Reading view

How WordPress decides a theme is a “block theme”

The term “block theme” is used a lot in WordPress but it was never really clear to me what that meant exactly from a code point of view.

While researching The post editor is going full iframe: what block developers need to know before WordPress 7.1, I learned that the outcome of testing WordPress 7.1 Beta 1 may soften the plan: instead of forcing the iframe for everyone, core might force it only for block themes, while classic themes using blocks with apiVersion 2 or lower keep the current 7.0 behavior. (The linked article covers the 7.0 state of things in full.)

If that’s the split, then the exact definition of “block theme” suddenly matters a great deal. So what does core actually check?

The public API is wp_is_block_theme(), which just asks the active theme:

PHP
// wp-includes/theme.php (guard clause trimmed)
function wp_is_block_theme() {
	return wp_get_theme()->is_block_theme();
}

And WP_Theme::is_block_theme() is, in its entirety, a file-existence check:

PHP
// wp-includes/class-wp-theme.php (caching trimmed)
public function is_block_theme() {
	$paths_to_index_block_template = array(
		$this->get_file_path( '/templates/index.html' ),
		$this->get_file_path( '/block-templates/index.html' ),
	);

	foreach ( $paths_to_index_block_template as $path ) {
		if ( is_file( $path ) && is_readable( $path ) ) {
			return true;
		}
	}

	return false;
}

A theme is a “block theme” if it ships an index.html block template, either in templates/, or in block-templates/, the pre-5.9 legacy location. Nothing else is consulted. That has a few consequences that may surprise people:

theme.json doesn’t make you a block theme. Neither do patterns, block template parts, or add_theme_support( 'block-templates' ). A theme can adopt every one of those “hybrid” features and still land on the classic side of this check, because the test only looks for a top-level index.html template.

Child themes inherit the answer. get_file_path() looks in the child theme first and falls back to the parent, so a child theme of a block theme is a block theme even if the child ships no templates of its own.

It’s a filesystem check, not a declaration. There’s no header in style.css that opts you in or out. Drop a templates/index.html into a theme and, as far as WordPress is concerned, it is a block theme.

The minimum files required for block and classic themes

This is the entire minimum viable block theme — two files:

Markdown
my-block-theme/
├── style.css          ← standard theme header
└── templates/
    └── index.html     ← this file IS the decider

(WordPress considers a theme valid if it has style.css plus either index.php or templates/index.html, which means for a block theme, index.php, functions.php, and even theme.json are all optional.)

And this is a theme that is guaranteed to stay classic:

Markdown
my-classic-theme/
├── style.css
└── index.php          ← the classic fallback template

Staying on the classic side of the check comes down to two conditions:

  1. No templates/index.html and no legacy block-templates/index.html. Other block templates don’t matter: a theme with `templates/single.html` but no `templates/index.html` still tests as classic. (In practice, though, if you’re shipping block templates, ship the index and be a block theme on purpose.)
  2. No block-theme parent. The check falls back to the parent theme, so a child of Twenty Twenty-Five is a block theme no matter what the child contains. To be classic, the whole chain has to be.

Everything else is fair game. theme.json, patterns, add_theme_support( 'block-template-parts' )` custom templates registered from plugins — none of them flip the switch., patterns, add_theme_support( 'block-template-parts' ), custom templates registered from plugins: none of them flip the switch.

Where real themes land

Running that check against some current releases from the theme directory

Tests classicTests block
Twenty Twenty-One and every earlier defaultTwenty Twenty-Two and every later default
Astra, Kadence, Blocksy, Botiga, Sydney, Hello Elementor — all ship theme.json
GeneratePress, Neve, OceanWP, Storefront

Six of the themes in the first column ship theme.json, the marquee “block” feature, and still test classic, because the check never looks at theme.json

Twenty Twenty and OceanWP are another good gotcha: both ship a templates/ directory and are still classic, because it’s full of PHP page templates (template-cover.php, landing.php). The check wants templates/index.html specifically, so “does it have a templates folder” is not the indicator you might assume.

How the editor reads it

On the JavaScript side, the block-theme flag surfaces in two different places, which is worth knowing if you go source-diving.

As an editor setting:

PHP
// wp-includes/block-editor.php, get_block_editor_settings()
$editor_settings['__unstableIsBlockBasedTheme'] = wp_is_block_theme();

and on the REST themes endpoint, which is where @wordpress/core-data picks it up:

PHP
// wp-includes/rest-api/endpoints/class-wp-rest-themes-controller.php
$data['is_block_theme'] = $theme->is_block_theme();

The one-file switch


For all the weight the term carries, “block theme” boils down to a single file: templates/index.html exists, or it doesn’t. Not theme.json, not patterns, not any amount of hybrid adoption. Just one index template, checked up the parent chain.

That’s worth keeping in mind if 7.1 does end up drawing the iframe line at wp_is_block_theme(). A hybrid theme that has adopted everything except block templates would keep the classic editor behavior, while adding a single templates/index.html (even accidentally, even in a parent theme you don’t control) would flip a site to the forced iframe. If your theme or your users’ sites sit anywhere near that line, now is a good time to check which side of it you’re actually on: it’s one is_file() call away.

#WCUS Schedule, iframed Post Editor, WooCommerce 11.0 and so much more — Weekend Edition 369

Hi there!

What a week! WordPress 7.1 Beta 1 (and Beta 2) arrived with a huge array of updates. We’ll unpack them together over the next four weeks, right up to the final release on August 19, 2026.

One thing shouldn’t wait, though: the security release WordPress 7.0.2. Go update your production sites now — this newsletter will still be here when you’re back. 😉

In this edition, you’ll also find the first speaker lineup for WordCamp US, a fourth page-builder migration story, WooCommerce 11.0 on the horizon, and plenty of block development goodness: from iframed editors to on-brand maintenance pages.

Grab your favorite Saturday beverage and dig in.

Yours, 💕
Birgit


WordCamp US 2026: Four Tracks, Three Workshops, 33 Speakers

First speaker spotlight WordCamp US>

The first wave of WCUS 2026 speakers is live — and it reads like a who’s-who of WordPress in practice.

WordCamp US just published its opening lineup for August 16–19 in Phoenix: 34 confirmed speakers so far, including K Adam White, Brian Coords, Jamie Marsland, Kathy Zant, Miriam Schwab, and Robert Abela, all experienced developers, educators, security specialists, community builders.

The program runs four tracks.

  • AI in Action leads with sessions on agentic workflows, AI search, and guardrails for AI-assisted development.
  • Honing Your Skills covers the practical side: maintenance, privacy compliance, creator commerce, security.
  • Technical WordPress digs into block migrations at scale, WP-CLI automation, and plugin pipelines.
  • Beginning WP101 is the on-ramp for newcomers — or for clients you’re bringing along.
  • Three hands-on workshops round out the program, where you build something real in the room and leave with it.

The full session schedule isn’t out yet, but the speaker list alone is a useful signal. If someone on that page is a voice you follow, a tool you depend on, or a corner of WordPress you’re actively navigating, you now have a specific reason to be in the room.

🎟 us.wordcamp.org/2026/tickets — $100 General Admission · $750 Micro-Sponsor (includes listing on the sponsors page) 👥 Full speaker list →

Developing Gutenberg and WordPress

WordPress 7.1 Beta 1 was release on July 15, 2026. is now available for testing. The release post offers instructions how to sent up a test side and shows an extensive list of new features.

The security team released WordPress 7.0.2 with the urgent appeal to update right away. The security fixes were also backported in 6.9.5 and 6.8.6.

The security fix was also included in WordPress 7.1 Beta 2, so testing sites are also protected during this release cycle.

Huzaifa Al Mesbah, from the Core Test team, published the accompanying Help Test WordPress 7.1 post.

A few WordPress 7.1 Dev Notes are already available:

Plugins, Themes, and Tools for #nocode site builders and owners

In about 10 days, WooCommerce 11.0 release is schedule. Brain Coords has the skinny for you in what’s coming for developers in WooCommerce. Performance leads the release with 28 PRs — product object caching becomes the default for new stores, speeding up variable products by 9–12%. You’ll also find email verification connecting guest orders to accounts, new phone validation hooks, video embeds in the block email editor, and the final removal of the Product Editor beta. The beta is ready for your testing now.


Jamie Marsland followed his instincts and build Jamie’s Front-End Editor for Content Teams, a plugin that lets your editors click any paragraph or heading on the live page and start typing — no block editor required. With the latest updates, you can now edit text, links, buttons and images right on the live page. No wp-admin, no block editor, just click and change it in place.

Built on the Interactivity API with no build step, it preserves block markup on save, records edits as native block notes for an audit trail, and lets you restrict chosen roles to front-end-only editing. Let Marsland what you think.


Last week, I shared three migration stories from page builders to the Core block editor and block themes. Here’s a fourth perspective: The team at WP Expert, an Ottawa agency founded by Frederic Sune, put together a comprehensive post on migrating agency sites from page builders to Gutenberg, should you go on that journey, too. You’ll find the strategic arguments (better Core Web Vitals, smaller attack surface, less technical debt) alongside a practical playbook covering backups, staging, block theme selection, pattern development, and SEO safeguards. The post also explores what block-based architectures mean for an agency’s business model, from premium modernization packages to fewer layout-related support tickets. An FAQ rounds it out.

Theme Development for Full Site Editing and Blocks

Brian Coords tackles a common WooCommerce pain point: custom product templates for block themes. He combines two core WordPress features — the plugin template registration API from 6.7 and the venerable single_template_hierarchy filter — to serve custom templates for product collections, like all products in a category. His example plugin falls back to your Single Product template unless you override it. Clone the repo and give it a try; custom Product fields are next on his list.


On the WordPress Developer Blog, Troy Chaplin shows you how to build an on-brand maintenance mode for block themes. You add one small hook to your theme’s functions.php once, then design and manage the maintenance page entirely in the Site Editor with full access to your Global Styles. Renaming or deleting the template toggles maintenance mode on and off, no code needed. An SEO-friendly variant adds 503 headers so crawlers know the downtime is temporary.

 “Keeping up with Gutenberg – Index 2026” 
A chronological list of the WordPress Make Blog posts from various teams involved in Gutenberg development: Design, Theme Review Team, Core Editor, Core JS, Core CSS, Test, and Meta team from Jan. 2024 on. Updated by yours truly. 

The previous years are also available:
2020 | 2021 | 2022 | 2023 | 2024 | 2025

Building Blocks and Tools

On WP Mayor, Jean Galea untangles when to reach for WP-CLI, the REST API, or the Abilities API. His mental model: they’re layers, not rivals. WP-CLI lives on the server for bulk work, REST serves off-server callers like headless front ends, and the Abilities API tells AI agents what they’re allowed to do, complete with schemas and permission checks. Galea also shares how his own sites lean on all three at once.


Get up to speed how to make your custom blocks plugin work in the iframed post editor, if you haven’t yet. After five years of ruminating and communicating the switch is coming to WordPress 7.1. In his post, Ryan Welcher explains why the post editor is going full iframe in WordPress 7.1 and what that means for your custom blocks. You’ll find the fixes for the most common breakage — global window and document references, editor styles enqueued into the wrong document, stale admin-scoped CSS, and third-party libraries — plus a companion demo plugin with broken/fixed block pairs, Playground blueprints for testing both states, and a handy pre-flight checklist.


The video volunteers at WordCamp Portugal uploaded all recordings to WordPressTV and two of the talks caught my eye:

Imran Sayed walks you through the fastest way to build Gutenberg blocks with modern tools, scripts, and AI. If custom block development has felt complex or time-consuming, you’ll appreciate his focus on practical, real-world workflows you can adopt immediately — moving fast without over-engineering. The recording is available on WordPress.tv, and the presentation slides are linked below the video for easy reference.

Jorge Costa shows you how to use the AI building blocks already shipped in WordPress core (the WP AI Client, the Abilities API, and the MCP adapter) to bring AI-powered features into your own plugins, themes, and sites. He also tackles the bigger question: when agents can spin up entire projects on any stack, why is WordPress still the right bet? Slides are linked alongside the recording.


Check out the not so new any more Talk Devy to Me series on Ryan Welchers YouTube Channel! In the latest epsiode, Antonio Sejas demos Studio Code, the agentic AI assistant built into WordPress Studio’s desktop app and CLI. You can spin up sites, run performance audits, add content, and install plugins and themes through natural language conversation — all locally, so nothing you break goes public. Sejas explains how it works under the hood before building something live with the host. Studio Code is free while in beta, so now’s a good time to experiment.


If you rather want to read about the updates in WordPress Studio, Fredrik Rombach Ekelund shares three big updates to WordPress Studio: a new default Native PHP runtime makes your local sites load 30–50% faster while using a third of the memory, the Studio CLI now installs with one dependency-free command — no Node.js or npm required — and Claude Sonnet 5 is the new default model in Studio Code, improving multi-step work like tracing bugs across files. A Sandbox runtime remains available for testing untrusted code.


Need a plugin .zip from Gutenberg’s master branch?
Gutenberg Times provides daily build for testing and review.

Now also available via WordPress Playground. There is no need for a test site locally or on a server. Have you been using it? Email me with your experience.


Questions? Suggestions? Ideas?
Don’t hesitate to send them via email or
send me a message on WordPress Slack or Twitter @bph.


For questions to be answered on the Gutenberg Changelog,
send them to changelog@gutenbergtimes.com


Featured Image:


The post editor is going full iframe: what block developers need to know before WordPress 7.1

For years, the post editor has lived a double life. The Site Editor renders your blocks inside an iframe. The post editor — where most people actually spend their time — renders them directly in the admin page. That split ends with WordPress 7.1: the post editor canvas will always be an iframe, on every theme, no matter what apiVersion your blocks declare. The Gutenberg plugin has been enforcing exactly this for months. If you ship blocks, assume the iframe.

If your block never touches the global document or window, you can probably stop reading after you’ve changed "apiVersion": 2 to "apiVersion": 3 in block.json. For everyone else — and especially anyone shipping blocks that wrap third-party libraries — the iframe changes where your code runs versus where your markup lives. That gap is where things break.

Quick reference guide: Are your blocks ready?

An infographic showing the checks and fixes for readying custom blocks for the WordPress 7.1 iframed editor

The timeline, in one table

ReleaseWhat happens
June 21, 2021The iframed editor was announced on make.wordpress.org
WordPress 6.9 (Dec 2025)Console warning (with SCRIPT_DEBUG) when a block registers with apiVersion 2 or lower. The block.json schema now only validates apiVersion: 3.
WordPress 7.0 (Apr 2026)The iframe decision now looks at blocks actually inserted in the post, not every registered block. All inserted blocks on v3+ → canvas is iframed. Insert a single v1/v2 block → the iframe is removed on the fly. Nothing is enforced yet.
Gutenberg 22.6+The iframe is enforced regardless of theme — this is the feedback-gathering phase.
WordPress 7.1 (Aug 19, 2026)The iframe is enforced on every theme, regardless of apiVersion. The conditions are gone, not tightened.

The WordPress 7.0 change is subtle but important: before 7.0, one apiVersion: 2 block registered by any active plugin — even one never used in the post — kept the entire editor out of the iframe for everyone. Now only inserted blocks count. Your v3 block gets the iframe until the user inserts a legacy one, at which point the editor quietly reloads the canvas without the iframe. The companion plugin ships a legacy-api-v2 block so you can watch this happen — insert it into an otherwise-v3 post and the iframe disappears. In 7.1, that escape hatch closes.

Worth knowing, as an aside: the “every theme” decision landed in WordPress 7.1 Beta 1, and it’s deliberately being tested in public. Gutenberg merged “Post editor: always iframe” (#74042) on July 10, 2026, deleting the theme and apiVersion conditions outright. The 7.1 release lead signed off on that merge on the condition that the team could “move to the softer approach” if Beta 1 feedback surfaced real problems — the softer approach being enforcement on block themes only, with everything else staying on the 7.0 rules. No specific mechanism is committed to; the plan is to respond to what the beta actually turns up.

Which is a reason to test harder, not to wait and see. If that rollback happens, the iframed and non-iframed editors both stay in the wild longer — and your block has to work in both regardless of which way it goes.

It’s also worth noting that blocks that will break with the 7.1 changes are most likely already breaking in the Site Editor.

Why the iframe is a good thing

This isn’t change for change sake. Rendering the canvas in an iframe gives the editor a real document boundary:

  • Admin CSS stops leaking into your content. No more #wpadminbar-adjacent style resets, no more admin styles subtly changing how blocks render in the editor versus the front end.
  • Viewport units and media queries finally work. vw, vh, and @media rules resolve against the canvas, not the admin page — so tablet/mobile previews and zoomed-out views actually behave like the front end.
  • What you see is much closer to what you get. The canvas document is built from your theme’s styles, not the admin’s.

The issue this raises for block developers? Your editor JavaScript runs in the admin page, but your block’s DOM lives in a different document. Every assumption baked into document.querySelector(...) and window.addEventListener(...) just became wrong.

What actually breaks (and how to fix it)

Everything below is demonstrable with the companion plugin — each pattern ships as a broken/fixed pair of blocks: iframe-editor-examples on GitHub.

1. Global window and document references

The classic: a block that reads the viewport or listens for resize.

JavaScript
// ❌ Broken in the iframed editor
useEffect( () => {
	const update = () => setWidth( window.innerWidth );
	update();
	window.addEventListener( 'resize', update );
	return () => window.removeEventListener( 'resize', update );
}, [] );

Editor scripts load in the admin page, so window is the admin window. In the iframed editor this reports the wrong width and never reacts to the canvas resizing — switch to the Tablet preview and the number doesn’t move.

The fix is to derive the document and window from your block’s own DOM element:

JavaScript
// ✅ Fixed — works iframed or not
import { useRefEffect } from '@wordpress/compose';

const ref = useRefEffect( ( element ) => {
	const { defaultView } = element.ownerDocument;
	const update = () => setWidth( defaultView.innerWidth );
	update();
	defaultView.addEventListener( 'resize', update );
	return () => defaultView.removeEventListener( 'resize', update );
}, [] );

const blockProps = useBlockProps( { ref } );

Two things to notice:

  • element.ownerDocument is whatever document the block is rendered into — the iframe’s document when iframed, the admin document when not. ownerDocument.defaultView is that document’s window. Code written this way is context-agnostic: it doesn’t care whether the iframe exists.
  • useRefEffect (from @wordpress/compose) instead of useRef + useEffect: it re-runs the callback when the ref changes, so if the block ever moves between documents, your listeners re-attach to the right window.

2. “Close on outside click” and other document-level events

This one is my favorite because it fails weirdly. A dropdown that closes when you click outside, implemented the way every React tutorial teaches it:

JavaScript
// ❌ Broken in the iframed editor
useEffect( () => {
	const closeOnOutsideClick = ( event ) => {
		if ( ! containerRef.current.contains( event.target ) ) {
			setIsOpen( false );
		}
	};
	document.addEventListener( 'click', closeOnOutsideClick );
	return () => document.removeEventListener( 'click', closeOnOutsideClick );
}, [] );

In the iframed editor, clicks inside the canvas happen in the iframe’s document. They never bubble to the admin document, so the listener never fires. The result: click another block in the canvas and the dropdown stays open — but click the admin sidebar and it closes. Same code, same block, works perfectly in the non-iframed editor. This is the kind of bug report you’ll get from users that “can’t be reproduced” — because whoever tested it happened to have a v2 block sitting in their post, which quietly dropped the iframe and made everything work.

Fix: same principle, attach to element.ownerDocument instead of document (see the plugin for the full useRefEffect version).

3. Editor styles enqueued into the wrong document

If you’re styling your block’s editor experience with enqueue_block_editor_assets, those styles load in the admin page — outside the iframe. They silently stop applying the moment the canvas is iframed:

PHP
// ❌ Loads in the admin page — never reaches the iframed canvas.
function myplugin_enqueue_editor_styles() {
	wp_enqueue_style( 'myplugin-editor', plugins_url( 'editor.css', __FILE__ ) );
}
add_action( 'enqueue_block_editor_assets', 'myplugin_enqueue_editor_styles' );

The fix is to register editor styles through block.json, which WordPress injects into the canvas document, iframed or not:

JSON
{
	"editorStyle": "file:./index.css"
}

(add_editor_style() also gets copied into the iframe, if you need theme-level editor styles.)

The demo plugin makes this visual: the same block carries a green banner from editorStyle and a red banner from enqueue_block_editor_assets. Count the banners — two means no iframe, one means you’re iframed.

4. Stale CSS written for the leaky editor

The section above is about CSS loading into the wrong document. This one is the sneakier inverse: the stylesheet loads into the right document — injected straight into the canvas, exactly as intended — and still gets it wrong, because of what it was written to describe. These are the rules that quietly stop matching, or start over-matching, once the canvas becomes its own document. It’s the code that’s been sitting in themes and plugins for years, “working,” right up until the iframe is enforced.

Selectors keyed on admin body classes

The most common one, and it fails exactly like the “close on outside click” bug — silently.

CSS
/* ❌ The canvas body no longer carries these classes */
.wp-admin .my-block { padding: 2rem; }
body.block-editor-page .my-block__title { font-size: 2rem; }

Inside the iframe, the canvas <body> is a clean document — no wp-admin, no block-editor-page. The selector matches nothing and your editor styling just evaporates. Same block, same stylesheet, works perfectly in the non-iframed editor.

CSS
/* ✅ Scope to the block, not the admin chrome */
.my-block { padding: 2rem; }
.my-block__title { font-size: 2rem; }

.editor-styles-wrapper does still wrap the canvas content inside the iframe, so .editor-styles-wrapper .my-block keeps working if you need genuinely editor-only styling — but the admin ancestor was almost never necessary in the first place.

Offsets that compensate for admin chrome

CSS
/* ❌ Subtracting the admin sidebar and adminbar from the viewport */
.my-fullwidth { width: calc( 100vw - 160px ); } /* 160px = admin menu */
.my-toolbar   { position: fixed; top: 32px; }   /* 32px = #wpadminbar */

This is the flip side of the win from earlier: now that 100vw resolves against the canvas instead of the admin page, there’s no sidebar to subtract — so the calc() overshoots, and top: 32px pushes your toolbar below an admin bar that doesn’t exist in this document.

CSS
/* ✅ The canvas is the viewport now — no compensation needed */
.my-fullwidth { width: 100vw; }
.my-toolbar   { position: fixed; top: 0; }

Specificity walls built to fight leakage

CSS
/* ❌ Cranked up to beat leaking admin styles */
.editor-styles-wrapper .my-block p {
	font-family: Georgia, serif !important;
	line-height: 1.6 !important;
	box-sizing: border-box !important;
}

The iframe already stops admin CSS from leaking in — that’s one of the reasons it’s a good thing. These !importants and resets have no admin styles left to override, but they do now override the theme styles the iframe loads into the canvas. The result: your editor preview drifts away from the front end — the exact opposite of what the iframe is for.

CSS
/* ✅ Let theme styles through; set only what your block truly owns */
.my-block p { font-family: Georgia, serif; }

Two things to notice:

  • The pattern is the same as the JavaScript fixes: stop describing the admin, start describing your block. A selector that names .wp-admin, #wpadminbar, or .block-editor-page is reaching for chrome that isn’t in the canvas document anymore.
  • Most of these were workarounds for problems the iframe solves. Deleting them is usually the fix.

5. Third-party libraries that assume one global context

The biggest real-world hazard. Masonry layouts, sliders, lightboxes, maps — a generation of libraries was written assuming there is exactly one document:

JavaScript
// Inside some-legacy-lib.js
const targets = document.querySelectorAll( selector ); // finds nothing in the iframe

Your block calls the library, the library queries the admin document, finds zero matches, and silently does nothing. No error, no warning — the block just stops being enhanced.

Your options, in order of preference:

  • Pass elements, not selectors. If the library accepts an element (lib.init( element )), hand it the block’s element from useRefEffect and you’re usually fine.
  • Patch the library. For unmaintained dependencies, patch-package is the pragmatic answer: edit the module in node_modules to resolve document/window from the element (node.ownerDocument), run npx patch-package <pkg>, commit the patch, add a postinstall script. The official migration guide walks through a real patch for @panzoom/panzoom.
  • Guard and bail. If the library is loaded inside the iframe (front-end scripts are), check for it on defaultView before using it: if ( ! defaultView.jQuery ) return;

So what does apiVersion: 3 actually do?

Less than you might think — and that’s the point. Declaring "apiVersion": 3 in block.json doesn’t change how your block renders; it’s a signal that your block is iframe-ready. All core blocks have been on v3 since WordPress 6.3. For most blocks the migration is literally a one-line change… followed by the actual work: testing that nothing in your edit component (or the libraries it pulls in) touches the global document/window.

And to be clear about 7.1: the iframe will be enforced there regardless of apiVersion. Staying on v2 doesn’t opt you out anymore — it just means you get the console warning and the breakage.

How to test today

You don’t need to wait for 7.1. What you’re testing is that your block works in both states — iframed and not — because both will exist in the wild for a while yet.

Iframed: install the Gutenberg plugin 22.6+. It enforces the iframe regardless of theme, so this is the fastest way to live in the future. 7.1 Beta 1 does the same — I’ve confirmed it forces the iframe on a classic theme, which is the merged behavior shipping in August.

Not iframed: run WordPress 7.0 without the plugin and insert a v1/v2 block alongside yours — the canvas drops the iframe on the fly. The companion plugin’s legacy-api-v2 block exists for exactly this. Any theme will do: core 7.0 has no theme check in the iframe decision at all, so you don’t need to hunt down a classic theme to reproduce this.

Confirm which state you’re in: element.ownerDocument !== document, or look for iframe[name="editor-canvas"] in devtools.

The Site Editor has been iframed for years — if your block already behaves there, you’re most of the way home.

The companion plugin ships a wp-env setup, an example override file that adds Gutenberg for enforced mode (copy it to .wp-env.override.json), and two Playground blueprints — one per state, so you can flip between iframed and not in two tabs without installing anything.

The block author’s checklist

  1. Set "apiVersion": 3 in every block.json.
  2. Check your editor code for window. and document. — every hit is a suspect. Replace with element.ownerDocument / .defaultView via useRefEffect.
  3. Check for enqueue_block_editor_assets — move canvas-affecting styles to editorStyle in block.json.
  4. Check your editor CSS for .wp-admin, #wpadminbar, and .block-editor-page , admin chrome offsets and !important
  5. Audit third-party libraries: pass elements not selectors, patch what you must.
  6. Test both states, not both themes: iframed (Gutenberg 22.6+ active) and not iframed (no plugin, v1/v2 block inserted).
  7. Watch the console with SCRIPT_DEBUG on — the deprecation warnings tell you which registered blocks are still on v1/v2.

Note What’s not on that list: checking whether the active theme is a block theme. Core exposes that answer twice — as __unstableIsBlockBasedTheme in the editor settings and as is_block_theme on the REST themes endpoint — and there’s a shelved PR and a live debate behind it. Your block never needs to ask. element.ownerDocument !== document answers the only version of the question that affects you. If you’re curious what that theme check does under the hood, that’s its own story: How WordPress decides a Theme is a “Block theme”.

Resources

#225 – Milan Petrović on the Risks of Legacy PHP in WordPress and Why Upgrading Matters for Security

Transcript

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, the risks of legacy PHP in WordPress and why upgrading matters for security.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players. If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you or your idea featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Milan Petrović. Milan has been deeply immersed in the WordPress ecosystem since 2007, developing an array of plugins, especially for expanding bbPress forums, and running his own company, creating plugins before joining the Freemius team as a full stack developer. With nearly two decades of hand-on experience, Milan has witnessed firsthand the evolution of both the WordPress and PHP landscapes.

Many WordPress users may be only partially aware of PHP. Perhaps they’ve noticed version numbers in their hosting panel, but few of the millions of WordPress users understand the real impact that PHP versions have on the security and performance of their websites. Milan is here to shine a light on why embracing newer versions like PHP eight isn’t just good practise, but a crucial step for security and efficiency.

Milan begins by recounting his journey through WordPress development. The conversation gets into the heart of his recent WordCamp Europe presentation, which tackles how legacy PHP code exposes sites to thousands of open bugs and vulnerabilities. And why relying on old versions is, as he describes, an active invitation for automated exploitation.

The discussion explores the contrast between running legacy code, and using the native shields of modern PHP, and highlights how PHP 8 not only closes security holes, but also delivers major performance boosts, reducing memory usage, and accelerating speed.

If you’re wondering why you should care about the PHP version your site is running on, or you’re a developer interested in practical ways to harden your code, Milan unpacks both the existential risks of outdated PHP, and the step-by-step benefits for hosts, agencies, and plug-in developers alike.

He introduces his Vulnerability Lab plugin, designed for developers to see firsthand how code exploits play out differently across PHP versions, and makes the case that modernising can happen gradually, one update, one plugin at a time.

If you’ve ever questioned how your hosting choice, or plugin stack, could affect your site’s future. Or you’re ready to take the first steps towards building more secure and future proof WordPress products, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Milan Petrović.

I am joined on the podcast by Milan Petrović. Hello Milan.

[00:03:58] Milan Petrović: Hello Nathan. Thank you for having me here.

[00:04:00] Nathan Wrigley: You are very welcome. We’re in a beautiful, beautiful media room at WordCamp Europe. And I know that you have already done your presentation because we just had a little chat about the fact that you’ve done it and it went well and all of that.

Do you want to tell us a little bit about you and your background working with code and developing and security and all of that kind of stuff? And then we’ll talk about your actual presentation and how it went.

[00:04:25] Milan Petrović: So I started with WordPress almost 20 years ago, so way back in 2007. And I created a lot of plugins for WordPress, and I especially have a lot of plugins for bbPress for expanding forums. Yeah, people still use forums these days. So that was, I really like bbPress and all the stuff I did with that.

I have been working as a freelancer for a lot of years. I have my own company that was doing plugins, it’s called Dev4Press. But in 2024, I joined the amazing team at Freemius. So for almost two years I am a full stack developer at Freemius. And that was a really nice change of pace for me and the work I usually do before that. So yeah, that’s a short of it.

[00:05:13] Nathan Wrigley: Yeah. That’s great. Thank you. And so the presentation that you did that is now over, goes like this. I’m going to read the entire blurb because it’s short enough to read, and it says, secure by design, hardening plugins with PHP 8.x. In the WordPress ecosystem, we’re often forced to choose between supporting the lowest common denominator of hosting and implementing modern security. But in 2026, writing legacy PHP 7 code isn’t just a bad habit, it’s an active invitation for automated exploitation. It’s time to stop playing whack-a-mole with sanitisation, and start building products that are secure by design. This talk isn’t just another slide deck on security tips. Through comparisons of a Vulnerability Lab plugin, you will see how common exploits like authentication bypass, and server side request forgery succeed on legacy code, only to be neutralised by the native shields of the latest PHP. You learn how to leverage the modern PHP patterns to ensure your plugins are resilient to a wide range of exploits.

Now into the show notes I will put Milan’s wordpress.tv presentation so that you can go and watch the entirety of it. I guess basically if at any point you get confused, that would be a good idea, pause this podcast and go and check that out. But, how did it go? How well received was it?

[00:06:33] Milan Petrović: For me personally, I’m very satisfied with how how it went. I don’t know, it’s a bit overwhelming to be honest, but I am very satisfied and I got a lot of questions after the talk. I met a lot of people that liked what I had to say. And I think it’s good feedback to have, for something that is more technical like this was.

[00:06:52] Nathan Wrigley: Well touching on the fact that it’s more technical, I have to confess that I think you are going to have to shepherd me through this, because a lot of the content that you I think probably got stuck into is beyond my pay grade. But hopefully we’ll get through it.

Now at WordCamp Europe, where we are now, I don’t know what the ratio is, but I’m guessing that a significant proportion of the people out there are not developers. They kind of know that PHP is a thing. They realise that WordPress is built on that, but they don’t really have an understanding.

They’ve probably heard of PHP 7. They’ve probably heard of PHP 8, because somewhere in a control panel that was shown to them. But maybe there’s not much of an understanding of the fact that it gets better over time. It gets secure over time. I think there’s probably a notion of, well, my website works. Why do I need to change anything?

So let’s get into that. What were you talking about in your presentation? What’s changed in the landscape of PHP more recently that you brought to the fore that you shared with your audience?

[00:07:51] Milan Petrović: Yeah, I think that PHP 8 was a big milestone for a lot of things. And I’m not sure, but I don’t think that the wider communities are kind of aware about the impact of the PHP, or the server environment in general, on how the websites work and how secure they are. Maybe the WordPress in itself needs to spread more awareness about that.

Because right now we get a notice in the dashboard that maybe the PHP needs to be updated. But for a lot of website users, that can be too much and too little information at the same time, because they may be not aware of how to do things on their hosting site.

We need to spread more awareness about how important the changes in the code are when it comes to the newer PHP versions, and what they can do to improve the security. And how developers should be starting to use more of those new features and the new things that PHP provides on a language level nowadays.

[00:08:49] Nathan Wrigley: WordPress has got this real legacy, I suppose is the right word, of supporting legacy code. So WordPress itself is supported way, way, way back. You can keep using versions of WordPress, which are many, many, many years old. And I wonder what your stance is in terms of PHP, whether or not WordPress runs versions of PHP which are far too old, in your opinion.

So in other words, should WordPress have a policy of, I don’t know, 8.x only? Or is 7 okay. And I don’t know what other CMS platforms, you know, Drupal, Joomla as was. I don’t know what they do, I don’t know what their posture is.

[00:09:32] Milan Petrović: I think that one of the most important decisions that, it was done with WordPress early on, is that backwards compatibility, because it opened the doors for a wider adoption. Because you don’t need to change server every year, or you don’t need to upgrade your software that often. And that helped a lot of hosting companies to provide WordPress hosting very cheaply, because they didn’t have to have the latest PHP, they didn’t have to invest much more money into all that. So WordPress got a lot of adoption from backwards compatibility policies.

But in the same time, that also proved a bit of a problem. Because even the WordPress Core code is kind of stuck because of that policy of backwards compatibility. And it’s not only compatibility with old versions of WordPress, but the old versions of PHP. And we are running now maybe six years behind end of life PHP versions. Because PHP 7.4 end of life was four and a half years ago. And we still support it in the Core.

[00:10:33] Nathan Wrigley: Yeah, I guess it’s a nice thing to support it. And it, as you described, it was a great way of onboarding the millions of people that came along. But things have moved on.

What would be some of the top level items? And I’m inviting you to open the scary book and sort of give out the worst case scenarios basically of running legacy code. So really, go to town, frighten us all. What are some of the horrors that await if you’re quite willing to, as a hosting company, support seven point whatever or beyond, six or five, or dare I say it, four, who knows? What are some of the terrible things that await us?

[00:11:08] Milan Petrović: To be honest, when I was researching some of the statistics and things like that, I was kind of scared when I saw that there are 3 or 4,000 open bug reports for PHP 7 and PHP 5, which are still in use today, and there are WordPress websites running on both of them in the millions. And there are 3 or 4,000 open and confirmed bags that are never going to be fixed. Never. So PHP 7 has thousands of bugs, and I’m sure that not everything security related, but a big chunk of those bags are related to security.

And there are open exploits that run on the PHP level. They don’t care really about if you are using WordPress or using something else. It’s more like a exploit on the level of a, on a server side that can be quite scary because you, even the technical people are not really sure what are all those bugs. Who is going to go through 3,000 or 4,000 bug reports?

[00:12:05] Nathan Wrigley: Yeah, so just to sort of describe that, the fact that there is no more updates to the 7 branch of PHP means that all of those bugs which are publicly available, anybody can go and read great detail about what they are. Well that then means that any hacker can do that, and probably did like a dozen years ago. And so really you are painting a picture there of you are asking for trouble.

[00:12:30] Milan Petrović: There are hosting companies that maybe do things a bit differently because you don’t need to run PHP as it was created. You can build your own version of PHP. You can patch bugs on your own. And a lot of hosting companies are doing that. But in the same time, that also poses a problem. You are going to run WordPress in your own plugins on a platform that is not actually officially PHP supported. It can have some different quirks that make your code run a bit differently.

A while ago we had the Facebook running their own PHP build, that was quite different from the public PHP. But they used it, and other people started using it. So I don’t know. Still I think that the official PHP is the one you should be on because you never know what other issues. Even when hosting company patches the PHP they’re using, maybe they’re opening doors to something else that is not quite documented on that level.

I think that the best policies, I don’t expect for WordPress to adopt the latest PHP or only supported PHP versions, but to kind of move quicker on the adoption of the newest version. So maybe we should be quicker to adopt PHP 8.0 or 8.1 is a next minimal required version for WordPress.

[00:13:50] Nathan Wrigley: When you say you don’t expect WordPress to do it, is that simply because it doesn’t have a history of doing it? Is there a technical reason why WordPress could not keep up with the latest version? I know we’ve got this plugin architecture where there’s thousands and thousands of developers who are all doing their own thing, and there’s all of that. Is there any technical reason why WordPress couldn’t be on the cutting edge, most up-to-date, latest version?

