 minutes ago, but now I don’t like it anymore.” So reversing that through the revisions panel is really cool. The team is working on, it’s really cool.

Joni Halabi: Yeah, no, no, no. I love that they’re working on that because I feel like a lot of our content editors don’t realize that revisions exist and it is such a powerful tool. So to be able to make improvements to the UI and maybe make it a little more obvious about how to use revisions, I think, will help our editors a lot.

Birgit Pauli-Haack: And it’s not only… Well, they still have to work on the content revisions for posts and pages.

Joni Halabi: Yeah. I mean, revisions, being able to work on the UI for revisions at any part of the styles or the… The styles, I feel like, is step one. So this is a great updates.

Joni Halabi: Yeah. So in black bindings, we’ve now added the ability to register binding sources in the widget screen. So block bindings, for anyone who’s not familiar with, it’s when the content of a block is tied to some sort of external data source. So you could have a paragraph that is tied to some RSS feed maybe or anything.

Joni Halabi: Right. Or meta field, yeah. So this particular change makes sure that a block, like a paragraph, inside a widget can also be bound to some sort of custom source, like a meta field.

Birgit Pauli-Haack: Yeah. And we haven’t heard about the widget screens for a long time, so I’m really happy that there are some people still thinking, “Okay, there’s another block editor that has been neglected for a bit.” But I think the unification efforts between post editor and site editor, they’re done now. And I think looking at the widget screen is one of the next steps. And having the binding sources there definitely helps because that’s what you want to put in additional information there.

The cover block experience, they refactor of the settings panel. It streamlined all the different features for a cover block and has some pull out. Up until now in the plugin, you had all the settings for the cover block in one sidebar. From top to bottom, you had to scroll. But now there is a three-dot menu there where you can switch off some of the features so you don’t have to scroll to them all of the time. So it’s similar to the typography settings as well as the dimension settings. Now, it’s just adopted the same philosophy there that not all the features are shown at the first time or by default.

Joni Halabi: Yeah, this is nice to see because the cover block has gotten complex for a reason. There’s a lot going on in terms of settings with the cover block, so it’s nice to see improvements there in that UI.

Bug Fixes

So that kind of covers all the enhancements that we had, but there are a few bug fixes we wanted to talk to you about. The code block now has a left-to-right direction for right-to-left languages. Can you explain that to me?

Joni Halabi: Yes. So it’s tricky to read, right? So right-to-left languages, so think Hebrew, think Arabic. When you write, the paragraphs and the headings that you write go from your right hand to your left hand. But when you’re writing code, if you’re a native speaker, if you’re writing prose in a right-to-left language, but you’re writing code, your code is still left-to-right. So this is making sure that, let’s say that you have a page, let’s say that you’re blogging in Arabic and you’re blogging about this really cool feature that you just wrote and you write your paragraph and it’s in Arabic and it’s from right to left, but you want to feature a code snippet. This is to make sure that the code on your page is still displayed left-to-right, because that is still how we write code regardless of what spoken language we are writing or reading or speaking.

Joni Halabi: It is. I mean, it’s a lot of letters in that headline, so I understand why.

Birgit Pauli-Haack: Yeah. And for someone who never knows where left and right is, it’s going to, “What?”

Joni Halabi: I still have to do the hand trick where I make my index and my thumb form basically be at right angles of each other. And the one that makes the L is my left hand. And I still do this, so I understand.

Birgit Pauli-Haack: Yeah, well that’s when my husband says, “The other left” when I go wrong.

Joni Halabi: Yeah, no, so another fix is do not… I’m just going to read this title, don’t render image when the source attribute is empty, which feels very obvious. But this was a bug fix where if you had an image, an image tag, but an empty source, that image tag was still getting rendered. And there’s no point in rendering an image tag if there’s no source. So this fixes that bug.

Birgit Pauli-Haack: It sounds like a rookie bug, but sometimes they just sneak in.

Birgit Pauli-Haack: Yeah, I have done a lot of dumb things like that. And then one is PR is in terms of extensibility, it kind of renames the register block template from W_register_block_templatetoregister_block_template. So the WP prefix is kind of taken away because it seems to be obvious and it follows other register block kind of function. But if you have been testing things with the new register block template for the plugins, you might want to look at your code and kind of remove the prefix kind of thing. I think that was back ordered to 6.7, so it’s in the 6.7. But if you have done it up until beta 3, I think with WP you can remove it now.

Joni Halabi: Yeah. And I think you have to, because if I’m reading that PR correctly, there is no backwards compatibility for the WP prefixed version of this function, which it didn’t seem like it was supposed to be in anyone’s code anyway like in a custom developer’s code. But please double check your code.

Birgit Pauli-Haack: So it wasn’t backwards compatible, it just kind of wasn’t a kind of discussion now through co-op contributors. So this comes as a new function, “Can we make it uniform with the other register block kind of functions and remove the WP?” And so there is no backwards compatibility because it hasn’t been in the future, but it was in WordPress 6.7 alpha up until beta 2 or beta 3, and only for the release candidate, they take the WP out. So if somebody wrote a plugin template already to come out in 6.7, when 6.7 comes out, that’s the code to check again. Does it make sense?

Joni Halabi: That does make sense. Thank you, yeah. I didn’t realize that was that new. That’s awesome.

Birgit Pauli-Haack: Yeah, it’s part of the… So now plugins can register templates for the site editor. So when you have a plugin that does a business directory or something like that, you can now register a template that then a user can modify in the site editor, which was before not possible or was a really hacky way to get it into that. And then you can, as a plugin developer, also document that. So the theme developer can also modify that template or build pattern for the template or something, yeah.

Documentation

Birgit Pauli-Haack: Yeah, that’s nice. I like it. And I wanted to point out a couple documentation changes. There was in a previous version of the plugin and for 6.7 a method to curate the heading level through level options. And that is now documented in the block editor handbook. So you can say, “Okay, if your content editor uses the heading block, you don’t want a heading one, you don’t want a heading four or five and six. There are only two heading levels that they can use. And that’s heading two and heading three.” You can do it now and have also your patterns, follow that through a block attribute. And you can also use it for your custom blocks. It’s in the site title, post title. And for where you ever use headings, you can change that there as well. And it’s in from the toolbar, so it’s documented now.

Joni Halabi: Excellent. Yes, and I love this feature and I love that it’s now documented just from an accessibility perspective because making sure that your heading levels are in order and makes sense is part of your site accessibility. So for example, having an H1 followed by an H4 doesn’t make much sense. You want these headings to go in order. So this feature helps us enforce that. And this new addition to the documentation helps people use the feature.

Birgit Pauli-Haack: Yeah, absolutely. So on the second documentation was just to announce that the components packages now produce the readme file with the documentation through an auto generator. So they’re at least standardized. And developers can, through their code, also control the documentation, but it doesn’t have to be an afterthought anymore and it’s standardized. So that’s kind of the first step to have some standardized component readmes because there are hit-and-miss to be honest. And this is kind of a part to rectify downtown.

Birgit Pauli-Haack: And that’s it, dear listeners. That’s Gutenberg’s 19.5 for you.

What’s in Active Development or Discussed – WordPress 6.7

So I promise you we’re going to talk about WordPress 6.7 a bit. So there are a few high level things. There are tons of changes in there, smaller ones and big ones. Anne McCarthy publishes for the last 10 releases, I think, a Source of Truth, which is mostly for writers who want to write about the new release to get in-depth information, to also get assets that they can use in their writing. But that is now published on the Gutenberg Times. So I will link through the show notes to that. So you can also follow up on some of the details there.

I like to point out, well, we all know Twenty Twenty Five is the new default theme, and I have had a lot of fun with it. It was really good. I prepared a talk for German WordCamp where I was almost using up all my time with the Twenty Twenty Five standard theme, which wasn’t particularly well organized, but that’s a different story. But my excitement kind of spilled over that I got on a tangent. And so I really, really like that it has about, I think, 50 patterns for all kind of different things because it wants to be a starter theme for a personal blogger or for a photo blogger or for a magazine style site and has templates for all of them, and also different ways for the different templates. So you can have a query loop template with different ways how the post comes in. I think there are about 10 or so different ways to organize that. Then there are services, price tables, testimonials, not only in one pattern, but maybe two or three patterns of that. So that’s really cool.