[00:14:15] Milan Petrović: There are two factors in all that. First one is you can declare, PHP 8 is the minimal version we support. We don’t support PHP 7.4 anymore. And that means that you don’t need to make any changes in WordPress at that point. You can declare it because WordPress is compatible with all PHP versions. It works on 8.0 and 8.5. That’s no problem. But say that branch 7 is no longer supported, you’re kind of pushing other developers and hosting companies to improve their support for newer versions.

And you don’t need to make immediate changes to WordPress. But at that point, you are open to modernise the code because now you can have more stricter typing across the board. There are some strict typing things in older PHP versions, but with 8.0, you can do all of that. And it doesn’t have to be a process that is done immediately. It can be done gradually. You can update parts of the WordPress Core over time. And it’ll take a few years, to get up to date, but at least you are closing doors to some older versions of PHP, and you are pushing developers as well for plugins to have that policy.

Right now, each developer can have their own plugins supporting any version of PHP you want. For my plugins, I have policy of 8.0 as a minimal version since this year. And, I’m updating the code as I go along. I don’t do it, it’s impossible to do it all at once. And for WordPress, it’s going to be even worse to make it all up to date. But declaring PHP 8 is a minimal required version, would be a great step in the right direction for wider adoption.

[00:15:51] Nathan Wrigley: Yeah, I think the problem is simply one of the user base, isn’t it? There’s just millions of people, thousands of developers all doing their own thing. And casting 8.x, 8.0 and above as the new minimum, there’s going to be a moment where some things do go wrong.

So that calendar plugin that you’ve been using for ages, which just works. And sure, you’ve never really received any updates from the developer, but it just works. Everybody’s booking on my calendar and we are all good. And then suddenly PHP 8 is required and it turns out the calendar plugin now no longer works.

You can imagine those kind of stories a million times over coming to the fore. But equally, we got to move on. There’s no way of, you know, because we can’t in 10 years still have sites on 7.4.

[00:16:43] Milan Petrović: We have sites on five point something. I recently checked the official WordPress tracking. 7.4 is on 20% even now. So we are far away from WordPress ditching the 7 branch. And I think there are still few percent of PHP 5 in all that so.

[00:17:01] Nathan Wrigley: Yes, I regularly look at the, it’s like a little donut chart, isn’t it? That is often produced and you gradually see the eight point x whatever section of the pie getting bigger as they produce the next survey. But you’re right, it’s still a significant chunk that’s on 7 and below.

And whilst when I look at that chart, it doesn’t really bring any alarm bells to the fore, I just think, oh, that’s a shame. But now that you are presenting this talk, and giving me this information, I realise that that attack surface is worse.

When you gave that talk, who is your target audience? Were you directly sort of aiming at the hosting companies who presumably can do a lot of work very quickly? You know, they could take a million people onto 8 with a little bit of development work and on the back end of their platform. Or are you really encouraging the general WordPress user, like me, to take a bit more interest and make sure that I am going into the cPanel or whatever it is and updating myself? Or is it a bit of both?

[00:17:59] Milan Petrović: For everyone actually. It’s for developers to be more aware of what they can gain with the new PHP versions. It’s for hosting companies. Because it’s not only about security when it comes to the newer PHP. The PHP is faster and faster. So each new version gets you 5 or 10% more performance without doing anything. So PHP 8.5 is more than 50% faster than PHP 7.4. So that’s a significant update.

And I have even, one slide was showing how much less memory PHP 8.5 used to run exactly the same piece of code. So it’s pretty wild to see that hosting companies are maybe the biggest factor in all this. They will gain a lot more because they’re going to free a lot of resources to run more websites because PHP is going to use less memory and it’s going to be faster.

So I understand they need to invest a lot of money to do all that. But, I don’t know, I think that gains from that are very significant, on that level alone.

[00:18:57] Nathan Wrigley: Yeah, so you described there are really compelling scenario. You know, it’s quicker, it uses less memory, you’ll save money. I mean what else do you need? You’ve just presented the entire argument.

However, it hasn’t happened. So technically speaking, why do you think it hasn’t happened? Is there an acquisition of new knowledge that is difficult to take in? Is it that simply you would have to, I don’t know, retrain your staff? How do you understand that it hasn’t happened? What are the reasons people are digging their heels in and not making these updates?

[00:19:25] Milan Petrović: I kind of make the group of two or three types of hosting companies. One, and that’s usually more expensive managed hosting solutions. They are forcing the updates. They’re not maybe on the latest version, but they are forcing their users to use at least three or four versions of PHP back. So maybe 8.2 or 8.3, which is a great step in the right direction.

There is also a problem of support. If something starts breaking, they’re going to be the first one to be asked about that, because they made the change to the server. So why now website that was working yesterday is no longer working today because of some change made on a hosting level. So there are a lot of factors to play into that adoption.

But on the other hand, there are a lot of developers that have moved on with supporting PHP 8. A lot of plugins are very much updated and, especially popular plugins. They invested a lot of time to do the update. It’s getting easier to support it. But on the other hand, you have very old websites that are simply cannot move without proper testing, without updating the plugins. And there are cases when you cannot simply update one plugin because something else may break, or you made some changes that will make some other thing break. So it’s a big puzzle that is definitely not easy to solve, but maybe we should start some work on that as a community to do it, and to move people along.

I don’t want to say force the change, but make people aware of the benefits. Make people aware of the risks if they continue to run the old and outdated software. And the same goes for not updating plugins, not updating WordPress. No matter how much work is done in that regard, there are still most likely some exploits on a WordPress level for very old versions that at some point someone is going to find out about and exploit.

[00:21:16] Nathan Wrigley: I mean I guess the motto of WordPress was democratised publishing, which means basically make it available to everybody. No matter your level of expertise, make it available to everybody. And I’m sure that if you were to grab the CEO of any hosting company and say, I can save you money, I can save you resources, and all of those things that you outlined earlier, they would, yeah, we know, we know. But we’ve got thousands of non-technical people using WordPress.

I kind of have this analogy in my head, and it goes a bit like this. Several years ago, I bought a bike. And it sits in my garage and there is my bike. And I expect my bike to work tomorrow in the same way that it did four years ago. And in 10 years, I expect my bike to work. I don’t expect there to be an update to wheels or gears or the saddle. It doesn’t need an update. It’s just a bike. And I need my bike to be a bike and nothing more.

And I get the impression that many people treat their WordPress website as the same thing. This sort of static commodity that, sure enough, they pay a monthly fee for it, but it’s this website. It’s a thing, and it doesn’t need changing. And so what I’m trying to say is, I’m fairly sure that the hosting companies are met with that an awful lot. The customers who just, it’s a bike, it’s a website. Do you know what I mean?

[00:22:37] Milan Petrović: Yeah, but you need to maintain your bike. If you don’t do it, it’s going to, your belt is going to rust, your wheels are going to be deflated or whatever. A lot of things can happen with it if you don’t maintain it. So, we don’t need to upgrade everything all at once, but we can start from someplace. We can do it gradually. But still, WordPress needs to be the platform that leads the charging that, because it’s going to force other developers to do it. It’s going to force hosting companies to start doing it. And it’s not a big jump on moving just that one version, but it’s going to help to move things along faster. Let’s see how it goes in the next few years. But I really don’t expect for WordPress to drop 7.4 for at least a year or two, maybe even more.

[00:23:24] Nathan Wrigley: I loved your rebuttal of my bike analogy there. That was perfect. That’s exactly right. The bike will rust, the wheels will be deflated and all of that, yeah. So we need to drag the WordPress users along.

Now, in your presentation, you mentioned something that I have never used, the Vulnerability Lab plugin, which you used to demonstrate the attack. Can you just tell us a little bit about that? Because I’d be curious to follow that up, and maybe some people listening to this would too.

[00:23:47] Milan Petrović: I started it for, created for this talk specifically to add few examples and to run the code that is going to show those things if you run the plugin on the old version and the new version of PHP. And I do plan to expand on it because there are a lot more PHP security elements that can be demonstrated in that way.

So it can show you, you have like a, in many cases the same code, but if you run it on one platform, you’re going to get one result. And if you run it on the newer one, you will get something different. So it’s useful to show, and some of those changes are quite small, those attributes that you can add to the code are very, very small, but they can really help you to improve security of your plugin.

And there are more complex security measures that can be implemented, but the format of the talk wasn’t really suitable to mention everything. But this was like something to get you started on the path of discovering what else PHP 8 can offer, when it comes to improving the security of the plugins and what possible exploits and vulnerabilities are there.

I try to use some obvious things that are very easy to spot. And I’m sure I did made some of those errors myself in the past. So some of those examples are something that I dealt with when I was upgrading my code. So I’m sure that a lot of people can see similar problems in their own code, and similar kind of solutions that can help them to overcome those and to make them much more resilient in the future.

[00:25:17] Nathan Wrigley: So is your plugin designed primarily, would you say for developers in mind, or is it something that just a typical end user may get some mileage out of?

[00:25:26] Milan Petrović: No, it’s more for developers that they can see, they can run that code and see how it behaves on the old version and the new version to demonstrate some of those things. And I will definitely expand it to include more examples in the future. Even for myself to like a document, what can happen if you run something in the old version, and the new version?

I had some suggestions coming to me like, maybe like a pattern library that is going to show what is the pattern that we use with old PHP and how to improve it with a new one, and document which version of PHP is going to support it, and how it’s going to improve the code.

[00:26:01] Nathan Wrigley: So is the idea then that you would instal it on various different, let’s say that you’ve got a live site and you’ve got, I don’t know, a development site and another development site, is that you would put it on each of those, different PHP versions, and just sort of compare and contrast what.

[00:26:16] Milan Petrović: Yeah, that can be used.

[00:26:17] Nathan Wrigley: Yeah, in that way. And what’s the reporting that you get? Is it kind of error logs, you know, that only a developer would be able to understand, or is it in plain language that somebody like me could understand?

[00:26:26] Milan Petrović: Right now it’s a bit technical because if you run a certain part of the code, some of those elements do have a visual component in the admin section. You will see, one of the examples, if it’s run on PHP 7.4, it’s going to result in a fatal error for sure, depending on the server settings. And if you run it on the new version, you will get a full code running and executing as expected.

So it’s a bit of a development thing that developers can use themselves to show maybe to potential clients or to website owners what is going to happen if they continue to run the outdated versions of the PHP. So it’s not just, yeah, the PHP 7.4 is bad, but here it is, why it is bad actually.

[00:27:12] Nathan Wrigley: Okay, that’s a really interesting use case, isn’t it? So if I’m an agency owner and I’ve got, I don’t know, a client over here who is absolutely wedded to this plugin, this calendar plugin say, and we know that the development of that plugin has ended years ago, then trying to persuade that client to find something new, or have something new built is difficult.

But with the capabilities of the plugin that you’ve created, you’ll be able to show in a sort of readable human way, okay, right. That’s all very well, but we’ve got to get onto PHP 8.0. And when we do that, this is going to happen.

So that’s actually quite a useful tool for agencies to be able to dangle things in front of the noses of their clients. Potentially, I don’t know, get some new work out of it as well, because there’s this extra work that needs to be done to bring it up to the modern standards.

[00:28:01] Milan Petrović: Yes. And one example especially demonstrates not only security, it demonstrates the performance. It shows you how much memory that piece of code is using on old version. Almost half the memory is going to be used less with a new version. So that’s very on the nose demonstration on security, and the performance in the same time. So things like that can help. And I will definitely try to invest more time in showing more examples and anyone can contribute.

It’s a plugin available on GitHub, so any contributions in that regard are welcome. And we can maybe all work to create like a list of patterns that are something that a lot of people can use, and show different people how the PHP can help them move along.

And again, I don’t want to sound like we don’t need whatever WordPress is doing. We still need to use all the security enhancements that WordPress has built in the Core. Escaping, sanitisation. All that is still very important because you cannot solve everything by upgrading PHP and upgrading your code to use some of the PHP features. There are still a lot of security elements in WordPress itself that are very important and should not be replaced, or removed, from the code. There are patterns that are crucial to ensuring the security is on a top level. So combination of what WordPress already has, plus everything we get with the newer PHP is something that we should strive in the future, and to make things better.

And it’s not that complicated to start with the process. You can start upgrading small things. You can start with stricter typing. You can start with very small changes, and then gradually you can add those new attributes. You can replace some of the functions that you may be used with old version of PHP, but there is something better in the new version. So that’s something that everyone can do. Do a bit at a time so not everything at once. Spend time and make some gradual upgrades, and that’s going to help moving along.

[00:29:57] Nathan Wrigley: You are obviously here to talk about where PHP meets WordPress, but presumably you, yourself are gaining intel from the PHP community. Is there a resource, like a central PHP resource that you would direct people to, or would you rather steer them towards kind of WordPress resources? The things that people are doing in the WordPress space and the hosting space. There’s not really a question there, but it’s more where do you find your information? Where’s the most reliable place?

[00:30:25] Milan Petrović: You need to check everything. PHP website is a really good resource to find the information about what’s coming in the next version of PHP, because the preparations take up to a year to release a new version of PHP. So they’re now on a cycle that every December we get a new feature version. So in December this year, there is going to be PHP 8.6. And you already know most of the things that are coming to that version. You have the detailed list of changes for every PHP version. And that’s something that any developer should look at, and to see maybe something that will drive them to upgrade.

In the current usage of third party libraries, there are a lot of libraries used in PHP that have moved on beyond 7.4. There are a lot of libraries that now require 8.1 or 8.2. If you depend on some library for, I don’t know, parsing URLs, or doing something else, something for security, something for whatever. You may face the problem that if you want to use the latest version of that library, you will need to have the newer PHP version. So you are kind of forced to upgrade your plugin requirements to meet with the requirements of the third party libraries.

And outside of WordPress ecosystem, those libraries will move much faster with the adoption of newer PHPs versions than WordPress itself, because they don’t deal with millions and millions of websites that are affected. They are creating the library the best way they can. And they want to ensure that their library is secure, that their library has access to the latest features. So they are going to bump requirements for those libraries on their own. And if you are depending on it, you need to do it yourself for your plugin. So it’s kind of, those libraries are kind of forcing the hand of some developers to upgrade, even if they maybe are not ready at this point to do it.

[00:32:15] Nathan Wrigley: Yeah, it certainly sounds like there’s no lack of information out there. If you make your business to find the information, then it’s all there. You’ve just got to make the effort to go and find it.

I’ve kind of run the gamut of everything I wish to ask. However, I’m very conscious, as I said at the beginning, that this conversation is a little bit above my pay grade. Is there anything that I missed that you wished you had been asked that you wanted to get across?

[00:32:38] Milan Petrović: No, I think we covered a lot of stuff in that.

[00:32:42] Nathan Wrigley: Well I’m glad to hear it. That’s great. Yeah, thank you.

In which case, I’m assuming, given that you’ve come to an event like this and you’ve put a plugin on GitHub, you are sort of semi available, or very available, to have conversations with people around this. And if that’s the case, where’s the best place to find you online? A website or an email address or a Twitter handle or whatever.

[00:33:00] Milan Petrović: We included the slide with the contact information. So even the email, if someone wants to get more information, they can do it on various social networks as well. So any input about all that is welcome. And I’d be happy to help if someone needs, some pointers or additional information to get started with all this.

[00:33:21] Nathan Wrigley: Well, thank you. That’s very much appreciated. As always, if you go to the show notes on the WP Tavern website and click on the episode involving Milan, you’ll be able to find, buried probably towards the bottom, all the different bits and pieces, the wordpress.tv video that will go with his presentation and various other links that have been discussed during the course of this episode.

So with that said, Milan, thank you so much for chatting to me today. I really appreciate it.

[00:33:47] Milan Petrović: Thank you. It was really great, and I appreciate your invitation for the interview.

[00:33:52] Nathan Wrigley: You are so welcome. Thank you.

[00:33:53] Milan Petrović: Thank you.

On the podcast today we have Milan Petrović.

Milan has been deeply immersed in the WordPress ecosystem since 2007, developing an array of plugins, especially for expanding bbPress forums, and running his own company creating plugins before joining the Freemius team as a full stack developer. With nearly two decades of hands-on experience, Milan has witnessed firsthand the evolution of both the WordPress and PHP landscapes.

Many WordPress users may be only partially aware of PHP, perhaps they’ve noticed version numbers in their hosting panels, but few of the millions of WordPress users understand the real impact that PHP versions have on the security and performance of their websites. Milan is here to shine a light on why embracing newer versions, like PHP 8.x, isn’t just good practice but a crucial step for security and efficiency.

Milan begins by recounting his journey through WordPress development. The conversation gets into the heart of his recent WordCamp Europe presentation, which tackles how legacy PHP code exposes sites to thousands of open bugs and vulnerabilities, and why relying on old versions is, as he describes, “an active invitation for automated exploitation.” The discussion explores the contrast between running legacy code and using the “native shields” of modern PHP, and highlights how PHP 8.x not only closes security holes but also delivers major performance boosts, reducing memory usage and accelerating speed.

If you’re wondering why you should care about the PHP version your site is running on, or you’re a developer interested in practical ways to harden your code, Milan unpacks both the existential risks of outdated PHP and the step-by-step benefits for hosts, agencies, and plugin developers alike.

He introduces his Vulnerability Lab plugin, designed for developers to see first-hand how code exploits play out differently across PHP versions, and makes the case that modernising can happen gradually, one update, one plugin at a time.

If you’ve ever questioned how your hosting choice or plugin stack could affect your site’s future, or you’re ready to take the first steps towards building more secure and future-proof WordPress products, this episode is for you.

Useful links

Secure-by-design: hardening plugins with PHP 8.x – Milan’s presentation at WordCamp Europe 2026

bbPress

Dev4Press

Freemius

 Vulnerability Lab plugin on GitHub

💾

Gutenberg Changelog #132 – Proposals for Core, Calls for Testing, WordPress 7.1 and Gutenberg 23.4 and 23.5

In episode 132 of the Gutenberg Changelog podcast, host Birgit Pauli-Haack and guest Ellen Bauer explore the latest updates within the WordPress ecosystem. The conversation centers on the releases of Gutenberg 23.4 and 23.5, the recent WordPress 7.0.1 maintenance update, and the strategic roadmap for the upcoming WordPress 7.1.A significant portion of the episode is dedicated to […]

💾

Gutenberg Changelog #132 – Proposals for Core, Calls for Testing, WordPress 7.1 and Gutenberg 23.4 and 23.5

In episode 132 of the Gutenberg Changelog podcast, host Birgit Pauli-Haack and guest Ellen Bauer explore the latest updates within the WordPress ecosystem. The conversation centers on the releases of Gutenberg 23.4 and 23.5, the recent WordPress 7.0.1 maintenance update, and the strategic roadmap for the upcoming WordPress 7.1.A significant portion of the episode is dedicated to major merge proposals destined for WordPress 7.1 that aim to evolve the core software.

These include “Core Abilities” for AI agent integration, the new “Knowledge” post type for managing site standards and guidelines, and “Design System Theming” to enhance consistency and accessibility via CSS custom properties. The hosts also discuss the shift toward mandatory iframing for the post editor in block-based themes, a critical architectural change designed to improve content rendering.Beyond core architecture, the episode highlights user-focused improvements such as enhanced responsive editing controls, which now allow for granular canvas resizing without preset limits. They also touch on media-related updates, including aspect ratio controls in the media editor, and improvements to the Icon block.

With WordPress 7.1’s Beta 1 approaching, Birgit and Ellen emphasize the importance of community involvement, encouraging developers and site owners to participate in ongoing “Call for Testing” efforts. Whether discussing React 19 status or new grid layout properties, the episode serves as a comprehensive briefing for anyone looking to stay current with the rapidly changing landscape of the block editor and WordPress core development.

Show Notes / Transcript

Show Notes

Special Guest: Ellen Bauer

Announcements

Community Contributions

What’s released

Post Editor iframed

Punted from 7.1

Gutenberg releases

Stay in Touch

Transcript

Birgit Pauli-Haack: Welcome to our 132nd episode of the Gutenberg Changelog podcast. In today’s episode, we will talk about proposals for core, calls for testing Gutenberg 23.4, Gutenberg 23.5, and whatever side ideas we have about 7.1, which is in the works. I’m your host, Birgit Pauli-Haack, curator at the Gutenberg Times and a full time core contributor for the WordPress open source project sponsored by Automattic. With me today on the show, and I’m very delighted to tell you that is Ellen Bauer, product manager at WordPress.com and early adopter of block themes. Thank you for joining me, Ellen. How are you today?

Ellen Bauer: Thank you very much. Always happy to be here. I’m great. I just landed back in Bangkok this week where we are. I’m staying here a little bit longer with my family this year from Germany, visiting family and attending a meetup. And yeah, it’s good to kind of do that travel because it always inspires me to get out of a routine. And yeah, I’m really glad I’m here now and motivated.

Birgit Pauli-Haack: Yeah.

Ellen Bauer: To get back into working, improving WordPress.

Birgit Pauli-Haack: That’s a great time to spend in Germany. And I hope you had luck with the weather.

Ellen Bauer: Well, there was this heat wave in the second week. It completely knocked me out, to be honest.

Birgit Pauli-Haack: Yeah, that was really hard. And a lot of people say that.

Ellen Bauer: It was great and went on the last day I went to Legoland for the first time, which was also an experience and exhausting, but great.

Birgit Pauli-Haack: That’s here between Munich and Augsburg.

Ellen Bauer: Yeah, I think it’s close. Yeah.

Birgit Pauli-Haack: Yeah, between my first time. Oh, nice. Yeah, maybe I should go there too. But it is fun.

Ellen Bauer: It is fun. Maybe not. I don’t recommend to go in the summer on a Sunday, which we did, but. Oh yeah, that’s actually really fun.

Birgit Pauli-Haack: Family day. Yeah. So you mentioned you attended the meetup in Porto. What was your takeaway from the meetup with digital?

Ellen Bauer: So it was actually the main reason I came to Europe for it was the first time all products meetup from Automattic in beautiful Portugal for me, also the first time I’ve been to Portugal, which shouldn’t happen to not visit before. But it was really cool. I love Portugal. Really lovely people, beautiful vibe, nice weather. Yeah, it was really relaxing, really a treat. And then very inspiring and motivating to be in the product group for the first time all together in a nice setting and we had amazing conversations. For me, I also got to know my team a little bit better because I just sort of recently switched into dot com, so that was helpful. But yeah, also a lot of meaningful, deep conversations and I’m really, really motivated after that meetup.

Birgit Pauli-Haack: Oh yeah. So when you said meetup, I’m still in the community brain, so I thought it might have been a WordPress meetup because I spent some time. And that’s probably also the reason why my brain went there instead of the internal. Because I spent some time with meetups, local WordPress meetups in Salzburg and in Erfurt and also in Munich. I restarted the meetup here in Munich with a few of the original founders and some other people and. And it’s a totally different vibe than a WordPress conference.

Ellen Bauer: That is true. I love meetups.

Birgit Pauli-Haack: You meet 15 maximum 20 people and then you learn more about how they use WordPress, what they really move a normal user. So it kind of grounds you much better than kind of always being in the contributor section, kind of.

Ellen Bauer: So that is true. Well, there was WordCamp Europe, which I didn’t attend because it was just so much. I attended WordCamp Asia, which I also loved this year. That was such an amazing experience and very motivating. And I talked to a lot of people who are meetup organizers in India and I really now want to visit one of their meetups. It sounds fun. I also visited the meetup here in Bangkok before and I love the people there, the really tight community. And I’m also. I have been thinking for many years now that I should actually start a meetup in our town in New Zealand. I haven’t committed, but I’m always coming back thinking about it. So maybe I should just commit and do that because it would be cool to have like a local.

Birgit Pauli-Haack: Yeah.

Ellen Bauer: In New Zealand. There aren’t many around, but it would be cool.

Birgit Pauli-Haack: Well, the first thing that you need is a co-organizer. So don’t start until you have a second person to do that because we travel a lot. Well, I travel a lot and I cannot be at every meetup, so I need somebody else to do that. So that was kind of back of mind.

Ellen Bauer: That’s a good advice.

Birgit Pauli-Haack: Yeah. And the meetups in India, they’re really big. They’re 40, 50 people.

Ellen Bauer: I talked to someone and. And they have 200 people every month on Surat. I was like, I want to come. Yeah, it’s amazing. Like, I want to visit.

Birgit Pauli-Haack: It’s a small word camp for an evening kind of thing.

Ellen Bauer: That is so true.

Calls for Testing

Birgit Pauli-Haack: All right. Yeah. So work for 7.1 is progressing and there are calls for testing out, and this is the first time that there are so many out there. There are five of them. And if you want to learn what’s really in 7.1, there’s no better way to take a deep dive and heed the call for testing. 

So there’s a call for testing for the responsive styling and yes, it’s coming to WordPress now. And then there’s a call for testing for the new modal media editor that opens up when you click on the crop icon in the toolbar of an image block or a cover block. And then there is the call for testing for the client media processing. That’s a feature that comes to 7.1 where the client, the browser is actually doing a lot of work in uploading the upload side of the image uploads and the resizing and then dumps it into the WordPress media library. 

There’s also a real time collaboration outreach effort that is also a call for testing. And then there’s a call for testing for getting Unicode into email addresses. And that’s kind of fun too. So the testing has done an amazing job putting those calls for testing together because you get instructions on how to use it and videos to show you how to use it and then the instructions also for the testing. So your mental work on how do I test this is already done. You’re just going to follow the script and, and then have room in your mental room to observe your feelings for whatever you’re doing and kind of try to, to verbalize them and share your feedback. So it’s really interesting and I hope you dear listeners are going to heed those calls. One or two of them. You don’t have to do all of them. Yeah, I don’t grade you, but there will be a test. Yeah. 

Community Contributions

Then there are also two. Well, I said two, but there are actually three merge proposals from the contributors. There’s new things coming to WordPress Core. One is expanding the WordPress Core abilities. It’s a merge proposal to add three read-only abilities to cover the settings, content and users for AI. And it gives AI clients real tools to call so the agents can understand what your site’s configuration, post and people are doing. There’s a discussion should this be in core, should this be a plugin and all that you can read up on the post. And the second one is also for AI is the guidelines to build knowledge on your website. Yeah, what’s your tone about what’s the tone of voice, the expression, what the topic is about and what the members are, what the standards are and all the notes for revision and capabilities. So an AI agent could follow those instructions as well.

And for people who manage multiple sites with one AI they can actually it’s different for every site. So it’s really important to have that on the site to give that that’s a new content type and new settings pages for these things. So you can even use your AI to update those guidelines. There’s one thing and then of course the last one is the bigger one and that’s a merge proposal for the design systems theming Andrew Duthie published a merge proposal bringing design tokens and new theme components to WordPress built by the Gutenberg Components team. But it turns the hard coded admin styles into CSS custom properties so your plugins and screens stay consistent and accessible. 

Then a color ramp tool generates harmonious accessible scales from just two seed colors and the user color scheme reaches the site editor which will come into I think 7.1. So with a dark mode on the horizon. So it’s a good time to get involved in the discussion now, dear listeners, and to make your point of view listen to and converse with others on the impact for you and your business and for your clients because that’s where the decisions are made. Some of them are already made but they are loosely held, so to speak. 

There’s a whole aspect of WordPress is we have strong opinions but they’re loosely held. If you have a good argument and you have a good use case or a different point of view, you are listened to. Of course if aired respectfully and even if it’s not respectful it should be because we all want to do the same thing. So the links to all the merge proposals and calls for testing will be in the show notes. You get to pick what you are interested in and so that’s a whole thing that happened in the last three weeks when we didn’t have a Gutenberg change log. So I wanted to catch you up. Any thoughts on that Ellen, that you want to share with our listeners?

Ellen Bauer: I think on the merge proposals but I think for the calls for testing the responsive styling of course sticks out to me because we have been calling for that for so long and the user the feedback was always there like what is that without responsive styling? So now here it is. So yeah go ahead and test it and I will do the same and kind of contribute to make it better or improve what. What we can. But here we go. We finally have. I think the number one ask always this is missing in Gutenberg.

Birgit Pauli-Haack: Yeah. I think the number one ask is not the responsive design because Gutenberg is responsive in certain areas. It’s a viewpoint. It’s a media kind of thing. Yeah. So what is a tablet? What is a mobile. And to change things for those screen sizes. And there was a big hesitation and there’s. On the developer blog, there’s an article about intrinsic design that’s built into Gutenberg. And I think the thinking was, okay, intrinsic design is what comes after media queries. Comes after. So because we need to also talk to what is component in the container queries in CSS and all that. And at the start of Gutenberg people wanted to push the envelope of intrinsic design and then see what’s missing. And. And now we know where it all goes and how to. To change it. And there is a. Yeah, we talk about it a little later when we come to that. Yeah, but so that’s kind of. That part why it took so long, I think was the reason why I kind of went on the drain there.

Ellen Bauer: That is true. I’m glad that we didn’t do like earlier versions of it. It seems late, but yeah, there’s. There’s a reason.

Birgit Pauli-Haack: But I think, yeah, a lot of plugin companies actually filled that gap quite nicely. I also saw a few implementations where you didn’t have three viewports or breakpoints, you had six, so. And I kind of couldn’t imagine that a normal user can keep in their head six different sizes to control the styling and when something needs to be changed to find it again where that actually was changed. I get the hesitation. So yeah, yeah..

Ellen Bauer: You quickly go a little overboard with that. And I’m also glad that we didn’t do that on the core level.

What’s Released – WordPress 7.0.1

Birgit Pauli-Haack: Yeah. So that brings us to what’s released and it’s release week kind of thing. So on Wednesday and we’re recording this on Friday, July 10, Thursday, July 9, WordPress 7.0.1 was released with bug fixes from the major release. And the release candidate announcement has a list of all the fixes in track and from the Gutenberg repo, 

I’m preparing an article for the Gutenberg Times. I will probably put in the show notes about what the fixes actually did is the WPKSS or however say that CSS corruption on some of the admin design glitches and some more. So you can have a summary of that. Yeah. 

On Wednesday, just the day before 7.0.1, a user ask in the core channel, what is. I see all the communication. Yeah. What is the latest version actually, and at that time it was still 7.0, but we say but tomorrow it’s going to be 7.0.1. 7.0.1. Yes. Yeah, yeah. 

So 7.1 last month Anne McCarthy posted the roadmap 7.1. It was aspirational and also very concise with an outline and links to the tracking issue for the many features contributors have been working towards. Beta 1 of 7.1 is scheduled for next week. That’s July 15th. And by then we will know the full picture of what made it and didn’t make it into the release features from the Gutenberg plugin releases 22.6 through 23.6 will come to 7.1 unless they’re behind an experiment flag or plugin or plugin only as guardrail 23.6 release candidate. And that’s what’s getting into the beta version is on July 14, so one day before the beta version, because that’s where all the NPM packages are created and all the things get into the branches. Right feature branch. 

The final release of 23.6 is moved to July 22nd. That was kind of decided by the release tech leads to get it all just in time for beta and organize that. So the deadline for enhancement into the plugin on 7.1 is July 14, the day before beta. So if you’re a contributor and you want to get the feature that you were working on in this weekend is probably crucial because it also needs to be reviewed and approved. So give people time to get in there. 

So yeah, what should be on your radar for 7.1 is the mandatory iframe of the post editor. We mentioned it before. It actually has also a lead time to come to this point is the post editor runs inside or the block editor should run inside an iframe because it isolates the content from your admin styles and makes the viewport units and media queries work correctly against the editing canvas rather than the browser window. And in 7.1, iframing becomes more enforced for block based themes or for all themes because it ensures that canvas behaves predictably and the blocks render accurately for both the post editor and the site editor, template editor and pattern editor and plugin developers. 

So plugin developers who have not updated their Block collections from version 2Block JSON version 2 to 3 should actually upgrade to make this all work. If you want to catch up on the newest discussion, there’s a Gutenberg PR that’s called Always the post editor for book theme. And that’s the 79819. And if you put that in your playground, you can actually add some of the plugins or your staging site, or add it to the staging site, then you can test your things. I think the biggest problems are sites that are maintained by people that do not read the make blog or do not listen to podcasts or read blog posts about their site or the software. And those are sites that haven’t been maintained for a while, otherwise they would have already upgraded things. Yeah.

Ellen Bauer: So block themes need to do anything too. They haven’t. No. Right.

Ellen Bauer: I haven’t looked into that.

Birgit Pauli-Haack: It’s a problem for blocks. Yeah.

Ellen Bauer: That are in the block plugin collections.

Birgit Pauli-Haack: Yeah. That only. They were only meant for post editor and have never been used inside editor or something like that. Because those would have broken already. Because the site editor since 2020 kind of uses an iframe version. So if you use the block in a template or use the pages thing from the site editor, the pages administration from the site editor, you will know when the block breaks. And in the post editor, if you go into the console, you see the notification that it’s going to be deprecated. But if you’re only in the post editor and never look at anything else and those blocks might break if they’re not updated.

Ellen Bauer: What should they do if this happened to them?

Birgit Pauli-Haack: There are some guardrails in place and there were two PRs. That one is the hard kind of, okay, we do all the iframe insight and that’s going to be in beta. And in beta, listening to the feedback will decide if there will be a switch to the other less hard choice there in terms of saying, okay, if it’s a block theme, it’s going to be an iframe post editor. But if it’s not a block theme and. Or if there are blocks on the page that are on the old version, like the version 2, then it will not be iframed, but that is subject to change. It’s kind of. There’s a trial and error kind of process here to figure out what is the best way move forward. Because the first post blog post about that was actually published in June ‘21, so five years. And then there was another one in November 2025, and there was another one in February ‘26. So there is a lot of leeway or runway for agency developers and plugin developers to kind of update, but sooner or later there will be a push to make it final and then deal with the consequences. Yeah. 

Anne McCarthy’s roadmap included two updates that we already know have been already punted. So that’s the update to React 19 and the deprecation of the classic block. Those things have been punted. And there are blog posts on the make blog for the reasons and next steps for that. It’s pretty much the classic blog where there was a lot of communication around it that said, okay, maybe it’s not a good time yet. And for the RAC 19 there were too many backwards compatibility issues, but it’s going to come. So it just needs a little bit more runway to get final to that point. All right. Any thoughts about that?

Ellen Bauer: Not really. I’m excited for 7.1. I think we haven’t mentioned the release time. Is that still planned for WordCamp US and like August 19th.

Birgit Pauli-Haack: Yes, the planning is July 15th being beta and then August 5th being release candidate and August 19th final release on the last day of WordCamp US.

Ellen Bauer: Okay, cool. I’m excited.

Birgit Pauli-Haack: Yeah, I’m excited too. There are nice features in there and there are nice updates to the site editor there and I’m very excited about that. 

Gutenberg 23.4

And now that brings us to Gutenberg 23.4. Let’s go and talk about things.

Ellen Bauer: So that was released June 17th. We’re also going to talk about the next release 23.5 right after. So let’s start with this one first. 

So I think the most exciting things in there are related to media. And the first thing that is pretty exciting is if you load media into the post editor, you now get like a little notification snack bar that kind of tells you the progress of your uploads. Like if you load dump, just dump in like 20 images you’re going to see. And you also I think timed first image, second image, third image. We are used to it, I don’t know from apps and stuff. So I think that is really, really helpful to see the progress of the loading there.

Birgit Pauli-Haack: Yeah. And Adam Silverstein did an amazing job to get this all done. There’s a second one that also that the upload process is now enabled. So when it’s interrupted because you’re offline or something, it also resumes automatically the upload on the when the connection returns. So this would save quite a few hurry up and wait kind of thing. When you’re maybe on a train or in a country where you don’t have stable Internet connections to upload your media. 

Right now, I only highlighted that because it’s in the same thing that the client side media processing is now geared towards 7.1. So the plugin’s only guardrail has been removed and it can be merged into WordPress.

Enhancements

The next one is the playlist block. It now has a visualization style selector so it has the playlist lock. When you try and test it, you’ll see there is a visualization kind of where the music builds some animation on top of the track and you can select the styles now for that. And also it now has a track length setting so you can set up the settings for that as well.

Ellen Bauer: Another thing I kind of liked because I’ve built that before is if you have, I don’t know, on a WooCommerce theme or something, if you want to have the log out log in or for any other kind of purpose, you can now get that into an inner block of the navigation submenu. The lockout lock in. That wasn’t possible before. It’s a small thing but very helpful for whenever you want to have that in a drop down or sub menu.

Birgit Pauli-Haack: Yeah. If you have a membership site or subscribers only content and you. You offer them a nice accessible way to log in and log out. There’s a very minimal change, but you might need. You will notice it. It’s the time to read icon has been renamed to time. So it’s not. Might be getting rid of redundancy, but I’m not sure it’s even clearer. It’s clear enough. So yeah, that’s the change.

Ellen Bauer: Yeah, I think that’s mainly kind of to reuse it, to be able to reuse it for more things. Right.

Birgit Pauli-Haack: Yeah.

Ellen Bauer: Another thing that I think is a little bit bigger and quite helpful is that now it’s possible that columns and gallery blocks can be transformed into grid variations for layout styling. I think that’s kind of cool. I think I wanted to do that many, many times.

Birgit Pauli-Haack: Yeah, me too. Because I forgot that I have a grid block and I tried to do things with the columns block.

Ellen Bauer: Yeah, yeah. So often you kind of start out in a column and then you realize no, that should be a grid.

Birgit Pauli-Haack: And then again for the media. But this time it’s out of the block editor. The media editing modal has changed and it has some new features, better features, new libraries. And we talked about it before on this podcast. But now you can reorder the details field has been reordered and then now you have aspect ratio controls for the mobile toolbar and they refactored a little bit the modal layout in total. But this is a great, great tool. So these are all just the usability issues. The main feature was already in 23.2 or 3 and there are editable attachment fields. And the mobile tool. The mobile toolbar has been updated to include the aspect ratio controls. Also uses the zoom uses now plus and minus buttons. Yeah. Instead of the spyglass.

Ellen Bauer: Oh yeah. That is actually very helpful an update on the dashboard. And you maybe have to help me out if I’m not 100% sure if I understand that correctly. So we always had the grid columns and now they are opinionated. So pre designed responsive. Is that correct if I say that like in your dashboard, like the two columns, I think it’s maximum four columns. It doesn’t go more than four and then it reduces like it nicely responsive by default, right?

Birgit Pauli-Haack: Yeah. It goes from 960 desktop width, so four columns to two columns between a tablet kind of size, between if it’s smaller than 960 to 600 and if, if it’s smaller than 600 or 600 and smaller, it’s going to one column and has a mobile kind of view there. So it’s definitely responsive. But that’s the dashboard. It’s about the admin dashboard. It’s not in the block editor. So that grid has nothing to do with a grid block in the block editor. So we have a little issue there with using the same words for different things. But that’s because it’s all grid based. But it’s a good thing. 

And contributors have an experiment on redesigning the dashboard and also let blocks going in there and all that. So it’s. It’s quite interesting to see that there are more additional features in there like this day before. Right. So if you’re in a block, you can. They’re figuring out how to put the previous day and previous years. So if you have a blog for 30 years or 10 years, you. You get. Or even five years. Yeah. You get a notification, what you published about this time of year, last year or something like that.

Ellen Bauer: Yeah, I like that.

Birgit Pauli-Haack: And that was actually kind of nice.

Ellen Bauer: It kind of embraces your blogging history.

Birgit Pauli-Haack: Yeah, exactly.

Ellen Bauer: One actually kind of cool little change that I really like is in the site editor now. The admin color scheme, if you select another one, get translated into the site editor. So I know a lot of people always say, oh, you go into the site editor and it’s this black different looking user interface. And yeah it’s. Why is it so dark? So now it kind of adopts the color scheme you have selected. And I think this like part of bigger work going into kind of making the interfaces more be like one thing instead of.

Birgit Pauli-Haack: Yeah. The unification of the admin interface is also a long time coming and I think that’s a, that’s a fantastic step. Yeah. To kind of just make it sure that if you have a green sidebar that it’s also green in the site editor.

Ellen Bauer: Yeah. Because why, why wouldn’t it be?

Birgit Pauli-Haack: Yeah. So on the client media side again, the ultra HDR JPEGs that are detected by upload and then the originals are kept unmodified and the sizes subsizes. They preserve their ICO standards. So you have a better quality of the Ultra HD but it also handles the bigger sizes. So it’s a nice addition to the media upload feature that we talked about before.

APIs

Ellen Bauer: And then we also have an update on APIs. Oh, God. You have to help me with this one. I read it, but now I’m kind of like what was that about again? The future it will help.

Birgit Pauli-Haack: So it tracks per entity, the view configuration for pages. And then so it’s about the pages of pages, posts, patterns, template parts, templates and have their default layout in the grids being the, the layout grid in the admin. So when you’re in the site editor you have a choice when you look at templates, what kind of layout. You have a grid layout, a list layout and these kinds of things. And now there is actually an API that you can extract that view configuration for several other things. If you’re plugin developers, you can then replicate what the, what the priority is or what the preference is for your user. And you see that in the rest API when you pull out the information and display it again, that you get the configuration with it. I don’t know.

Ellen Bauer: So you can practically kind of unlock whatever the configuration was in default and then use that in a plugin or something, right?

Birgit Pauli-Haack: Exactly. Yeah.

Ellen Bauer: The same screen.

Birgit Pauli-Haack: So when you. One use case could be if you are using WordPress as your content container, but have another application that displays things as a headless or in another. In another admin content management system that only talks to WordPress with all and pulls out the things that are in WordPress and measures it up with other data that’s also in the system, then you are able to display the same what the user sees in the WordPress admin, you can display that also in your system at the same time. So that kind of would be one of the use cases that I just made up.

Ellen Bauer: Yeah, that makes sense and very good to explain in that way. What else do we have next?

Experiments

Birgit Pauli-Haack: So the dashboard we talked about that now has also an events widget that can be filled. 

Documentation

I wanted to point out one documentation thing that is really a big deal that Juan Margarido has taken on in April or May and push that through a merge now with 23.4 and that is the auto generation of the per block API reference from the block JSON files. 

So, until now it was really hard to figure out, okay, what’s the block markup and are there all the supports in there? Because the documentation was handmade. So if somebody updated a block’s configuration and block JSON and added support to it for other things, it would not show in the documentation until someone touches the documentation page. And for 90 blocks or so that are in core right now, that’s a moving target and fast moving target. So he proposed to go in and auto generate that documentation page for humans and AI to map multiple things. 

So one is the parent relationship with other blocks like think accordion block and the sub blocks there, the attributions in the table, in a table that what the block supports and with links to explain those features. So if you don’t know what the alignment or support of a block is, you can look it up right from there and then what block styles come with core so you don’t have to figure that out from the interface. So like the button comes with two styles, one is the default, the other one is the outline style. Then which CSS selectors are automatically created and then an example of the block markup. And last but not least, also the links to the source of the information and the packages. So you have a full 36-degree view on the block. And because the documentation is auto updated, it comes right there when the new features are kind of added to the block and it will be shown in the documentation. 

This not only helps the developers and theme developers to have a better handle on or one lookup page or section in the documentation, it also helps AI agents to form a comprehensive space to learn about WordPress blocks. Because I have found that AI sometimes just does a custom HTML block and puts it all there instead of using a column block or cover block or something like that. 

So this is a very big deal because that’s something where AI elevates human capabilities because he used AI to run the code that parses the block JSON and puts it into the documentation page and then also has that documentation page from the GitHub repo into the developers.wordpress.org document block editor documentation automatically merged there. So this is a big deal. And kudos to Juan Margarido. He also spent some time getting some community input from the documentation team from the Gutenberg leadership. We had a hallway hangout with a Q and A and it finally was merged now. So kudos.

Ellen Bauer: Yeah, that’s pretty cool. 

Gutenberg 23.5

I think now we’re moving to the latest release, 23.5, released July 1. 

Enhancements

I think the first thing we wanted to highlight was that the design system token defaults now with out a runtime which practically, as far as I understand it correctly, helps that all the styling from the design system is just there by default. There’s nothing that got missed. Is that correct? Yeah, because it happened before that some design elements were in style.

Birgit Pauli-Haack: Exactly. Yeah. It’s now available as public export. That’s pretty much so you can use it in your own apps that you put into apps. I say it’s also called plugin, so you can use it without having to import it into your plugin via NPM and these kinds of things via the build process. So you can just import it into your app here. 

But I also want to point out again the match proposal for the design system. Everything there is kind of in a holistic way explained and also what it’s supposed to come to. And these are all plenty of the component work that’s done for 23.5 and released or merged is actually in support of the design system and the UI revamp of the components.

Ellen Bauer: I think about the block library. And we have a few other updates in the release. The first one is that the viewport states and the controls are now support for they supporting aspect ratio and all the related controls with that.

Birgit Pauli-Haack: So I think yeah, it’s part of the styling system. Yeah.

Ellen Bauer: For image blocks featured image block media library also no, no background images. A background cover image and cover block, yeah.

Birgit Pauli-Haack: Also yeah, okay, that’s the viewport states is the name that they give the responsive editing screens. So those controls are now also available. 

There’s also a line item in the block library section of the changelog about the classic block to hide it from the inserter that has been reverted. That’s part of the blog post that I mentioned earlier that was published after the release of 23.4, so I wanted to point that out. 

The next one is that the media editor modal is now available also for the cover block that comes with that. I think I mentioned that already. But now when you have a cover block with an image, you can also use the media editor modal to crop it, to rotate it, to tilt it and all that kind of things.

Ellen Bauer: That’s a nice add on small but also visually really nice to have is that the icon block now has controls for flip and rotate the icons, which is very nice to have like a. One of the things you like kind of expect to be able to do and then it’s super difficult. So now you can do that. And then it also. What is the second one about?

Birgit Pauli-Haack: Oh, it just adds a default placeholder instead of to the blockchain.

Yeah. So there was also a big push to have text alignment support for some of the text blocks. And now the block quote. I think there were seven or eight blocks that have that again. This time there was missing text align support and that has been rectified. So now you have also text align support for the block quote. 

Yeah, that was one thing that threw me quite a bit and quite often I always went back to the quotes block. But a quote block and a pull quote have different use cases and a pull plot is an excerpt from the article and you couldn’t make it not centered. It was kind of odd that you couldn’t left align it. Which is my favorite. Yeah. Centered when you have more than one word in the center, you hardly can read it. Or more than one line. Yeah. So I always wanted to be left aligned and I can’t quote just a sentence. Yeah. So I’m really great that they have a text aligned support now that makes sense.

Ellen Bauer: It’s these little things that kind of throw you, throw you off if you don’t have them and you’re like, why can’t I then? I think one of the biggest things in this release is that the resizable editor now it’s like fully resizable. You can drag it along. It’s not just mobile, tablet, desktop, you can get your own size and preview it. I think this is one of the biggest releases in this. In this update 23.5. So can you do anything else? You can resize it.

Birgit Pauli-Haack: Yeah, yeah. It has a handle though. You can resize it. So you have a handle to make it smaller but not as small as mobile. So you can see if. If somebody uses a tablet whatever and odd width you can kind of test it if, if your settings actually work there or your. If the. The layout is there. But you cannot change the viewports themselves. Yeah. They are not customizable. It’s just so you can see the preview there. Yeah.

Ellen Bauer: Which is very helpful like visually.

Birgit Pauli-Haack: Yeah. Especially when you get a call and you don’t have that device on hand. Yeah. That a client sees or a client has a complaint from their clients that something is wrong on the view. You can just kind of tested in the block editor without having the device on hand. 

But there is a long standing request to be able to change the viewport numbers and because right now they are hard coded to I think 768 is the desktop and then 467. Yeah. 468 is the tablet and or between there is tablet and then below is the mobile. But there is good news. There is coming with 23.6. It’s already merged is in PR where you can change that via the theme JSON. So theme developers are now able to change viewport numbers for their sites. There is no UI yet for it. But that’s typical. That theme JSON is first. So theme developers can test it out and can actually use it. But for the UI you need a little bit more information how things are going and how users would work with it.

Ellen Bauer: And there’s also been a smaller change on. If you add a note that just. It’s simplified how the show more or less collapse works. If you have a long note you want to collapse it and show more or less. I think that just has been reworked or simplified.

Birgit Pauli-Haack: Right.

Ellen Bauer: I don’t think it’s anything we see on the user side. Right. It’s more in the background. Yeah.

Birgit Pauli-Haack: It’s just faster. Yeah. It’s kind of that. Okay. Mostly performance issue. Yeah. You’ll see a slight change there. 

There is the experiment of the omnipresent toolbar which is pretty much the admin bar. In the editors you see the admin bar, the black admin bar on top of the screen when you’re logged in and you look at your website from that perspective and you also in the post editor you see the black toolbar but you couldn’t in the site editor or in the other editors. So now the experiment is to show it but then also unify the interface because the design view or the site editor has its own W to go back to the other admin. And when it’s in the admin bar you just click where you normally click to get to the site. So it’s all unification of the interface pretty much. And now you can see the site icon instead of the dash icon if you select it as well in the toolbar. So there has been an ongoing effort and some of it might come to 7.1. It’s on the roadmap for the admin bar everywhere, so to speak.

Ellen Bauer: I think one thing that I remember I struggled with quite a lot is the flex behavior of children. So now there has been.

Birgit Pauli-Haack: You mean your child? Well, it’s not the flexibility of toddlers.

Ellen Bauer: The Flex elements. I love flexbox CSS always have. But I think we always had a problem that they weren’t behaving like exactly like CSS. Flexbox should behave. So now one of the changes has been that so flex children that had a fixed width, this is now like truly fixed. I think it was squishable before. Can you say that? Is that correct? And now it’s like a truly fixed width to zero. So I think that’s one of the things visually that helps a lot. And then the other one was grid layouts now have fill available space, toggle. Is that correct? I think it’s just a toggle in the settings. Right. That you can toggle on and off and then you have auto fill and auto fit behavior. Okay. And this behaves exactly like CSS grid behavior.

Birgit Pauli-Haack: Yeah, you would expect. Yeah, that’s pretty nice. There was some. Some quirkiness to the grid block and the grid layouts and I’m glad that Isabella is working on that constantly to improve it and to get back to it.

Ellen Bauer: Yeah, she’s doing great work. I met her live at WordCamp Asia this year and it was really pleasant because I love flexbox Grid. I always love these blocks and CSS settings and they never quite worked. How I or like went into that depth, I wish they had. And yeah, she’s. I think, like, she has the same opinions, so it was a good chat. 

Another thing that is kind of cool and fun to have is that now global styles allow text shadow settings. So, yeah, there’s these options of text shadow, if you ever want to use that in like a cool, fun design or. So now you can set it in global styles, which is really cool. That wasn’t possible before at all, I believe. Right?

Birgit Pauli-Haack: Yeah.

Ellen Bauer: Right.

Birgit Pauli-Haack: It’s a new style support.

Ellen Bauer: I really like that.

Birgit Pauli-Haack: Yeah, I tested it and it’s really nice. There are some presets in there that come from core, and I still need to figure out or find out how you can switch off some of the styles and how you can add your own styles like you can do with the shadow box. The shadow box has a feature that you can switch out the core styles with your own styles or just switch them off, but you definitely would need that for the texture as well.

Ellen Bauer: Maybe we will add that.

Birgit Pauli-Haack: Yeah, it’s not there. It’s the first version and the first version is pretty much a minimal viable kind of setup. Yeah. 

The next thing is again Media Editor modal. It now has some error states. You can magnify the crop to fill the canvas and the current post always includes the initial options. There are also minor fixes, but that is because it gets ready for 7.1 release. So every aspect of it is actually and comes from feedback from the call for testing. The call for testing was actually already issued in I think in May. So it’s already a month in or two months in. So there is already some feedback coming back. 

The data layer has a feature for the real time collaboration or many features, but one of them stands out is that you can disable collaboration per post. So if you have maybe a recipe or a book post type and you don’t want anybody to collaborate with you on that, you can switch that off. It’s probably best for very visual post types or it’s also necessary for template parts or for navigation. Those are also post types. You can control that now. 

So there was a for a while in the text controls there was a prop to have the next 40px default size and there was underscore. Underscore was an experimental property and that now has been made the default. So if you had a 36 before or 32 on the default size for the text box, then if you wanted to be in the same realm as WordPress itself, you had to use the underscore next 40px default size prop to have the same sizes of the controls and now those are default now. So you don’t have to do this experimental prop to use but it will change how things work. So you might want to, as a theme developer or a plugin developer, you probably want to check your plugins, your text control components, how they change behavior or at least the default layout. So that’s why I’m calling that out here in the episode. 

And also a similar thing is known that 23.6 Gutenberg 23.5 bumps. The minimum required version to install the Gutenberg plugin is now 6.94 versions 23.5 and newer. So if you are on 6.7 or 6.8, you are not getting the newest version of the Gutenberg plugin. So I think. Oh, there’s one more. Did I overlook something?

Performance

Ellen Bauer: No, I think on performance you highlighted that blocks migrate markdown converter from showdown to marked. And what does that do?

Birgit Pauli-Haack: It actually is just performed faster. Yeah.

Ellen Bauer: Oh, yeah. Okay.

Birgit Pauli-Haack: And it also has a different parser, so it might have a say. It’s G. What’s it called? GTM. There is a standard for markdown that comes from GitHub and it now adheres to that standard. Yeah. So that’s updated. It’s a minimum change most people wouldn’t even need to do. But if you copy paste something from GitHub or from other Markdown editors or from your AI agent, it’s a different parsing process.

Ellen Bauer: I just researched that and it said that the previous one was like from 2018 or so and this is just like a faster newer version that we updated to. Okay, that makes sense. 

Experiments

And then there was one last highlighted thing on the block library unwrapping. Classic block migration notice experiment.

Birgit Pauli-Haack: Yeah, that’s part of the effort to the classic logic. But that has also been reverted so it will not announce that this is deprecated. So it’s important to know that that line item in the change log has been overwritten already with a newer version that comes to 23.6 on July 22.

Various

Ellen Bauer: And there was another small update on icons to self declare icons color on the icons block.

Birgit Pauli-Haack: Oh, nice. Yeah, I overlooked that. I got lost in the changelog already. So.

Ellen Bauer: I mean there were a lot of these smaller things.

Birgit Pauli-Haack: Oh yeah. So if you have an icon, it can say I’m. I’m only in blue or something like that. What does it mean, the current color?

Birgit Pauli-Haack: Oh, current color. Yeah, of course. Duh. Yeah. I was still stuck on tab sync finally second the tab sync because it’s the. For stabilizing it to come into 7.1. The tabs block is still under active development until July 14, so don’t start building on it yet because there’s API cleanup and refactoring going on where the contributors try to nail down the final version before it gets into core. Yeah, that’s the end of it.

Ellen Bauer: Wow.

Birgit Pauli-Haack: Yeah, we still had a lot to talk about, Ellen. Yeah. So apart from the responsive styling, are you excited about some things that come to 7.1 in the near future?

Ellen Bauer: I think for me, being like a Visual X thing builder or and working on blocks, I think responsiveness is a big one and I’m excited to see how. Yeah. How we just kind of improve things. Also, I like that we are looking more into the dashboard and finding ways to unify the experience. I think this is one of the things that always come up that it looks kind of like two different versions, partly outdated. And I think we need to move along and kind of come to maybe not make everyone happy, of course, but come to a compromise that we can all live with and then move forward. I think this would really help WordPress to kind of shine in a way that it doesn’t look outdated or not like one product. I think if we can come together and do that and push for that change, that would be really, really helpful for all of us and for everyone and for WordPress. So I’m excited to contribute and help to make this happen.

Birgit Pauli-Haack: Awesome. Awesome. Yeah. Yeah. I like the new blocks that are coming. Of course. I have been a fan of blocks since the beginning of the block editor, so I like that the playlist block and the TAMS block. And finally. The table of content. There is an effort to actually have the table of content come to WordPress. Right now. It’s only available for years in the Gutenberg plugin.

Ellen Bauer: I didn’t even know. I thought it would be in.

Birgit Pauli-Haack: Yeah.

Ellen Bauer: Even small things like rotating icons and stuff like that or having them be the current color and all these grid and Flexbox things. They. We need these things. I think it’s still very, very important to have professional settings like that available.

Birgit Pauli-Haack: Yeah. And this is a visual person. You’re probably also happy that you now can have in the group block. Background gradients. Gradients. We all love gradients. I love gradients. I love gradients. Yeah. And there’s these kinds of things.

Ellen Bauer: They’re like, why aren’t they there? And so responsiveness. And I think just of kind of growing up Gutenberg and the editing experience.

Birgit Pauli-Haack: Yeah.

Ellen Bauer: Seems. And even like with AI helping on a lot of things and being able to patch CSS and stuff on onto things to make things better that we don’t have. I think it’s still important that we aim for a really high quality experience in manual editing so people find what they’re looking for and are not frustrated or get lost. I think that’s just the quality we want to stand for and have in WordPress no matter what.

Birgit Pauli-Haack: Yeah.

Ellen Bauer: I think the standard should like, should be. We aim. Should aim for that as being just there for people, for users.

Birgit Pauli-Haack: I think we. We develop, as I say. Yeah. Are kind of really immersed in this AI grace and hype and also the possibilities and the usefulness of AI in our work. There is a danger that we forget that WordPress users that are writers or publishers actually are not using AI to do their work on WordPress. So we definitely need a delightful interface and all these small changes, quality of life changes and the big changes like the responsive editing and the dynamic galleries and whatever is going to come. The modal editor, the media editor needs to be delightful and useful for humans that are kind of having fun and producing more content for the Internet that is kind of. Yeah. Eating it whole, so to speak, with AI.

Ellen Bauer: Yeah, yeah, I love that too. Delightful is a beautiful word to use. Yeah. We want to delight people using WordPress and this should be our aim. AI or not, like in whatever. We have to meet users wherever they are, however they want to use the tool. It shouldn’t be, oh, we can leave this stuff now because everyone uses AI. I think if we have a user interface, it would be delightful. If it’s not yet delightful, we have to make it delightful. And AI can only help us to do that because we can contribute faster, we can move things faster. So let’s use AI for that, to delight users to meet them wherever they are for everything we offer, and we do offer a user interface. So here we are with some work to do.

Birgit Pauli-Haack: I think that’s a good end of the show today. Thank you so much, Ellen, to be on the show and walk with me through those changes that are coming and if people want to reach you, how is a good way to reach out to you.

Ellen Bauer: So I am in the community Slack WordPress community Slack. I’m also on social media, not that active to be fair, but reachable anytime. I think for WordPress community, the community Slack is the best place to reach me. But if you look at my name, Ellen Bauer, you can find me online on all kinds of platforms and I’m oh, I’m actually revamping my Manu and my Little Elmo Studio blog. So there’s going to be a new design and I’m really excited to get blogging again. Also doing a lot more like a few more YouTube videos. I have some ideas for that over the summer month now. So, so wonderful. Yeah, I will share if I have some news on that. Look out for Ellen or Elmer Studio and just reach out anywhere.

Birgit Pauli-Haack: Excellent.

Ellen Bauer: Yes, I’m always excited to hear from you.

Birgit Pauli-Haack: Wonderful. Thank you so much, Ellen.

Ellen Bauer: Thank you for having me. Birget, you’re welcome to be on the show.

Birgit Pauli-Haack: It’s delightful to have you to overuse that word. 

Now, dear listeners, the show notes will be published on GutenbergTimes.com podcast this is number 132, 132. And if you have questions and suggestions or news you want us to include, send them to changelog@gutenbergtimes.com that’s changelog@gutenbergtimes.com thank you all for listening. And until the next time, goodbye.

Ellen Bauer: Bye.

💾

Roadmap 7.1, Gutenberg 23.5, Responsive Styling, Migration to Block themes — Weekend Edition #368

Hi there,

After a four-week break — courtesy of a sciatic nerve with strong opinions — I’m happy to be back in by office chair and in your inbox. There is plenty to catch up on.

Beyond the updates on the new WordPress and Gutenberg versions, you’ll find stories below from WordPress veterans on migrating to and working with block themes on client sites and dive into more complex theme solutions or

Don’t let me keep you from your light summer reading.

Have a splendid weekend ahead!

Yours, 💕
Birgit

Developing Gutenberg and WordPress

The team around release lead Aaron Jorbin pushed WordPress 7.0.1 Maintenance release out the door to update millions of WordPress sites. The update covers 17 Trac tickets and 14 Gutenberg PRs. The full list is available in the RC 1 announcement post from last week.

In WordPress 7.0.1 Fixes Registration Spam, wp_kses() CSS Corruption, and 7.0 Admin Design Glitches, I cover the most important fixes for end users and developers of this release. You’ll learn how the registration-spam loophole got closed, which admin design glitches were sanded off, and why developers can finally remove their wp_kses() CSS workarounds. Update your sites soon if auto-updates aren’t enabled.


Ryan Welcher compiled What’s new for developers (July 2026), and it’s all about the 7.1 cycle getting real: Beta 1 lands July 15, final release August 19 at WordCamp US. You’ll want to test responsive styling, the React 19 runtime flag, and Unicode email addresses now. Also on your radar: merge proposals for Core Abilities and Guidelines, the 40px component default, icons inheriting color, and Playground’s MCP support.


Berislav “Bero” Grgičak announced what’s new in Gutenberg 23.5, released July 1. The headliner: you can now drag the editor canvas to any width, with the device preview dropdown and resize handles working together for responsive editing. The experimental Media editor gains a magnified crop canvas, pixel-snapping handles, and Cover block support. Also notable: text shadows in Global Styles, flip and rotate controls for the Icon block, and a minimum WordPress version bump to 6.9.


For the next episode of the Gutenberg Changelog, I sat down with Ellen Bauer to chat about what’s coming next for WordPress. We dug into the latest Gutenberg plugin releases (23.4 and 23.5) and the recent WordPress 7.1 update. Plus, we walked through some big merge proposal, like the Design System Theming. our excitement around responsive styling coming to WordPress. It’s a packed episode full of news you won’t want to miss! The episode will land in your favorite podcast app over the weekend.


WordPress 7.1 roadmap and more calls for testing

Anne McCarthy published Roadmap to WordPress 7.1., scheduled for August 19, 2026. Longstanding styling gaps are being tackled: responsive styling and interactive-state styling let you adjust blocks per viewport or on hover — no custom CSS required. You’ll also find new Playlist, Table of Contents, and Tabs blocks, a smarter command palette, a Design → Identity screen, the admin bar inside the editors, a media editor modal, and expanded Unicode support for email addresses.

Also mentioned Real-time collaboration, Knowledge Guidelines, React 19 upgrade, Classic block deprecation have been punted since the posts came out. Beta 1 arrives July 15 and will settle which of the other Roadmap features are in and which will be punted to a future release.


The latest Weekend Edition listed three calls for testing. Meanwhile, two more came online:

Nikunj Hatkar, this year’s team rep of the Core Test team, posted a call for testing responsive styling. You’ll be able to style blocks differently for tablet and mobile right in the editor — no custom CSS or media queries needed. The underlying PR unifies the resizable canvas with the device-preview switcher. Fire up the linked WordPress Playground instance, walk through the four test scenarios, and share what feels intuitive or broken. Plugin and theme developers should test their canvas integrations, too.

Dennis Snell published a call for testing Unicode email addresses. With initial support merged, is_email() and sanitize_email() now accepting non-ASCII addresses like grå@grå.org, and validation aligns with the Web Hypertext Application Technology Working Group (WHATWG) spec. You’ll want to check your plugins and themes: the new WP_Email_Address class gives you structured access to local and domain parts, and a snippet lets you disable Unicode support until third-party integrations catch up.

Three Merge Proposals

Core contributors put together three merge proposal for new features to be added to Core for public comment.

Jorge Costa published a merge proposal to expand WordPress Core Abilities in WordPress, adding three read-only abilities covering settings, content, and users. Building on the Abilities API from 6.9, they give the AI Client real tools to call, so agents can understand your site’s configuration, posts, and people. Settings and post types opt in through a dedicated flag, and management abilities are planned for a later WordPress version. 


Greg Ziółkowski published a merge proposal for Guidelines built on Knowledge, a new custom post type headed for WordPress 7.1. Knowledge gives your site one shared home for standards, memories, and notes — with revisions, capabilities, and REST access built in. Guidelines is the first feature on top, letting you capture voice, tone, and per-block rules right where writing happens. Although, originally aimed at WordPress 7.1, in their latest comment, Anne McCarthy indicated that it needs to simmer some more before it’s considered for inclusion in WordPress Core.


Andrew Duthie published a merge proposal for Design System Theming, bringing design tokens and a new theme component to WordPress. Built by the Gutenberg Components Team, it turns hard-coded admin styles into CSS custom properties, so your plugins and screens stay consistent and accessible. A color ramp tool generates harmonious, accessible scales from just two seed colors, and the user color scheme reaches the Site Editor — with dark mode on the horizon. 

Plugins, Themes, and Tools for #nocode site builders and owners

Anne Katzeff published a tutorial exploring the WordPress Cover Block for parallax scrolls. You’ll learn how the Fixed Background setting turns a Cover block into a layered parallax effect — background, middle ground, and foreground text moving at different speeds. The post steps through nesting a second Cover block, switching which layer scrolls, and improving text readability with grouped backgrounds. A video tutorial rounds it out. She also demos her process in this YouTube video.


Carrie Dils shared a case study, One Header, Two Themes, on phasing a legacy Elementor site toward Full Site Editing without a rebuild or content freeze. Using ThemeSwitcher Pro to run two themes side-by-side, she built one shared header in a plugin that both themes render. You’ll learn from five real-world snags — WooCommerce’s hooked blocks, cascade conflicts, routing gaps, query-string bypasses — and why shipping the shared layer first de-risks everything after.


Gina Lucia compared WordPress block themes vs page builders on the Ollie blog. You’ll get a clear-eyed walkthrough of what classic themes, page builders, and block themes each handle — scope, design control, performance, lock-in, and maintenance — with side-by-side tables. Her conclusion: block themes combine sitewide design control with visual editing natively, so you rarely need a page builder anymore, though migration costs and team habits can justify keeping one.


Elliott Richmond explained why he spent 16 months turning 400+ holiday cottages into WordPress blocks. The kate & tom’s site moved from ACF flexible content to a native block theme, freeing the marketing team from waiting on custom widgets. You’ll appreciate his candor: 10,590 widgets migrated via a purpose-built plugin, re-run against fresh production snapshots, with flaky conversions fixed by hand. Even untuned, PageSpeed jumped from 22 to 67.


Wes Theron published a video tutorial, How to Create and Edit Navigation Menus in WordPress, for anyone getting comfortable with block themes. In under ten minutes, you’ll learn how to edit your menu with the Navigation block, add pages, posts, categories, and custom links, and build dropdown menus. Timestamps let you jump straight to the part you need — handy if dropdowns are the only thing standing between you and a finished header.

Theme Development for Full Site Editing and Blocks

Henrique Iamarino shared how the Automattic Design team built a WordPress theme without ever opening Figma. You’ll follow the making of Crafted, a production-ready theme created almost entirely in the WordPress Editor: Global Styles for typography and spacing, Create Block Theme to save edits to theme files, WordPress Studio for local review, and an AI assistant for finishing-touch hover CSS. His takeaway: the Editor is now a professional design surface.


Justin Tadlock explained how to dynamically load template parts in block themes on the Developer Blog. Instead of maintaining a pile of near-identical templates, you can hook into the render_block_data filter and swap a template part’s slug on the fly — say, a different sidebar per post category. His walkthrough covers early returns, fallback behavior, and file setup, and the technique works for headers, footers, and banners, too.


 “Keeping up with Gutenberg – Index 2026” 
A chronological list of the WordPress Make Blog posts from various teams involved in Gutenberg development: Design, Theme Review Team, Core Editor, Core JS, Core CSS, Test, and Meta team from Jan. 2024 on. Updated by yours truly. 

The previous years are also available:
2020 | 2021 | 2022 | 2023 | 2024 | 2025

AI and WordPress

Jeff Paul announced what’s new in AI 1.1.0, the latest release of the canonical AI plugin. Two experiments headline, type-ahead text suggests inline ghost text as you write in the block editor, and key encryption secures your AI Connector API keys in the database. You’ll also find smarter content readiness checks with locale-aware counting, more control over guest comment moderation, a new core/read-settings Ability, and a peek at 1.2.0 plans.

Need a plugin .zip from Gutenberg’s master branch?
Gutenberg Times provides daily build for testing and review.

Now also available via WordPress Playground. There is no need for a test site locally or on a server. Have you been using it? Email me with your experience.


Questions? Suggestions? Ideas?
Don’t hesitate to send them via email or
send me a message on WordPress Slack or Twitter @bph.


For questions to be answered on the Gutenberg Changelog,
send them to changelog@gutenbergtimes.com


Featured Image:


WordPress 7.0.1 Fixes Registration Spam, wp_kses() CSS Corruption, and 7.0 Admin Design Glitches

WordPress 7.0.1 is now available. As the first maintenance release of the 7.0 cycle, it’s strictly a bug-fix release: every included ticket addresses either a regression introduced during 7.0 development or an issue intentionally deferred at the end of the cycle.

The release ships fixes for 17 core Trac tickets and 14 Gutenberg PRs. Because this is a maintenance release, sites with automatic background updates enabled will update to 7.0.1 automatically — everyone else should update as soon as possible. Here’s what stands out for each audience.

Kudos to release lead Aaron Jorbin and his team for pushing this release over the finish line and getting it into hands of WordPress users quickly.

The most important fixes for end users

Registration page spam is shut down (#63085). The account registration page could be abused to send “Login details” spam emails from your site. This is arguably the most impactful fix in the release for anyone running a site with open registration — it protects both your users’ inboxes and your domain’s email reputation.

The 7.0 admin reskin gets its rough edges sanded off. WordPress 7.0’s refreshed admin design shipped with a handful of visual glitches that this release cleans up:

  • Form elements are now standardized in the mobile viewport (#64999)
  • The image editor’s scale and crop inputs no longer mismatch in size, and the info icon uses the new color scheme (#64937, #65428)
  • The publish settings panel no longer crowds its primary action buttons together (#65286)
  • The Media Library’s loading spinner is properly aligned in the modal filter toolbar, and the search bar no longer jumps position after a search (#65275, #65296)
  • A “black flash” that briefly appeared on wp-admin pages before the interface finished loading is gone (Gutenberg #78493)

Emoji behave correctly again. Two related fixes: the emoji detection script is once more printed in the admin (#65310), and certain characters are no longer incorrectly replaced by Twemoji images (#64318).

Accessibility improvements to the new revisions experience. The Visual History / Revisions feature introduced in 7.0 receives several accessibility fixes: focus now moves to the revisions slider when entering revisions mode, and changed blocks are marked with a CSS outline as a secondary, non-color indicator — important for users with low vision or color blindness (#65122, Gutenberg #77530, #78393, #79691).

The most important fixes for developers

wp_kses() no longer corrupts valid CSS (#65270). Since 7.0 RC4, wp_kses() could mangle legitimate background-image: url(…) declarations into a broken style=")" attribute. If your theme or plugin outputs inline background images through KSES-filtered content, 7.0.1 restores expected behavior — any workarounds you shipped can now be removed.

global-styles-inline-css can be dequeued again (#65336). Since 7.0, developers were unable to remove the global styles inline stylesheet. If your build pipeline or performance optimization strips this and re-serves it another way, that control is back.

PHP 8.5 compatibility fix in wp_get_attachment_image_src() (#64742). An incorrect array access triggered issues under PHP 8.5. If you’re testing sites on newer PHP versions, this removes one blocker.

A removed Navigation function returns as a deprecated shim (Gutenberg #78484). block_core_navigation_submenu_render_submenu_icon() was removed in 7.0, breaking themes and plugins that called it directly. It’s restored as a deprecated shim — but treat this as your migration notice, not a reprieve. Update any code that references it.

Editor state management fixes reduce false “unsaved changes” warnings. Two Gutenberg fixes matter here:

  • controlled/mode block changes are now marked non-persistent (#79350), and
  • related navigation entities are no longer dirtied during passive renders (#79000).

Together these should mean fewer spurious dirty states and a cleaner undo history — a quality-of-life improvement if you build with template parts and navigation blocks.

Block Visibility: “hide everywhere” keeps working after a block opts out of visibility support (#65389). If you register blocks that disable visibility support, previously hidden instances now stay hidden as expected.

How to update

You can update directly from Dashboard → Updates in your site’s admin, run wp core update with WP-CLI, or download WordPress 7.0.1 from WordPress.org and install it manually. Sites that support automatic background updates for minor releases will begin updating on their own shortly.

The full ticket list is available in the release candidate announcement, Trac report 4, and the 7.0.x editor tasks board on GitHub.

What’s next: WordPress 7.1

With 7.0.1 out the door, attention turns to the next major release: WordPress 7.1 is scheduled for August 19, 2026. To see what’s planned for the release, check out the Roadmap to 7.1 on the Make WordPress Core blog.

#224 – David Snead on Building Trust and Collaboration in the Hosting Industry With the Secure Hosting Alliance

Transcript

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, building trust and collaboration in the hosting industry with the Secure Hosting Alliance.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you, and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today, we have David Snead. David has been involved in the hosting industry since 1999, starting out as legal counsel for one of the earliest shared hosting companies, and going on to work with over 50 others. He helped found the i2Coalition, serve as in-house counsel for cPanel and WebPros, and now leads the Secure Hosting Alliance.

If you’re listening to this podcast, I’m sure that many of you will have worked closely with hosting companies. Perhaps you run an agency, or business, that depends on the reliability, ethics, and security of hosting providers. David is here to talk about cross-industry collaboration in the hosting world, specifically around improving security, professionalism, and communication between hosts.

The conversation focused on why, and how, the Internet Infrastructure Forum, or IIF, is building a framework for real-time intelligence sharing and abuse reporting, aiming to help the entire ecosystem detect and prevent attacks faster than adversaries can adapt.

David talks about the challenges hosting companies face, especially smaller ones, in keeping up with security, and how this evolving project hopes to ease this by sharing actionable, non-proprietary abuse information across registrars, hosting providers, DNS services, and more.

He discusses the growth of both the Secure Hosting Alliance and the IIF, the business case for collaboration, and the nuances of legal and technical information sharing across borders.

If you’re in hosting, run a web agency, or just want to know how the backbone of the web is working to stay more secure and connected, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so, without further delay, I bring you David Snead.

I am joined on the podcast by David Snead. Hello David.

[00:03:20] David Snead: Hello.