And what the crown of it is, that there are also four different… So there were color variations for the full theme. And then there are style variations for the full theme that changes the look and feel, but it also has separate color variations. So you could just leave the style like it is, but only change the color combination. Or you can say, “Okay, I want it like it is, but I just want to change the font.” So there are font variations as well.

And then there are section styles. So when you have a group pricing header or a pricing section or a group block with a call to action, you can actually use four or five different styles. So when you add them to your page, you actually can change the color of each of them, but still be in a full theme variation. But it makes it much livelier to scroll through a page that has several sections that also changed the colors, but it’s really well done and they have been all tested. So it’s a really good theme. Kudos to Carolina Nymark and Juan Aldazoro. Oh, I’m butchering his name. Sorry, hang on.

Joni Halabi: I was just going to say while you’re looking that up, you talked quite a bit about the colors and a bit about the fonts, I love that these font variations include font combinations. So the font variation has these combinations of a header. They’re a set of a header and body fonts. And that is one of the most challenging things I have experienced trying to design a site, just trying to find a really good combination of a header font and text font. And this gives you eight different options that I can see that are really solid options. If you’re a bit shy about design and playing with typography, you can choose one of these eight and there are no bad choices here.

Birgit Pauli-Haack: Yeah, yeah, no, the developers and designers that build out the theme, so the design comes from Beatriz Fialho, but Juan Aldazoro is his name, Juan Aldazoro and Carolina Nymark are the lead developers on the Twenty Twenty Five default theme, and they did a marvelous job also. But there are also about, I don’t know, 30 to 50 additional contributors that delivered patterns. So it’s actually a larger group of people who built this theme, and it’s really fabulous. So try it out and look at that.

The query loop, so that was part of it that I tried out the new features for the query loop. It is now optimized and streamlined. So you have all kinds of filter settings. You can filter by author, date, or you can say, “Okay, I want to have a post loop just for a custom post type with custom fields.” And all of that is now possible for any template you can use. Or you can just use them on the post and say, “Okay, I want from the same category or the post from there, except this one.” So you can also include post and offset post. All the features are now available. Some of them were in the toolbar and now then the sidebar complete with all the new ones. That is a really great quality of life kind of change.

Birgit Pauli-Haack: We talked about the zoom out for the template handling. The page views and the site editor, that’s more the data views kind of how in the admin section how you can view the pages. There are some previews. There’s a list view where you have a three pane window. On the left-hand side, you have the block site editor navigation with the published kind of status. And then in the middle you have all the list, all the pages. And then when you click on them, the third pane is a preview of the page. So you don’t have to go back and forth when you just want to look at, “Okay, what’s in the page here? How does it look?” So you can also have it right there. So it’s a really improvement in navigating your pages.

Yeah, I wish that was available for posts, but the developers are working on it. There’s an experiment. If you use 19.5 Gutenberg plugin and there’s an experiment menu item there and you enable the post data views, then you can see how that also works for posts. But it’s a little harder to make it for posts because there are so many customizations and things to look at. So right now it’s an experiment, but always welcome for feedback. Do you have any questions about things?

Joni Halabi: No, no. I was just going to say, as somebody who’s now less on the development side of things and more on the content side of things, I appreciate something that will make editing easier and being able to see those changes easier. Because like you were saying, having to flip between different screens, it’s not ideal. So seeing improvements, even if it’s not on posts yet, it’s coming to posts, that is something I’m looking forward to.

Birgit Pauli-Haack: Yeah, they’re also experimenting with a quick edit part. So yeah, in the current admin you have the quick edit section where you change categories and rename things.

Birgit Pauli-Haack: So that also is coming to the data view section, so you can have that part as well if you missed it until now.

A lot of designers are really excited about having background images not only for blocks like the cover block, but now you can also do it for group block. And you can have it site wide. So there is in the global styles, in the first list of typography and layout and styles, and there’s now one for background image. So you can have your clouds there or your tiles or whatever you need from your site. And sometimes I feel we could go back to GeoCities sites.

Joni Halabi: I was just thinking GeoCities. And in my head I was wondering like, “Should I bring it up? This is still very retro ’90s.” Can I just make a shout-out? Please do not put in an animated background. It’ll make everybody who works in accessibility cry.

Birgit Pauli-Haack: Yeah. Yeah. I think it only… It doesn’t do animated GIFs.

Birgit Pauli-Haack: I think it’s just Gs or JPEGs. Yeah, but you’re right. Yeah, that would be really cool. Hilarious, yeah. But I’m thinking that there are some designs that can be quite unique with that. I remember one of my first backgrounds was really bright red and bright blue, and then I had white fonts on it, and you couldn’t read what you were writing or what I was writing for it, so.

Joni Halabi: Oh, yeah. I remember when we were talking about Web 2.0 in the late ’90s, and I was in an electronic arts curriculum at that point, and we were making web pages with hidden links. So you had to explore the page just by moving your mouse around to see if you happen to stumble upon a link. This will literally make everybody sad now. We know better, but this was experimentation in the late ’90s.

Birgit Pauli-Haack: Yeah. Unless it’s a game or something like that, but yeah.

Birgit Pauli-Haack: Yeah. So yeah, apart from the developer API changes that are there, so these are kind of my highlights for WordPress 6.7. And there are improved blocks. Most blocks now have border support that we are missing for… Only six or seven blocks at border support. And now almost every block has a border support with 6.7. So again, I will share the Source of Truth post from the Gutenberg Times, and also a link to the November 5th highlight live stream on YouTube for those who want to hear and see things beyond a podcast, which is really hard to demo things, but yeah.

Well, is there anything else that you want to talk about, about block themes, block editor, WordPress or your life?

Joni Halabi: Oh, I could go on about so many of those things, but I think we’ve covered the basics. I think we’ve covered all the important things.

Birgit Pauli-Haack: So let me ask you this. If you now do a lot of content, are you going to go back to some block writing or coding in your spare time, kind of rest your brain from the content editing and just do some coding?

Joni Halabi: I might. My challenge is finding spare time. My life is very filled with just research and writing, and then also my child and raising a six-year-old, like I will have spare time in about 12 years.

Birgit Pauli-Haack: Okay. We’ll talk about it. What is that? WordPress 15.6 or something like that?

Birgit Pauli-Haack: Well, this was lovely. Thank you so much for taking the time to be on the show. And we will hear from you sooner than in 12 years.

Birgit Pauli-Haack: … when you come back to show. Yeah. Well, it was great that we had you again and you walked with me through all the announcements and stuff there.

I will share some links for Joni Halabi if you want to get in contact with her. I mentioned the Static versus Dynamic Blocks article on the developer blog. Joni also wrote a book, Sweet Little You, and that’s available. And then I’ll have the LinkedIn link as well as the WordPress profile link for you if you want to get in contact with Joni.

As always, the show notes will be published on Gutenbergtimes.com/podcast. This is show 110. And if you have questions or suggestions or news you want us to include, send them to changelog@Gutenbergtimes.com. That’s changelog@Gutenbergtimes.com. And this is it. Thank you for listening. And if you want to comment on… What is it? It’s not Storify, it’s not Shopify, it’s Spotify.

Birgit Pauli-Haack: Spotify. When you listen on the Comcast there, send in a comment. If you listen on Apple, do a review. If you listen on Pocket Casts also, feel free to review our show so more people can join us for the next time. Thanks for listening and goodbye.

How are you today? It’s getting cold again in Munich. This year, I am hopefully better prepared for the Winter than last year.

Developing Gutenberg and WordPress

Seizing the moment, David McCan published a tutorial on How to Use the WordPress Beta Tester Plugin. It’s a great tool that allows you to test pre-release edition of the next WordPress version. “There are a lot of reasons why people want to test a pre-release. Maybe you’re a theme or a plugin developer, and you want to make sure that your theme or plugin is going to work with the next version of WordPress. Or maybe you’ve got some critical sites, and you want to make sure there aren’t going to be any surprises with the next version of WordPress. Or maybe you’re curious about the upcoming changes and features that will be in the next version.” he wrote.