[00:03:21] Nathan Wrigley: Very nice to have you with us. David’s got a really interesting background, and a really interesting, I’m going to use the word project. I don’t know if that’s the right word. It feels like it’s got more solidity and it’s got a lot more history than that. It’s something which is, I think going, but we’ll find out a little bit more about it. It’s all about the hosting industry and trying to get hosts to, I guess communicate with each other in ways going forwards.

[00:03:44] David Snead: That is a part of it. There are really two goals and one is to level up the ethics and professionalism in the hosting industry. And the second is to facilitate more comradery and interaction among hosts. Something that folks felt occurred in the early 2000s, and with all the consolidation that occurred went away. And so that’s something that we’re also trying to facilitate.

[00:04:16] Nathan Wrigley: Okay. So given that we’re going to be talking about hosting, I guess it’s a good idea to paint your credentials and find out a little bit more about you. So a short opportunity to just tell us a little about you and your background in WordPress and hosting specifically, I suppose.

[00:04:29] David Snead: Sure. So I have been working in the hosting industry since 1999. As I often say, I was working in the hosting industry when hosting was cool. It is not so cool anymore. In fact most people don’t really pay attention to it.

You know, and I started as a lawyer for a hosting company, and I was in-house counsel for a company that actually owned a hosting company and was one of the earliest hosting companies that specialised in shared hosting. And so I was their general counsel. And for some reason it stuck, and I’ve just kind of turned it into a career.

So after that I had a private practise as a lawyer and I worked with probably 50 different hosting companies, mostly writing policies that nobody ever reads, which makes me super fun at parties.

And then from there, my friend Christian Dawson and I formed the i2Coalition as a response to some legislation in the US that would’ve been kind of the death nail for internet providers. So we started the i2Coalition. I then went in-house for cPanel and worked at cPanel and WebPros for 10 years, and then started the Secure Hosting Alliance.

[00:05:52] Nathan Wrigley: Okay. So you’ve got all all the history. That’s pretty good. You know, if we’re going to talk about hosting.

[00:05:57] David Snead: All the hosting history in one person. That’s kind of a very scary idea, no?

[00:06:02] Nathan Wrigley: But that’s excellent. So do you still offer counsel? Is that still, so you haven’t sort of sidestepped and do half of the week on a sort of more technical basis? It’s still the legal side that you’re involved in.

[00:06:13] David Snead: I do. Right now I’m doing mostly M&A work for, it’s weird. So I don’t know if anybody has ever said this to you before, but web hosting is kind of like the Hotel California. It’s like, once you start in the web hosting industry, you never leave. And so I have all these clients from 15 years ago who are now running like little baby hosts, and they’re talking to bigger hosts and they want to get acquired. So I’m doing some of that now. I am not writing any of the policies that nobody ever reads because that was just, I did that for too long.

[00:06:51] Nathan Wrigley: There were too many moments parties.

[00:06:53] David Snead: Yes, exactly. Yeah.

[00:06:55] Nathan Wrigley: Okay, so I’m going to read into the record the title and the blurb that went with the presentation that you are doing or done.

[00:07:02] David Snead: I did it yesterday.

[00:07:03] Nathan Wrigley: Okay, we’ll get into that in a moment. So the title is coordinating the fight, cross industry collaboration, and the blurb goes as follows. WordPress hosting threats cross company lines. When one provider falls victim, the entire ecosystem suffers. This session explores how the Internet Infrastructure Forum, or IFF, enables hosting providers, registrars and registries to coordinate abuse response through real time intelligence sharing. Learn how operational collaboration helps responsible operators detect and stop attacks faster than adversaries can adapt. And why working together produces results no single provider could achieve alone.

When I read that, immediately was, yeah, that’s a really sensible idea. Why are we separately, as hosting companies, I say we, I mean the hosting companies. Why are they all trying to do the same work over and over again, separately? When presumably this aspect of the work, the security bit is something they all have in common.

[00:08:05] David Snead: Right? So that’s the fundamental question, right? So the IIF is a voluntary organisation that is made up of everyone in the infrastructure stack. So from registrars, registries, DNS providers, hosting providers, cloud providers, everyone in the stack. So it is facilitated by the Internet and Jurisdiction Foundation. They’re based in Paris, and they’re the actually the secretariat for it.

And what it’s designed to do is create a common way for everyone who’s in the infrastructure stack to share information about abuse and abuse issues. And it’s one of the fundamental problems that you referred to is everybody is operating in a silo, right? And that’s mostly because that’s the way the internet is architected, right?

So the internet is architected, so it’s distributed, right? Registrars and registries basically do their own thing with domain names. They might have a small hosting component or maybe a cloud component, but by and large, all they do is domain names.

Hosting providers probably resell domain names, but they’re not part of that industry. And so how do they all coordinate? And that’s what the IIF is trying to facilitate, is more information sharing among the participants.

[00:09:39] Nathan Wrigley: Well I imagine some of the hosting companies are probably fairly good. You know, they’ve got a giant customer base. Let’s imagine hosting company X over there, they’ve got millions of customers. They’ve got a huge budget that they can put over to, let’s say, security things. Well that’s all well and good, brilliant. But then there are other companies who are much scrappier. You know, they maybe have only a few thousand customers. And so their budget for the exact same work is going to be reduced.

How will this work? Is it going to be like a subscription service basically? Will you have a membership, which is in some way equal to the number of clients that you’ve got? Will there be some expectation that, okay, we’ll look at your revenue, your membership will be equivalent to a percentage of your revenue? How will that all work?

[00:10:20] David Snead: We don’t know. This is a very early stage project. Right now we are in a prototype phase where we have just figured out what information folks should submit to the secretariat.

So the way it works is, you submit the information that you collect for a particular abuse issue to the secretariat, who then enriches it with all the other information that’s been submitted and sends it to the right person.

So a great example is, let’s say a registrar reported a phishing domain. They turn off the phishing domain and they have maybe a timestamp, an IP address where it was submitted from. They submit that to the secretariat, who then finds the hosting company who is providing the services for the hosting and says, this came in about this particular site. Can you take action on that? So that’s the way it works.

Right now it’s very early stage. It’s in the first phase of a test, and we’re going to look at whether the way we’ve architected it, or the way the group has architected it, actually makes sense.

[00:11:39] Nathan Wrigley: Is this going to be then a sort of slow on ramp whereby you bring a few companies in at the beginning, hopefully. And then one or two more and iron out the wrinkles, and then some more and some more? Because I imagine, if you just threw the switch, everybody’s in, a lot could go wrong at that point. And I’m guessing there’s going to be more of a slow on ramp.

[00:12:00] David Snead: So you’ve pointed out my particular frustration with the IIF, and the reason that the secretariat is moving slowly, right? So fortunately, or unfortunately, based on my cultural background, I’m just sitting here going, this needs to move faster. We need to have everybody involved, we need to have all the hosts involved, we need to have all the registrars and registries. And other folks who are a little bit more skilled in this type of work say, no, we need to figure out what we’re doing and that requires a small number of people.

The phase that we’re in right now is looking for more folks who are interested in sitting at the table and being part of the discussion. Particularly in the hosting industry and in the web design and marketing industry. Those are folks who don’t generally participate in these kind of industry led collaboration exercises. And that’s the reason that I’m at WordCamp, is to talk to web designers, marketing agencies about why they should participate in something like this.

[00:13:13] Nathan Wrigley: So this really isn’t bound in any way to WordPress, is it? It just so happens that WordPress has a significant chunk of the internet, so this is a good place to start. But if you happen to be a, I don’t know, Drupal user, or you’re just into writing PHP code or whatever it may be, this is still applicable. There’s no real WordPress layer to this. This is just a good place for you to come because, well, there’s probably, what, 30 hosts, 100 yards away from us out there.

[00:13:37] David Snead: I know. And I haven’t seen all of them yet.

[00:13:39] Nathan Wrigley: Yeah, there’s work to do. But agnostic to any platform, basically.

[00:13:42] David Snead: It is completely platform agnostic, yeah.

[00:13:43] Nathan Wrigley: Okay. Okay, that’s interesting. But WordPress is a, is certainly a good place to start.

Now, I’m imagining, if I was a hosting company and I was the chief executive, I definitely have some questions for you in terms of, okay, we’re going to share our valuable intel with you, what are you going to do with that? How can we trust you? How do we know that the sharing is going to be done effectively and what have you?

So I guess really what I’m getting to is, what is the assurances or checks and balances that you, in the end, will hope to offer the host? That you can assure them that, look, if you hand us this body of work, you don’t need to think about it again. You can trust us to do it honourably, effectively, collaboratively. You get where going.

[00:14:26] David Snead: Yeah, yeah. And I suspect that you wanted to be a lawyer at some time, because that’s one of the issues that we’re facing. Information that can be shared freely, as an example, in the United States, might not be capable of being shared so freely in the European Union, or in Brazil, or in India or someplace like that.

So one of the things that’s being done, not by me, but by another group, another working group that’s part of this, is analysing the legal issues around information sharing.

The information that’s being shared, to answer the proprietary and confidentiality question, is not proprietary or confidential information. So it’s things like timestamps, domain names, IP addresses for the initial abuse submission. Things like that that really don’t indicate some sort of company confidential information. And it’s further abstracted into xarf, which is a language that’s used for abuse reporting, that we all can share. And so I think that the only thing that would be of concern is whether that information is personal information that’s subject to jurisdictional restrictions around the world.

[00:15:48] Nathan Wrigley: Would the idea be that this organisation would do the remedial work? So is there any notion that, let’s say for example, some sort of security problem was discovered by hosting company A over there, and they share that intel with you. Maybe the question is kind of asking, will you then appoint people to figure out what the patch is for that? Or is your idea just to, oh, red flag, we’ve got this problem, now you all know about it. Is it just information sharing as opposed to fixes?

[00:16:17] David Snead: Yeah, it’s the latter. So the thing that we’re solving for right now, so there’s just one issue that, one abuse issue, that we’re testing out and it’s issues related to fake shops. And so the fake shop issue is the test abuse issue for the project, and where folks are sharing information. It’s a particular problem right now with credentials harvesting. And so that’s what we’re trying to look at.

[00:16:43] Nathan Wrigley: And how has the conversations that you’ve had thus far, how have they gone? Has this been warmly received or are you facing a little bit of pushback?

[00:16:50] David Snead: So, look, I’ll be very direct with you. If something isn’t just an immediate threat to them, it’s very difficult to conceptualise why you should participate. And I am pretty used to answering that question simply based on the political work that I do with the i2Coalition. But once you talk about, so let’s use fake shops as an example. Fake shops, and you’re providing services to fake shops, actually has an impact on your bottom line.

So if you are providing, let’s say, payment processing to an entity that is running a fake shop, it very easily can make your credit card processing charges higher. It ends up eating bandwidth. It will tax your abuse resources.

One of the things that you referred to initially is, you know, larger hosts have a lot of money. I wouldn’t say they have a lot of money, but they have more bandwidth to handle a vast fire hose of abuse issues. Most smaller hosting companies might only get five or six abuse issues in a month. But if you have a fake shop, that’s going to generate a huge amount of abuse, and it’s taking away resources that you can use to actually grow your business. So that argument actually is relatively persuasive in getting folks to pay attention.

I find that the business argument around abuse is a much more compelling discussion than kind of moral persuasion. I don’t think moral persuasion works in the context of a community that is trying very hard just to keep their heads above water.

[00:18:42] Nathan Wrigley: It feels to me from what you’ve just said, and I could be reading too much between the lines, but it feels to me as if a good target audience would be smaller hosts to begin with, simply because they’re probably going to be more receptive because they have less bandwidth themselves. And so would welcome anything that can make the burden of sharing this information easier. So 10 of the small hosts combined is, well, it’s much bigger than each of them individually would be, whereas I suppose you’ll have to get a critical mass of them on board until maybe some of the bigger hosts start to look at you with favourable eyes, let’s say that.

[00:19:15] David Snead: Well, so we have some pretty large hosting companies who are participating. So as an example, both GoDaddy and Newfold are participating. But we also have smaller hosts. But I agree with you, the information that’s being provided, particularly since it is actionable, realistic information that can be adapted for bespoke systems, is invaluable, right?

So if you only get five or six abuse complaints and you get an abuse complaint, and you can go to the secretariat and say, we got a complaint about this domain, and the secretariat says, here’s what the registrar did. Here’s what Cloudflare did. Here’s the information they provided us. And you can use that to make a decision on how to address that problem. It saved you hours and hours and hours of research time.

[00:20:09] Nathan Wrigley: Technically speaking, what would the conduit of information both toward you and away from you look like? So if I’m hosting company X, how are you imagining that I will supply you with that information? But also, if I’m just looking for information from you on a daily, weekly basis, whatever it may be, how do I receive that? Is this like a, I don’t know, a website or an API or?

[00:20:33] David Snead: It’s an API. So it’s a file. It’s just a general file download.

[00:20:37] Nathan Wrigley: Right, okay. So it’s readily available 24/7?

[00:20:40] David Snead: Right. That’s the goal. Right now it’s not, but the goal is to kind of figure out a way to make something like that possible.

[00:20:47] Nathan Wrigley: Yeah, okay. I also suppose that the hosting companies, whilst this is good for their business if they can minimise costs and hand a lot of this work over to you, there’s a part of them which would also probably like to put some sort of badge on their website to say, this is what we’re doing. We’re part of this alliance, for want of a better word. Is that something that you are looking to develop as well, you know, some sort of credentialing system to demonstrate that you’re in this?

[00:21:12] David Snead: So that’s not something that the IIF is working on. It’s something that the Secure Hosting Alliance does. The Secure Hosting Alliance has a trust seal that we give to hosts who fulfil our Trust Seal Certification provisions. But that’s not something that the IIF does.

Talking about like why, other than business reasons, folks should participate in this, one of the things that is going on that I would suggest that most hosts know about, is there’s a little bit of a moral panic going on in the world about what contents you have. And regulation is actually a very real thing for the hosting industry, who has not ever been regulated. This is the time where you can say, hey, this is what we’re doing, right? We’re dealing with issues. This way a trust seal is the same thing, right? It’s something that you can say, we are actually taking steps to make the internet a better place.

[00:22:18] Nathan Wrigley: I think if you are a general agency owner or, I don’t know, just a freelancer, hosting is one of those things that you, once you’ve done it once, you’re in it for the long haul until something goes wrong. But you’re also browsing around for any tiny indication of why is this host slightly different? You know, what is it that they’re doing that, I don’t know, is faster? What is it that they’re doing that’s more secure? So it feels to me if you had a credentialing system and I began to hear about it and see it pop up again and again, it would be one of the metrics which I would weigh up when looking at hosting.

[00:22:51] David Snead: I would think so. One of the things that a trust seal does is it indicates that there’s been some vetting of the host. That someone has determined the things that are important to the hosting industry and are important to the web design industry. The agency industry are also important to the host.

Great example of that is one of the provisions of the Secure Hosting Alliances’ Trust Seal Certification is that a contract is presented to the customer before they sign up, which is super customer friendly.

One of the things as a lawyer that you hear about all the time when people are dissatisfied with their services is, yeah, well, I never saw that contract. Or it was just a hyperlink in an email that I got. That’s one of the differentiators for a Trust Seal certified host is that the contract is actually presented to them, to the customer beforehand.

[00:23:57] Nathan Wrigley: So in terms of the WordPress crowd, is this a thing that you are pitching only to hosts? Like when you step out of here, are you trying to have conversations only with hosts? Or is there some bit of the WordPress community, the freelance, the agency owners? Are you trying to communicate with them just to scope out what they need?

[00:24:15] David Snead: So for both the Secure Hosting Alliance and for the IIF, it is that. I really enjoy talking to agencies and developers about whether this is important to them, or why it might be important to them.

[00:24:31] Nathan Wrigley: In terms of how long this project’s been going, I’ve only heard of it because of your participation here, but I don’t know if you’ve been banging this gong for a decade or, I mean you’ve been in the industry for long enough to have been banging it for decades. Is this a new initiative or is this something which has a long and storied history?

[00:24:49] David Snead: So the Secure Hosting Alliance has only been active for a year, a little bit over a year. I’ve been talking about abuse for a long time, but the Secure Hosting Alliance has only been around for a year.

[00:25:01] Nathan Wrigley: And have you, in that year, got any intuitions that you’ll be here for another year? Is it basically going in the right direction?

[00:25:09] David Snead: It is going in the right direction. So we started out with two or three charter members. We now have 25 hosting members. We have three security vendors who are members as well. We have, I think, 17 Trust Seal Certified members, and we’re launching in 2027 a trust seal for security vendors who provide services to hosting companies.

[00:25:40] Nathan Wrigley: I know that several owners of hosting companies listen to this podcast. They may very well be the people that you’ve spoken to already, but if they are not, and they are people who would like to investigate this further, I suppose the thing that’s going to be in their head is, okay, Nathan and David, you’ve explained what I’ll get out of it, what do I need to put into it? So is this an annual financial commitment? How does it all work from that point of view?

[00:26:02] David Snead: Yeah, so you become a member of the i2Coalition. And so the Secure Hosting Alliance is a working group of the i2Coalition. So you would be a general member and you would participate in the Secure Hosting Alliances’ working groups. You also have the ability to participate in the i2Coalition as a whole, which is a much larger trade association that represents almost everyone in the internet infrastructure vertical. Mostly doing policy work, primarily in the US and the EU. Although there’s, we’re doing some work in India right now as well.

[00:26:40] Nathan Wrigley: And does membership allow you to steer the future of the project? I know that lots of chefs in the kitchen results in terrible food, but that, I fear, is something that could happen. You’ve got 87 members, 260 members. And then the 260 members all start to bicker and, you know, we want this, no. You see how it goes.

[00:26:59] David Snead: I do.

[00:26:59] Nathan Wrigley: What’s the position there? You know, is there sort of gated levels of membership? How are you organising all of that?

[00:27:04] David Snead: There are not. The membership is based on self-reported revenue. The membership is not horrifically expensive from my perspective. And I think that that, most of our members would say that it is, it’s actually relatively affordable, particularly for the small to medium sized hosts. And registrars or design agencies, anyone who’s participating.

The question about, who’s running the show, comes up quite a bit. We haven’t really faced that issue, particularly in the Secure Hosting Alliance. Folks seem to get along. But the organisation runs on the idea of rough consensus. And so decisions end up not being controlled by one member or not. Some of the i2Coalition has some very large companies who everybody knows about, who get along with startups, and folks against whom they compete directly. And policies still get made. The organisation still moves forward.

[00:28:11] Nathan Wrigley: Yeah, I guess you’re in a space where, obviously all of these hosting companies commercially are vying for everybody else’s business. But in this particular situation, that is not the case. Nobody’s vying for their websites to be less secure. They all want the same level of security. So at least in that sense, you would hope that consensus could be maintained even if, commercially, the two companies that are in the room, the 10 companies that are in the room might be commercially at loggerheads with each other. At least on this they could agree. That would be the hope, I suppose, anyway.

[00:28:47] David Snead: It seems to be, not only the hope, but the actual way that things work. You ask about how compromise is reached. What comes to mind is I have a much different concept of privacy than, particularly when I was at WebPros, than other folks in the i2Coalition had. And another company just called me up and we worked through our disagreements about how privacy should be handled within the i2Coalition and were able to move forward.

The industry I’ve found to be hugely collaborative, particularly the hosting industry. Everybody knows what their competitor is doing. But when it comes to addressing an issue like, how are we going to deal with abuse as a community? Folks come together. CEOs of hosting companies while they compete tend to be relatively good friends.

As I said at the very beginning, it really is like the Hotel California, right? You come in as a CEO of a hosting company, you grow it and you sell it to another company. All of a sudden you’re at the bottom again with a server in your grandma’s basement, you know, trying to start again.

[00:30:08] Nathan Wrigley: It’s a really curious effort. I suppose really at the bottom of this entire podcast is your endeavour to be heard and to reach out and get some conversations going. So with that in mind, where do people find the information about this? So maybe there’s a website that we could mention. But also, is there a specific place where you hang out? Is there a place where you would like to be contacted most?

[00:30:33] David Snead: Sure. So our website is hostingsecurity.net. I’m not too afraid of getting too much spam. So folks can email me at snead@i2coalition.com And the two is the numeral two. So it’s snead@i2coalition.com. And I’m happy to answer questions.

In terms of hanging out, I am at most industry conferences in the hosting industry. In the WordPress industry, I’ll be at WordCamp US. We also participate very heavily in ICANN. So there is an i2Coalition member at every single ICANN meeting.

[00:31:12] Nathan Wrigley: So if you go to wptavern.com and you search for the episode with David Snead, S-N-E-A-D, you’ll be able to find those details. I’ll put everything into the show notes. So anything that I missed? Was there a particular focus that we didn’t touch?

[00:31:26] David Snead: No, this is actually one of the most thorough podcasts I’ve been on recently.

[00:31:31] Nathan Wrigley: That’s love to hear it. Well, David Snead, thank you very much for joining me today.

[00:31:35] David Snead: Glad to be here. Thanks for having me.

On the podcast today we have David Snead.

David has been involved in the hosting industry since 1999, starting out as legal counsel for one of the earliest shared hosting companies and going on to work with over 50 others. He helped found the i2Coalition, serve as in-house counsel for cPanel and WebPros, and now leads the Secure Hosting Alliance.

If you’re listening to this podcast, I’m sure that many of you will have worked closely with hosting companies. Perhaps you run an agency or business that depends on the reliability, ethics, and security of hosting providers. David is here to talk about cross-industry collaboration in the hosting world, specifically around improving security, professionalism, and communication between hosts.

The conversation focused on why and how the Internet Infrastructure Forum (IIF) is building a framework for real-time intelligence sharing and abuse reporting, aiming to help the entire ecosystem detect and prevent attacks faster than adversaries can adapt.

David talks about the challenges hosting companies face, especially smaller ones, in keeping up with security, and how this evolving project hopes to ease this by sharing actionable, non-proprietary abuse information across registrars, hosting providers, DNS services, and more. He discusses the growth of both the Secure Hosting Alliance and the IIF, the business case for collaboration, and the nuances of legal and technical information sharing across borders.

If you’re in hosting, run a web agency, or just want to know how the backbone of the web is working to stay more secure and connected, this episode is for you.

Useful links

i2coalition website

Secure Hosting Alliance website

💾

#223 – Ivana Ćirković on How WordPress Credits Bridges Education and Industry in the WordPress Ecosystem

Transcript

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case how WordPress Credits bridges education and industry in the WordPress ecosystem.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Ivana Ćirković. Ivana is a digital marketer with 18 years of experience working both in and out of the tech industry, and currently leads marketing at WPBakery. She’s an active participant in WordPress events, having attended, and spoken at, numerous local and international word camps over the years.

In this episode, our focus is on the WordPress Credits initiative. We learn how this program, launched by the WordPress Foundation, connects students with real world opportunities to contribute to the WordPress ecosystem, earn certifications, and increase their competitiveness in the job market.

Ivana discusses her own experience as a WP Credits mentor, working with students as they learn about digital marketing, remote work, and other open source contributions. We explore, how universities can modernise their curriculums, and real world value for students by participating in the initiative, and how businesses can get involved, not just to support the community, but to help shape and discover future talent.

The program’s evolving structure also gets attention, and we learn how students are guided through hands-on activities such as translation or documentation, and how their progress is tracked publicly via profiles on wordpress.org. Ivana shares the opportunities and challenges for both educators and businesses with thoughts on accountability, mentorship, and the need to bring new faces into the WordPress community.

If you’re interested in the future of WordPress, education, or bridging the gap between academia and industry, this episode is for you.

If you’d like to find out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Ivana Ćirković.

I am joined on the podcast by Ivana Ćirković. Did I get that right?

[00:03:14] Ivana Ćirković: Yes. Excellent.

[00:03:16] Nathan Wrigley: Thank you. This is my first interview at WordCamp Europe 2026. I’m guessing because we’re on the first day of the event and it’s quite early in the morning, it’s 10 in the morning, I’m guessing you cannot have done your presentation yet?

[00:03:30] Ivana Ćirković: Not yet. Tomorrow.

[00:03:32] Nathan Wrigley: Do you get nervous with these kind of things?

[00:03:34] Ivana Ćirković: I get nervous all the time. I’ve been doing this for 12 years, it never gets easier. It is what it is.

[00:03:39] Nathan Wrigley: Well, the presentation that you are doing is going to be the focus of what we’re talking about today. So do you just want to tell us a little bit about the topic that you’re talking about, but also just give us a bit of a general bio about who you are and what you do. So just tell us about you and about your presentation basically.

[00:03:56] Ivana Ćirković: Okay. First thing first, I would like to introduce my presentation, or the talk, that is build up around WordPress Credits initiative, which is something that WordPress has rolled out late last year in December. And I applied to be a mentor to support students into their entering into WordPress. Got accepted, did my courses, passed them and started working with students on their, first entering the WordPress society, how everything works, contributing.

And out of all of this, I came up with the idea of sharing the story about WordPress Credits. What it is, why it is important, not just for the WordPress community, but also for universities all around the world for businesses to support, because there is an angle and huge opportunity for them too. And hopefully inspire people to join and become part of it more.

As far as I’m concerned, my name is  Ivana Ćirković and I am a digital marketer for 18 years. I’ve been working inside tech organisations, tech industry, but also outside of it. So I’m the multiverse. And lately, for past couple of years, I’ve been working in WPBakery, in marketing their product, and talking to people, sharing knowledge of what we do, how we do it, and so on. In the meantime I am attending many, many WordCamps, local and international ones, giving lectures, giving talks about digital marketing and all things related.

[00:05:39] Nathan Wrigley: So are you here at this event, not just to give your presentation, are you also here on behalf of WPBakery to represent them and the products that they have as well?

[00:05:47] Ivana Ćirković: Yes, we are sponsors. I am speaker, I was table lead for marketing on Contributors Day. So we are wide into the ecosystem.

[00:05:56] Nathan Wrigley: I have to say, having only been in this event space for about an hour, I’m actually deeply impressed by this particular event. It really is a gigantic venue. It’s so pleasurable as well to see the WordPress community in such large numbers here. And so we’re looking forward to a really good event.

Okay, let’s kick off with the topic at hand then. So it occurs to me that many people listening, whilst they’re using WordPress and they’re kind of, I don’t know, they’re building websites for people, and they’ve got products and plugins and they’re just general users. It may be that the community piece, and the educational piece, is nothing that they’ve heard of before. So would you just tell us a little bit about what WP Credits is as far as you’re concerned, just to give us that broad background of what it is?

[00:06:40] Ivana Ćirković: Okay. So WP Credits program is initially made to bring new young people into the WordPress, to broaden the ecosystem with the new fresh blood, new contributors. And to do so, WordPress Foundation initiated this program to connect with universities all across the world. To connect students to some programs, to learn about WordPress through contribution. For that, they will get graded and get certification, which in the end will help them be more marketable, and have more modern knowledge of what is needed in today’s job market, and to be more competitive and more appealing to potential employers.

So by doing so, WordPress Credits aims to broaden the ecosystem, to strengthen the WordPress community, and WordPress itself. But also to put new generations in more marketable place, and to help them get more profitable jobs.

[00:07:45] Nathan Wrigley: Thank you. That was a really nice summary. In terms of your personal commitment to it and what have you, how did you fall into it as a thing that you were doing? And is this something that you get sponsored for from WPBakery, or is it personal and simply a sort of philanthropic thing that you are doing on the side?

[00:08:01] Ivana Ćirković: Yeah, so basically, I’ve been doing education my whole professional life. So it’s something that comes natural to me. In my local country, in Serbia, I do informal education for high schoolers and primary school’s children about digital marketing, digital literacy. This is like very natural to me. I’m being sponsored by WPBakery to do so.

And the program works like, initiative needs people, needs more mentors to get involved. More than it needs like product and businesses to support with their products. So if there are businesses who are maybe interested in support through their product, know that you need to put your people first to actually get involved and contribute, and then you can offer products as the side piece, so to say.

[00:08:52] Nathan Wrigley: So yeah, it seems that you’ve got a lifelong interest in education as well. Okay, that gives me some sort of hook there.

Okay, if I was to say WP Credits to the people outside, the people who already knew about it, I think would probably peg it as entirely educational in nature, just an education initiative. But curiously, your presentation, the notes that went with that and the blurb that went on the WordCamp Europe website, you kind of make the point that it’s much bigger than that, and you get into businesses and the students themselves and universities.

So the students in universities bit, well, that’s the education piece. But the business bit, what’s going on there? Because I definitely hadn’t drawn that intuition. I thought education from top to bottom. But business, okay, where does that fit in?

[00:09:37] Ivana Ćirković: I will get the hot insights from the talk. So basically, there is more than what meets the eye, so to speak. Businesses have unique opportunity to shape people they want to employ by getting involved as mentors. They also get the chance to see firsthand how those young minds work in real environments, in real contribution. And they get the chance to pick and choose who they want to employ by seeing them work on some real things. Whether it’s documentation, whether it’s translation or programming, developing something, AI.

We need more people who know what they do, although they are young. By having students in this program, they are working on not fictional things, but actual things that really contribute to community and businesses as a whole. By supporting this initiative, businesses then in relations to that can get more insights into who they want to employ. So on top of that, they are building the better market for themselves as well.

[00:10:42] Nathan Wrigley: I guess the student university piece is fairly obvious. You know, WP Credits and the people working on that project communicate with universities, they’re probably easy to find. You know, if you go to a phone directory for example, they’ll all be there. And it’s an easy thing to do. You phone up the university and see if there’s interest. And I know that some universities have taken up the WP Credits program. And it seems to be, as far as I can work out, it seems to be working very successfully.

How are you going to make the connection with businesses? Because that seems like a much more scattered, I don’t know if you’re going to be working with big businesses, you know, huge companies or if it’s going to be kind of more the businesses on the street, the smaller businesses, that kind of thing. So, I’ll just sort of hand it over at that point.

[00:11:23] Ivana Ćirković: So basically, web agencies, businesses around WordPress, we know they have an issue with new employees onboarding last, let’s say three to six months. That cost time and money and other people who are teaching them what needs to be done and how.

Then we have WordPress Credit students who are already doing that junior type of work within contribution. They’re already onboarded through using Slack, knowing how to do remote work, what needs to be done. So businesses supporting WordPress Credits initiative can choose those students and spend less time and money and energy in onboarding them because they already went through that by doing WordPress Credits program.

[00:12:10] Nathan Wrigley: Yeah, I guess if you are a small web agency, it’s highly likely that you won’t necessarily have an induction program finely tuned, so that the young people that are coming through have this sort of specialised system where they can get some accreditation. It’s probably more, okay, I’m going to assign you to John this week and then next week you’re going to go over to Susan and follow what they’re doing.

So is there a sort of structured program that, let’s say a web agency based in London could drop into and receive documentation about? Where are we at with that whole process for the busineses?

[00:12:44] Ivana Ćirković: Yeah, so since this initiative is still fairly new and we already have just one generation of students that are passed the program, this is something in development. So at the moment, we still don’t have like a specific structure that is based just for agencies and businesses in general, but it is something that we are considering and working towards too. So definitely.

On the other hand, the upper management organisational team might not be aware to the fullest what am I about to talk. So it might come as a surprise to them, but also it is something in the works as well. So give us some time and we will come up with something.

[00:13:26] Nathan Wrigley: Yeah, it feels like that would be something really credible. Because if you’re a small business owner, the last thing you want to be doing is kind of wasting time. And onboarding somebody might be something that you’d have to divert weeks into, you know, syphoning employees off, writing documentation, SOPs, those kind of things. And if you could just pick something up off the shelf that was tried and tested over many years, that would actually be really handy. So good luck. I hope that that initiative comes off.

In terms of students, if you were a student, let’s say you are at a university, or you are looking for work, what would you say would be some of the top line items that you would mention as to why WP Credits is worth looking at? Because, you know, if I’m at a university, there’s probably a thousand different things that I could be doing. WP Credits would be in competition with all of those. Why do you think it’s something that young people should be taking care of to look at?

[00:14:17] Ivana Ćirković: Yeah, I would think differently, in that sense. Universities curriculums are outdated comparing to the industry that we are living and working in. So WordPress Credits gives something that is in trend. That is happening now that people are using and working now. So students who choose to go to this program are gaining the most efficient and not outdated curriculum, and things that are being worked on in this moment.

And this is bigger than WordPress. It is initially for WordPress, but the knowledge students get, nobody can take that away. They learn to be outspoken. They learn to use all the necessary remote work tools that is applicable in all the industry.

So we are really encouraging them to be very marketable employees and people who have portfolios, whether they choose that category that brings them portfolio. That is very transparent throughout whatever they do. Because on wordpress.org, every contribution is noted. So they’re building their own business brand by doing WordPress Credits. And in that way they are more marketable and can get more business opportunities.

[00:15:42] Nathan Wrigley: I didn’t realise that the wordpress.org profile, is it the profile that you mean?

[00:15:47] Ivana Ćirković: Yes.

[00:15:47] Nathan Wrigley: Each time you participate in one of these credit programs, that will be a badge, for want of a better word, that you can display and it will be freely available for the public. And presumably that will be difficult to acquire. That’s the wrong word. What I mean is, it won’t be simple to acquire. You will genuinely have had to.

[00:16:07] Ivana Ćirković: Yes, you need to do the work. Let’s say students are interested in translation. So they go to Polyglots team and they get assigned to a mentor who is on weekly basis working with them on onboarding, helping them how to navigate through wordpress.org website, translation, what needs to be done. And basically, for that student, they need to translate to have approved translation, 150 strings approved.

So that doesn’t mean, okay, I will translate 150 words. No, no. You might need to translate 500 words out of which 150 is approved. And this is the bare minimum you need to do in order to get that badge that you contributed. Because that contribution, each contribution needs to be something very specific and tailored to help other people. That is very open and helpful.

[00:17:00] Nathan Wrigley: So you mentioned translations there, which obviously is just one of multiple things that you could do, and we could list them all out, but we won’t. How is that curriculum, I’m doing air quotes, how is that curriculum decided upon? In other words, how do you decide, okay, I’m going to do a bit of translation, I’m going to do a bit of work on Core, I’m going to work for the Plugin Review Team? How is that decided? And, how is it decided by the institution, I guess that that’s going to equal something which our university will stamp as part of your degree, let’s say?

[00:17:33] Ivana Ćirković: Yeah. So basically, that is all arranged between the foundation and universities. You won’t get IT students doing marketing if that’s not their preferable choice. So students opt in. They’re given the whole like curriculum, categories of things they can contribute to. And the one they choose, this is the one they stick to throughout all the programs.

So you cannot switch in between like translation and documentation, or plugins, or WP-CLI whatever. The whole program stick to one chosen category. And that is all aligned with the, let’s say, topic of university. So IT is preferable for IT related contributions. Communications are also more favourable towards translation community, marketing. So it’s aligned that way.

[00:18:23] Nathan Wrigley: So flipping that round, so we’ve been talking about it from the point of view of the students. Now let’s just flip it around to the point of view of the university. I guess the same thing applies. They would have to communicate with the Foundation and say, okay, these are the kind of things that we wish our students to do. These particular strands, we will, you know, if they do 500 translation strings, that will count as something. I guess there’s got to be some interface between the Foundation and each university to establish what a credit equals.

[00:18:50] Ivana Ćirković: Yeah, common ground as to how WordPress Credits adds to the official curriculum of the university. And the thing that university get out of it, they are in position to offer modern, in trend, teachings, and that makes them more appealing to next generation of students. Because the more their existing students who are in the WordPress Credits program are succeeding, the more desirable the university gets to newer generations because they don’t teach outdated curriculums. They’re aligning to what is now efficient and needed in the job market.

[00:19:30] Nathan Wrigley: I suppose also as well, when I was at university, there was a choice of about, I don’t know, four things to do each year. Something like that. You could do this or this or this. And you had to pick one of them and that was your pathway. This feels much more wide open because knowing the WordPress ecosystem, I know that there’s dozens, maybe multiple dozens of different things that you could be involved in.

So that’s quite appealing as well, isn’t it? You know, you can just take a little nibble of this one thing, and another nibble of this. And so there’s potentially multiple dozens of different pathways that you could pick. And whilst you say that, once you’ve decided you’ve got to stick to that, well, that’s fair enough, but the fact that you’ve got so many different ways that you could choose. That to me as a university student would’ve been really appealing. The fact that there’s so many different things that you could do.

[00:20:15] Ivana Ćirković: Yeah. And once they got in, the overall input that we get from students that, first they don’t know that something like this exists. And once they go deep and start work, it’s like, wow. The whole mind just shifts, and they are amazed by all the possibilities that they can do within WordPress that isn’t talked about.

[00:20:36] Nathan Wrigley: Yeah. And I presume they get to do it in the way that the WordPress community works, which is remotely distributed and when you wish to do it. So long as I, you make the end of the university period of whatever a semester is or something, so long as you make the deadline, you can do it at night or in the early morning or.

[00:20:57] Ivana Ćirković: Exactly. So they are training to be like workers as we all are today, that are not restrained with some deadlines or by official university rules. They’re accountable for the final output. How will they come to that output? It’s entirely up to them because, yes, they are young but they’re not so young that they cannot be held accountable for their actions. So they need to do the work. We got weekly mentorships and assessments. So it’s a fun ride.

[00:21:31] Nathan Wrigley: So just touching on that, the sort of ongoing support that every student needs, because with the best rule in the world, there’s a proportion of students who will leave everything to the last minute. I’m looking at myself in the mirror when I say that. So that ongoing support, it’s a weekly sort of huddle. And is that like a one-to-one thing or is it a one to many thing?

[00:21:50] Ivana Ćirković: Yeah, so depending on the number of students, if a mentor has a one or two students, it can be one-to-one. If there are more like five or six, it’s better to have a group meeting on a weekly basis, and then Slack chats in between if anything is more needed than that.

So basically we go through what they did last week, are there any setbacks or they need additional help, or do they need information from other parts of the team? Are they interested in something else? So we are really trying to get them involved in a way that matters to them.

One of the things that each student needs to do, no matter section they chose, is to create a blog and to have weekly blog posts. So we discuss about that. What interests them. Whether they want to be something personal like, or professional like. So it’s very interesting to see how they think and how they express themself and how they build their online persona.

[00:22:55] Nathan Wrigley: Do those huddles take place on a, let’s say university by university basis? So for example, when you join and you mentor students, are they from the entire WP Campus project, or are you doing it from the university of this town and the university of that town?

[00:23:13] Ivana Ćirković: No, it’s mixed and matched.

[00:23:14] Nathan Wrigley: So, okay, well that’s a real strength as well it feels, because presumably then you’re on a call with people potentially from all over the world. Certainly people that you may not have encountered before. And those sort of serendipitous chance encounters can sometimes be some of the more meaningful ones. You know, work comes out of those things, and meetups come out of those things, and unexpected things come out of those things. So that must be really nice as well, watching those kind of things happen.

[00:23:42] Ivana Ćirković: Yeah, it’s like nothing I experienced before. And just to have the privilege to talk and work with those people, you never know what can come up out of them, and out of our connections. And I get inspired every time we have chats and they make me want to be a better educator.

[00:24:03] Nathan Wrigley: Oh, that’s interesting.

[00:24:04] Ivana Ćirković: So, yeah, that’s my take out of all this.

[00:24:06] Nathan Wrigley: Yeah. Okay, so there’s actually some psychological benefit for you as well. You get a real nice feeling of it. Okay, that’s really good.

So with the best will in the world, a university, every year there’s a cohort of children, young adults, whatever it may be, whichever institution it is, and a proportion of them will work diligently and hard and they will succeed. And some others maybe not so much.

How does that work? How do you ensure that everybody gets through it? And I don’t know if there’s enough data to answer this question. Again, I’m doing air quotes, how is the pass rate? Do most people that embark on this get through the necessary things? Or is there a fair bit of, I don’t know, discipline, for want of a better word, that needs to be applied and cajoling people to get through it?

[00:24:46] Ivana Ćirković: Yeah, so I touched base on the accountability. So we have not strict rules, but recommendations. Weekly mentor chats, async communication through Slack. They all have weekly tasks that needed to be done. So if a student don’t answer the message or come to weekly mentor call three times, they are no longer WordPress Credit students. And that is the accountability.

You need to show yourself that you are willing to do the work. So if you don’t care, we won’t force you to do that if you don’t want to. We will set reminders, we will call back, we will reach out. But if you are no show, no tell anything for three times, then evidently you are not for that. You don’t wish to be there, and we won’t force you to be there.

[00:25:40] Nathan Wrigley: And then in some way, are you required then to report that back to the institution and sort of say, okay, we’ve reached the end of the road here, and then it’s for them to figure out how that impacts. And presumably the students can.

[00:25:53] Ivana Ćirković: Their grades, yeah.

[00:25:53] Nathan Wrigley: Yeah, their grades what have you, okay. Touching back on the sort of business side, because we’ve dwelled a lot with students and universities and we’re going to stay with students, because that’s really the underpinning of the whole thing. How has the business side of things, is it taking off? You were describing that it’s kind of like a new thing. Have you got any sort of success stories or anecdotal evidence that people do in fact want this?

[00:26:15] Ivana Ćirković: Yeah, so it’s still fairly new, so we don’t have those anecdotes yet. One of the reasons why I’m here at the WordCamp Europe is to find out and to get new perspective from businesses to like reach out to them to see what they think about the program. Would they want to be evolved. And how to give tips, maybe how we can improve. So stay tuned for more.

[00:26:38] Nathan Wrigley: Yeah. And it is interesting, when you walk around an event like this, I don’t have the exact numbers, but the demographic is definitely skewing older. There’s not so many 18 year olds. And if this community wishes to carry on, at some point the age demographic will get to retirement age.

[00:26:57] Ivana Ćirković: Yeah. Just last night we were talking. I’ve been in the community for 11 years. And for 11 years all the same faces are here. And we really need new faces. But to get new faces, WordPress Credits is one part of the solution. But then again, we need to meet young people where they are. And they are not on the conferences, they are not on websites, they don’t use websites, they don’t care about websites. They are on very specific social media channels. And if we want to get fresh, new, young blood, we need to go there and to present what we do in a way that matters to those kids.

[00:27:35] Nathan Wrigley: In terms of success, if you were to, I don’t know, let’s imagine that we could cast our minds forwards five years, let’s go for that. What would you like to have happened with WP Credits? Would you like, for example, to see a bunch of 20 somethings wandering around in an event like this? Does it matter that they’re involved in the community and doing WordPress events and contributing to Core and those kind of things? Or is success just more broadly, people are using WordPress? You know, it’s still a project. What’s your take on, what does success look like in five years?

[00:28:08] Ivana Ćirković: For me, I would like to see more young people involved. Yes, we will always have users because in its core, WordPress is a very useful tool. And I’m happy to stumble upon that tool many, many years ago to use it both personally and professionally. But I really want to see young people involved in a way that we were involved 10, 15 years ago, and to see what can happen with WordPress.

I strongly believe it’ll be transformed, not with AI or all other flashy trends. WordPress has always been about people. And we need new people, we need young people to get it where it needs to be.

We are getting older and don’t have strengths or stamina to do so for how many long years. By having new kids, fresh perspectives, I’m really excited to see what they can come up with next.

[00:29:08] Nathan Wrigley: Yeah, it’s kind of handing over the baton in a way, isn’t it? Seeing what the future holds. Yeah, I definitely have concerns that the age demographic is skewing. And no matter what has happened in the past, I don’t see it being backfilled with younger people moment.

But I think that’s largely because we just assumed that that age demographic would fill itself, because we were excited about it, so the younger generation will be excited about it. Well it turns out the world moved on. And TikTok came along, and YouTube became a massive thing and mobile phones and all the different platforms became a thing. And so the attention was put elsewhere by many young people.

And so I suppose we needed to come up with a system where we are, in a sense, just putting it in front of their face and saying, look, it’s here. You know, you’re a university student, you are somebody looking for work in a small business. Here’s a credible way of getting involved in something which potentially could change your life. That seems like the most credible way of doing it at the moment. And I guess we’ll just have to see what the next five years brings.

In which case, is there anything that you felt you wanted to touch on that you wanted to get out of this chat before we finished?

[00:30:15] Ivana Ćirković: No, I think you did it masterfully. And we touched base on everything that needed to be said.

[00:30:20] Nathan Wrigley: Perfect. In that case, I will say Ivana, thank you for chatting to me today. Fingers crossed that your presentation goes well tomorrow, and that you pack the place out, and that by this time next week, you are extremely busy with the WP Credits program. Thanks for chatting to me.

[00:30:34] Ivana Ćirković: Thank you. Thank you for inviting me.

So on the podcast today we have Ivana Ćirković.

Ivana is a digital marketer with 18 years of experience working both in and out of the tech industry, and currently leads marketing at WPBakery. She’s an active participant in WordPress events, having attended and spoken at numerous local and international WordCamps over the years.

In this episode, our focus is on the WordPress Credits initiative. We learn how this program, launched by the WordPress Foundation, connects students with real-world opportunities to contribute to the WordPress ecosystem, earn certifications, and increase their competitiveness on the job market.

Ivana discusses her own experience as a WP Credits mentor, working with students as they learn about digital marketing, remote work, and open source contributions. We explore how universities can modernise their curriculums and add real-world value for students by participating in the initiative, and how businesses can get involved, not just to support the community, but to help shape and discover future talent.

The program’s evolving structure also gets attention, and we learn how students are guided through hands-on activities such as translation or documentation, and how their progress is tracked publicly via profiles on WordPress.org. Ivana shares the opportunities and challenges for both educators and businesses, with thoughts on accountability, mentorship, and the need to bring new faces into the WordPress community.

If you’re interested in the future of WordPress, education, or bridging the gap between academia and industry, this episode is for you.

Useful links

WordPress Credits

WPBakery

What it (really) means to be a part of the WP Credits program?

💾

I Just Made WORDPRESS Editing SIMPLE (Try It in 1 Click)

💾

I've turned my WordPress Site Editor simplification concept into a real Gutenberg pull request - and you can test it yourself in WordPress Playground with one click.

A few months back I showed this as a concept. You wanted a real PR, not just a demo. So that's what I built.

I take you through the whole thing - a stripped-back sidebar, smarter page creation, a unified editing canvas, better navigation menus, a content types browser, and a first look at the Workspaces concept. Mockups create opinions. Working prototypes create evidence.

👇 Check the PINNED COMMENT for the Playground link and the PR.

---

📋 Site Editor Complexity playlist: https://www.youtube.com/playlist?list=PLrseGPEoB8wM8rlu_J8qTtEW_B7bDK8ja

---

Timestamps

00:00 Introduction
00:54 Demo Start
01:54 Orientation
02:37 Homepage Discoverability
03:31 Configuring Homepage
04:21 Simplified Editor Sidebar Menu
05:27 New Pages screen
06:50 Adding Pages Flow
08:50 Universal Canvas
11:33 Swapping Page Templates
12:21 Managing Posts and Layouts
15:28 Custom Post Types
17:04 Navigation Menus Upgraded!
18:21 Auto Menus (Simplified)
20:46 Adding Menu Items
23:46 Bulk Add Menu Creation
26:12 Design & Identity
27:05 Workspaces
29:24 Customising Editor Sidebar
30:23 Test the Prototype Yourself
32:17 How to provide feedback

#222 – Destiny Kanno, Anand Upadhyay, Maciej Pilarski on How WordPress Education Programs Are Growing

Transcript

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, how WordPress education programs are growing.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today, we are joined by three WordPress Education Initiative leaders, Destiny Kanno, Anand Upadhyay and Maciej Pilarski.

Together, they have spent years at the heart of WordPress training and outreach, working in roles spanning community education management, plugin development, and credit program administration. Their efforts have helped shape student engagement and university partnerships across the globe, introducing thousands of learners to WordPress.

The conversation focused on the current landscape of WordPress education with particular attention to three key initiatives, the WordPress Credits Program, Campus Connect, and Student Clubs.

Each initiative is designed to provide unique entry points for students of all ages and education levels. From high schoolers building their first site in a library to university students earning official credits for open source contributions.

We discussed the different approaches these programmes take. WP Credits ties student work directly to academic credit and mentorship. Campus Connect provides flexible, community driven, events in diverse locations and Student Clubs foster sustainable, peer led, learning within schools and other institutions. We explore how these models feed into each other, building a sustainable ecosystem for ongoing growth in the WordPress community.

We also get into the importance of repeat campus partnerships, the need for scalable facilitator training, and the role of recognition, certificates, badges, and public showcases in keeping students motivated and validated in their journey.

If you’re curious about the growing movement to bring WordPress knowledge to the next generation, or are looking to get involved with education in your local community, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Destiny Kanno, Anand Upadhyay and Maciej Pilarski.

I am joined on the podcast by Destiny Kanno, by Anand Upadhyay and Maciej Pilarski. Hello, one and all. Nice to have you with us.

[00:03:29] Destiny Kanno: Hello. Thank you.

[00:03:30] Anand Upadhyay: Hello.

[00:03:31] Maciej Pilarski: Hello.

[00:03:32] Nathan Wrigley: So a few months ago, back in, I think it was September 2025, I was joined by two of the three participants on the call today. I was joined by Destiny and I was joined by Anand. We were also joined at that point by Isotta, but she’s not on the call today. We’ve obviously got a wonderful replacement, Maciej who’s going to do a fabulous job explaining the bits and pieces here.

But the intention of that episode, which you can find on the WP Tavern website, it’s episode number 183, was to find out about all of the overlapping education initiatives in the WordPress space. And it was born, I think, largely out of a sense of curiosity on my part, but also a somewhat sense of confusion, because there were lots of things which were going on. Some of them seemed to be slightly overlapping. There was a conflict of names in some cases. So that episode was laying out the groundworks of what has been happening in the WordPress space.

When that conversation finished and we’d click the stop record button, I said, that was absolutely fascinating. This seems to be moving at such a rate, wouldn’t it be good to revisit this whole subject in about six months time?

Well, we missed that target, but here we are, maybe eight months later. I think my intuition at that point was correct, because being a close observer of what’s going on in the WordPress community, I think it’s fair to say that the educational space has been somewhat turbocharged during the last eight months.

And so today’s episode, with the help of the three people I’ve just mentioned, is to describe what’s going on, what’s changed, maybe some things that have been mothballed, but certainly a lot of things that are new and interesting and have gained a lot of momentum.

But I think, dear listener, the intention of this episode is to get you involved. Is to get to the end of this episode and for your curiosity to have been turned into action. To have gotten you out of your chair, written an email, turned up to an event, helped organise a thing.

So please have that in the back of your mind. If you’re sitting listening to this in a car, at your desktop, there is actual action that could be taken at the end of this. I think the intention of all four of us on this panel would be dearly for that to happen.

Okay, let’s establish the credentials of the people that we’re going to be talking to today. So we’ll just do a little potted bio of you one at a time. So we’ll begin with Destiny, if you could just tell us a little bit about you, your relationship with education in the WordPress space, I suppose would be apropos.

[00:06:01] Destiny Kanno: Yeah, absolutely. So again, Destiny Kanno. I’m currently working as an education program manager sponsored by Automattic. And I work directly with the Make WordPress Community Team. And I also work adjacently with the training team as well, because education training materials, they go pretty hand in hand. And I’ve been doing this now for about four years and, yeah, it’s just evolved since my original time working on Learn WordPress, and that relaunch that happened, to now, yeah, these wonderful programs that are spreading like wildfire as you said.

[00:06:37] Nathan Wrigley: Fantastic. Thank you so much. Okay, we’ll move over to Anand for the same sort of introductory moment.

[00:06:43] Anand Upadhyay: Yes. So my name is Anand Upadhyay, and I run the WordPress plugin development company, WPVibes. Apart from that, I’m very much involved in the WordPress community and I contribute in multiple ways. It can be documentation, it can be Core, Polyglots. But I’m also keenly involved in the community part, and specifically I can say with the education initiatives, I started with WP Campus Connect in WordPress Campus Connect in 2024. And since then, after that we started joining hands with Destiny and we started evolving this program in a much bigger shape. So that’s it.

[00:07:16] Nathan Wrigley: Okay. Thank you so much. And last, but by no means least, Maciej.

[00:07:20] Maciej Pilarski: Yeah. Thanks for having me. My name is Maciej Pilarski. So I’ve been doing anything related to WordPress pretty much since 2007, so that’s been a while. But the biggest breakthrough for me was 2014 when I actually volunteered to WordCamp Europe in Sovia, Bulgaria. That opened my eyes to the whole community, everything that is happening around WordPress.

And since then, pretty much I’ve been working for multiple companies from the WordPress ecosystem. I joined Automattic in 2016. For many years I’ve been a Happiness Engineer, and since October last year, I’ve joined Isotta as one of the admins of the WordPress Credit program. And since that time, I will have been helping her out to grow that initiative.

And Destiny mentioned, it spreads like fire because at that time we had six universities onboarded, now we are at 21. The 21st, we got it after WordCamp Asia actually through a connection made there. And it’s our first institution from Africa, from Uganda. A huge shout out to Stephen Dumba, who I connected with during the event. And after that, pretty much a week after we signed our first partnership from Africa. So we’re actively growing and getting new institutions on board.

[00:08:42] Nathan Wrigley: Thank you so much. Gosh, there was an awful lot in there, wasn’t there? That was really interesting. We’ll try and unpack quite a lot of that.

Firstly, a sort of slightly personal message from me. I don’t usually reveal much about myself on this podcast. I take the position that I’m a, kind of like an interested party, but don’t really give much of my own thoughts. However, this is different because I cannot think of a more interesting, meaningful, moral, let’s go with that word as well, use of time than educating people. It simply is the most profoundly useful thing to do with your life.

Now, obviously people will have different opinions about that, but the juxtaposition of free open source software, in this case WordPress, and education is a real sweet spot for me. I just think that is such an amazing thing to be involved in, to have going on in the background.

If you think about it, an open source project, like how many open source projects have this level of stuff going on in the education space, this real international footprint. Things going on which we’ll find out about in a minute. It’s really fascinating.

And I am sure that the listenership to this podcast, the vast majority of people listening will never have encountered much of this before. Maybe they’ve seen stuff on Learn because they want to technically learn about WordPress in an online capacity, but we’re going to be delving into real world events affecting real adults, real youngsters.

And so anyway, that’s my little bit at the beginning, just how curious it is that the project is so big that we’ve got this international footprint of education. And so I suppose what we should do right at the beginning is lay out the different initiatives and just name them, and try to figure out how they differ from each other. Just so that we’ve got some kind of awareness.

So I don’t know which one of you wants to take that, but if maybe you take one each or something, I don’t know. If we just want to lay out the, just erect that tent basically so that we know what the initiatives are called, and how they differ from one another. So I’ll open that up. Whoever wants to step in.

[00:10:48] Maciej Pilarski: I can start with the Credits Program. So the Credits Program is based, it’s a contribution based program, internship, initiative by the WordPress Foundation that connects higher education students with the global open source community. So basically it’s an opportunity for the students as part of the educational curriculum to contribute to the WordPress community.

There are two types of courses that the students can do. One of them is 50 hours, the second one is 150 hours. Usually the students do that during a full academic semester. And as part of that, students are first onboarded into the WordPress ecosystem and the wider open source ecosystem where they learn not only about WordPress, but open source as a whole, and how crucial it is for the internet.

Then the second phase is picking the contribution area to which they would like to contribute. All the contributions areas basically are the ones that are listed at make.wordpress.org. So any team that is listed there, students can pick from that area. During that phase, they work on a particular area that they have selected.

And finally, during phase three, they wrap up the whole achievements, the contribution, what they did, they publish a final post. And what is also very important as part of the credit scores, students have also assigned a mentor from the WordPress community that guides them through the whole process. We don’t leave them alone. We connect them with actual mentors from the WordPress community that are vetted by us, that guide them through the whole journey into the contribution and the whole WordPress ecosystem.

So it works on multiple levels. For me, this connection is also special because it builds this bridge between the previous generation of WordPress contributors to the new one where they are introduced and can start working on any fields of contribution.

What is also important is that this is not limited to technical universities. Pretty much any type of university can participate in the program. The first university that we started with was University of Pisa, and it was the humanity studies. So the students from humanity field were the first group who started the Credits Program. There’s room for pretty much anyone from any field.

[00:13:18] Nathan Wrigley: Okay. There’s a lot there. Wow. I’ve just been taking notes and I’ve almost filled an entire A4 page. So WP Credits, the WordPress Credits Program, I guess the name sort of gives it away. The idea here is that you trade time for university or higher education credit. So credit being, I suppose if you were to atomise your three year degree, you might do, I don’t know, 12 modules or something like that. The idea is that one of those modules, perhaps it’s more, becomes something in the WordPress, but also curiously the free open source software space as well. I didn’t actually know that.

The idea is that you link up with real world institutions. So the first one was Pisa, and maybe we can get into which other ones have come along. And in exchange for 50 hours or 150 hours, you will be given that credit, which can then go to the overall awarding of a degree or whatever it is that you are hoping to get.

You’re then linked up with team members, WordPress community team members who will mentor you and shepherd you through this process. And the idea is that it culminates, I think you said in a final post, which I suppose in a sense is a bit like a dissertation or something like that, you sum up all the different bits and pieces. Yeah.

[00:14:29] Maciej Pilarski: Once that happens, the students also receives an official certificate from the WordPress Foundation, signed by Matt himself, that certifies that they completed the course. And what is also important to know, the whole progress through the course and what they did during the course, it’s also stored on the wordpress.org profile. So any contributions that they did, for example, photos that they’ve uploaded, this all will be visible on the wordpress.org profile. And they also receive a special badge dedicated to students who graduated from that program.

So it really gets them started into the WordPress ecosystem, and at the same time creates something like a small portfolio for any future company that would like to, for example, hire them. Because they have a proven history of contributing to the ecosystem.

[00:15:20] Nathan Wrigley: Okay, so that’s an interesting quid pro quo, isn’t it? So the idea is you do all this work, which on the face of it, I suppose looks very philanthropic, you know, you’re giving up your time, but you get a real thing at the back end of it. You get a certificate. You can then presumably apply for jobs and indicate, okay, I’ve done this, I’ve contributed in this meaningful way.

What I think is really interesting there, and it kind of gets lost, I’ve worked in education in the past and I know the red tape that’s involved in doing anything in the education space. There is so much red tape. And I can only imagine what’s happened in the background to enable these kind of things. You know, the back and forth, the tennis of emails that go on and on and the proof that’s required to categorically show that this thing that we are doing is worth something. You know, it’s not just this Mickey Mouse. We use that expression, Mickey Mouse kind of qualification that really, it doesn’t actually require any hard work. It’s just there, nothing really in it, but you get an accreditation anyway.

I can only imagine the hard work that has gone in every single time you touch a new institution, trying to convince them that this is legitimate, that this is real. You’ve just kind of glossed over all of that by just describing what is in existence, not necessarily what has gone on to make it happen. I know that there’s probably more than the three of you involved in this, but my profound thanks for all of that hard work, which presumably is utterly and completely invisible. And I can only imagine what’s going on there. So yeah, thank you for all of that.

[00:16:54] Maciej Pilarski: Thank you for that.

[00:16:54] Nathan Wrigley: So that was WP Credits. So that was one wing of the things that we’re going to discuss today. Should we move on to another one and maybe somebody else wants to take the helm?

[00:17:03] Anand Upadhyay: I think Destiny can take Campus Connect and then I will take Student Clubs.

[00:17:06] Nathan Wrigley: Okay. Destiny, let’s move over to you and see what you can tell us about something different.

[00:17:11] Destiny Kanno: Yeah, so I’d love to tell you more about WordPress Campus Connect. And the way we ended with WordPress Credits, I think is also very critical to the story of Campus Connect because, you know, it started with Campus Connect first, and that’s how organisers such as Anand and Pooja like were able to get those connections with the universities through being boots on the ground, you know, having those relationships. Proving through action that these activities that we’re doing with the students are having real impact and are showing real results.

Slowly building up these kind of case studies in a way has helped open a lot of doors, especially with Campus Connect now, we’ve done a lot of events, especially since we last talked. Like I think this year alone, we’ve already had 22 Campus Connect events. So, like it’s not even half the year and it’s quickly becoming one of the biggest run events, WordPress official series.

But these events are like a way of opening the door, right? Hey, here’s a free learning opportunity for your students. And as you said, like the red tape is there. A lot of institutions are like, wait, so what’s in it for you? Why is, there’s a little bit of dubiousness sometimes in the reaction, right? You’re going to give your time to educate our students, why? But once they see, it’s like, no, we really are just passionate about spreading WordPress, showing students what’s capable with their website, how it applies to different skillsets as well. Like it’s not just for coders, it is for marketers, it is for designers.

You know, there’s so many career opportunities that once we just get the foot in the door and we’re able to showcase that, a lot of institutions are like, okay, now I get it. I do want to highlight in Anand’s case, like they’re going to have their third WordPress Campus Connect in Ajmer this year. You’ve got repeat institutions. I’ve heard you also have institutions that are like, when are you going to come to our place and teach WordPress? You know, once the fire is lit and people see how bright and shiny it is, like people want to get involved.

But as you said, like getting it to click for people, that is like the most difficult part. And I’ll give an example of, right now in Japan, we had our first WordPress Campus Connect event on the 9th of May. So I’m like, woo hoo. Like it finally happened. But we have this community in Japan that is like very passionate, very active. So when I first was like introducing the concept of Campus Connect, people were like, okay, but like how do we do this? What’s it about? It takes like a lot of presentations, a lot of going to people in person and talking. Helping them even shape the conversation that they’re going to have with the institution to sell this amazing gift of WordPress on their campus.

And after this one on the ninth, like now we have a case study in Japan that others can now use to be a starting point for those conversations going forward. So I think, once you have that one step, the gate just slowly opens until it’s just, the doors bang open in each way. But yeah, we’ve seen really great success with Campus Connect and it’s just like honestly, it just keeps growing.

[00:20:30] Nathan Wrigley: Can I just ask a quick question? So I just want to draw a very clear line for everybody that’s listening to this, what the difference may be between Campus Connect and WP Credits. Because from the description that we’ve had so far, it may be that you’ve fallen into the trap of thinking, well, they sound like they might be the same thing. So could you just, Destiny, just tease out where Campus Connect differs? Maybe in the nature of the event, the timing of the event, the availability, the age group, those kind of things that separate WP Credits from the Campus Connect initiative.

[00:21:02] Destiny Kanno: Yeah. Thank you, that’s like a really great distinction to make. So whereas WordPress Credits is geared toward higher education, Campus Connect is geared toward, honestly any level of students as long as they’re able to browse the web safely, and enjoy and participate.

So that means, Elementary school students now are pretty good at devices. High school students, college students, vocational students. We honestly kept the door pretty open in terms of what a campus means. We’ve even had a Campus Connect event in Uganda in a library, the Lira Public Library because students were able to go there right?

We were trying to make it as barrier free for students wherever their campus is. And so that’s, I think, the main difference. It’s more wide ranging in terms of who can participate as a student. And then also the fact that it could be a one-off event, so a one day event. A lot nowadays are multiple day events, they’ll maybe go two times out of a month, or a couple days consecutively. And then after that it’s up to really the organisers in the institution whether or not we have another addition on their campus the same year, or the next year.

[00:22:15] Nathan Wrigley: I’m going to tease out a few things. I just want to point out to, me as an English person, that is to say, not an English speaker, but somebody from England, campus has a really defined definition, and it’s usually bound to a university. Whereas it sounds like the description here, campus literally means the place where education happens, not it’s 18 years old and older, you know, people doing degrees, bachelors and PhDs and that kind of thing. Basically, if there’s an institution somewhere, that’s what the campus is in this case. Okay.

So the WP Credits program sounds like you forge your relationship with the university, and correct me if I’m wrong, it sounds like it takes place inside that institution, and it’s part of that program and what have you.

The Campus Connect initiative is much more ad hoc. It could be a one-off, it could be monthly, it could be inside a library, it could be inside the school, it could be an inside an institution. It feels a bit more like, I don’t know, a WordPress Meetup, but geared towards a younger audience or something like that.

And the minimum age requirement is really driven by your capacity to type on a keyboard and hold a mouse and those kind of things. And that’s kind of curious to me because I think my educational experience was always younger children. It’s really interesting how patterns are laid down at a very, very early age. Patterns that go on into much later life get laid down, typically at incredibly young ages. So this is fascinating for digging into that.

And it’s not just about, say, the code, it sounds like code is on the menu, but it could be about marketing, it could be about design. Basically the gamut of anything online, CMSy, those kind of things. Okay, is there anything you want to add? Did I misunderstand anything there, or misstate anything there?

[00:24:02] Destiny Kanno: No, I think you’re completely right. We’re trying to convey that WordPress isn’t just a blogging software that I think is still a lot of people have a mentality of. Like there are many ways to utilise it that goes beyond that.

And one thing I did want to add are a couple numbers. So since WordPress Campus Connect became official in May of 2025, an official WordPress event series, I should say, we’ve had 42 completed events, with 71 participating institutions, and over 5,500 students have been reached.

[00:24:37] Nathan Wrigley: That’s something else. 42 events, 71 institutions, and I think you said five and a half thousand individuals. Good grief. I don’t know what the measure of success is for this, but that feels like success to me.

I mean, imagine turning up to a WordCamp, like a flagship WordCamp and five and a half thousand people descending on you. You’d feel slightly overwhelmed. That’s a lot, isn’t it? Gosh, that’s pretty remarkable. Wow. Congratulations.

[00:25:05] Destiny Kanno: And the majority, the outcome, the students make a website. So we could almost count those students as also new WordPress websites that are live now on the web. So within a year, organisers around the world have been able to make that happen.

[00:25:19] Nathan Wrigley: Could I just perhaps draw another distinction as well, just very quickly, because it sounds like the WordPress Credit system, because it’s binding itself to institutions, it sounds like there might be more paperwork going on there, and maybe more high level meetings that need to take place. Whereas Campus Connect feels much more community driven. It’s the kind of thing that, quite literally, anybody listening to this podcast with a fair wind could have one of those going in a handful of months. If they’ve got the right initiative and they can find the audience for that.

Again, is that about right? There’s sort of more opportunity to become involved with the Campus Connect initiatives. You don’t need to have that academic background or have a point of contact at a university. You basically just need a building, some interest and a bunch of students.

[00:26:02] Destiny Kanno: Yeah, the key thing is, you know, having a real connection to the campus that you’re going to present at. But you’re exactly right. We tried really hard to lower the barrier to organise these events. Because I don’t know if you’ve organised a WordPress event before, there’s kind of a lot of hoops you have to jump through. And we’re like, okay, how can we think about this in a different way?

And I think that also has positive repercussions for how we organise other events too, that are, changes are being thought about too so that we can enable people and empower them to put these events, instead of bogging them down and process and a little bit of bureaucracy to say.

[00:26:38] Nathan Wrigley: So what’s really curious about that as well is we’re all in different parts of the world, aren’t we? People on the call today are in Japan and I’m in Europe and, Anand, are you in India? I think.

[00:26:47] Anand Upadhyay: Yeah.

[00:26:47] Nathan Wrigley: Yeah. Each of those events, I guess would look quite different. The kind of nature of the attendees, the nature of the kind of building it might be in, the institution. And it really is, you just grab what’s around you I suppose, and work with that. If you’ve got a connection to an institution, you can go for it. Maciej, I feel like I crosstalked you. I think you wanted to say quite a few times and I’ve just interrupted. I’m very sorry.

[00:27:08] Maciej Pilarski: No worries about that. So I wanted to add that those initiatives set backgrounds for each other. Because in some uni institutions, the interest sparks with a Campus Connect event, and that gets the institution interested in those initiatives, which sets background for WordCamp Credit.

And it happens also the other way around, where we start with an institution that starts credits and then we get the students interested in WordPress in general, the community, which leads to a Campus Connect event during the Credits Program. What is important is that those initiatives don’t compete with each other. They support each other.

[00:27:51] Nathan Wrigley: Right, so there’s a lovely virtuous cycle there, isn’t there? Where the two things can be going on in harmony, one promoting the other and they’re definitely not in competition. Okay. That’s really interesting.

One final question on Campus Connect, and I’ll direct this at Destiny, just because she’s been handling that. With the WP Credits thing, there is this moment where you hold the certificate in your hand and you go, yay, did it.

Is the same thing true of Campus Connect or is it more of a show up to the one event, you know that you did that, that was great, you can file that away in your own head as a thing? Or is there some sort of accreditation, or certificate giving, or badge giving, or profile updating that might go on on wordpress.org? Is there any sort of thing that the attendees receive, and I suppose that the people that are organising might receive as well?

[00:28:37] Destiny Kanno: Yes. So we do have a certificate of participation that students can receive signed by WordPress Foundation Executive Director, Mary Hubbard. And that just needs to be requested by the organisers ahead of time, because we need to get the signature and all that. So yes, they can come away with that. And we’ve heard really positive things about that, like it motivates them. They’re like, yeah, I did something, which they did.

[00:29:01] Nathan Wrigley: There we go. That was WP Credits and WP Campus Connect.

Can I just say at this point, dear listener, if at this point you’re thinking hang on a minute, there’s a lot going on here, don’t worry, there’ll be show notes. If you go to the WP Tavern website, there’ll be show notes. I’ll try to list out as many sensible links to get you to the root of each one of these initiatives, so that you can begin your journey and fan out from there.

I’m not sure what episode number this will be, but if you just go and search for, oh, I don’t know, Destiny or Anand or Maciej, you could probably find the episode that way. And all the show notes will contain all of the links.

Right, in which case, I think it might be Anand’s turn. What have you decided to take on Anand?

[00:29:39] Anand Upadhyay: So I will be sharing my thoughts on the third part of this whole education initiative ecosystem. So that is a Student Club. Just a few minutes before you were giving the analogue of meetup with this Campus Connect. So I would like to share the same analogue with us because we are more accustomed with like other terms of WordCamps and Meetups and contributer days.

WordPress Campus Connect is kind of like a WordCamp happening in the campus, because it’s like a big day event that holds everything happening, different kind of sessions, maybe workshops happening. So I would compare it with that thing.

And same way, credits thing, Credit Program is kind of like ongoing contribution series because more focused on the contribution part because the student devote 150 hours of their program. A lot of period goes to the contribution.

And now the same way we, if we talk about the Student club, it’s similar to like the Meetups that we have. But these are the in campus meetups for the students and by the students. How do things get started? Like the Campus Connect introduce the WordPress to those campuses and to those students, but since most of the campus, it’s a once in a year event. So once this event has sparked something about the WordPress in the students. So keeping that momentum going on, that’s where the Student Clubs come in.

So with the Student Club, it’s kind of like, as I mentioned, it’s like an in campus meet program. So a student can gather themselves, they can form a club and a couple of students can be nominated as club organisers, student club organiser from their campus. And then they organise the in-campus events, maybe like once in a month or twice a month, depending on academic calendar. There are a lot of hurdles in doing those things continuously.

But they usually do once or twice a month. They do a kind of a meetup in their campus. The students gathered together. They learn from variable resources available from WordPress. And from those resources, they share with the other students. It’s kind of a group learning, group study, that we use. Education live, we always do that. It’s kind of a group study. They’re learning from themselves. If someone has learned something, they are helping others to learn those things.

So I would just like to give some of the examples from my city. There are multiple Student Clubs are going on. When we went to the campus, we just taught like a small group of students about the WordPress, because we’d have some limitations of the resources, of the setting arrangement. We cannot call all the students of the campus and, okay, come together and I have a amazing workshop. So we have given the WordPress walk through to the limited number of students.

After that, they form a Student Club in their campus because they got very much interested. Then the first session they did was like, they started teaching to their juniors, like the students who have just entered the campus. They took a session for them. So they told, whatever we have told them, they have taught the same thing to the juniors.

After that, in the next few session, they experimented different things. Like in some session they’re just doing a fun quiz around WordPress. And in some sessions they are doing a kind of like a, I would say like a hackathon kind of thing. So they are just picking up a website. Or you can, just similar to the speed build challenge that Jamie do. So they have just one website open on the screen and everybody’s like cloning that website.

So there are different ways students are engaging through those student clubs. So it is helping to keep the momentum going on so that the student keep learning about WordPress and they are also connecting with the community members for the guidance about how they can learn more. What should they learn next if they are sharing their experience. Like we have covered these things and, what should we go next?

And in the recent WordCamp Asia, they’re also one of the Student Club lead from my city. She joined the event and there are conversation with the, like other community members who has offered them like, okay, we can come to your campus, or we can do, have a webinar for your campus where we can teach you particular subjects, particular topics. Maybe they can talk about SEO, maybe they can talk about plugin development.

So this is also opening the horizon for them, to learn from people across the world. So that is how the Student Clubs are happening. The examples I’ve gave, again, from my own city because I’m closely mentoring them, but there’s similar things are happening across the world.

So it is helping to create a kind of sustainable environment for the long-term sustainable environment in the campus. So the next time when we go to that campus, we are not going to teach like the basics of WordPress, because we want like, the ecosystem should be built within the campus, so every student know about the WordPress. Because last time when we went to the campus, we have to tell everything about WordPress because why you should learn WordPress.

So the Student Clubs, my ambition is that, wherever the Student Club is from, next time a Campus Connect event is happening, next time we should not tell them about what is WordPress and why they should learn this thing. There should be already a sustainable ecosystem.

And I feel that all these three programs are like very much interconnected. And the real impact of these programs, we will be able to see in the next two or three years. And there will be a regular ongoing activities around WordPress in the campus.

And these are also kind of a balance program as well. Like the Campus Connect is introducing WordPress to the students, Credits Program is motivating them more towards like the contribution part. And I would say that Student Clubs is more inclined towards getting new users to the WordPress. Because if we keep on focusing on the contribution, contribution, but if we discard the like increasing the number of new users, so we are not going to win. We need a balanced state.

The Student Club is trying to, learning how to build website, how to mastering the skills of the WordPress. And later on, many of them are going to join the contribution part as well.

So this whole ecosystem is built around bringing more people to the contribution, bringing more people to use WordPress, build websites, as in, for the individuals as a business as well. So that’s how all these three programrs are very much interconnected, and growing together fast.