Save the date! November 5th, 2024 at 17:00 UTC with a live stream on WordPress 6.7 Highlights a Q & A with Jamie Marsland, Rich Tabor and Nick Diego

Gutenberg 19.5 was released and Hector Prieto wrote in his release post What’s new in Gutenberg 19.5? (23 October), that the release mostly focused on stabilizing existing features but also brings some improvements to the general UI and the zooming editing experience.

It was a great pleasure to have Joni Halabi, Georgetown University, on the show again and to geek out over the block editor. We discussed, Gutenberg 19.5, Create Block theme plugin and marvel at the fact there are now 1000 Block Themes available in the WordPress repo. The episode 110 arrive at your favorite podcast app over the weekend. If you listen to the podcast on Spotify, you can now leave a comment from your phone. I would love to get connected with more listeners.

Plugins, Themes, and Tools for #nocode site builders and owners

Md Noruzzaman just added the Geomap Block to the plugin repository that allows you to add a basic Google map to your post or pages without handline API keys.

Wes Theron recorded a new video for Learn.WordPress on how to create a portfolio site with a block theme and patterns using a up-and-coming Twenty Twenty-Five WordPress default theme which has an extensive pattern library. This will show you how to leverage these patterns to save time and build your site from a solid foundation.

Over at the CSS Tricks, Geoff Graham shared Justin Tadlock’s article on the Developer blog, and ruminated in Mastering theme.json: You might not need CSS about writing CSS in style sheets vs. CSS in JS and WordPress way. “Regardless of all that, I’m linking this up because Justin does bang-up work (no surprise, really) explaining and illustrating the ways of CSS-in-WordPress.” Graham wrote.

1,000 Block Themes in the WordPress theme directory!

Building Blocks and Tools for the Block editor.

Have you ever run into a situation where you needed to unregister a block pattern in your theme? Justin Tadlock has the right snippet for you. Snippet: Conditionally unregister patterns. This post also starts a new section on the Developer Blog of short code snippets that any developer could use for a specific use case. For now, we still need to get some kinks out of theme and editorial process, but soon we start publishing more code snippets in CSS, PHP, JavaScript, or JSON

In his latest video tutorial, Add custom CSS and JavaScript to any WordPress block, Brian Coords, walks you through the process of modifying any block.json with simple PHP to load your own custom CSS and JavaScript. The post also holds the full transcript of the video for those of us who want to read along.

Now also available via WordPress Playground. There is no need for a test site locally or on a server. Have you been using it? Email me with your experience

Questions? Suggestions? Ideas?
Don’t hesitate to send them via email or
send me a message on WordPress Slack or Twitter @bph.

Dave (who bootstrapped the project) gave me one mandate: “I’m very open to whatever you make, but whatever it is, in some way I want it to help this child”. And he sent the following photo.

Now that’s a stock photo, you can find it all over the web. We’ll never know who that specific kid is, but the point was that there are millions of kids like that in India, and Dave wanted to give a boost to as many of them as we could. Ever since then, HeroPress has been deeply tied to India.

Recently I was telling this story to Nathan Wrigley on the WPBuilds Podcast. I was talking about my concern for the WordPress community in these days of difficulty. Many many Indians have gotten their start in computing in their early teens, on their own computer, or a borrowed one, or even on just a phone.

While we were talking I realized, if this kid were about 3-5 years old when the photo was taken, approximately 10 years ago when HeroPress started, it’s entirely possible he’s 13-15 years old now, and could very well be learning about WordPress. And it’s entirely possible HeroPress has helped him.

We’ll never know of course, but can say for a certainty that HeroPress has helped people LIKE him.

The WordPress Themes Repository has hit an exciting milestone of 1,000 block themes. As of today, the repository has over 12,000 free themes.

Block themes were introduced in WordPress 5.9 allowing users to create and customize all aspects of their site using the block editor. This ushered in a new era of site design, and in July 2022, the Themes Repository celebrated reaching the 100-block-theme mark. It hit the 200 mark in December 2022.

The journey of block themes was not without challenges leading to the community discussing why more theme authors were not embracing block themes. To give block themes greater visibility, a “Block Themes” menu item was added to the filter menu on the directory homepage, helping developers and site owners discover these innovative designs more easily.

Ganga Kafle, a representative of the WordPress.org Themes Team, has shared more details about block themes and contributors. The very first block theme to go live was Armando, a theme crafted by Carolina Nymark. Today, Automattic leads the contributions to the block themes category with 116 themes, followed by Creta Themes with 41 themes.

Ganga Kafle also shared the team’s vision, “The themes team would like to see more block themes. We expect an influx of innovative designs and functionalities. Whether you’re a developer, designer, or site owner, the potential of block themes offers exciting opportunities for creativity and customization.”

Remkus de Vries tweeted, “It started out real slow, but it seems we’ve finally got some momentum for the Block Themes. Let’s see how long it takes for the next 1000!” while Jeff Chandler tweeted, “Back in 2021, Matt’s request was for 5,000 block themes, not 1,000 lol. Still a bit shy of that number :D.”

Say goodbye to generic author boxes. The Gravatar Enhanced plugin for WordPress just got a major upgrade with a fully customizable Profile block. Now you can showcase your authors in style – and give your SEO a boost while you’re at it.

Complete Control Over Your Author Profiles

Best part? Your authors can update their profiles directly through Gravatar.com – no WordPress access needed. Perfect for multi-author blogs and company websites.

Boost Your SEO with Enhanced Author Signals

Google loves knowing who’s behind your content. The new Profile block helps establish E-E-A-T signals (Experience, Expertise, Authoritativeness, and Trustworthiness) by:

These reputation signals can help search engines better understand and rank your content.

Quick Setup Guide

Why Switch to the New Profile Block?

Ready to upgrade your author profiles? Get the Gravatar Enhanced plugin today and start customizing!

In nearly 1,000 days, the WordPress community has created 1,000 Block themes—coming together to use the full potential of the Site Editor and unleash new creative possibilities for everyone.

First introduced in WordPress 5.9, Block themes have steadily evolved, improving flexibility and functionality for themers, users, and agencies alike. Now, design tools allow customizing almost every detail. With style variations, users can change the overall look of their site in a few clicks. You can even use curation options to customize the editing process itself. But we’re not done! We can’t wait to keep pushing Block themes even further. Thank you to every early adopter who, by embracing early features with passion, helped shape the Block themes we love today with feedback and testing.

If you haven’t yet explored Block themes, check out some of the resources below to get inspired:

[00:00:00] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley.

\n\n\n\n

Jukebox is a podcast, which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, the recent security collaboration between Elementor, and Patchstack.

\n\n\n\n

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast. And you can copy that URL into most podcast players.

\n\n\n\n

So on the podcast today, we have Miriam Schwab and Oliver Sild.

\n\n\n\n

Miriam co-founded Strattic, a platform with an aim to revolutionize WordPress security and performance on the web. After Elementor aquired Strattic, Miriam continued leading the unit before becoming a head of WordPress relations.

\n\n\n\n

Prior to that, Miriam founded and managed a prominent WordPress development agency in Israel. With over 15 years of experience, she’s a respected member of the WordPress community and a frequent speaker at WordPress events.

\n\n\n\n

Oliver is the CEO and co-founder of Patchstack, a company dedicated to the mitigation of security vulnerabilities in WordPress and open source environments. Patchstack is now a seven year old enterprise, and they specialize in penetration testing, security process management, and protective services for developers, agencies, and major hosting companies.

\n\n\n\n

[00:02:07] Nathan Wrigley: Oliver’s background also includes experience running an agency, and his work at Patchstack focuses on collaborating with plugin developers and hosting providers to ensure robust security measures for their clientele.

\n\n\n\n

Miriam and Oliver joined me at WordCamp US 2024 in Portland, where they did a presentation discussing the processes needed to enhance open source plugin security, and the advantages of leveraging bug bounty partnerships.

\n\n\n\n

Their collaboration brings to light the importance of integrating security solutions within the WordPress ecosystem, especially for companies with a footprint as large as that of We talk about the global operations of

\n\n\n\n

Oliver’s team at Patchstack, who work across all time zones, providing round the clock threat intelligence and vulnerability monitoring.