[00:35:16] Nathan Wrigley: It feels like, of the three things that we’ve talked about, so WP Credits, Campus Connect, the Student Club, this final one that you’ve just covered, it feels like that’s got a very flat hierarchy to it. In other words, there’s like this peer learning. So it feels like more or less anybody can show up and demonstrate anything, which might then lead to somebody else thinking, okay, that was interesting, I’ll take on next month’s one because I’ve now seen that’s doable. Less hierarchy, if you know what I mean? So a much more flat structure.

[00:35:45] Anand Upadhyay: Because when we started Campus Connect, we also get a lot of attraction in the local community as well. And people join our Meetup groups. But then it becomes difficult for us, how to plan about the topics for our meetup. We have some experienced professionals coming in. We have some students coming in, and we plan the topics that suits the professionals. The student will feel like, okay, what’s they’re talking, we are not getting anything in our mind. If we bring the topics, very basic topics and the professionals who are joining the community meetups, they’ll feel like, okay, these are very basic stuff, why am I coming here?

Student Clubs giving them their own platform, giving them a own opportunity. Okay, these are all the familiar faces. It is also giving the opportunity to come on the stage, come onto the stage and get out of your fear as well. It is also generating leadership qualities in them. Okay, we have to keep this momentum going on and we have to keep the activities going on. So there are a lot of ways, apart from learning WordPress, there are a lot of other ways it is helping the students as well.

[00:36:40] Nathan Wrigley: When you have to stand up in front of a bunch of people and deliver something, obviously there’s a whole bunch of us that are just really confident at doing that, quite happy to stand up and do that kind of thing off the bat. But equally, there’s people for whom that is just the most terrifying experience possible. You know, standing up in front of two or three people, oh boy, you know, anything above that is just off the books.

And I was just wondering about that, whether or not there’s, in this particular style of event, the Student Club, whether there is a growing corpus of, I don’t know, previously done topics or topic suggestions or slide decks or anything like that, which might enable people to feel that level of confidence? I don’t know if that’s something which is being put together. Just resources which enable somebody who doesn’t have the confidence, let’s go with that word, who then may gain that confidence. And I’m going to pass this to Destiny because she’s waving her hand.

[00:37:30] Destiny Kanno: I was really hoping I could shamelessly plug this project. This is like, you’ve said the most opportune thing. So I’m actually developing right now what I’m like tentatively calling the Meetup Activity Library. It comes with like kits on certain topics. So for example, WordPress Playground was the first one I built. But it comes with the facilitation guide, which is a doc. So the facilitator can read through, understand the steps they’re going to go through in the activity, how to pace it. And then a presentation deck which they would display, if that’s available to them, to the folks that they’re presenting to. And it’s a hands-on activity only. So it’s not only presentation. The facilitator of course guides and talks them through things, but then people are getting hands-on experience with that topic along the way.

[00:38:16] Nathan Wrigley: That is a beautiful remover of barriers, because I think just having that little document, that little crutch, you don’t have to feel that you, okay, I’ve got to come up with a topic. Not only have I got to come up with a topic, but then I’ve got to research the topic, deliver the topic. If you can have it all on a thing that you can crib from, I don’t know, it just arms you with that confidence as you walk in. I think that’s such a brilliant topic. And, Maciej.

[00:38:40] Maciej Pilarski: Both Destiny and Anand mentioned two keywords, sustainability and facilitator. The goal of also getting all those educational initiatives going is also create in a sustainable way. We’re not pushing for numbers, but growing them in a smart way where we don’t get too many students so we get overwhelmed. We need to have enough mentors to accommodate those students, and also enough facilitators to be able to scale the program, to grow it in the future.

And it’s exactly what Destiny is now doing, the Facilitator Training Program, which gets more people from the educational sectors, community organisers, everyone on board, to jump on those educational initiatives and help us to grow. Because the number of every, all those students involved in participating in those programs is increasing and we need to be able to accommodate them. And through the Facilitator Training Program, this allows us to do that.

[00:39:42] Nathan Wrigley: It’s so interesting in open source software spaces as opposed to corporate spaces. I suppose the metric of success for anything like this in the corporate universe would be how many people showed up and gave us money in exchange for this knowledge or, you know, something akin to that. Basically a metric of humans in a room and money gained. And of course, the measurement of this is so not that.

I did wonder, Destiny obviously very proudly rattled off the statistics for Campus Connect, you know, the five and a half thousand attendees and all of that. I wondered if there were success criteria of some kind in the background, which guide you. You know, it’s not like, okay, well we didn’t meet that we’re going to abandon it all. But more, things like you would like to see happen, so aspirational goals. It sounds from what Maciej was saying that maybe the attendance growing slowly over time is some kind of measure of success. Maybe there is none of that, but I’ll just open that one up to see if you want to take that.

[00:40:38] Destiny Kanno: I think one definite measure of success is repeat events on certain campuses. So if the campus is saying, we love that, please come back, or please come again soon. I think that is a really great indicator that, not only did the students get something great out of it, but the school believes in it. And that’s what we want to do. We want to create these systems that, not only bring people into WordPress, but also continue this cycle of, you know, growth within the community, but also ownership by the institution.

Another measurement of success is the institution is like, okay, great, how do we learn how to do that ourselves? So we have some folks now working in the institution that are organising WordPress Campus Connect events that are helping facilitate these Student Clubs. So the faculty and educators themselves, they’re directly getting involved. And that for us as community members too, whose volunteer time is quite limited, as Maciej was saying, like it is a great multiplier that makes everything much more sustainable.

[00:41:45] Maciej Pilarski: So from the WordPress Credits perspective, we don’t hope all the students to turn into contributors. That would be amazing but that might not happen. I can share with you some numbers. So currently we have 450 students globally enrolled. For the whole program so far, 75 graduates.

We hope that some or as many as possible of those graduates who completed the program will stay and become active contributors to the WordPress community, stay engaged.

That’s one of the goals we are aiming for the Credits Program, to not just get this done, but this is building the next generation of contributors. We know that like we are ageing, we’re getting older every year. We are not getting younger, unfortunately. Getting those students staying in the community allows us to build those next generations of WordPress contributors that will also have completely different perspectives to how the community functions, how it was built.

What brought us here might not move us forward. So these new students will bring us this new, fresh perspective of how they would like the community to function and move it to the future, to be current, to stay up to date with what’s happening globally.

[00:43:00] Anand Upadhyay: That’s why it’s very difficult to like measure the impact in numbers because how it is impacting in the longer term. But yeah, it’s going to impact. And I would say also, like Destiny mentioned, one of the metrics is like this campus is willing to have the Campus Connect again and again in the campus.

So I just want to share one more. Like I just recently got a call from one of the faculty coordinators from one of the campus where we have a Student Club. And now they have like two months of vacations. And he called me like, okay, now the vacations are going on, students will not be here, so what can we do for the students to keep their involvement with the WordPress in those two months? So can we do something online? Can we do something like this?

When we get these calls, these kind of communications, that these are interactions that we have, this gives us a sense of like accomplishment. Okay, yeah, we were able to create some kind of interest in the students. Because we cannot expect that if we are going to like any campus and 100 or 200 students are participating in our Campus Connect, they are all going to jump into the WordPress. They are getting a lot of different kind of opportunities as well.

There are other technologies as well, which are, some students are going into that, some students are going into that. But we are showcasing the WordPress as one of the career opportunities. And they have a choice of multiple options, so they will choose what they do. But yeah, the impact will be seen in the next few years. Just like Maciej said, mentioned that he went to the WordCamp as a volunteer and it’s bring him into the community.

And the same is with me. I attended the WordCamp and just after coming out of the WordCamp, I started the Meetup group in my city. So I got inspired from that. So that is a result of that WordCamp. And that cannot be measured in the numbers. That can only be sensed when we are doing this kind of conversation. Okay, that WordCamp helped me, that WordCamp helped me.

The same way in future, these students who will join the community or the WordPress industry, they will be talking about, okay, I got first introduced about WordPress through a WordPress Campus Connect event or I got introduced to the contribution through WP Credits Program. So when these conversation will be happening in the future, then we will say that those are the real metrics that we are looking for.

[00:45:00] Nathan Wrigley: That’s really interesting, and I like that. It sounds like there’s not so much a focus on statistics, you know, literal, brutal numbers, more kind of playing it forwards and measuring the impact over many years, not, you know, a handful of months into the future.

[00:45:15] Destiny Kanno: So yes, we’re not like, okay, here’s our KPIs, you know, and here’s our hard metrics. But one thing I really noticed that our community is, it could be better at doing, is just talking about what happened. Because then you hear all these success stories and there are numbers in that. So like for example, Ajmer again, Women’s Day event this year. 50% of tickets sold were to students. And that’s directly because of the involvement in going to these campuses and teaching WordPress. And I’m like, that’s amazing, that’s direct injection of 50% youth into the WordPress community.

[00:45:52] Anand Upadhyay: And they sold out so fast.

[00:45:53] Destiny Kanno: And they sold out really fast, yeah.

[00:45:55] Anand Upadhyay: The organisers were hoping like, now we have to pitch out to sale our tickets. And they have planned a social media campaign around that. Okay, we will be periodically pitch a student on the social media to encourage the ticket purchase. And within one day, we sold out. And the whole social media campaign was like their whole planning was gone. We don’t have tickets.

[00:46:14] Nathan Wrigley: It’s really interesting that there’s all this success going on, and yet, as Destiny said, it is hard to get that discovered. Maybe it’s a case of shouting louder about the previous success. Maybe things like this podcast will help in some small way for things like that.

But I know what you mean. There’s a lot of people talking about the code, and there’s a lot of people talking about the plugins and the themes and whether or not we’re going to get collaborative editing in version 7 or 7.1. All of that seems to suck up all of the oxygen in the room. And yet, without a throughput of, let’s go for young adults, coming into the WordPress space, there’s not really a great deal of hope for a project over decades unless we get people of a much younger age beginning now. And I’ll just hand the torch to Maciej because I think he’s got something to add.

[00:47:05] Maciej Pilarski: But this is also changing because at WordCamp Asia, we were able to introduce the educational table during the contributor day. And I’m also organiser of WordCamp Europe that’s going to happen really soon in two, three weeks, beginning of June. And during WordCamp Europe, we will also have a contributor table, dedicated to education, but for the first time also educational track.

During the second day, we will start the whole day with topics related to education. We will have a discussion panel rethinking learning in WordPress that Mary will be participating. And later in that afternoon, we will have actual students, who take part in the program. Sharing the experience, presenting the results. Not only students from universities, but I’m also leading a group of high school students who’ve been working for the whole past semester with a teacher on some projects related to WordPress building websites. So they are super eager and excited to show them.

We will also showcase some students, teachers stories, how both of those sites motivated each other, learn from each other, and basically help us keep growing the community.

So WordCamp Europe definitely will feature some of those things. And we’re slowly introducing more and more those things into those flagship events and into the broader community.

[00:48:28] Nathan Wrigley: Really nice. Yeah, that’s really nice to hear. I think it’s a difficult circle to square, the idea of making this stuff visible so that everybody’s aware of it. Even if they’re only interested in running their agency, or writing code or whatever it is. Maybe to realise that this is some version of the underpinnings of the WordPress community without which the software ultimately doesn’t exist.

And it is quite curious. I don’t know if I’m reading between the lines here, I think I’m not, but I get the impression that, I’m going to use the phrase like, I don’t know, from higher up, let’s put it that way. It feels like education is taking a more central place. It feels like for example, Mary Hubbard, it feels like you’ve got a real advocate there. Again, I could be reading between the lines, but it feels like the words coming out of her mouth, I hear the word education coming out of her mouth quite a lot when she’s on stage.

So it feels like you’ve got some big hitters, let’s go with that. I don’t know if you’ve got anything you want to add to that, but it feels like the importance of this is more profound this year than it was a few years ago.

[00:49:33] Maciej Pilarski: You are correct. Mary is a big supporter of that and she also created this space for us to grow those initiatives that like allows us to grow that. Isotta started the first Credits Program at the Pisa University as an experiment. And from there it was proven that this actually works. It gets us universities and new contributors.

And then on the other side, there was those Campus Connect events that also organically grew up on their own. So basically there was a need. It feels like there was this hive mind somehow that worked also for all of us. All of us felt this need to introduce those things. It looks like we’ve reached a certain growth level for the community that we organically felt that that’s the direction that we should start heading.

[00:50:24] Nathan Wrigley: Yeah. What’s interesting there as well is that it very much overlaps with maybe a concern. So we’ve touched on this at various points without saying it out loud quite. If you go to, and I’m going to exclude WordCamp Asia 2026 from what I’m about to say, because that event was very different. If you go to a typical WordCamp, the age skews, and I’m doing air quotes, older. You don’t typically look around and see a bunch of teenagers.

So that’s a concern. There’s this, like a pyramid, like a reverse pyramid, and if we don’t get the younger people coming up, the edifice of this entire project kind of becomes a lot more shaky. And we’ve lived through 22 plus years of WordPress, and I think quite a lot of those people began, a lot of the people who’ve been involved in the community began their careers using WordPress and they’ve kind of moved through WordPress as it’s evolved over those 22 years.

And not to, I don’t know quite how to say this. At some point they’re going to stop contributing. Their age will become something, you know, they want to retire or they want to move on or do some other things. Unless we build the scaffolding and put things in place so that young people feel they’ve got a place here, feel that, I don’t know, some proprietary system is not the way they want to go, they want to support the ethic of open source.

Unless these building blocks, these educational building blocks are put in place, then that’s going to be a bit of a concern. So to your point, Maciej, it organically grew. And what a nice thing that it did kind of organically grow because it’s sorely needed at the same time. There isn’t really a question in there. But anyway, there’s my observation. Anand, did you have something to say? I think you did.

[00:52:04] Anand Upadhyay: Yeah. So just want to add that thing you have raised recently. So the way that we want to teach the students about the open source as well, because if you go to the WP Credit curriculum, so the initial lessons, they learn through the, given to them to learn from the learn.wordpress. So it’s all about like open source ethics, and how the WordPress community, WordPress project works.

So this opens up their mind about the open source. Because in the education system, it is something that is not clearly mentioned. There are simple, just simple definitions around the open source. But open source is much more than those definitions.

And especially the open source community like WordPress. It’s more about the people. So the students also learn about how the community is working, how the people are working from the different time zones, people are joining hands for running the bigger events like WordCamp Asia or these Credits Programs. The students will learn all those things as well, and I’m sure when they will join as a contributor in the future, they will have lot of experience before joining as well.

[00:53:02] Nathan Wrigley: Thank you. I love that expression, by the way. You just dropped it in in the middle of a sentence there. You said people are joining hands. What a perfect summation of the entire enterprise being discussed today. Maciej, you raised your hand.

[00:53:14] Maciej Pilarski: Yeah, and besides the community goals and keeping it going, I have also a very personal goal that also is behind all of those things that I do. From my own experience, I had a pretty difficult and bumpy educational path, let’s call it. Unlocking those possibilities for those students, helping them out, making it easier for them, it’s one of my very personal goals, because I know it does not need to be very difficult or crazy when you study, especially when you are young. You’re not sure fully which direction you would like to go. So creating for them, one of those opportunities that might click for them is also something very personal and close to my heart. Because not everyone needs to struggle or have like difficulties, so.

[00:53:58] Nathan Wrigley: I am so glad you said that because that encapsulates all of it. That’s the entire point. It’s got to be that, right? So we’ve spent a long time talking about the minutiae of this, that, and the other thing. It all goes, like they’re spokes on a wheel. And the whole point is that little bit in the middle, which is the child, the adult, the human being somewhere who just wants to make use, wants to grow, wants to learn things, wants to figure things out.

With open source, with this kind of learning, there is potentially zero impediment, or at least very few impediments to actually get that learning underway. And so I think maybe we lost sight of that in this conversation a little bit. So I’m glad that you grounded it there, Maciej, right towards the end. That’s perfect. Destiny, was there anything you wanted to say? I don’t know if you were indicating that you did.

[00:54:48] Destiny Kanno: I know we’re like probably over time, but there’s still so much to share. Like even thinking about keeping WordPress relevant, right? For us and then also for youth. I think about the new AI Leaders Credential that was announced and is being worked on. And how tying WordPress to AI is like really helping students engage more, and see like the relevancy of it in a different way. Not even for the students, like for me, that’s challenging me and I think other organisers and learners of WordPress to be adaptable and think about WordPress differently in a new way of this year as AI keeps advancing.

And then you were also talking about wins, right? How do we celebrate that? I did want to surface, we have the Education Buzz Report, which goes out every month, which aims to try to surface all of these educational wins that are happening in the community. And I just have received some further collaboration from marketing to hopefully also broadcast that on our socials going forward so that we do get the word out.

And lastly, like celebrating the students too. There was a post that went out about the Student Clubs and the success. And we just want to make sure that in this, that they feel seen, right? And that this feels like a space for them. And I know WordPress Credits, we’re working on something to showcase, no, something went out recently. A post went out recently to showcase some of the successes of the students. And we just want to keep highlighting that as well. Because their work and the way they operate, especially because they’re coming in with different lenses, is really important to showcase and highlight and make sure that they feel like they deserve that.

[00:56:26] Nathan Wrigley: Yeah, there was a post, I’ll try and link to it. I think it was like a week ago about the Student Clubs. There were three or four images, three or four photos and there were so many smiling faces in those pictures. It was absolutely lovely. Lots of people gathered in classrooms. I couldn’t exactly tell where, but it was just so nice seeing people kind of enjoying WordPress, having a nice time, bit of camaraderie, hanging out with each other, learning things. It was absolutely wonderful.

Unfortunately, I think time might have got the better of us. Hopefully, dear listener, what you’ve gained is an understanding that there’s so many layers to this educational initiative. It doesn’t appear to be in any way standing still. It’s growing. It’s interesting. There’s a lot going on, and you can be involved.

I will put links in the show notes to any of the places where I feel you would be best making a start with that. Maybe the contributors to this panel can drop some things, you know, if they’ve got a particular link. So again, wptavern.com. If you want to go over there, we will look for the links.

This giant edifice that you maybe know nothing about, and maybe at the end of this episode, some parts of you is tuned in and thinking, I would like to be involved in that. And the truth is, you can be. It’s all available to you to get involved and you could start today.

So there we go. With that said, I’m just going to say a great big thank you to Destiny, to Anand, and to Maciej. It kinds of feels like we need to come back. Let’s do it again in six months or so, and we’ll see where we’re at. Oh, I’ve got a lot of nodding faces. That’s nice. So maybe we’ll revisit this in a few months time.

But seriously, from the bottom of my heart, Destiny, Anand and Maciej, profound respect to you and all of the different things that you are doing. Thank you so much for chatting to me today.

[00:58:13] Anand Upadhyay: Thank you.

[00:58:13] Maciej Pilarski: Thank you.

[00:58:14] Destiny Kanno: Thank you.

On the podcast today we’re joined by three WordPress education initiative leaders, Destiny Kanno, Anand Upadhyay and Maciej Pilarski.

Together, they have spent years at the heart of WordPress training and outreach, working in roles spanning community education management, plugin development, and credit program administration. Their efforts have helped shape student engagement and university partnerships across the globe, introducing thousands of learners to WordPress. You can see their bios further down.

The conversation focused on the current landscape of WordPress education, with particular attention to three key initiatives: the WordPress Credits Program, Campus Connect, and Student Clubs. Each initiative is designed to provide unique entry points for students of all ages and education levels, from high schoolers building their first site in a library, to university students earning official credits for open source contributions.

We discussed the different approaches these programs take: WP Credits ties student work directly to academic credit and mentorship, Campus Connect provides flexible, community-driven events in diverse locations, and Student Clubs foster sustainable, peer-led learning within schools and other institutions. We explored how these models feed into each other, building a sustainable ecosystem for ongoing growth in the WordPress community.

We also got into the importance of repeat campus partnerships, the need for scalable facilitator training, and the role of recognition: certificates, badges, and public showcases, in keeping students motivated and validated in their journey.

If you’re curious about the growing movement to bring WordPress knowledge to the next generation, or are looking to get involved with education in your local community, this episode is for you.

Useful links

Previous episode of the podcast related to this episode:
#183 – Destiny Kanno, Isotta Peira and Anand Upadhyay on how WordPress is shaping the future of education for students worldwide

WordPress Community Team

Welcome to WordPress Campus Connect

Stephen Dumba’s WordPress.org profile

WordPress Credits: Contribution Program for Students

WordPress Student Clubs

WordPress Campus Connect in Ajmer

Peer Review Needed: Hands-On WordPress Meetup Activity Library

Introducing the WordPress Facilitator Training Program

Piloting the AI Leaders Micro-Credential

Monthly Education Buzz Report – May 2026

Learn WordPress

WordPress Student Clubs Build Momentum

Links provided by the guests

Guest bios:

Destiny Kanno

Destiny Fox Kanno, sponsored contributor acting as a Community Education Programs Manager at Automattic. Destiny works closely with the Community team and Training Team, with a focus on growing, enabling and amplifying WordPress Campus Connect, Student Club, WordPress Credits and other education initiatives.

Anand Upadhyay

Anand Upadhyay is a long-time WordPress contributor and community advocate based in Ajmer, India. Active in the ecosystem since 2010, he has contributed to several Make WordPress teams including Core, Docs, Community, and Polyglots, with a strong focus on empowering others to get involved. He is the founder of WPVibes, a WordPress plugin development company that builds performance-driven tools for WordPress and WooCommerce users.

Anand is also a regular WordCamp speaker, Meetup organiser, and someone deeply committed to bringing WordPress education to students. In 2024, he launched the first WordPress Campus Connect event, which went on to become a global program officially recognised by the WordPress Foundation. Anand continues to support and mentor student communities through events, workshops, and open-source advocacy.

Maciej Pilarski

Maciej Pilarski is a Community Wrangler at Automattic, where he works on WordPress.org with a focus on educational initiatives that connect the next generation of contributors to the global WordPress community.

As one of the admins behind the WordPress Credits Program, Maciej works with universities across Central & Eastern Europe and Asia to bring students into open source contribution, pairing them with mentors, building institutional partnerships, and helping turn academic coursework into real-world impact on software used by 43% of the web.

Originally from Poland and now based in Okinawa, Japan, Maciej brings a uniquely cross-cultural perspective to community building, bridging local ecosystems in places like Kraków, Riga, Tallinn, and Tokyo with the wider WordPress world. He’s passionate about making open source contribution more accessible and making sure the WordPress community reflects the full diversity of the people who use it.

💾

#221 – Rahul Bansal on Using AI Everywhere at rtCamp

Transcript

Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case using AI everywhere at rtCamp.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you or your idea featured on the show. Head to wptavern.com/contact/jukebox? And use the form there.

So on the podcast today we have Rahul Bansal. Rahul has a long and accomplished history in the WordPress ecosystem. As the founder and CEO of rtCamp, a company he started 17 years ago, he’s led his agency through the rapidly changing landscape of the web, helping enterprise clients such as Google, Fortune 500 companies, and major publishers solve complex problems with innovative WordPress based solutions.

rtCamp specialises in everything from large scale website builds, to more bespoke projects like Chrome extensions and SaaS connectors, and has grown to a team of hundreds over the years.

Today’s episode takes a deep dive into Raul’s recent talk at WordCamp Asia, which focused on what it will take to launch and scale an enterprise WordPress agency in the future.

The conversation focused on real, hard won, lessons from rtCamp’s journey, but also how rapidly the playbook is changing with advances in technology, particularly the explosion of AI tools and workflows.

We discuss Rahul’s philosophy around hiring, namely building a team of people whose strengths complement each other rather than just replicating your own skillset. This approach has allowed rtCamp to adapt to new challenges, fill gaps in expertise, and whether major industry changes.

We then explore how this idea of complimentary sets can also apply to choosing the right kinds of clients, those who value your expertise because they need what you offer, rather than simply hiring somebody who does what they already know.

A theme that emerged in the conversation was specialisation. Rahul outlines how, whereas rtCamp’s earliest differentiator was a simple focus on WordPress, when virtually nobody else in India was, today’s agencies must drill down much further to stand out choosing niches within niches, such as WooCommerce, or payment gateway integrations, and becoming recognised experts in those areas in order to thrive in a much more crowded field.

Towards the end of the episode, the discussion turns to what might be the most significant topic for agencies today, artificial intelligence. Rahul describes how recent advances in AI have not only altered his agency’s practises, but given them a firm mandate. If something in rtCamp can be done by AI it will be.

We talk about how AI is being leveraged inside rtCamp to automate and optimise everything from sales and proposal writing to project management, and even technical proof of concept builds. With a unified platform for all business processes, the agency is now able to significantly reduce costs, speed up delivery, and focus on higher value consulting and creativity, reshaping roles and team composition as a result.

If you’re interested in what it takes to stand out and succeed in the evolving world of enterprise WordPress agencies, how to confront uncertainty with both optimism and realism, and how AI can become not just a bolt-on feature, but the operational backbone of your business, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Rahul Bansal.

I am joined on the podcast by Rahul Bansal. Hello, Rahul.

Rahul Bansal: Hello Nathan. Thanks for having me here.

Nathan Wrigley: You are very welcome. Rahul and I were both at WordCamp Asia and that is going to be the main focus of the podcast today. We’re going to be talking about agencies, growth in agencies, and then probably delving into AI a little bit at the end because of a recent announcement that came out of rtCamp, which is the company that Rahul founded many years ago.

In order to, I suppose, lend credibility to a conversation about agency work, would you mind Rahul, just introducing yourself and tell us a little bit about who you are, what you do in WordPress, and maybe give us a few little interesting facts about rtCamp and what you do over there.

Rahul Bansal: So I’m, as you mentioned, founder and CEO of rtCamp. We started this 17 years ago. We primarily help large enterprise client, sometimes we build websites for their marketing team, which is the most common use case of WordPress. But at the same time, we help large tech companies like Google communicate better with the WordPress ecosystem for their offering. Like sometimes we build products that includes neither thing, neither plugin, but something like Chrome extension. For large companies sometimes we build like SaaS connectors for technology companies.

Yeah, so we work with, like a big companies really Fortune 500, and the idea is to deliver something related to WordPress in one form or another form.

Nathan Wrigley: If you go to the rtCamp website, you can probably Google it I would’ve imagined, then you’ll be able to get some impression of what the company is like.

I think last time we spoke you were into the sort of 200 employees level. I’m not sure if those numbers have gone up or down or what have you. But you get an impression of how large it is. And one of the interesting things that I spotted during my time at WordCamp Asia was just how vibrant the community, the WordPress community is. So maybe we’ll get into that a little bit as well.

I’m going to concentrate to begin with on the presentation that you gave at WordCamp Asia. If you would like to see that, wordpress.tv will have a video. And if the video is already available, I will link to it in the show notes. But the presentation that Rahul gave was entitled, how to Start an Enterprise WordPress Agency in 2026. And I’ll just read the blurb that goes with it because it was fairly short and easy to manage.

Building a WordPress agency business for large enterprises. In this talk, I’ll share the story of how rtCamp grew from a small WordPress shop into a globally recognised enterprise agency, trusted by Fortune 500 companies and major publishers. If you’re starting an agency today or looking to move up market in 2026, this session will give you a realistic roadmap building on real lessons from my personal experience.

So I suppose what I’m going to do at the beginning, Rahul, if it’s all right with you, is just ask you to tell us some of the bits and pieces that you mentioned during that. Some of the advice that you would give an agency owner beginning in 2026.

Rahul Bansal: Yeah. So first, like I deviated a little bit from the blurb because when I applied this talk I had a different frame of mind that, hey, I’m going to do this. And then as I was preparing the talk, and in during those months, especially like last few months, the AI has reshaped everything. And then I realised that a lot of what worked for rtCamp won’t work even for rtCamp if I start again today.

Rather than making it as a nice story about what worked for us, I lean more towards practical advice, and that’s where the essence remained. But I focus more on the 2026 part, because when we started, it was 2006. The first time when I used WordPress was 2006. rtCamp started in 2009. 20 years is a big time. And then at the end of this 20th year, like we are going through this AI led change.

So a lot of things that worked for me won’t work anymore. And that is how I restructured my talk to take enough from our history, enough from our learnings, what worked for us.

The way we hire is very different. And after the talk, if that one line that stick with the audience, that many people told me that the hire your complementary set was the most different idea. And it’s timeless idea. It’s relevant in AI world also.

So the idea was basically that we have this bias that when we try to scale, like basically when we go from freelancing to agency business, the idea of building a business, we try to find people like us. But my idea was that we should initially, especially, we should find people who are opposite of us. Like I was good at engineering, bad at sales, so my co-founder is sales heavy. My English was not good. His English was very polished.

So I literally listed down my weakness and found people who were opposite of me. Even interesting part was that, to the few initial hires I asked the questions, whose answer I had no idea whether they’re saying right or wrong.

So that was the most interesting idea and I think that’s still relevant today. I will do exactly same thing if I have to start building a new agency. I will build in WordPress, build in AI, any kind of business I will, my initial few hires will all together will cover each other’s weaknesses.

It’s at certain scale then you need to replicate, like, you need 50 engineers, you need 20 React engineers, you need five people who can write same proposal. That comes much later. But starting is all about finding your complementary set. And this was inspired by a set theory from math class that I attended in when I was like some 12-year-old. That stuck around before the life. And that is what I put in this talk as a biggest lesson we learned and that worked.

The second most specific thing that I would say, practical advice, like that was more about hiring advice, but that is not only hiring address, that is, I advise in many walks of life applicable.

When you’re looking for your client, you have to look for complimentary set there as well. Because you are trying to sell to agencies like yours, your margins gets hit a lot. You need to find people who do not understand WordPress at all because then, that is why your expertise become more important and premium for them, because they need to depend on you. They value you more. You are not commoditised for them.

So that hiring your complementary set works across the board. But then the most specific advice I gave that I didn’t follow myself, I would say. Actually there was nothing to follow that. When I started WordPress was just a blogging platform. There was custom post type were not yet part of WordPress Core. Everybody was just building blogs. We were playing around themes, and the race was to make our blog look unique. The metric usually was like traffic and how many email subscribers you got.

So there was no niche to pick. Like, that was the only thing WordPress was doing. And after post type, people started building a lot more than WordPress. Actually people started pushing WordPress earlier, and as a result of that, WordPress created those APIs to make it easy to extend WordPress beyond blogging platform.

But today, in 2026, there is so many things happening. And if you’re starting new and you do what rtCamp did on day one, like, hey, we are WordPress agency. That is not going to work.

It worked for us 20 years back because we were like, probably only one in India at that time who said at that time that we will be only taking WordPress project. Because India was a land of outsourcing. Like in supply chain, it was like a, it’s like a Chinese manufacturer saying that, hey, we are only going to assemble if you are building for iPhone. So it’s like, hey, we are only going to write PHP if it is going to end up as a WordPress theme or plugin. We are not going to do what was Cake PHP project at that time. We are not going to write custom PHP script.

So in a way we picked the whole WordPress as a niche among the largest set of choices available to us. But if your largest set of choices was building a iOS company, like mobile app company. Mobile app was big because with the introduction of iPhone, there was a sudden shift and huge demand for iOS apps, and we haven’t built one till 17 years. Like literally we built our first iOS app, public iOS app last month.

That time we were like, well, we are going to only do WordPress. So now that advice translate into, pick a niche within WordPress because WordPress itself is the web now. That time, WordPress was very small. Now you can choose e-commerce. Within e-commerce then you can probably pick WooCommerce. Within WooCommerce then probably you can pick like, depending on your market, payment gateway specialisation, ERPs, back office specialisation, subscription based businesses.

Start by picking a niche as small as possible and then go bottoms up, rather than starting with everything. So that was the key takeaway of my session, I would say that. Pick a niche, position yourself as a expert in the niche. Don’t just say that, hey, we build WooCommerce store, or we build WordPress site.

Nathan Wrigley: Okay. Yeah, I’ve got all of that. So firstly, hiring. That’s an interesting one. Hire people that are different from you. I was imagining when you were saying that, I wonder how long you can do that, because you can’t, eventually, you have a company of a hundred people and all of them are not the same as you. Eventually it must be nice to find somebody who’s a little bit like you.

But then also you mentioned picking clients who will trust your expertise, I think is a good way of describing that. Because they themselves are perhaps not expert within that WordPress platform.

And now of course, moving forwards, what worked for you in terms of being a WordPress agency 17 odd years ago, that was, as it turns out, really successful. But now you are going to be amongst tens of thousands in India alone, if all you say is that you are a WordPress agency. So you need to go a little bit more specialised and niche down.

I wonder, Rahul, with the benefit of hindsight, it’s always easy to look back and sort of see for example, from my perspective, I see rtCamp as an entirely successful enterprise. You know, you began all those years ago, and decisions were made and you grew and you grew and you grew and you grew, and now we are where you are now. Committing a lot to WordPress with incredible growth and a really amazing agency on your hands.

But I’m just wondering, looking back, with the benefit of hindsight, were there any moments where you made some decisions where you were very nervous about how it was going to be?

So for example, one of those could be WordPress. There was no writing on the wall that said WordPress will be the successful CMS. That really could have gone either way. It could have been Drupal, it could have been something that some kid in a basement created. So I’m just wondering, are there moments when you look back and you think to yourself, gosh, I am so glad that we did that random choice than all the others that we could have made?

Rahul Bansal: Yep. So it’s a reality that, one of the co-founders we lost, within the first year of company formation was because, I refused to add Joomla to our offering. And Joomla I think was market leader at that time when we started. So we were like more like engineers, like some were good at sales, some were good at communication, but we were all from the same kind of school, like we didn’t know if there was any survey existed.

So we didn’t back by any data. The only reason we chose to stay with WordPress or build this agency with WordPress because we were using WordPress. So rtCamp for the most part, people missed that. So rtCamp was not started as an agency. rtCamp was basically a media company, a blog network. And that blog network was running on WordPress. As a technology blogger. It’s like just imagine WP Beginners, like that is more relevant example.

So by the way, we, and WP Beginner were operating at the same time, that’s the power of niche. Like say I chose to focus on WordPress and say very very well. And my technical blog was everything like from iPhone to Windows operating system to Mac OS update to web APIs, to HTTP2. Whatever, like it was a larger technology blog So we were more like a stripped down version of TechCrunch rather than picking a niche. And Syed picked this WordPress as a niche.

Both were contemporaries in that same era. Now just imagine Syed in those days I started an agency. So we were using WordPress, we needed to stand out because, social network or blogging or web was still a fancy place. Like minimalism wasn’t the trend. It was how much you can push, like how you can make your website look different without using Flash. That was the coolest thing. Like how much you can push jQuery, how advanced CSS you can write. So all those things led to we customising our WordPress a lot.

Another thing that worked in our part was, our blog was one of the biggest in India. Globally also, it had good traffic. In fact, it had so much traffic that one of the most Googled keyword in my name was Rahul Bansal, how much money this guy make. Like that was the first question I used to get asked because traffic was insane. We used to get a lot of traffic.

That led us to writing nice WordPress code. In early days, like especially when I was freelancer, I had to write amazing WordPress code that will scale and host it in a way that it will also scale. So not only WordPress, we choose Nginx before it become a norm. Like before there was. anybody started any WordPress managed hosting company. We managed to scale WordPress at a very high level.

And so now we, are this famous blog running on WordPress handling so much traffic, on Linode’s $10 something plan. Customising it. So we got this natural market. We got initial customers were technically our competitors, like other tech bloggers. It’s like TechCrunch hiring Mashable to customise their blog So something like, because Mashable has a tech team. So that was at early story of rtCamp.

And then we realised that we are making more money and faster money via customising WordPress. So we started cutting down on our editorials. And then, slowly, slowly like the business has shifted from, being a blogging agency, to WordPress custom development agency. That’s why we chose WordPress.

And that has been the principle since then, like we only sell what we use. That was the reason we didn’t, so it wasn’t any ideological decision. So the ideology is at open source level. So rtCamp is committed to providing open source solution to its client from day one.

Joomla tick that box. But Joomla didn’t tick the box that we use Joomla. We don’t use Joomla. There was no reason for us to have our blog running on WordPress and website running on Joomla, and that’s why we stick around WordPress when there was no data, no trend. And I think in hindsight it was just luck. I would say like it could have backfired.

Nathan Wrigley: Well, okay, I really like this story. Firstly, I like the fact that you are identifying luck as a component, because I think too often when you listen to people who have had success, they sort of chart this narrative of how brilliant the decisions were along the journey and how impeccable, you know, we did this and then we did this, and then we did this, and then we did this. But never a nod to luck.

And of course, with the benefit of hindsight, we did this, we did this, we did this does lead to where you are now. But I really enjoy it when founders and people have that confession in them. Yeah, there was a bit of luck.

But also, and we’ll get onto this in a minute, because a big part of what you are about to do, or have recently done with your business kind of leans into what you’ve just been saying.

It sounds like you were led by what was in front of you, if you know what I mean? It doesn’t sound like there was a great big, okay, by 2016 or 2026, we want to be here. It was more like, okay, this is where we’re at now. These are the things that are coming to us. Okay, looks like WordPress, not only are we using it, but it looks like people want us to help them to use it. Well, let’s go there then. Let’s put the blogging to one side and let’s become more of a, I don’t know, a technical helper for you and your website.