\n\n\n\n

We also explore the Patchstack system as a whole and how it categorizes WordPress vulnerabilities based on their exploitation likelihood, and their implementation of virtual patches to protect against high and medium priority vulnerabilities automatically, without code changes.

\n\n\n\n

We also get into how Miriam’s team at Elementor collaborates with Patchstack to ensure rapid and professional handling of vulnerabilities, enhancing security for their 17 million installations.

\n\n\n\n

The partnership between Elementor and Patchstack is a great example of how different companies within the WordPress community are able to work together to provide better outcomes for their users.

\n\n\n\n

If you’re curious about the intersection of page builders and security in WordPress, or the value of collaborative partnerships in maintaining the ecosystem, this episode is for you.

\n\n\n\n

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

\n\n\n\n

And so without further delay, I bring you Miriam Schwab and Oliver Sild

\n\n\n\n

I am joined on the podcast today by Miriam Schwab and Oliver Sild. Hello.

\n\n\n\n

[00:04:14] Miriam Schwab: Hi.

\n\n\n\n

[00:04:15] Oliver Sild: Hello.

\n\n\n\n

[00:04:16] Nathan Wrigley: We’re in Portland. We’re at WordCamp US. It is 2024, and Miriam and Oliver have done a presentation, which I think happened yesterday. How did it go?

\n\n\n\n

[00:04:26] Miriam Schwab: I think quite well. I’ve been getting good feedback. What about you?

\n\n\n\n

[00:04:28] Oliver Sild: Yeah, I think it was great. I think, after the talk, we had a lot of people coming to us, and to ask about how they can, you know, replicate that on their plugins as well and it was very good.

\n\n\n\n

[00:04:37] Miriam Schwab: I actually ran into someone who was like, that was the best talk I’ve heard since the start of the conference, just by the way.

\n\n\n\n

[00:04:41] Nathan Wrigley: The title of that presentation was Enhancing Open Source Plugin Security, Establishing Robust Processes and Leveraging Bug Bounty Partnerships. And the podcast today is going to be about a partnership between, well, in Miriam’s case, Elementor, because that’s where Miriam’s working, and in Oliver’s case, Patchstack, because that’s where he’s working.

\n\n\n\n

Before we get into the nuts and the bolts of it though, can we start with Miriam? Can you just give us your little potted bio, like less than a minute, something like that?

\n\n\n\n

[00:05:06] Miriam Schwab: So, hi, I’m Miriam Schwab. I’m head of WordPress relations at Elementor. I act as a type of liaison between Elementor and the broader WordPress community. I joined Elementor about two years ago when they acquired the startup that I co-founded called Strattic, which was static hosting for WordPress. And that’s where my biggest activity around security started to happen. I basically created Strattic to solve security issues around WordPress. That was my biggest motivating factor for founding it. And then after joining Elementor I became quite involved in our security around our plugin specifically, and the processes behind it, and how we communicate with the community at large. And so that’s kind of how this all happened.

\n\n\n\n

Okay, great. Thank you, Miriam. And if you want to hear more from Miriam, I did a podcast episode with her from WordCamp Asia earlier this year. So you can check that out as well. I’ll put a link in the show notes. And, Oliver?

\n\n\n\n

[00:05:57] Oliver Sild: Yeah. I’m Oliver, I’m the CEO and co-founder of Patchstack. Actually, this month we turned seven years old, so already quite a long time. What we do is, we have just one very clear mission, it’s providing the fastest mitigation to security vulnerabilities in WordPress, and in open source. So we work with plugin developers, we do pen testing for them, manage their security processes. We also provide protection for developers and agencies for websites, to protect them from the vulnerabilities. And we work with probably most of the biggest hosting companies, in terms of helping them identify vulnerabilities in their customer’s websites, and also protect them from that.

\n\n\n\n

Yeah, I mean, from my own background, I used to also run an agency, which I think literally everyone has done at one point of the time. I had like a very strong security focus early on, so I did like malware research, and then met my co-founder who did vulnerability research. Fun fact, we met in Reddit. That’s how we actually met. But yeah, also do a lot of community stuff, so organising capture the flag events in Estonia.

\n\n\n\n

Right now, in WordCamp US, we also host a WordPress CTF, so everyone can go and join that. I don’t know when it’s going live, probably it’s over then. There’s a lot going on, and being very active in NGOs. I have co-founded a co-working space in Estonia, which is now a startup center and stuff. So a lot of community, open source and security stuff.

\n\n\n\n

[00:07:14] Nathan Wrigley: Thank you, Oliver, that’s great.

\n\n\n\n

So over the last few years, WordPress has been sort of replete with acquisitions, and then it felt like that dropped off the news and partnerships came along. And that became a big thing, and obviously Elementor, Patchstack partnering up. It seems like a curious thing to be partnering on. One is a page builder, that’s pretty clear, one is security. How did this come about, and what possible benefit is there with a security company partnering with a page builder company?

\n\n\n\n

[00:07:39] Miriam Schwab: So I’ll just start by explaining a bit about my approach to my position at Elementor, which is that, I want to find the ways that we can work together with other companies in the space, even ones that seemingly compete with us. Because there’s generally a place for us to collaborate, we have shared and common users. When we work together, things go better for everyone. I just really feel like there’s a power in two organisations, or companies coming together to achieve goals together. So I do actually quite a lot of that in general.

\n\n\n\n

With Patchstack it’s actually a really straightforward win-win here, I think, and definitely a win for Elementor. So Elementor, the plugin, the core and the free have an active install base of over 17 million websites, right? Which is a mind-boggling number. And that means that everything that Elementor does, we have to do quite carefully, right? Because it can impact the users very positively, and then something goes wrong that’s quite a negative experience.

\n\n\n\n

And that includes security. We need to make sure that the plugin is as secure as possible for this very broad user base. And we have a lot of very robust internal processes around ensuring that the code is secure before it’s deployed and released. But anyone who works in software will know that, no matter what you do, you can do everything and be superhuman, things still might end up having a vulnerability that needs to be dealt with after deployment. It’s just the nature of the game.

\n\n\n\n

So were working with a bug bounty program called Bugcrowd to bring another very significant layer of security to our plugin post-deployment. I was fortunate to meet Oliver, I think it’s like almost two years ago, at least a year and a half ago or something. I had been looking at what Patchstack was doing, I was very impressed. Their specific focus on WordPress plugins, and open source, and also the clear passion that they have for open source, and making open source ecosystems more secure. That really, I think resonated with me and with Elementor.

\n\n\n\n

And so we started to explore whether Patchstack could be a good solution for us to add another layer of security to our plugin, with that angle of expertise in WordPress. And so, you know, we start to explore that and work together, and it’s been successful from day one. And brings a lot of value, not just to Elementor, by bringing their like additional expertise to the table. But also obviously to our end users who can be confident that there’s a very thorough, and professional, and responsible process behind bug disclosure, and how we handle it, and release patches very, very quickly. Our turnaround time is quite fast.

\n\n\n\n

[00:09:58] Nathan Wrigley: So can I just unpack that for the audience who in many cases won’t be particularly technical. So, does the workflow go a bit like this? Elementor creates a new feature, creates an update, has something that they need to push out to the plugin, and that is then created on your side. But then somehow it gets pushed over to Patchstack, and then Patchstack inspect it, check it, make sure that it passes all the tests that maybe they’re using, and then passes it back to you and says, go, no go. Is it basically something like that?

\n\n\n\n

[00:10:25] Miriam Schwab: It’s something like that. I’ll explain a bit, and then I’ll let Oliver like expand on that. Basically, Patchstack receives a report from one of their security researchers that there’s an issue with Elementor. Patchstack gets more than one report, okay, in general, but the additional value that they bring to us is that they review the reports to make sure that what we’re seeing, and then dealing with, are quality reports.

\n\n\n\n

There’s a lot of researchers that just, they’re just looking to report stuff. So they’ll repeatedly report like ridiculous things that aren’t really a problem for anyone, just wasting everyone’s time. So we get high quality reports from Patchstack. We replicate it, you know, we determine the plan of action, and the team creates a patch for it, test it on our end as thoroughly as we can.

\n\n\n\n

Pretty early on within our work with Patchstack, we added a stage, I asked if they could do it, I think it was something like that, and they’re like, yeah, of course. And it’s possible they already did it, but we hadn’t experienced that before, that we then send it to them for review to make sure that it fully resolves the issue. That’s very value add because it’s additional pairs of eyes on it. And once they’ve confirmed, then that actually goes out to release to our users, and all that. But I’ll let Oliver just explain more about that.

\n\n\n\n

[00:11:26] Nathan Wrigley: Yeah. So just to confirm, that is one of the things that’s happening. Once you’ve packaged it up, it gets handed over to Patchstack. Patchstack inspect it, like I said, go, no go, something along those lines. Okay, over to Oliver for the technical details.

\n\n\n\n

[00:11:37] Oliver Sild: So it’s important to understand that our logic is that, the only way how we can provide the fastest mitigation for security vulnerabilities in the WordPress ecosystem is when we cover the entire life cycle of a security vulnerability.

\n\n\n\n

That starts from the point of someone finding it, reporting it to a vendor, patching it, to users getting notified about it, and users getting mitigated, and to the point where they eventually, you know, fix it, right?

\n\n\n\n

Which includes three different key stakeholders, right? So it’s plugin developers, website builders, or like website owners who build websites, and hosting companies who also have like a huge responsibility because they are like hosting that code and everything, right?

\n\n\n\n

So the reason why probably we are one of those only ones that are going to validate the patches is because we need to do it anyways. That’s the very simple answer.

\n\n\n\n

Because ultimately we have responsibility in front of our customers who are using Patchstack to protect their websites. And if we don’t validate the patches that we see, like plugins releasing fixes, then how do we actually know that it’s patched? Because there’s so many cases where vulnerabilities are getting patched by the vendors, but then you look into it and they patch the wrong thing, or they just kind of like messed something up. So for the hackers, it’s very easy to bypass it, and things like that.

\n\n\n\n

So before we tell our customers that, hey, now you don’t have a security vulnerability anymore, we must make sure that it’s the actual case, right? So that’s really where this comes from because yeah, as I said, we cover the entire life cycle. So our customers, developers and agencies who use Patchstack to get their websites, you know, we call it virtual patching, which is like auto mitigation of vulnerabilities in real time.

\n\n\n\n

So to get everything mitigated as soon as possible, and then plugins to fix all the vulnerabilities as soon as possible. And then hosting companies to be able to send out notifications. Everything, we need to basically combine all this into a single process. So internally we could say that we are actually doing one thing, but it just kind of like spans out in three different locations.

\n\n\n\n

[00:13:35] Nathan Wrigley: Where do you get your data from? Where do the data points about what’s going on in the world, for Patchstack, how does that come into you? Have you got like a, I don’t know, like a red team or something like that, or is it just your paid employees that are constantly going out looking? I genuinely have no idea how that information comes in into your inbox if you like, for want of a better word.

\n\n\n\n

[00:13:53] Oliver Sild: So there’s three sources really. We have internal security researchers that do a lot of pen testing, they do a lot of research in general.

\n\n\n\n

Then what we started doing, four years ago already, was we created the first kind of like open bug bounty program for WordPress. So if you, Nathan find the security vulnerability in someone else’s like Miriam’s plugin, then we pay you if you report it.

\n\n\n\n

So we started like incentivising security researchers to start looking for vulnerabilities in the WordPress eco system, because there was so many of them to find. And if you don’t give incentives for hackers to report them properly, then they are going to do something else with it. So that was something that we started doing, yeah, about four years ago already.

\n\n\n\n

And we have like 1,600 people in the community, of like ethical hackers all around the world. We have like a leaderboard system, and they get rewarded. Just two weeks ago, one of the researchers got like 16.4k for a single vulnerability, which we paid out from our own money.

\n\n\n\n

But we do all of that because we want to protect our customers, right? And also it helps to protect the plugins as well, because it gets the plugins, you know, fix the vulnerabilities before, potentially hackers have had time to kind of like do that.

\n\n\n\n

But there’s this third one then, which is the MVDP. So we act as a security point of contact for a lot of plugins. So Elementor is one example, but we have 400 other plugins that actually pass every single vulnerability to Patchstack. So we help them validate those issues. We help them to verify that the patches are complete and everything like that. And that’s also how we basically become like the best security solution for their users, because we are able to protect them very, very fast.

\n\n\n\n

[00:15:28] Nathan Wrigley: So we could be having the same conversation with Miriam with 400 other companies. There are 400 companies with the same kind of relationship. I’m guessing not many of them with 17 million installs. But actually that’s a serious point though. The fact that you’ve got 17 million installs kind of makes this more important than almost any other plugin out there in all honesty. Because if something goes wrong, it’s going to completely break. You know, it’s not like a minor function of your website, it probably is the entire website, the front facing website.

\n\n\n\n

And so I guess you have a pretty big target on your back. You know, if somebody can leverage, or figure out a vulnerability in Elementor, that’s going to be worth more than, I don’t know, plugin X over there that has 24 installs on the repo, or something like that. So the security posture from your side has to be really, really serious.

\n\n\n\n

And so, is it like a bi-directional relationship? Like, if you discover something, and I’m pointing at Oliver. If Patchstack discover something, you can then send it directly to Elementor, and forewarn them about that problem. They can fix their code. But it works in the other direction as well. You don’t know you’ve got a vulnerability, so you pass it to Patchstack, they figured that you have, and it comes back. So it’s this nice circle of virtue where you’re both helping each other out.

\n\n\n\n

[00:16:37] Miriam Schwab: There’s a few different directions that this security relationship works with Patchstack. So one is that they have their community of security researchers, that’s what they’re called, who are basically constantly trying to break into everyone’s stuff. That’s more or less what they’re doing.

\n\n\n\n

Now that could be like, oh no, why are they doing that? That sounds so terrible. But like, they’re not the only ones doing it, right? They’re doing it in order to then report it, so that it can be fixed.

\n\n\n\n

There’s other people who are just like them out there who are doing the same thing for malicious purposes, and don’t necessarily plan on reporting it, but plan on exploiting it.

\n\n\n\n

So we want these security researchers doing what they’re doing, and then reporting it to Patchstack, and Patchstack reports it to us. And then we start this cycle of mitigating it, and releasing a patch that fully resolves it.

\n\n\n\n

Because we’re so big, and we have such a huge code base, so definitely we’re like a target of interest because let’s say the ROI for a hacker, or a vulnerability is high for Elementor, so that’s why we take it seriously in terms of this full circle type of approach to the security before deployments and after deployment, which I described.

\n\n\n\n

But another way that we work with Patchstack is when we get reports that aren’t from Patchstack, because that also happens. But we find a lot of value in making sure that Patchstack is in the loop even on those reports. Theoretically, we could get a report from someone else, and I’ll explain how briefly, but we could get a report from someone else, and then we could just do our own thing. But we want to be as responsible and as transparent as possible around vulnerabilities that exist in Elementor.

\n\n\n\n

From our perspective, security’s not something to be embarrassed about because we know we’re doing everything we can. It’s something to just accept that it’s going to be a thing, but the question is not if, but how? So our how, is to be very, very responsible about it and transparent.

\n\n\n\n

So when we get these reports, we loop Patchstack in, and we tell them that we’ve got this report so that they can be part of the process, and make sure that the loop is closed in the most secure way possible, including that they look at these reports as well, and our patches as well, to make sure that we’re fully resolving it.

\n\n\n\n

[00:18:33] Nathan Wrigley: So you’re sort of patting each other’s backs in a way. You know, something that you get gets passed to them, that’s kind of nice free intel for them. It came to you first, but it ends up at Patchstack, so they can then act on that, and send it out to your other 400 customers if it might affect them. That’s nice.

\n\n\n\n

[00:18:47] Miriam Schwab: I think it helps Patchstack. I can’t speak for Patchstack, but I think it helps for Patchstack to have the full, the full vision of what’s going on with every, let’s say, all plugins that are in their MVD program, which means, by the way, MVDP is managed vulnerability disclosure program. Yes, that’s important because not everyone will know what that is.