So there’s this sort of lucky piece, but also the willingness to steer into favourable winds, if you know what I mean? I love that story. Thank you very much for that. I also admire your humility in all of that. That’s lovely.

So the next thing then, I suppose that I want to get into is some change in the landscape at the moment. And again, this maps to what you were just saying about move where the wind takes you. We all know that AI is a thing. You cannot have missed that. But I think a lot of people are taking nervous steps into their business and how they’re doing things with AI and maybe biting off a little bit here with AI and leaving the rest as it is, and biting off another chunk here, and leaving the rest as it is and slowly moving into AI.

You have a very different approach. And I will link in the show notes to a blog post on the rtCamp website, which I read several weeks ago. I’ve got to say, I was a little bit, not surprised, that’s the wrong word, but it was written in such a way that I thought, gosh, now that’s interesting.

Because in it you painted the case that rtCamp in the future is going to do AI everywhere. And I know we hear that all the time. You know, we’re going to use AI here, and we’re going to use AI there. You have painted your colours on the mast, and literally, I think you said, if it can be done with AI, it will be done with AI. There will be no stone left unturned.

Okay. Firstly, why? Why have you got that approach? What’s the reason? Now, I’m sure it’s fairly obvious, but lay it out for us anyway.

Rahul Bansal: Yeah. So I don’t know from where it comes, anytime I see things going south across industry like COVID or, like AI, like everybody was gloomy, my brain kind of think of opposite. So in my brain, I’m not building, I’m actually imagining an AI only agency with humans required to probably feel capture. That’s how my brain works. So it’s like AI first.

Then again, like WordPress, so I have been lucky more than once in my life. So before this AI came, this famous saying by Steve Jobs like you can only connect the dots looking backward. Three to four years ago, riding on the digital boom, we survived the COVID, like all agencies grew. rtCamp grew a lot more, and a lot faster in very short span of time. And to manage this humongous workforce, we needed to refactor a lot internal tooling, softwares, processes, to the point that we have internally codified our mission that we want to build McDonald’s of consulting business, inspired by that movie Founder. That was also part of my talk at WorkCamp Asia.

And in fact, I had somebody to literally a complimentary set example. I know we want to build this, but I don’t have that kind of mental model. So that’s the brief I give to our chief delivery officer that you have to give me this. McDonald’s of agency business.

We start thinking of every process that we can repeat, and we realised that we need to take control of our software stack. And we ended up finding something, in open source. That’s, I would say truly a spiritually aligned to the WordPress ecosystem called Frappe ERPNext, which handle our accounting, payroll, project management, CRM. So many business processes in one single source of truth, like single source of truth for so many things. Earlier it was all siloed data.

So this was started with a different intent, to scale rtCamp, 2000 people, 5,000 people, 10,000 people, because that was a business model then. Agencies growth with capacity. You want to sell more, you need to hire more. Basically agencies growth was limited by on one dimension, the inventory, human inventory you can have. So we started implementing this open source back office software automation with the idea that we will own, central piece of our operating system of connecting, getting thousands of people working together.

Then AI happened, and then we realised we don’t need to hire those many people anymore. Year on year, we moved from 200 to 250, but I think next 50 will be very slow. Because, now we are no longer aiming to sell, or hire people. But as luck would’ve been, we ended up creating this system of record, which is unified and cleaned. When we think of a client or a project or a human. All aspect of their metadata is available in a single system.

So that is why we can leverage AI more than a company, agency to agency. For agencies using say, Jira for project management. QuickBook for accounting, some other software. If their operations is scattered across 6, 7 software, we have leverage over them. Not only we are paying very less because all our software is open source. The data is first party. Like sitting duck there to query in any way we can. We are not limited by SaaS providers, enterprise plan or this AI capability.

So that is where we realised that we can take this huge bet on AI where we can now build a lot more, in a lot less time using AI across the board. And if you look at a business like not just WordPress business, when you buy something, like you buy a car from a car company. You are actually paying for everything that company does, advertising, researching on the EV technologies, hiring a brand ambassador to put billboard, sponsoring F1. Anything that company does. every penny they spend on their business, the customer ends up paying it.

So we thought like now we have a single stack, which technically takes care of 70 to 80% critical nature of our business operations. From when the lead enters the CRM, the project management, time entry, people’s new management, everything is linked. Everything is beautifully linked in a single unified interface and database. So why don’t we just use AI to cut down the cost.

Because now we cannot charge by hours, we can try, but, it’s not making sense anymore for clients. They want us to commit to fix output bid. Now when we say, hey, we can migrate this thing for 100k, or we can build this website for half million dollars. So those numbers, traditionally, and actually all the time will include all the operation cost. Like my salary. I’m not doing any coding work, but my salary will be eventually paid by all the clients. Electricity bill that is also going to be paid by all the client.

So we thought like rather than just thinking AI to build a website, let’s use AI to bring our operational costs dramatically down. Because we have single source of truth for maximum data we have, and that is where we went all AI in. Now it’s like we can submit a proposal in one third of the time.

In old days we used to build PPTs. Now we vibe code a WordPress demo site and attach it to the proposal. Hey is this something that you want? Not just the screenshot, not just the Figma, like we are actually building Playground, like websites, and launching them and sharing those links to the client. Go play with it. We are even trying to copy the design systems if they’re migrating. So migration is a big category of work we do.

So that is what we mean by going AI ready. So we are leveraging AI to reduce the cost of sale, increase probability of winning the project by pitching them something. And then while estimating the effort, like let’s say we would traditionally say, oh, this might cost us a thousand hours. Now we blindly said Make it 30% less, as if it will be done in 700 hours and it will be, sometimes it backfires.

But then on some project it’ll be 500 hours. In some project it’ll be 900 hours, but average will come back to 700 hours. Then again, the idea is we have a central operating system, which gives us, like bird’s eye view of how healthy our projects education are. Are we getting returns on our AI engagement? And all this is possible because few years back we took a bet in different direction.

Like we choose WordPress because we wanted to be a better media agencies, and that was what media agencies were doing in the early days. But we ended up building an agency business with the WordPress. Likewise we choose this Frappe ERPNext software. To operationalise our back office. But now it is starting out to be our advantage point in this areas like we are able to do AI a lot more. In the end, it’s all about bringing the cost down at certain quality. You have to keep the quality up, and just make it more affordable. If that is not. as a business you cannot do that with AI, then something is wrong.

So AI is not about building something new. I have another approach. So if you’re an agency people are hiring you to move things from A to B, like you are the movers and packers of internet. I put crudely, what rtCamp does. We move things, like a shipping company who moves your house, remove you from Sitecore to WordSpace.

And that’s still big part of our business. We don’t have to reinvent or reimagine different experiences all the time. Sometimes we have to just do what everybody’s doing, the boring part. Put AI there to make it efficient, more cost effective. And if you do that, that means more people wanting to shift to new house. Again, a different approach. People think that they need to build something out of the world to benefit from this AI way.

My idea is that pick a boring thing and make it so affordable that people who were sitting on the fence, just imagine travel, Middle East travel. Like this is a very actually a bad example, might sound inhuman, but, say like X number of people wanted to experience Dubai as a destination, but let’s say, it was beyond their budget. For some even unfortunately now suddenly that comes within their budget, they will be able to do that.

People wanted to move to WordPress Initially, agencies were quoting a hundred thousand dollars for that big shift. Now if you can, suddenly you can do it in 50k a lot more people will shift. So, you don’t have to do things like out of the world thing. You don’t have to invent new. You have to sometimes just make existing problem more efficient to solve.

And it was not always about money, especially in large client. It was not always about 100k versus 50k versus half million versus 1 million. It was about timeline. It’s like you are refurbishing your home and it is going to take three month, then it’s a different mental model, like to put up yourself in a hotel or a second home for three months. If a magically a new company appears and hey, we can refurbish your home overnight. You don’t mind checking into hotel for one night. And that is where I feel like this WordPress will be net gain because of AI. Agencies has to be optimistic, and think differently to gain from AI.

Like, what people are doing is everybody’s trying to act like a ChatGPT, OpenAI, it’s their job to invent AI algorithm. We are agency. Our job is to apply AI, not invent AI. We don’t have to think of what is Opus 4.8 will do. Let cloud engineers think of that.

So we need to understand we are AI’s consumers or consultant, and that is where some people are getting it wrong by vibe coding things that they’re not able to sell to anyone. Then they will cry that, hey, six months later they will realise they built stuff nobody bought. Now they don’t have money to pay AI bills, or their developer salaries and then they will try that, hey, AI took over job, AI killed our business. No, think what existing problems we can solve with AI cheaply, efficiently, with better quality. And a lot of work is there to be done.

Nathan Wrigley: There’s a lot in there, but one of the things that I’m taking out is. So prior to AI coming along and demonstrating to us all what it could do, which by the way didn’t kind of happen overnight, although it feels like it did, there was a sort of, a year in which we could suddenly see, oh boy, it’s getting much more performant and much more interesting. But prior to that, it sounds like post COVID, you kind of inspected your business and were thinking, okay, how can we refine everything that we’ve got in the business and how can we put it all into this one system?

And again, with the benefit of hindsight, and I’m maybe going to use the word luck, maybe that’s not the right word. You, having done that work, then meant that when AI did come along, you weren’t trying to link up four or five or six or ten different things. You had this one source of truth. Which meant that you could cut waste, for want of a better word. You know, waste could be measured in terms of dollars or it could be measured in terms of time or it, whatever it may be.

You happened to be in that place because you’d done that preparatory work, not necessarily knowing that AI was going to come along and make all of this fun stuff possible. But with the benefit of hindsight, that’s exactly what it did.

And it’s curious, you said 70 or 80% of the business could be streamlined in that way. And I’m so staggered by that number. I thought you’d be in the kind of, I don’t know, 20, 30% or something like that. But a full 70 to 80%. So does that mean 70 to 80% of the things available, or do you mean that you were able to cut 70 to 80% of the cost or the time? Because I wasn’t sure which 70 or 80% you were meaning.

Rahul Bansal: It meant different things. First like, as I mentioned that we are not thinking AI adds just something to sell, but something to consume first. Because, again, dog fooding principle. We managed to sell WordPress better because we were a blog network. That’s why we could understood publishers better. We got into this Frappe ERPNext consulting because we built our backend with it. Now before we make any promise with AI, we have to be net gainer with the AI. And we believe that our internally, we will be.

So there are two parts, actual cost of building something and the meta cost. Like cost of sale, like the writing proposal. marketing costs, like case studies, going to even preparing for articles. Non build cost is definitely, we are able to bring, I would say it’s already half, but it’ll be, further down. I will give you a very simple example.

Like in early days is when somebody used to submit rtCamps form, inquiry form, a human, would manually check like, Hey, what is the domain name of this email id? Are they on LinkedIn? Some 30 minutes and then they will write a note hey, this looks like a good quality lead. We are fortunate that we get a lot of inbound inquiries, so we had to have prioritise, like which leads we are going to respond first.

Now, as soon as somebody submits a form an AI integration does that, within minutes. And the notes are much more details, it creates action items. Across like WordPress our Frappe CRM, our Slack, everything runs like a clockwork, and we don’t need a human. So that, junior human job is definitely gone. So in sales team, we used to have like this entry level job. That is no longer there. Some jobs are actually going to get vanished. So now going on a call, meeting notes, a lot of those things are getting automated. So the cost of sale has dramatically came down.

What is the effect? Like, say we can now assume flat 10% discount compared to earlier pricing when we are thinking of a migration project. Like, let’s say, in early days, we used to think like hey, anybody wanting to migrate from Adobe Experience Manager? We must assume that they need to pay us 100k. On the initial call, we can say, hey, that would probably cost something like minimum 50,000 dollars.

The minimums, the starting numbers has came down because we need less energy to have those pre-sales conversations. Less number of minutes of ours spent building those demos. Very fast discovery. Data mapping sometimes happens in minutes. In fact we did one 10 days to prepare this migration literally in five days, that was unthinkable. And that included data migration, QA testing, like automation testing where somebody built a bought in panel, which would randomly open a Zendesk ticket and verify that all metadata and deploys are migrated into new health desk system, all within five days.

This is where I have been saying that the cost of building custom solutions will fail. For like so low, like it’s 60, 70, 58. Like definitely more than half. It’ll be reduced by half more. People will buy custom solutions. So agencies are going to grow from here in just these one or two years. Because agencies, to price something upfront, we need consistencies. Like I’m running an airline and if my jet fuel is my biggest cost, and that is out of my control. Then how do I price my tickets? That’s AI hallucination, which is, I would say the jet fuel version of aviation industry.

Something happens in Middle East and fuel prices goes up. A war starts. So now when AI hallucinates so it’s like what we are internally tracking, or what we call as a KPI or internal metric is that, worst case, AI gains, that’s already 20%. Best case is more than 90%. In some cases it’s literally 90%. This range will keep compressing and that’s what I think 70% is my expectation in two years. We will have that maturity that, the build time will fall by 70%. That means. the client companies will hire more agencies to do more work.

WordPress will emerge as a winner, not only for its ecosystem, but its ability to expose structured data without any proprietary walls. AI was so fast that only an open source can keep up with it. In fact, we are seeing more migration inquiries with with the AI boom.

Nathan Wrigley: Oh, interesting. I was going to ask a sort of follow up question. Do you think that you, so you were mentioning, how to describe it, a rising tide carries all boats, or you certainly implied that the pie is getting bigger, if you know what I mean? So you are getting more phone calls, more migrations, more work, and you can obviously do that more affordably. And because you can pass on some of those savings to the clients, the price point lowers and so you get more inquiries because there’s this virtuous cycle of price going down, but quality staying the same or getting better.

I wonder if you, given your success in the past, I wonder if that transition will be easier for you, because the phone is already ringing, than it would be for somebody who was beginning in 2026? Because we all know when you begin, getting the phone to ring is probably the hardest thing. You know, getting those first 5, 10, 15 reliable clients, whatever it is that makes you work.

I wonder if you are in a uniquely good position, having a history of clients, a roster of clients that will come back to you. And also just being famous, for want of a better word, in the WordPress space, for doing the kind of things that you do. I wonder just what your thoughts are on that.

Rahul Bansal: They’re both pros and cons. The only con for rtCamp is that our business model, a big part of what’s traditional like setting our flagship revenue stream for last 8 to 10 years was staffing solutions. We used to provide engineers, sometimes to other agencies, sometimes to publishers. So usually they used to have the leadership layer with them. We were more of executors, and if AI within the IT industry, the first casualty of AI revolution was that people who code, or people who can only code but cannot think. But luckily our hiring was very different.

While it is taking time, so as I said, net headcount addition has been slowed down. I think this is probably first time rtCamp’s career site doesn’t have any engineering opening. If we would’ve been like a publicly listed or like a shareholder owned company, we might have got mandate to fire a hundred people right now, because we have already gained by, so much that, our one third of our WordPress engineers are currently out of work when the work is rising.

Because traditionally, when we needed eight people, now we were able to do in four people. But now we are using this. We have our own challenges, going from one kind of business to another kind of business model. The switch is causing some friction, but we are communicating it openly. We are giving people like more freedom. You give us ideas like which part of the entire business equation you can optimise. Is it editorial experience, is it migration cost? Is it data mapping, visual testing? So people are constantly building.

So change is there. Change is scary. It is scary for us also because we don’t want to fire people. We don’t want to lay off people. We want to return this team. From here onwards, we don’t see we are hiring more engineers for at least a year, because we have enough of them. But, we are so optimistic about this WordPress growth and the pie getting bigger.

We are hiring more sales and marketing team. Two days back I was telling like traditionally, we had this 90 to 10% ratio, like in 200 people, our headcount team, we would have 20 people. That would be, we can call as a sales and marketing department, I think next 50 hires will be only sales and marketing.

Nathan Wrigley: Oh, that’s a big skew, isn’t it? So you’ll go to more like 30% marketing as opposed to 10% marketing.

Rahul Bansal: Yeah sales and marketing. By the way, when we say sales, sales in rtCamp means slightly different. It’s more of a initial consulting, basically making those solid promise, which can be backed by engineering, not over promising. So our sales team needs are more like a WordPress consultant, but we have a category within rtCamp which we call Growth Engineers, who are some of our best coders. But rather than writing code, they go on the first client call and make promises on behalf of WordPress which are practical, feasible, and real.

That is what our internship look like, because coding is race to bottom. Eventually the cost of building will shrink to the point that you don’t need many, you won’t need many traditional developers in any agency. You will need people who can imagine what needs to be built. There might be 20 different ways and which way this project should be executed. That prompt engineering, context in engineering.

So the value is shifting and it’s definitely shifting away from people who can only code. That is why, probably from two years now, we might be at 300 people. Hundred of them will not be coding at all. But they will be prompting AI. They will be building vibe coded prototype in pre-sale stage to gain that customer confidence like early on that day. What you want is possible with the WordPress. It won’t cost that much. It’ll be given you fast enough that your life won’t be disrupted for many months, like your business operations won’t be disrupted for many months, so this is a thing

Nathan Wrigley: Yeah, nobody could deny that we’re in interesting times. I think a lot of people are very confused by what’s going on at the moment. You know, they’re trying to figure out a path. They’re trying to figure out how it affects their business. They’re probably in, I would imagine, quite a lot of cases, quite keen to stick to the ways that they’ve done it in the past. But certainly the picture that you’ve painted over at rtCamp is that you are aligning yourself with a very different future, kind of embracing AI, seeing where it can take you, trying to adapt your business. Being optimistic about it rather than pessimistic. Because I think there is quite a lot of pessimism around there at the moment. But seeing the opportunity and seizing it.

Absolutely fascinating. There was so much to unpack there. I feel like we could talk probably for another nine hours about this because it genuinely is never ending. I would love to prize back the curtain a little bit more. However, time allows only this much. So what an interesting conversation. Thank you very much, Rahul.

Just before we end, could you just tell us where we can find you online, should somebody want to, you know, maybe they’re experiencing a bit of anxiety of their own. Their agency is in a rudderless ship at the moment and they’re trying to figure it out. Where can people get in touch with you best?

Rahul Bansal: I am actually available on all social networks. I use LinkedIn least and email is most level way, I’m a bit old school there. But, yeah, Twitter. I check daily.

Nathan Wrigley: I will link to your bio in the show notes, but also, I will link to the presentation that you gave and any other bits and pieces that we discussed that I can find links for. I will mention those well. So head to wptaven.com, search for the episode with Rahul in it.

Thank you so much for chatting to me, and all I can say is all the best. I hope that all of the intuitions that you have turn out to bear fruit and be fruitful for you.

Thank so much for chatting to me today.

Rahul Bansal: Thank you Nathan.

On the podcast today we have Rahul Bansal.

Rahul has a long and accomplished history in the WordPress ecosystem. As the founder and CEO of  rtCamp, a company he started 17 years ago, he’s led his agency through the rapidly changing landscape of the web, helping enterprise clients such as Google, Fortune 500 companies, and major publishers solve complex problems with innovative WordPress-based solutions. rtCamp specialises in everything from large-scale website builds to more bespoke projects like Chrome extensions and SaaS connectors, and has grown to a team of hundreds over the years.

Today’s episode takes a deep dive into Rahul’s recent talk at WordCamp Asia, which focused on what it will take to launch and scale an enterprise WordPress agency in the future. The conversation focused on real, hard-won lessons from rtCamp’s journey, but also on how rapidly the playbook is changing with advances in technology, particularly the explosion of AI tools and workflows.

We discuss Rahul’s philosophy around hiring, namely, building a team of people whose strengths complement each other, rather than just replicating your own skillset. This approach has allowed rtCamp to adapt to new challenges, fill gaps in expertise, and weather major industry changes.

We then explore how this idea of “complementary sets” can also apply to choosing the right kinds of clients, those who value your expertise because they need what you offer, rather than simply hiring someone who does what they already know.

A theme that emerged in the conversation was specialisation. Rahul outlines how, whereas rtCamp’s earliest differentiator was a simple focus on WordPress (when virtually no one else in India was), today’s agencies must drill down much further to stand out, choosing niches within niches, such as WooCommerce or payment gateway integrations, and becoming recognised experts in those areas in order to thrive in a much more crowded field.

Towards the end of the episode the discussion turns toward what might be the most significant topic for agencies today, artificial intelligence. Rahul described how recent advances in AI have not only altered his agency’s practices, but have given them a firm mandate, if something within rtCamp can be done by AI, it will be.

We talk about how AI is being leveraged inside rtCamp to automate and optimise everything from sales and proposal writing to project management and even technical proof-of-concept builds. With a unified platform for all business processes, the agency is now able to significantly reduce costs, speed up delivery, and focus on higher-value consulting and creativity, reshaping roles and team composition as a result.

If you’re interested in what it takes to stand out and succeed in the evolving world of enterprise WordPress agencies, how to confront uncertainty with both optimism and realism, and how AI can become not just a bolt-on feature but the operational backbone of your business, this episode is for you.

Useful links

rtCamp

Rahul’s presentation at WordCamp Asia 2026: How to start an enterprise WordPress agency in 2026

The same presentation on WordPress.tv

A year of reinvention as we turn 17

Frappe tools mentioned several times during the podcast

Rahul on X

Rahul on LinkedIn

💾

This ONE MISSING FEATURE could FIX WORDPRESS

💾

WordPress has a missing feature that's been quietly making the Site Editor confusing for years. In this video I walk through exactly where the pain is — and show a prototype that explores what fixing it could look like.

👇 Check the PINNED COMMENT for links to the live demo and prototype.

---
Timestamps

00:00 Introduction
00:24 Types of WordPress Pages
02:14 The Problem with the Editor
04:24 A Solution?
07:40 Progressive disclosure: power users aren't left behind
08:24 Allow for Missing Templates
09:56 Recapping the Proposal
10:18 A vision for the Editor
10:44 How to give feedback
11:09 Subscribe for more!

#WordPress #SiteEditor #WordPressTips #Gutenberg #WebDesign #WooCommerce

WordPress has a HOMEPAGE PROBLEM - I built a better version

💾

Setting your homepage in WordPress is harder than it should be. In this video I walk through exactly why the current experience fails beginners — then show a prototype I built that explores what a simpler, clearer approach could look like.

👇 Check the PINNED COMMENT for links to the live demo and prototype.

---
Timestamps

00:00 Introduction
00:25 The homepage problem in WordPress today
02:33 Templates add friction
05:07 A better approach - the prototype
08:47 3 Key Principles
09:07 Feedback


---

#WordPress #SiteEditor #WordPressTips #Gutenberg #WebDesign

#220 – Cathy Mitchell on Why WordPress Events Matter: Community, Connection, and Giving Back

Transcript

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case, why WordPress events and community matter.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today, we have Cathy Mitchell. Cathy has been working with WordPress since 2007. What began as a fun personal project during her maternity leave soon evolved into a fully fledged business with the launch of WPBarista in 2008. Over the years, Cathy has garnered extensive experience in the WordPress space, and is now working towards the 2026 WordCamp Canada.

The conversation focuses on the powerful role of community within the WordPress ecosystem, something that Cathy is deeply passionate about. We discuss how open, welcoming, and international the WordPress community feels, compared to more traditional corporate or volunteer environments. A theme that emerged was how involvement in WordPress has provided Cathy, and many others, with a sense of belonging and fulfilment, especially after life changes like becoming an empty nester.

The discussion explores the motivations for volunteering and organising within the WordPress community, both from the perspective of newcomers looking for purpose and connection, and business owners assessing the return on investment from contributing or sponsoring events. This includes how easy it is to get involved, the unique lack of barriers and red tape, and the value of altruism and camaraderie.

Other topics we explored with a broader impact of technology and loneliness, the importance of service and community for wellbeing, challenges in sponsorship amid changes economic times, and the vital need to engage the next generation in open source.

If you’re interested in the human side of WordPress, how volunteering shapes both individual and the broader community, and what the future might hold for WordPress events and contributors, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Cathy Mitchell.

I am joined on the podcast by Cathy Mitchell. Hello, Cathy.

[00:03:25] Cathy Mitchell: Hello. Thanks for having me.

[00:03:27] Nathan Wrigley: You are very welcome. Cathy and I have been having, well, 15 minutes or so of chit chat just before we started the podcast. I’ve been learning a little bit about Cathy and we’re going to share all sorts of information.

I think probably broadly we could talk about it as being the WordPress community, which is a subject which is dear to my heart.

However, before we get into that, Cathy, I’ve had an introduction from you over the last few minutes, but would you mind sort of giving us your potted version of that, your shorter version, your bio if you like. Tell us who you are and how come you’re featuring on a WordPress podcast.

[00:03:58] Cathy Mitchell: Well that’s a whole lot of imposter syndrome. Why I am featuring, because you’re kind enough to have me. I’ve been working with WordPress since 2007 and it was just something fun that I did to begin, much like you with podcasting.

And then a couple years in, I told my friends that they’d have to start paying me, or I was going to go back to work, find a real job. This was during my mat leave, and so it kind of just took off from there in 2008, started WPBarista.

And now I’m very interested in the community because I was looking for something to do in the WordPress community last year. Dan in the Canada Slack got a hold of me and said, hey, do you want to help with the WordCamp? And I said, sure. You know, I had time.

And he got me in and brought me right up to like being on the organising team. And it was so fun but so shocking. Like, there is a lot of red tape in the corporate world before they let you do anything meaningful. Like you have to sweep the floors for a whole long time before they let you actually do something you’re good at. So this was remarkable. And this year I find to my surprise, I’m leading the 2026 WordCamp Canada.

So that’s what I’m doing now. And we’re going to focus on community too. So I’m very excited about this topic, both from a corporate, like what do we get out of this? Or are we supposed to get something out of this? And from a personal standpoint, it’s been amazing to meet these people, and to be given a chance. And I found out I’m not the only one. This is like normal, which is bizarre and wonderful.

[00:05:37] Nathan Wrigley: My experience of the WordPress community, so I started in WordPress actually quite a long time after you did. Maybe sort of six or seven years after you began using WordPress. I really didn’t know that there was a community at all. I just downloaded the software and used the software. And then I can’t even remember really how it happened. It might have been through things like Facebook Groups or something like that, where I was trying to learn a particular thing? Or perhaps there was something in the dashboard which indicated that there was an event nearby.

But I found myself, to my own surprise actually, I found myself at a WordPress event in London, WordCamp London, which at the time was going really strong. You know, hundreds and hundreds of people would show up every year.

And I remember purchasing a ticket and getting the train ticket and thinking, what am I doing? What am I possibly hoping to get out of this? And showing up and kind of being a bit like a timid rabbit sitting in the corner a little bit, and then it kind of worked out fairly quickly. Okay, this is all fairly benign. Nobody seems to be all that boastful. Nobody seems to be sort of shoving corporate speech down my throat, or trying to sell me anything unnecessarily.

And during the course of a day or maybe a couple of days, opened up a little bit and got chatting to people. And lo and behold, within a couple of years, a significant proportion of my free time, let’s call it that, outside of the commitments of daily life and family and all of that kind of thing, was taken up with doing WordPressy things in my spare time.

And so I, I don’t know if the story maps the same as you, I’ve shared mine, maybe you’ll share something similar in a moment. The community to me is much more than just, oh, there’s a community there. It genuinely is a seriously important part of my life. To the point where if that was to be sort of whipped away, or somebody like a Thanos type character suddenly clicked their fingers and that disappeared, I don’t know what I would do with myself. I would really have to go out there and find an awful lot of other things to do. Was it a bit like that for you?

[00:07:41] Cathy Mitchell: Not at all. I went to the forums first. And in 2008, 2009, there were some big names nowadays that were just answering us in the support forums. And so I learned from the best of the best, I think. And they would answer my ridiculous questions. I had no idea about PHP. I didn’t even know HTML. I didn’t even know what the internet was, like as broad concept. I asked my husband at the time like, okay, I don’t understand how my computer is talking to someone else’s computer, like you need to draw me a picture.

So anyway, I’ve only recently, I went to a couple of events, but I’ve always had the business mind. If I can’t see an ROI financially, I’ll say, from what I’m doing, then I don’t have time for it. But that was also during a time when I had a young family and then I became a single mum and then I had to work this business. And so it’s only really recently that I’m looking around and seeing people like you and going, this is unique.

I’ve been in volunteer communities, and now that my kids are all grown up, I’m kind of looking for those opportunities. What meaningful thing can I do with my time? And this just seems so unique. Like I volunteered at other places and there’s so much red tape and there’s so much, I don’t know, different feelings than this one. This one’s very open.

[00:09:09] Nathan Wrigley: I think the bit that is so curious to me is you can sort of dip in and dip out of it. Because, I don’t know, let’s say for example, you do something much more local, involved with your hometown or something like that. And you get involved in it and there’s a certain kind of, pressure is the wrong word, I suppose you can dip in and dip out of that as well, but do you know what I mean? You get involved in those philanthropic things locally and you get to know things and it becomes more of a habit, and you do the same thing over and over again. At least that’s my experience.

What I quite like about this is the international flavour of it. The fact that I’m being introduced people from really different parts of the world and cultures. And it’s very, very open, and it’s a real contrast to the bit that you just mentioned, where the corporate bit, and obviously there’s a side of our community which is very much devoted to turning a profit and what have you. But there’s a significant proportion of the people who don’t have that metric in their head when they’re introducing themselves to people.

They are just trying to be helpful and trying to deliver on the promise that the internet gave us back in the 1990s of, here’s the infrastructure to pass information around freely. Wouldn’t it be nice if everybody had the capacity to publish things, or to share things online without some sort of corporate overlord or paywall or algorithm? Which we’ve now probably regret deeply allowing that to happen to the internet.

All of those kind of things come into play. I have constantly, for the last decade, tried to sum up and capture what this is. And I always fail. It simply feels nice, is all that I’ve got, really. This community, the people in it that I hang out with, it just feels like a nice thing to do. That’s all I’ve got. No wisdom beyond that. It’s bizarre, isn’t it?

[00:10:53] Cathy Mitchell: I’ve been trying to quantify it too, and especially planning this next conference. I feel much like a student because there’s a large group, probably most people are not like me. Like they’re like you, at least the ones, in Slack that I’m talking to on a daily basis. And they’re the original nerds who are so happy, like were inspired and spent their free time, like this wasn’t their job. Promoting this and like answering my questions in forum as an absolute noob. So in that way I feel like I would really like to give back now.

But the community, yeah, I can’t quite put my finger on. I just talked to a sponsor yesterday and she is of course wanting to get in front of her audience, which is agency owners. But there’s a real sense of promoting the community because the healthier the community, the healthier all of us are. Not just financially, but it creates the forward momentum, I think as far as open source as a whole too. Like there’s a bunch of us, me included, even though I kind of am taking a corporate angle that really believe that open source could change the world. I still do, maybe even more so because AI is, can actually talk to things that are open source. Less so if everything’s behind a paywall.

[00:12:09] Nathan Wrigley: I think one of the things that you mentioned there, which suddenly sort of struck me is whilst there are a handful of people out there, and I say a handful, there’s obviously many millions of people. I think it’s fair to say that many people prefer to be in proximity to other people, to do things, to be in conversation with people, to have a shared experience. You know, we go to the cinema or the movie theatre to watch a movie. I mean I know the screen’s bigger and everything, but part of it is to be with other people and to go ooh and ah, at the same time and go to firework displays and concerts and things like that.

Now all of that stuff can be done in an isolated environment in your house. You know, you can watch Netflix and you can watch the TV and get a similar kind of experience. But I think there’s some sort of core part of me at least, and the people that I hang out with at these kind of events and online who just enjoy that shared experience, that willingness to be involved in a similar task. Just to be pointing in the same direction as a bunch of other people, pulling together on the same team. And it’s unquantifiable. I literally can’t encapsulate it, but I think you and I are talking about the same thing.

What’s interesting is I accidentally found it fairly early on in my WordPress journey. Serendipity played a really blinding hand for me there. But I think had I not had, bit like that film Sliding Doors, I could easily have missed the cues which sent me to that WordCamp or whatever it was that got me started. And I probably could have gone for a decade or more and not even noticed it was a community and maybe discovered it much more recently.

And it sounds like that’s kind of happening to you. You mentioned that you are, I think in the show notes you described it as, it’s a lovely phrase, empty nesting. Does that mean when your children grow up and go away? Is that what that means?

[00:13:53] Cathy Mitchell: Yeah. That’s a pretty common phrase over here.

[00:13:55] Nathan Wrigley: Oh, okay.

[00:13:56] Cathy Mitchell: This side of the pond. You know, you kick the little birdies out, and they’re spreading their wings. All of a sudden we’re left with, it’s a different life stage. I think we were talking a little bit about it. You’re getting there.

[00:14:08] Nathan Wrigley: I’m going to there very, yeah, awh, it’s kind of filled with melancholy. On the hand, obviously I would love for my children to grow up, but on the other hand it’s, pulls all the heartstrings, doesn’t it?

So you are finding space in your life to do this kind of stuff. I’m going to ask a question, which is maybe a little bit personal, I don’t know. Hope you don’t read it in the wrong way. Do you find this stuff like meaningful and significant? Do you get a sense of fulfilment and satisfaction from the work that you are doing? For example, with WordCamp Canada.

Because there must be moments when it’s a real chore and, you know, you’ve got far too many tasks which are spilling over, and you think, gosh, I’m just a volunteer. There’s no quid pro quo here. I’m just doing it out of the goodness of my heart. But on balance, do you get that warm and fuzzy feeling from doing all of this?

[00:14:54] Cathy Mitchell: That’s a good question. I had time, so I started volunteering at a bunch of things. I started volunteering teaching kids, and then to go the complete other end of the spectrum, I did a seniors class at my local college last month. I just started volunteering because in my opinion, as a little amateur psychologist, I think service, serving our community is kind of the best way to, like you said, pull alongside someone. And then when you have like a focused goal, there’s a togetherness and I really need to grow my community.

Me, and I think quite a few other people, there’s this whole epidemic of loneliness to be frank. Having raised the kids and then having done the job, now all of a sudden it’s like, I have time to invest in a real community. And I really want it to be worthwhile. I don’t want to sweep the floors for, maybe it’s an age thing, I don’t know. I’m so, so grateful that they let me do something that I’m good at, as far as organising, because they didn’t have to. That’s a big responsibility to put on somebody. And I am praying it all works out in the fall.

But it comes because of the huge number of volunteers that all work together. So my job’s just basically pulling all these people together, and making sure that we’re talking to each other. Because one person can’t possibly do all of the work that comes with putting on a conference. At least not part-time. But yeah, I’m finding it immensely rewarding because I also feel like I’m good at it. Everybody loves to do something they’re good at.

[00:16:28] Nathan Wrigley: You mentioned something earlier where you sort of implied that you were very surprised that in the WordPress world, you were given a bunch of responsibility for an event. I mean, basically, I think a lot of that, isn’t there? There’s a lot of, whoever can show up does get the job really, because there’s a paucity of volunteers. And for an event of the magnitude of WordCamp Canada, if you’ve ever been to events like that, you sort of walk in and on every level it feels like a corporate event. You know, it’s very polished, highly polished. There’s catering, the venue’s all been booked, you’ve got name badges and there’s probably some translation going on, and there slides and every, there’s timetables and everything. And it’s all done by volunteers.

And I remember the same sort of thing, being asked to do a variety of different things and thinking, wait, really? You don’t know the inside of my head. I will mess this up so badly. But that is such a nice characteristic of our community. And you’ll fail together, if you know what I mean? You know, it is not like anybody’s going to let you deeply fail. People will step in and help you, should you need to.

[00:17:31] Cathy Mitchell: Yeah, we have to say yes, like it’s part of the culture is, if people volunteer, we have to find a way to say yes. Like our default is yes, not, well, have you done this first?

[00:17:43] Nathan Wrigley: Yeah. It’s interesting because you obviously have done a lot of this kind of corporate stuff, and so have the impression that you ought to be qualified, I don’t know, a decade or two decades of this particular thing in order to be trusted to do it. And this is just, yeah, this is so different. Anybody? Bueller. Okay, you’ll do it. Great. Fine. That’s great, yeah.

[00:18:03] Cathy Mitchell: Yeah. You’re hired.

[00:18:04] Nathan Wrigley: Yeah, that’s it. That’s I’ve never done it before. It doesn’t matter. You’ll be brilliant.

[00:18:07] Cathy Mitchell: We’ll help you.

[00:18:08] Nathan Wrigley: Yeah. And that camaraderie of binding together on a particular thing, in your case WordCamp, but the broader project, you know, the WordPress project as a whole, I feel it’s full of these kind of people. And we will get into in a minute I’m sure, how that maybe has changed for some people in the more recent past, and about the fact that the community does feel like it’s in a bit of a challenging place at the moment.

But I just want to go back a little bit because you mentioned, and neither of us I suspect will have the answer to this, but I’m interested in your intuitions anyway. You mentioned that people nowadays, maybe this has always been the case, but it feels like there’s been a change. Loneliness seems to be a very common thing now. And my sort of back of the napkin calculus points me in the direction of wondering if it is actually oddly technology. The very thing that we’re celebrating. If technology might be responsible for it.

For example, I look around and I see a lot of people who give an awful lot of what would’ve otherwise been free time, time that they could have gone out and socialised and what have you. And, you know, you sort of end up sitting on the couch and scrolling through social media and things like that.