\n\n\n\n

To have the full visibility into what’s going on, so when we share that information with Patchstack, it helps Patchstack have more information for everyone, and also for us, Elementor going forward. So there’s like more context for everyone. And then that comes back to this approach of transparency as well.

\n\n\n\n

Again, Oliver can speak to this, probably working with a plugin of our scale, while there’s a lot more at stake here, it brings a lot of learnings into Patchstack because there’s not that many plugins that are at the scale. I think there’s maybe five that are over 10 million active installs in the plugin repository. They recently updated the numbers so that it will show that, at least there’s that. And it’s a whole other ball game when you’re at that scale of size, reach, code base, age, right? Elementor is eight years old, so all that, but Oliver can talk to that.

\n\n\n\n

[00:19:42] Oliver Sild: So one of the things is that, if we look at the data from the past years. In 2023, if we look at all the security vulnerabilities being known, or made public in the WordPress ecosystem, over 76% originated from Patchstack. The number and the volume is incredibly high. And even if we talk about historic data, like all the WordPress historically, Patchstack has processed the highest amount of security vulnerabilities that are biggest amount of them, or even majority I would say.

\n\n\n\n

So that also gives us like some level of experience in terms of how much we’ve had to already work with security researchers. We understand how they like to report things, what are the issues with the reportings, and things like that, but also like how to build processes internally, so you would be able to even like, cope with that kind of a load, right?

\n\n\n\n

So I think there’s this kind of experience we’ve had there, which has allowed us to actually build a solution that works for Elementor, and they have a very high standards. So I think without the hard work we’ve done over the past years, it could have not been possible.

\n\n\n\n

By the way, we provide all of this to Elementor for free, Elementor doesn’t pay anything for providing MVDP service. And we provide this for free for everyone in the WordPress ecosystem. And we built this entire MVDP program, and the platform, together with European Union because European Union is going to pass a law in Q4 that is making this actually mandatory for all commercial open source software.

\n\n\n\n

[00:21:03] Nathan Wrigley: Why do you do it for free? You could see my face, my eyes open thinking, hang on, wait, why?

\n\n\n\n

[00:21:08] Oliver Sild: So, one of the reasons is because European Union funded building it for free, for us as well, right? So we got 2.7 million euros to build it, and to build all the processes and everything around it. European Union understood that WordPress ecosystem is just so massive in scale, and they chose us to do it because of our track record.

\n\n\n\n

And now we are very well connected with that, and as they are, you know, preparing to release this new regulation, which by the way, like even US companies need to comply with. So everyone who has European users, every software that has commercial element to it, like accepting donations, having paid support, having premium version, or even if they’re just not fully free, but like the company that owns the plugin has any commercial activity, they need to comply.

\n\n\n\n

And the things that they need to comply is have a VDP program, which is literally what we built. You need to start releasing patches separately from functional releases. There is going to be a lot of those kind of changes, like you have to notify users about vulnerabilities. You have to notify users later on, also if the vulnerability is getting mass exploited. There’s these kind of rules, and our platform basically pre complies you for that entire regulation.

\n\n\n\n

The reason why we do it also for free is exactly what Miriam told, it’s like we also get visibility. Because as I mentioned, we cover the entire life cycle of vulnerabilities, so our goal is to provide the fastest mitigation to vulnerabilities. And the way to do that is to know about vulnerabilities. So for our end users and to all Elementor users, for example, who are using Patchstack, they know that the fastest way to get protected is from Patchstack, because we work together with Elementor. We work together with other plugins, and that’s how they know that they are getting protected by Patchstack as well.

\n\n\n\n

[00:22:42] Miriam Schwab: So both of us have strange business models, Elementor and Patchstack, because if you think about it, Elementor’s 17 million active installs, the vast majority of them are using our free product, and that’s our business model. And Patchstack’s business model is based also on providing a lot of value for free that then ends up being an actual business model. I wonder if these types of business models, that bring a lot of people value for free, could exist outside of open source, and could exist outside of WordPress.

\n\n\n\n

[00:23:08] Nathan Wrigley: Do you both advertise each other’s presence then? For example, Miriam, do you on your website somewhere say, we have this relationship with Patchstack, I don’t know, protected by Patchstack or something? And again, in the opposite direction, do you say, yeah, one of our customers, Elementor? I don’t know if there’s anything in that.

\n\n\n\n

[00:23:24] Miriam Schwab: We have a page on our site that we make sure is linked to from the footer of every page on our site. It’s called our Trust Center. It’s very important for anyone who has some kind of security process, which everyone should, to have an easy way for people to find how to report issues to the company, because otherwise people might find something, not know how to report it. It ends up in some random person’s inbox, nobody pays attention, and that’s not good for anyone.

\n\n\n\n

So we have this trust page that describes all of our security process and everything, and that links to our Bug Bounty page. It’s a page fully dedicated to just explaining our Bug Bounty program. And it clearly states there that all plugin related issues should be, and need to be reported to Patchstack. And we highly request that people respect that process because it allows Patchstack to make sure that these vulnerabilities are patched quickly, and it allows Elementor to make sure that it’s patched quickly. Which is better for everyone because we have the processes in place based around our partnership with Patchstack.

\n\n\n\n

So that’s clearly visible on our site. And we talk about in different forums, for example, the talk given yesterday, and of course this interview right now. So it’s something that’s quite publicly known.

\n\n\n\n

[00:24:27] Oliver Sild: So what we also have is, on Patchstack, we have a vulnerability database, which is completely free to use in public, where everyone can see what are the latest vulnerabilities. We show people like what the priorities there are and so forth. But it also has a directory of VDPs. So we actually have a directory where you see all the plugins that have VDP programs active.

\n\n\n\n

So that also gives you, as a developer or user, an understanding of like, okay, I want to use a plugin for my website for a specific function, let’s say a page builder. I want to use something that has proper security practices in place. So that’s where we have like this directory where you can go and look into which ones actually have a VDP program.

\n\n\n\n

We also have like a highlighting there for those plugins that are, you know, also contributing more into the community aspect as well. Actually, Elementor is featured there currently.

\n\n\n\n

So, I think having mature security processes is a big competitive advantage for plugins as well, because developers are going to choose stuff that they feel, security is, in general, very hot topic right now. I just talked yesterday with some quite big hosts in the space, and they said that it used to be that everyone was asking about performance, and now everyone is asking about security.

\n\n\n\n

And that also means that this kind of interest to security has, you know, reached the developers and everywhere. And when they make those decisions of, what plugs should I use, they are going to eventually choose the ones that they can trust most.

\n\n\n\n

[00:25:47] Nathan Wrigley: Does it muddy the water a bit? In other words, let’s say that I’m a customer, and I’m out there looking for a page builder. I come to Elementor, I’ve got my site up and running and I’m thinking, okay, I want some sort of security, I’ve heard that security’s a thing on my website. Does it muddy the water? Commercial rivals of Patchstack, for example, is the implication, okay, you must only use Patchstack. Patchstack is our preferred customer, nothing else will work. Do you ever get any intel like that?

\n\n\n\n

And the other way around? You know, if people have got some sort of security posture, but they’re looking for a page builder, do you know what I mean? There could be some sort of misunderstanding, like we only work with Elementor, or we only work with Patchstack. Do you ever get any of that kind of intel where it’s, I don’t know, muddied the water, confused things?

\n\n\n\n

[00:26:25] Miriam Schwab: The way that is generally accepted that companies and products work when it comes to their security processes, and particularly with regards to their bug bounty programs, is that they will define their bug bounty programs, and it is highly requested that people respect that.

\n\n\n\n

That isn’t always the case, and so we have had to put some processes in place where we are capable of accepting reports from other parties or individuals, who for one reason or another prefer to send it directly to us.

\n\n\n\n

So it doesn’t mean that you have to only work with Patchstack. We want reports to go wherever they can go that will make sure that we’ll get them so that we can take care of them. Legitimate reports, right? High quality reports.

\n\n\n\n

But then at that point we loop Patchstack in anyways. And that’s one of the great things about our relationship with Patchstack, they’re not like, oh, they didn’t send a to us so, you know, good luck to you, take care of it yourself. It comes back to this interest in having full visibility. And we want Patchstack’s input in making sure that everything is done properly. Both in terms of us patching it fully and resolving the issue.

\n\n\n\n

But some other things that come up is that sometimes these other reporters send us reports that are not clear. Patchstack sends us reports that are quite clear, replicable, which means that we can recreate them on our end, which helps us figure out how to fix them, right? If you can’t see the problem, you can’t fix it, and well documented. Sometimes we get reports from other sources that are quite unclear. So Patchstack can even help us ask the right questions, or sometimes try to figure out what’s going on there, either we’ll do it ourselves. Basically the process is either directly to Patchstack, then to us. Or to us, and then to Patchstack, and then to us. And then that loop starts from that direction.

\n\n\n\n

So we’re open to working with anyone. We want the reports to come to us. If for some reason people really refuse to work with Patchstack as our bug bouncy program, that’s okay. Patchstack is still part of our bug bouncy process, but we are capable of handling that as well.

\n\n\n\n

[00:28:16] Oliver Sild: We actually work with other security companies. I don’t know if you’re not aware, but like Patchstack is powering vulnerability notification system and V Patching for Solid Security, which was previously known as iThemes Security. We do that for WPMU Defender. We do that for SecuPress. We do that for Shield Security. We do that for WP Guardian, which is a co-product with Patchstack and WebPros.

\n\n\n\n

So I think what is very common between Patchstack and Elementor is that we actually work with everyone, together. Regardless whether they are like a competitor or not. We work with everyone who is willing to work together with us as well. Everything that we do in Patchstack is about collaboration.

\n\n\n\n

As I’m saying, like we work with hosting companies, we work with plugins, we work with developers and agencies. I think that is literally the only way how to succeed in making the ecosystem secure.

\n\n\n\n

In general, I think that allows us to also just make it actually as secure as it can go. And I think, from going forward from here, with all the regulations and everything also coming in, I think it’s the only way really.

\n\n\n\n

[00:29:12] Nathan Wrigley: Let’s take the scenario, Miriam, that you discover, or it is discovered by you, so not by Patchstack, out there in the wild somewhere there’s a serious problem in the Elementor’s code base. And it’s Friday night, and it gets reported to you. I’m just interested, what is the behind the scenes process that you have got set up between you to make things happen in a timely fashion?

\n\n\n\n

So I’m taking the example of, you know, Friday night being the beginning of the weekend, everybody’s going off for a couple of days, this is a bad time to discover it. I’d be interesting to know, how does that get handed off, and how does it then come back? What are the backend systems that you’ve put in place that we’ll never know about, will never be discoverable to us, but I’m presuming they now exist since you’ve partnered up with each other?

\n\n\n\n

[00:29:51] Miriam Schwab: So there’s two types of reports. I mean, there’s a lot of types of reports, but I’m just going to divide them into two categories.

\n\n\n\n

One report, type of report is this issue is being actively exploited. Meaning bad people know about it and are already trying to hack sites with it. Or this issue is some level of severity and needs to be taken care of, but nobody knows about it yet.

\n\n\n\n

Okay, so in the case of the first one, it’s all hands on deck, do or die, let’s fix this. I can’t think that this has happened since we started working with Patchstack, so I’m like theorising here. But, probably we’ll reach out to them in one of our direct channels. So like we have a shared Slack channel with Patchstack, they’re very responsive there.

\n\n\n\n

So it would be like, help, all the sirens. We’re like now dealing with this. If it’s actively exploited, we know we’ll be like, okay, we’re probably already working on it, right?

\n\n\n\n

But, FYI, heads up, we’re going to like be releasing this as soon as possible, please be available so we can send it to you just for review before we do. So that’s one type.

\n\n\n\n

The second type is you can breathe more. There’s different levels of severity. Meaning if between now and some point it’s discovered, if it’s a high level of severity, then oh my goodness. If it’s low level security, then it’s like it’s not going to affect all sites, only going to affect some certain types of users, like that kind of stuff. So it’s like less urgent.

\n\n\n\n

But that probably means that we can all just continue our weekend. I’m theorising again, so nobody should take me at it and be like, what? You’re going to sleep through the weekend with this? No, that’s not what I mean. Each vulnerability is looked at for vulnerability, and if it’s super urgent or highly urgent, then it gets the attention immediately, Patchstack will be pulled in. But if not, then there’s like a pretty clear process around it in terms of internal timelines, and the timelines that Patchstack gives us.

\n\n\n\n

So the reason that Patchstack gives a timeline is because, if they report something, a plugin, developer, or whatever has a certain amount of time within which they need to patch it. It’s better for everyone that that exists. There’s a lot of other things that you want to make a priority, so you could just kind of drag it on. But It will eventually be found.

\n\n\n\n

If something is not patched within the timeframe, then Patchstack has a whole process, which Oliver can explain. But it does get disclosed, let’s say, to the plugin review team, and that’s a serious matter for the plugin then to have to deal with it at that point.

\n\n\n\n

And then we create our own internal timeline in terms of how fast we have to turn around a patch, also based on the level of severity. So if it’s highest level of severity, it’s like really fast, medium, less fast. But our turnaround time, our customers keep raving about it on like bugs, but also security issues, we’re very fast. We take it seriously in all situations. Whether it happens Friday night at midnight or, you know, Sunday morning, because our work week starts a Sunday, that’s a different story.

\n\n\n\n

[00:32:14] Nathan Wrigley: Oliver, just before you begin, I have a friend who’s a medic and he is in trauma surgery. His phone is the conduit to, like the alarms are sounding. Do you have something equivalent to like that? Do you operate a sort of 24/7? I think you said you’ve got a distributed team. So you’re able to react right now, no matter what time of the day or night, 365 days of the year. Is that the kind of thing that you do? I was saying about the weekend, do you all take the weekend off? How does it work?

\n\n\n\n

[00:32:38] Oliver Sild: We do cover all time zones. So we have people in Asia, we have people in Europe, we have people in the US. This is important for us to do threat intelligence and, you know, security research in general.

\n\n\n\n

One thing, also in terms of like a zero days, or like in vulnerabilities in general, one thing that we help the, I would say our developer to sleep over the weekend, is that we are actively monitoring whether this vulnerability is getting exploited or not.

\n\n\n\n

So immediately when we see any kind of like signals that there is an actual exploitation attempt against this vulnerability, they would be notified immediately.

\n\n\n\n

We also take care of this kind of like a background threat intelligence monitoring part, where we know about the vulnerability, so we have signals whether this vulnerability type is getting exploited or not.

\n\n\n\n

[00:33:17] Nathan Wrigley: So you could tell whether a zero day is realistically a zero day, okay. In theory it’s possible, but nobody’s doing anything about it, so maybe we can step down a little bit.

\n\n\n\n

[00:33:27] Oliver Sild: So there’s two things we do. One thing is that we have created what we call Patchstack Priority. And this is like a special scoring made for prioritising WordPress vulnerabilities based on the likelihood of them becoming exploited.

\n\n\n\n

So we have high priority vulnerabilities, which is based on historic data, vulnerability types, and there’s like a lot of data around that shows that this vulnerability, basically we predict that this vulnerability is going to become exploited.

\n\n\n\n

And then we have medium priority, which is vulnerabilities that are potentially going to be exploited in targeted attacks. Doesn’t mean that it’s mass exploited, but it’s like, you know, if you have like a e-commerce store, for example, that holds credit card details, there’s a higher potential that this is going to be used in a targeted attack.

\n\n\n\n

And then there’s low priority, which is like, this is not going to get exploited at all.

\n\n\n\n

Based on that, we also kind of modify our timelines and everything. And also we generate virtual patches based on that, which is the auto mitigation feature that we have for all the high and medium vulnerabilities. We immediately create virtual patches, which are like essentially vulnerability specific protection rules that get automatically deploy to our customer sites without changing any code or anything. It’s very, like a precise way of making sure that this vulnerable function can’t be used in any other way than it was originally intended.

\n\n\n\n

So because of that, we have full visibility into the kind of like a network, whether we see where a specific vulnerabilities are being exploited or not. And that allows us to also basically notify back to the plugin developers later saying like, hey, we now have proof that this vulnerability has been exploited, here’s all the attacker’s information, all that kind of stuff. So we have a lot of data around that as well.

\n\n\n\n

[00:35:03] Nathan Wrigley: I think it’s amazing that WordPress as a CMS is big enough to have a page builder plugin and a security plugin at the scale that they can not only function independently, but also they can create a really meaningful partnership between the two of you. And I have really found this conversation fascinating. It’s really interesting peeling back the curtain and seeing how you’re doing things behind the scenes, if you like, so that you’re protecting all of your customers. Thank you so much, Oliver. Thank you so much, Miriam. Where can we find you online?

\n\n\n\n

[00:35:34] Miriam Schwab: You can find me personally on Twitter at Miriam Schwab. I’m also on Make WordPress Slack, post status Slack, LinkedIn, whatever. And Elementor of course is on all the social networks. We’re active on Instagram, Twitter, our website, elementor.com.

\n\n\n\n

[00:35:48] Oliver Sild: All the same places, but just Oliver Sild.

\n\n\n\n

[00:35:51] Nathan Wrigley: Perfect, and Patchstack.

\n\n\n\n

[00:35:53] Oliver Sild: Yes, patchstack.com.

Miriam co-founded Strattic, a platform with an aim to revolutionise WordPress security and performance on the web. After Elementor acquired Strattic, Miriam continued leading the unit before becoming Head of WordPress Relations. Prior to that, Miriam founded and managed a prominent WordPress development agency in Israel. With over 15 years of experience, she’s a respected member of the WordPress community and a frequent speaker at WordPress events.

Oliver Sild is the CEO and co-founder of Patchstack, a company dedicated to the mitigation of security vulnerabilities in WordPress and open-source environments. Patchstack is now a seven-year-old enterprise, and they specialise in penetration testing, security process management, and protective services for developers, agencies, and major hosting companies. Oliver’s background also includes experience running an agency, and his work at Patchstack focuses on collaborating with plugin developers and hosting providers to ensure robust security measures for their clientele.

Miriam and Oliver joined me at WordCamp US 2024 in Portland, where they did a presentation discussing the processes needed to enhance open source plugin security and the advantages of leveraging bug bounty partnerships. Their collaboration brings to light the importance of integrating security solutions within the WordPress ecosystem, especially for companies with a footprint as large as that of Elementor.

We talk about the global operations of Oliver’s team at Patchstack, who work across all time zones, providing round-the-clock threat intelligence and vulnerability monitoring. We also explore the Patchstack system as a whole and how it categorises WordPress vulnerabilities based on their exploitation likelihood, and their implementation of virtual patches to protect against high and medium-priority vulnerabilities automatically without code changes.

We also get into how Miriam’s team at Elementor collaborates with Patchstack to ensure rapid and professional handling of vulnerabilities, enhancing security for their 17 million installations. The partnership between Elementor and Patchstack is a great example of how different companies within the WordPress community are able to work together to provide better outcomes for their users.

If you’re curious about the intersection of page builders and security in WordPress, or the value of collaborative partnerships in maintaining the ecosystem, this episode is for you.

Useful links

The first release candidate (RC1) for WordPress 6.7 is ready for download and testing!

What’s in WordPress 6.7 RC1?

Plugin	Install and activate the WordPress Beta Tester plugin on a WordPress install. (Select the “Bleeding edge” channel and “Beta/RC Only” stream).
Direct Download	Download the RC1 version (zip) and install it on a WordPress website.
Command Line	Use the following WP-CLI command: `wp core update --version=6.7-RC1`
WordPress Playground	Use the 6.7 RC1 WordPress Playground instance (available within 35 minutes after the release is ready) to test the software directly in your browser without the need for a separate site or setup.

Get a recap of WordPress 6.7’s highlighted features in the Beta 1 announcement. For more technical information related to issues addressed since Beta 3, you can browse the following links:

Want to look deeper into the details and technical notes for this release? These recent posts cover some of the latest updates:

How you can contribute

Get involved in testing

Search for vulnerabilities

Update your theme or plugin

For plugin and theme authors, your products play an integral role in extending the functionality and value of WordPress for all users.

Thanks for continuing to test your themes and plugins with the WordPress 6.7 beta releases. With RC1, you’ll want to conclude your testing and update the “Tested up to” version in your plugin’s readme file to 6.7.

If you find compatibility issues, please post detailed information to the support forum.

Help translate WordPress

Do you speak a language other than English? ¿Español? Français? Русский? 日本? हिन्दी? বাংলা? You can help translate WordPress into more than 100 languages. This release milestone (RC1) also marks the hard string freeze point of the 6.7 release cycle.

Release the haiku

Thank you to the following contributors for collaborating on this post: @atachibana, @jorbin.

We’re a studio in Berlin with an international practice in architecture, urban planning and interior design. We believe in sharing knowledge and promoting dialogue to increase the creative potential of collaboration.

We\'re a studio in Berlin with an international practice in architecture, urban planning and interior design. We believe in sharing knowledge and promoting dialogue to increase the creative potential of collaboration.

The voyage had begun, and had begun happily with a soft blue sky, and a calm sea.

Welcome to WordPress. This is your first post. Edit or delete it, then start writing!

This is an example page. It\'s different from a blog post because it will stay in one place and will show up in your site navigation (in most themes). Most people start with an About page that introduces them to potential site visitors. It might say something like this:

As a new WordPress user, you should go to your dashboard to delete this page and create new pages for your content. Have fun!

Who we are

Suggested text: Our website address is: https://wordpress-56409-0.cloudclusters.net.

Comments

Suggested text: When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.

An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Media

Suggested text: If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Suggested text: If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select "Remember Me", your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

Suggested text: Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Who we share your data with

Suggested text: If you request a password reset, your IP address will be included in the reset email.

How long we retain your data

Suggested text: If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

What rights you have over your data

Suggested text: If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Where your data is sent

Suggested text: Visitor comments may be checked through an automated spam detection service.

Recent Posts

Recent Comments

Archives

Categories

Welcome to WordPress 6.7!

Introducing Twenty Twenty-Five

Endless possibility without complexity

Get the big picture with Zoom Out

Explore your content from a new perspective

Connect blocks and custom fields with no hassle (or code)

A streamlined way to create dynamic content

Embrace your inner font nerd

New style section, new possibilities

Performance

Accessibility

And much more

Learn more about WordPress 6.7

The 6.7 release squad

Thank you, contributors

Get involved

What’s in WordPress 6.7 RC3?

How you can contribute

Get involved in testing

Search for vulnerabilities

Update your theme or plugin

Help translate WordPress

Release the haiku

What’s in WordPress 6.7 RC2?

How you can contribute

Get involved in testing

Search for vulnerabilities

Update your theme or plugin

Help translate WordPress

Release the haiku

What’s in WordPress 6.7 RC1?

How you can contribute

Get involved in testing

Search for vulnerabilities

Update your theme or plugin

Help translate WordPress

Release the haiku

Why This Addition Matters

How This Change Protects the Community

Moving Forward Together

How to test this release

Vulnerability bounty doubles during Beta/RC

Beta 3 updates and highlights

A Beta 3 haiku

Welcome to WordPress 6.7!

Introducing Twenty Twenty-Five

Endless possibility without complexity

Get the big picture with Zoom Out

Explore your content from a new perspective

Connect blocks and custom fields with no hassle (or code)

A streamlined way to create dynamic content

Embrace your inner font nerd

New style section, new possibilities

Performance

Accessibility

And much more

Learn more about WordPress 6.7

The 6.7 release squad

Thank you, contributors

Get involved

Step 1: Choose consistent and memorable social media handles

Use Namechk and KnowEm to ensure handle availability

Step 2: Optimize handles for each platform’s format

Step 3: Display social media handles on marketing materials creatively

Step 4: Display your social handles in one place with Gravatar

Step 5: Leverage QR codes to simplify access

Step 6: List social media handles on your website and landing pages

Include social media icons in key website locations

Embedding live social media feeds

Optimize social media links for mobile users

Step 7: Promote social media handles in video and audio content

Display social media handles as text overlays in videos

Add social media handles to the description box of video platforms

Mention handles verbally in video and audio content

Include social media handles in end screens or outro segments

Promote social handles during live streams