Television has become so absolutely fascinating. You know, there’s like a billion different channels, and essentially there’s a thousand ways to keep yourself entertained all by yourself, and never speak to another human being, or be in proximity to another human being. There’s no question there, I just wondered if you had an observation or a similar thought process.

[00:19:39] Cathy Mitchell: I looked up, because I knew we were going to talk about this, the stat on it. Because I know I’ve had the same feeling. And I’ve heard people talk about it, but I didn’t really know if that was like true or not, because whenever I am thinking or researching something, of course that’s what the algorithm shows me. So I’m always kind of hesitant, like is this actually real or am I just seeing this?

But it did say in a 2021 report, the US Surgeon General, and this is in the States, no 2023, that the health impact of a loneliness epidemic. Okay, General Vivek Murthy declared a loneliness epidemic in 2023. And he said that the health impact is the same as smoking 15 cigarettes a day. It’s not good for us. And that the biggest effect, 79% reported feeling lonely of the 18 to 24-year-old group, which is more like 40 some percent. What was it? 41% of 66 plus.

[00:20:35] Nathan Wrigley: Okay, so the younger you skew, the more lonely you are likely to be.

[00:20:40] Cathy Mitchell: Yeah. And we also see, now I don’t know if this is correlative or causative, but technology has also skyrocketed in that period of time.

[00:20:48] Nathan Wrigley: Yes. Yeah, and also probably, again, I’m drawing conclusions which are not based in fact or research or anything like that. You and I were both born in an era where that technology wasn’t available. So I imagine patterns were set down in our infant brains, which are perhaps different to the patterns that are set down now.

It’d be curious to see if there is a there, there. If the broad adoption, certainly in the UK, I can’t speak to Canada, but the broad adoption of technology to ever and ever younger children, to a really alarmingly early age. You know, you see children who are not even at school age who seem to have access to every technology under the sun, and who don’t seem to get that interaction from another human being. I wonder. And I’m going to sound all curmudgeonly and there’s probably going to be people shouting at me.

[00:21:34] Cathy Mitchell: I have seen it change with the Gen Z that they’re talking about. And my kids fall in that category. Whereas I wanted to be, okay, it’s personal responsibility, so we’re going to raise them. It was new to me, so I raised my kids thinking, okay, tablets, I’m going to teach you how to use it, not restrict it. I was all open-minded about all.

Now they’ve told me that if they have kids, they will restrict it far greater than I ever did. They were like, they won’t have nearly the freedom that I gave them in my open-mindedness.

[00:22:06] Nathan Wrigley: Yeah, well, but you are forgiven for your open-mindedness because I guess humanity perhaps needed more evidence to draw conclusions around that. And perhaps those conclusions are now landing.

[00:22:16] Cathy Mitchell: I think so.

[00:22:16] Nathan Wrigley: Yeah, well, certainly as an example, I know that in Australia more recently, there’s now a widespread ban, I think under the age of 16, and I’m going to use the word illegal, maybe that’s the wrong word. Maybe there’s a technical definition, but social media is not permitted for children under the age of 16. And I think that there’s legislation being talked about in the UK of a similar nature, and some other European countries.

I don’t know how much traction that will have because I feel that there’s a persuasive argument, much like you described of, it’ll all work itself out. You know, we don’t need the government to tell us what to do, and all of that, and that all makes sense.

But my, I can well understand, I think in the UK also, there is a growing, a groundswell of this alternative way of looking at it. Like a rejection of the phones and the technology.

Anyway, there we go. That was an aside. Do you want to contribute into that a little bit more before I push us back in the WordPress space?

[00:23:11] Cathy Mitchell: Yeah, I don’t want to be all, it’s bad, it’s bad, but I think that we’re seeing an effect. I really do believe that volunteerism, whether it’s with WordPress or anything else, in my faith background, being a person, a Christian person, I grew up seeing the service as an answer, as just part of our lifestyle. You just serve others. But now I’m seeing it come in a secular sort of way as well, where service is an antidote to loneliness.

And I think no matter where you’re serving, not the church or any, like just pick a service. Being that cameraderie with people, having a similar goal, going in the same direction, like I really do think there’s hope. There’s hope out there for all of us. And it’s a great way to do something meaningful. Like you get to do all those things. You get to practise a skill, you get to do something meaningful, you get direction, you get cameraderie all by serving.

[00:24:03] Nathan Wrigley: I’m going to, say something now, and I’m going to caveat it heavily before I say it because A, it relies on my prodigiously bad memory, and B, it could just be fabricated anyway because the source could be utterly wrong. But it feels like there’s a kernel of truth in it.

I was doing some research recently about happiness, that broad subject. You know, we would all like to be happy I’m sure. There’s a lot of people who spend a lot of time thinking about what this actually means, and trying to drill it down to some fairly basic maxims, if you like, for what leads to happiness.

Two of the biggest indicators of happiness are really interesting. One of the two is how often you spend with other people basically. How much time you interact with other human beings. Now I know that that’s not for everybody, but broadly speaking, that seems to be a huge indicator. If you actually get yourself out and you do things with other human beings, there is a definite benefit.

And the other one, which is very curious because I think it’s fair to say, you know, Canada and the UK, we’ve been brought up to worry about our own finances and amassing as much stuff as we can, and lining your nest for the future and everything. Well, this other one, controversially, the second one that I’m going to mention is the amount of stuff that you basically give away. And that could be time, or it could be finance, it could be any of those things. The more that you give away with no expectation of a return, that also apparently is a real indicator of happiness.

And I think we can all identify that. That moment where you give somebody a gift and you’ve really thought about it, and you hand it over and you watch the face change as they unwrap it. And you think, they’ve loved that, haven’t they? And you’re not thinking to yourself, well, I did that. I made them happy there. You’re just thinking, oh look, they’re really happy. Isn’t that wonderful? So anyway, there’s my 2 cents of utterly unproven thoughts.

[00:25:59] Cathy Mitchell: Okay. Learned something. Those are two, so the two things were being around people and altruism basically, with nothing expected in return.

[00:26:08] Nathan Wrigley: And funnily enough, they map very closely to what we’re talking about, right? We’re talking about events and socialising with other people, but also that, in this case, it’s not a financial thing that you are giving away, but you are definitely giving away an awful lot of your time for doing these kind of things. And maybe, given that little bit of information, it kind of becomes a little bit easier to justify because if you can say to yourself, this makes me happy, it might not seem it in those stressful moments.

[00:26:36] Cathy Mitchell: Yeah, today.

[00:26:37] Nathan Wrigley: Yeah, that’s right. But ultimately that might be causing your happiness.

Okay, so there we go. That was our little segue. Let’s sort of bring it back to WordCamps. You were very kind to write me a bunch of show notes, and they really drew me in as I was reading them. And I want to sort of dwell on a few of them because you.

[00:26:53] Cathy Mitchell: Had to convince you to get me on the podcast.

[00:26:54] Nathan Wrigley: Yeah, no, there not a lot of convincing needed. I loved it. You’ve got some sort of bullet points if you like, not really bullet points. You’ve touched on different areas where you feel that you’ve got something to say about, I dont know, why people might contribute and why they might volunteer and what have you.

So it’s things like, why might new people, newbies, as you’ve described them, volunteer and why might business folk volunteer?

So the first one was, let me go back. So I’ll read into the record what you wrote because it makes a lot of sense. You said, in 2025 I helped the organisers for WordCamp Canada and this year found myself the lead organiser. And this has been consistently one of the nicest, most open groups, that I’ve ever been part of. And then you strayed into why other people, for example, new people and business people might like to contribute.

So on the business side, you said, volunteers, boundaries when not getting paid, giving back, sponsoring folks, not necessarily a financial return on investment. And then for the newbies, you said, there’s other ways to contribute, for example, contributing in code or non-coding ways, and also just being a recipient of the open, friendly community that you encounter. So that was really it. Maybe I’ve said everything that you wanted to say.

[00:28:07] Cathy Mitchell: Well, those are kind of questions that I had coming from a corporate, and I keep talking to different people trying to figure out, I guess I’m looking for something other than altruism when comes to the corporate people at least. Like why are they sponsoring? And I can see, the pessimistic, or maybe the pragmatic, side of me to be positive wants to know why. Why are they putting the dollars in?

But then on the other side, I think, well, if WordPress doesn’t do well, then they don’t do well. Like, if their businesses are based on WordPress. But then I also saw something that, if you sponsor open source projects, it makes hiring people that much easier, and also vetting people that much easier. Because it gets you into the community and so it goes both ways. People will be more likely to apply for your jobs and you will be more likely to have a way to vet them. That’s one thing I saw.

[00:29:04] Nathan Wrigley: I think there’s a lot of truth in that, or at least I’d like to believe there’s a lot of truth in that. That makes me feel happy about the whole situation. But what’s curious about what you’ve just said, and I don’t know how much of an intuition you’ve got on this, but if you were to go back to, let’s say the year, oh, I don’t know, 2018 or something like that, WordPress was experiencing this really stratospheric growth. You know, in terms of market share of the internet broadly, you know, the number of websites as a percentage, WordPress was going from sort of the low twenties to the mid twenties, high twenties, and then through the thirties, and then finally landing at this sort of 40%.

And during that time, saying this phrase sounds ridiculous because it is ridiculous, WordPress could kind of do no wrong, I think. There was just growth upon growth upon growth and a lot of companies, I don’t think needed to explain themselves to their directors quite so much. The return on the investment didn’t need to be made. It was just, look, we’re part of this thing, and there’s this rising tide, and we are one of the boats. And look, we’re going up as it all goes up. So it just happened.

However, during COVID, and then especially over the last few years, and then now especially the last couple of years, inject AI into the mix, I feel that that calculus has changed a little bit. And there’s this inkling when you speak to the same corporate people who a few years ago were willing to open their wallets to sponsor events, the wallets are much, much harder to open.

Again, in much the same way that I don’t really know why the community is so fabulous. I don’t really know why the wallets are harder to open. But I think the landscape for sponsorship, and the requirement of a return on investment, as opposed to, well let’s just join in because WordPress is growing. I think that calculation is going to be harder and harder to make. And maybe you’ve got experience of this over at WordCamp Canada trying to gather sponsors. Perhaps you found it straightforward. Perhaps it’s been difficult. I don’t really know.

[00:31:08] Cathy Mitchell: There’s almost like a perfect storm right now because wallets are tighter because over the last few years, at least in the States where my clients are, it’s become, economically there’s uncertainty. And so that trickles down and trickles up, right? And so more wallets are going to be a little bit more restrictive on what they’re going to buy, and they’re going to want to see more bang for their buck.

Corporately, also there’s been this huge rise in competition in the corporate world. There’s just way more competition over the last five or six years for just about anything when it comes to agencies or plugins or themes or whatever, there’s a lot more great competition, like good products out there. But then there’s also a lot more competition to get the clients, like clients have a lot more options.

And so I think it’s a perfect storm. Like, do you want to put your money into WordPress because is that the future? Is there money for sponsorship? Plus WordPress has become stricter on what they require to sponsor, as far as trademark use and different things that have been put higher on the priority list.

And I kind of see it like a levelling off. Like not as a bad thing because every industry can’t just, go, go, go, go. Like there’s going to be a levelling, right? Can’t be that easy. When I started, I didn’t even advertise. And I’ve had this business for 19 years. I’ve never advertised. That is going to go away. Like it was just, you know, I lucked out starting somewhere, but that’s not realistic.

[00:32:44] Nathan Wrigley: So what’s interesting in that is I think I am the same. The only period in which I’ve been in the WordPress community was during this stratospheric growth period really. Everything has been, you know, people have argued on the inside about this, that, and the other thing, and whether a feature should ship in Core, or whether or not we should do this thing at an event or what have you. So there’s been some minor disagreements.

But broadly speaking, the whole project has just swelled and swelled and swelled. There’s this overarching sense of optimism and growth, and now the brakes are on. And so for me, it feels like unfamiliar territory. And because it’s unfamiliar, it feels a little bit scary because I don’t know what that means. I don’t know whether that means that things are going to just level out as you just described, or whether it means things are going to decline, or whether it means some of my friends are going to go away because the community, it’s no longer going to be something that they wish to frequent because their profitability is under question and they need to seek revenue from other different options. Maybe AI, maybe, whatever it might be. And so I think my concern just, it’s probably self-interest really. I’m just concerned because I don’t know what’s coming and that fear is, well, it’s fear.

[00:33:57] Cathy Mitchell: I think this brings me perfectly into the WordCamp Canada thing that I wanted to mention. Just because I see this event, and even the community team, as a whole in WordPress. There are teams in WordPress, by the way, for people that don’t know, that help you get involved. It’s not just coders, like there’s all kinds of teams. And one of them is the community team, and all we have to know how to do is plan an event or host an event or serve coffee. It’s amazing. But anyway.

I am excited about WordCamp Canada, and the reason I’m putting so much time and effort into this conference is because I really see it as a light at the end of this tunnel. Not at the end. Maybe midway. I have no idea what’s going to happen to my own business, to WordPress, I don’t know. But I think there’s one thing that I’m fairly certain of, even now, even in the midst of AI, and that’s open source. I really still believe that open source is the way of the future. I still think it is, open source and AI are probably the way of the future. Yeah, I don’t know how else to say it.

And I think the exciting thing, and the thing that we need to do as people who got to take advantage of that uprise and that uptick, is you and I need to get young people involved. Like we need to get those young people involved in open source. I don’t even care if it’s WordPress or not, but they need to become part of a community that is exciting, that is beyond themselves. They need to see that we’re nice. We don’t bite. We’ll hire them. There’s just so much good that can come out of being together. And these are the nicest people. They’ll talk to people that are just standing around in the hallways with nobody to talk to, which is me. I’m an introvert, ironically.

[00:35:38] Nathan Wrigley: You definitely don’t come across like that, just so that you know.

[00:35:40] Cathy Mitchell: Well, we’re I’m pretending nobody else is listening.

[00:35:43] Nathan Wrigley: The other thing that I would add, as you were saying all of those things, it occurred to me that, I would imagine that people in more senior positions, I don’t really know how to describe it in the WordPress world, have got a similar intuition to the one that you just described. In that they can definitely see that the future needs to be thought about in terms of the youth coming in. Because there’s an awful lot of work being done at the moment and an awful lot of hours being put into educational initiatives.

And also, not just where you and I are living, but all over the world. And it was kind of interesting at WordCamp Asia recently, that was a big focus. A lot of people talking about exactly this thing and these kind of overlapping initiatives that are beginning to bear fruit. So people coming out of universities who’ve had experience of open source and WordPress in particular. And children at schools having experience of open source and WordPress.

And I think, as much as we would like open source and WordPress to win, just from a moral point of view, wouldn’t that be a great thing if everybody just noticed it and got on and used it? I think we need to do a bit of work to make sure that it’s being put under their noses so that they can make those judgements for themselves. And that is definitely a part of the future.

[00:36:57] Cathy Mitchell: Yeah, the Campus Connect and the Credits where they can university credits, like it is getting popular in other places we haven’t heard so much. But I really want to introduce it and bring it to the conference in Vancouver this fall. Because we can have universities in Canada and the US, on this side of the pond get involved in this and actually give kids credits that they can use to graduate.

[00:37:21] Nathan Wrigley: It’s so interesting as well because it’s very hard to, how to describe this, that’s a difficult one to sell, let’s put it that way. The people that are really into those initiatives really love it, but it’s hard to get people to notice that that’s going on, and hard for people perhaps to notice how important that is. But without those little foundational bricks being put in place for the future, this rising tide carries all boats metaphor, that’s not going to happen. You know, I think maybe another good metaphor there is they’re kind of building the harbour wall to make sure that the boats have got something to rise against. And I think that’s really important.

And your part of the world is definitely open to that, I’m sure. Seems to be that some European institutions, colleges, universities and South American institutions and parts in India and Southeast Asia and places like that are also beginning to bite on those ideas as well. So it’d be really interesting to see how that all goes.

You’re painting a picture, Cathy, which makes me feel optimistic. Feels like there’s a lot of positivity coming out of where you are, yeah.

[00:38:24] Cathy Mitchell: I’m probably going to get in trouble for saying this, but for all of the faults that Matt might be accused of, somehow he put something in place that became very, very popular. And the culture that I have been a part of, I haven’t worked for Automattic, but the culture at the WordCamp level and volunteering and the community team has been unbelievably positive, and foreign to me. Like I’ve had to learn this culture. What do you mean there’s no application process? How do I say yes? What are you talking about? So somehow this has grown. And he has had a lot to do with it. People don’t like that he’s had a lot to do with it, but there’s some truth there.

[00:39:07] Nathan Wrigley: It’s really interesting and it doesn’t matter how many times I have conversations like this, I’m always confused by it. I can never get my hands around it and work out what the secret sauce is so that I could copy and paste it into a different locale or a different jurisdiction or different era. But there’s a there, there. There’s something very satisfying about this community. And from everything that you’ve said, it sounds like you are very positive about it. And I share your positivity, even though sometimes it seems quite hard to grasp in the more recent times.

Oh, Cathy, that’s been absolutely wonderful. I’ve enjoyed chatting to you today. We’ve hit the sort of sweet spot of the amount of time that we’ve got, so if it’s okay with you, we’ll wrap it up there. Just before we go, if anybody wants to get in touch with you, or just sort of wants to pat you on the back for your wisdom there, where would we find you?

[00:39:55] Cathy Mitchell: Well they can find me at WPBarista. And right now they can also find me at canada.wordcamp.org.

[00:40:02] Nathan Wrigley: Okay. Well I will make sure that that goes into the show notes. So if you’re listening to this, head to wptavern.com, search for the episode with Cathy Mitchell, that’s Cathy with a C, and you’ll be able to find the details in the show notes there. So Cathy Mitchell, thank you very much for chatting to me today. That was lovely. Thank you.

[00:40:19] Cathy Mitchell: Thank you. I enjoyed it.

So on the podcast today we have Cathy Mitchell.

Cathy has been working with WordPress since 2007. What began as a fun personal project during her maternity leave soon evolved into a fully fledged business with the launch of WPBarista in 2008. Over the years, Cathy has garnered extensive experience in the WordPress space, and is now working towards the 2026 WordCamp Canada.

The conversation focuses on the powerful role of community within the WordPress ecosystem, something that Cathy is deeply passionate about. We discuss how open, welcoming, and international the WordPress community feels compared to more traditional corporate or volunteer environments. A theme that emerged was how involvement in WordPress has provided Cathy, and many others, with a sense of belonging and fulfillment, especially after life changes like becoming an “empty nester”.

The discussion explores the motivations for volunteering and organising within the WordPress community, both from the perspective of newcomers looking for purpose and connection, and business owners assessing the return on investment from contributing or sponsoring events. This included how easy it is to get involved, the unique lack of barriers and red tape, and the value of altruism and camaraderie.

Other topics we explored were the broader impact of technology and loneliness, the importance of service and community for well-being, challenges in sponsorship amid changing economic times, and the vital need to engage the next generation in open source.

If you’re interested in the human side of WordPress, how volunteering shapes both individuals and the broader community, and what the future might hold for WordPress events and contributors, this episode is for you.

Useful links

 WPBarista

WordCamp Canada 2026

WordCamp London

 WordPress Campus Connect

WordPress Credits

💾

Gutenberg Changelog #131 – Gutenberg Plugin Releases 23.1 – 23.3, Calls for Testing for 7.1 and more

In episode 131 of the Gutenberg Changelog, Birgit Pauli-Haack welcomes Isabel Brison to discuss the latest developments in Gutenberg plugin releases 23.1, 23.2, and 23.3, as well as progress leading up to WordPress 7.1. The hosts highlight recent calls for testing, including collaborative editing—previously delayed from 7.0 due to stability concerns—and the new media editor modal for the image block.

Isabel Brison shares insights into the new responsive global block styles, allowing users to customize styles per device breakpoint, as well as updates to the layout and dimensions controls in the block editor. She encourages feedback from users as these features iterate for the upcoming WordPress 7.1 release. The episode covers stabilizations, such as the improved, more ergonomic media editor and cropper, and strides in accessibility, particularly regarding the tabs block.

The hosts also discuss experiments in dashboard widgets, content type management, and empowering plugin developers with new admin UI components. Both stress the importance of community feedback and testing, given the ambitious new features arriving soon. The episode wraps with practical notes on documentation improvements, React 19 integration, and a reminder of the short summer break ahead.

Show Notes / Transcript

Show Notes

Special guest: Isabel Brison

Calls for Testing

What’s released

Gutenberg releases

Stay in Touch

Transcript

Birgit Pauli-Haack: So welcome to our 131st episode of the Gutenberg Changelog. We will talk about Gutenberg plugin releases 23.1, 23.2 and 23.3. There are calls for testing out for WordPress 7.1 and we have more. I’m your host, Birgit Pauli-Haack, curator at the Gutenberg Times and a full-time core contributor for the WordPress open source project sponsored by Automattic. Today, Isabel Brison joins me from Sydney again. Isabel is a longtime core contributor and JavaScript developer on the Gutenberg Project. Welcome back to the show, Isabel. Thank you for joining me. How are you?

Isabel Brison: I’ll be good. Thanks for having me. It’s always a pleasure to be here.

Birgit Pauli-Haack: Well, I’m so glad you’re here because you and your team have worked on some of the most exciting features that coming to Gutenberg. People have been waiting for quite a long time. So we will dive in when we get to the updates. How is Sydney?

Isabel Brison: It’s winter, cold, rainy, you know, the usual.

Birgit Pauli-Haack: The usual? Yeah. How is the technology? I know you’re going to meetups there. Are these WordPress meetups or are these other technology meetups?

Isabel Brison: I go to a variety of tech meetups. There’s not a huge amount, so I’ll go say to JavaScript meetup and there’s a good technology leaders one too. I enjoy going to the Python meetup even though I don’t work with Python. It’s just a lovely community and they have some interesting talks. So it’s sort of whatever’s on offer, I guess.

Birgit Pauli-Haack: Oh, nice. Yeah, I found out in Munich to the technology community and I kind of connected with a local Claude meetup community and it was kind of interesting at the Technical university or the Design university, they switch around the places, but it was interesting. Yeah, they had some lightning talks. Yeah, like 20-minute talks and it was really cool. Yeah, I think we need to get out more.

Isabel Brison: Yeah, no, I like, I like going out after work and just, you know, even if it’s just to listen to some tech talks, you get a bit of air and meet new people.

Birgit Pauli-Haack: Yeah, that’s good. Yeah. 

Announcements

All right, so we have a few announcements. WordPress 7.0 has been released two weeks ago and we are heading big steps towards 7.1. Beta 1 is scheduled for July 15th. That’s kind of a little bit of ahh. It’s only six weeks away.

Isabel Brison: Yeah. So we get going not long time at all.

Birgit Pauli-Haack: And contributors have been working on the next major version already. So the official roadmap planning post is in the works. The team is in the final steps to assemble the release squad and we do well from the Gutenberg plugin releases we get a pretty good idea what might come through also from what didn’t make it into 7.0 as well. So we will. But it’s the web, right? Web is translated for me in the Japanese kind of design thing. Yeah, it’s like wabi sabi. Nothing is finished, nothing is last, and nothing is perfect. So we always get work to do and it’s always getting better. Yeah.

Isabel Brison: Yep. It’s a work in progress.

Birgit Pauli-Haack: It’s a work in progress. 

Calls for Testing – WordPress 7.1

So there are two calls for testing out now. One is announcing the collaborative editing outreach effort for 7.1. Many of you dear listeners remember, okay, collaborative editing, real time collaborative editing was pulled from the 7.0 because it wasn’t stable enough for all the hosting environments that are out there. And there was this call for testing out for hosting and now there’s another one for outreach effort to make sure that everything is kind of caught for 7.1. 

And Anne McCarthy just published it on the Make Core blog so you can join it anytime. There’s a separate channel Collaborative Editing Outreach that you can. It’s kind of modeled after the full site editing outreach program that ran for two or three years. I hope this doesn’t run for two or three years before it’s released, but it definitely there are more people kind of discussing it and how it all supposed to work. Amy Kamala, who was the Release Coordinator for 7.0 and Justin Tadlock, who is a developer advocate at Automattic and Theme Team Rep are helping Anne to coordinate those calls for testing. And also some of the teams at Automattic who work with Enterprise level are also there. So yeah, it’s a bigger discussion on how collaborative editing works on all the levels.

Isabel Brison: Yeah, it’s a pretty big and complex piece of work.

Birgit Pauli-Haack: Yeah, join the channel and dive right in if that’s a feature that you are excited about. I’m excited about it. But I also only have two or three people that handle my editing stuff. So I don’t have 10 or 15 editors in my post zone. 

Another call for testing is about the media editor Modal that has been added to the image block. Ramon Dodd published a call for testing about two weeks ago about the new modal for the image cropper. It’s kind of the bigger image cropping in the block editor, so you don’t have to. It’s a much easier way to get your images in line, but you can also rotate the images and resize them. And it has been merged with the Gutenberg plugin. It also, with 23.3, is out of experimentation. So anybody who has the Gutenberg plugin installed can be testers. And Ramon has some great details on how to test things and what to look for and how to share the feedback. It also has a little paragraph there on what’s out of scope. So for this version, we of course share all the links in the show. Notes. Isabel, you’re part of that project. What excites you about it?

Isabel Brison: I haven’t actually, actually worked on it. Well, not I, I, I helped a little, a little bit at the very beginning when we were discussing sort of choice of libraries and whether to build our own or use a third party. And a bit with the initial testing, but it was mostly Ramon and Andrew’s work. This latter part, the bit that’s now in Gutenberg, in fact, it was all their work. And I think it’s super exciting because replacing the old, the old Cropper, I. I never liked it. I have to be perfectly honest.

Birgit Pauli-Haack: I hate the old Cropper.

Isabel Brison: I never could figure out how to use it. It was not ergonomic at all. And this one is such a better experience. Aside from allowing us to do all the stuff that the old Cropper, the in Editor Cropper is what I’m talking about. The one that you can access from the Image block toolbar. It’s also on the site Logo block. So you can now access it from both those blocks and the new one, in addition to what the old one did, also allows you to do free cropping and free rotating. So if you want to rotate your image 3 degrees and if you want to crop it to whatever weird aspect ratio you like, you can do that, which you couldn’t on the old one. Yeah, and it’s. It’s just a much nicer experience. I believe it’s also more accessible than the old one in terms of the keyboard accessibility of it. It’s. It’s better too, so. All advantages. Yeah, they did a great job on it.

Birgit Pauli-Haack: I used it just for a little bit and I was so amazed how smooth it was. Yeah, I kind of. It was also much more intuitive. I never knew what to do with the Cropper when I was pinging it previously and said, so how do I do this now? Every. I had to think every time. And this one is very, very intuitive and very smooth also to use it and to see it. So I’m really happy about that. I’m hoping it makes it into 7.1. Yeah, so we have that.

Isabel Brison: Yeah, it’s, it’s on track, I don’t think. I mean, barring any major natural disaster, I don’t think that there’s any reason for that not to make 7.1. It’s a great piece of work. It’s really stable and now that it’s not behind the experiment flag anymore, real users are using it. I’m sure we’re going to get tons of feedback if there’s anything that’s not 100% perfect and we still have time to iterate on it until beta one.

Birgit Pauli-Haack: I really appreciate that Roman and Andrew went to the research portion and kind of looked at how other graphic programs actually are doing things and tried to get some of the experiences also into the blocked. So okay, yeah, so two calls for testing for those who want to dive in. It’s a very good way to contribute to WordPress because it’s so close to what you’re doing with WordPress. And not only developers but also content creators can help testers even better and those who work at agencies or work with clients at agencies to kind of see how that all works. Which brings us to what’s released. I mentioned it. 

What’s Released – WordPress 7.0

WordPress 7.0 Armstrong was released. We talked about it in previous episodes on this changelog with various people from the agency view, from the designer view, from the content creators views. We will share in the show notes in case you need to catch up. The Field Guide the link to the official field guide for WordPress 7.0 as well as to the source of truth on Gutenberg Times that has all the user facing stuff in there. Those are the best information on 7.0. I have not seen in the last two weeks any major boo boos that came in. Yeah, it was such a great testing cycle with a delay of six weeks. 

Most of the bugs were actually caught quite early or in the loliso, I don’t think. I’m not sure when there will be a point release which normally happens within a few weeks of the major release, but I have not seen any planning for that. But it could be end of June after WorldCap Europe. 

So let’s dive into the Gutenberg releases. We start with Gutenberg 23.1. Oh, one question, Isabel, do you have a favorite feature that came into WordPress 7.0?

Isabel Brison: Oh, I don’t know. There’s a bunch of interesting features and I worked on some of them. Of course I have sort of my personal favorites of the ones that I worked on of which one that is. It was very, very subtle or sort of low profile. We didn’t talk about it much, but I worked on a little handy addition to the grid block or the grid layout type, I should say. That allows us to configure a responsive number of columns. So by setting column count and a minimum width you can say I want my block to always have at maximum three columns but on smaller screens it can go down to two and even one. So that’s something we didn’t have before and I’m quite happy with it. I think it’s a good improvement. But compared to. Oh, there was. There was loads of stuff. The pattern editing work I think is going to be really handy. And what else? There was the notes feature.

Birgit Pauli-Haack: No, I was in 6.9 already. Yeah.

Isabel Brison: Oh yeah. No, there was something about what? Oh God, I’m confusing my releases.

Birgit Pauli-Haack: Yeah, yeah, they’re kind of. They melt together once it’s released. They melt all together. It’s kind of. Yeah. Was it there or there? Yeah, sometimes. 

Gutenberg 23.1

All right, let’s dive into Gutenberg 23.1. It was released on May 7, had 212 closed PRs by 49 contributors. So we are really wrapping up the releases or the work on Gutenberg and the block editor. It’s now not only the block editor, it’s also the site editor. It’s the data views, it’s the. The design system, those all. So the Gutenberg repo has kind of exploded in other areas for the WordPress ecosystem. So. But yeah, the first one on the list and it’s. It’s really interesting how these change logs are actually automated and coming together is the upload media and it enabling concurrent sideload uploads. That’s an interesting thing because it’s so performance issue to have multiple streams on upload on images so you don’t have to wait so long that the image shows up in your block canvas. And that’s a really good improvement for that.

Isabel Brison: Yeah, yeah. I’d imagine when uploading, when bulk uploading particularly.

Birgit Pauli-Haack: So when you copy paste content from another source it has this also a feature that you can download and upload the images that you connect there. And that also happens in this module stream uploads thing. So it’s really cool. You only know this because it’s faster but other than that there’s no disruption of your work or any of that.

Isabel Brison: Yeah, there’s a lot of good work. This was also the client side. This is part, I believe, of the client side media processing work that did not make 7.0 but is now being aimed at 7.1. That’s mostly Adam Silverstein’s been working on that. I haven’t kept a close eye on it, but it looks like, you know, very useful work and it’ll be good once we manage to get it in for performance.

Birgit Pauli-Haack: Yeah, Adam Silverstein has worked on these image handling features quite a bit for 6.9 as well. 

Enhancements

So yeah, there is an enhancement that I have flagged here, but I’m not sure how useful that is. It’s for the WordPress UI overlays and a global preview styles on the storybook. So the WordPress UI is the next level of components for WordPress.

Isabel Brison: It’s sort of the successor of the components package.

Birgit Pauli-Haack: Yeah. And at the moment both are used, but I have seen now efforts to migrate, merge things, I don’t know how you call it, but to get it kind of in one thing. But the overlays, the preview styles is how you can show the preview in the storybook so you have a better inkling how it’s going to look later on.

Isabel Brison: Yeah, that should be good.

Birgit Pauli-Haack: And then there are tons of changes for the components, the admin ui, the UI components, dialogues. This is mostly for developers that are working with WordPress and creating their own either building WordPress or creating plugins for WordPress to have a unified design system, unified component system that they don’t have to kind of come up with their own interfaces. Those decisions are already made and you can kind of build on top of things before any of that, even the components, every plugin had to design their own interfaces and now this is really cool.

Isabel Brison: Yeah, it’s good to have a sort of a system that you can use when you’re extending and you need to build a new screen or something for your plugin, you can just use these components and everything looks integrated with WordPress.

Birgit Pauli-Haack: And it’s also good for the users because they don’t have to think about how do I use this tool now? Or how, how is. How do I filter now on this screen? Because it’s all a unified system and it’s all built out and stable. So the next thing is on the notes getting a few updates. So right now it’s in 23.1. It’s mostly refactors on the positions and the floating board. But we will see later in, in the other releases that there are some nice features coming in for the Blocked libraries. We have updates to the tabs block. I’m really hoping that it comes into 7.1. It’s still behind an experiment flag, but now it can handle duplicate tabs, meaning duplicate handles on the tabs. And it follows now WCAG tabs pattern for accessibility in the renaming of the blocks. So which is a. It’s a major step towards accessibility and acceptance for that. I’m really waiting for the tabs to come into Gutenberg or to.

Isabel Brison: Mostly I think the renaming was about as I understand it, so that the blocks have names that match the accessibility standards or how these things are known as. There’s a WCAG pattern it’s linked to in the PR, and those sort of example patterns that the WCAG website has for people to know how to use ARIA attributes correctly, which is a whole science. And the idea is to have our tabs blocks match the names of that pattern so that it feels more standard and it’ll be more familiar to people who might have implemented tabs in other places.

Birgit Pauli-Haack: Yeah. And those are the standards also where screen readers kind of tap into and people are. That use screen readers kind of have a common pattern for that. Yes. So that definitely elevates the tabs block in its accessibility. Yeah.

Isabel Brison: So it’s going to be pretty useful block once it’s stabilized. So I hope it is.

Birgit Pauli-Haack: Yeah. Yeah. I know that quite a few block collections have tabs right from the beginning in the last eight years. And they’re not going to go away because the first iteration of any of the core blocks will not be as feature rich as any of the block collections that have been developed for the last six or seven years. Yeah. The next one is tapping into the image cropper we talked about. So you can. And it was tapping into the keyboard actions with drag handles on the canvas. So you can use your mouse to do some of the actions that you want to do with the image cropper or the image tool. Yeah, if you say Image Cropper, it kind of reduces it to cropping, but yeah, it’s also the handling to rotate

Isabel Brison: And all that too.

Birgit Pauli-Haack: Yeah, yeah. There’s a new API for the WordPress grid package, but that’s a different grid that you are working on.

Isabel Brison: Yeah, that’s not the layout. The block layout grid. This is something else. This is a grid that you can use for dashboard UI.

Birgit Pauli-Haack: Exactly.

Isabel Brison: Sort of admin stuff.

Birgit Pauli-Haack: Yeah. That’s the new API that powers the new experiments that in Gutenberg. That is the dashboard widgets. We kind of talked about it a little later. You as a plugin developer or extender of WordPress, you can use them now as well for any of your dashboards. If you are having a plugin that has some data vising kind of, you can put them into these grid package and display them on your plugin settings pages. The guidelines is also a new API and it has now a public API method and the REST API route to it. There have been iterations after 23.1, so I think that that would be really helpful to look at later. 

New APIs

The guidelines are actually a whole set of content types that are for AIs. Pretty much when your agents come to the WordPress site, you can tell them what to do with things. What’s the purpose of the site? The editing guidelines? Yeah, how, how you want AIs to behave on your site if you let them in. And it’s really important when you have other agents come in that you don’t control. Yeah, that sounds scary. 

But if you as a site owner connect your Claude to your website, you can have in the guidelines all the things that you want Claude to know about your site. So it’s. You don’t have to put it all in a prompt and it kind of finds all the things and it’s also your memory. So if you use an agent to do your SEO, to do your. Some of the content updates like headlines or tags, your policies on how to do tags and categories, that’s all things that you can solidify in your documentation in the guidelines for your AI. And it will remember that. But it’s also interesting to see the discussions about it. I had a short discussion with Grzegorz, who was a former co-host here on the Changelog, a few, I would say a few hundred episodes before, but it wasn’t that much. But he is now part of that team who thinks about AI and memory and all that. And it was really interesting to hear because if you are in an agency, you work on multiple different sites, but you have one Claude, so you don’t want things to bleed over from one site to the next. And these guidelines help you kind of keep track of everything. So it’s an interesting problem space that came out with AI.

Isabel Brison: It’s like providing the correct context and the correct amount of context so that the AI can be maximally productive on your website, whatever you want to do with it.

Birgit Pauli-Haack: Yeah, right. Yeah, yeah. Most people are really not all that into. Site owners are not so into AI, but it helps a few things quite nicely. I find it with SEO and with yeah, accessibility and all that. It’s really helpful to have a double check there. Yeah. All right, what’s next in 23.1? Do we have something? 

Experiments

Oh yeah, there’s these custom taxonomies experiment in 23.1 with the custom post types and taxonomy management that started out as out of. I don’t know how that came about, but it probably is one of the radical speed month project as well that people say okay, we probably need to have content management when the APIs were in WordPress in 3.1. But there is no interface there and there were always plugins there to do this, be it custom UI, custom post UI or ACF or so. But there’s no interface for. And that’s where this experiment comes in to kind of push the envelope on that a bit. Have the REST controllers in there, have the interface in there. But it definitely is not the last word spoken there yet because that is a field where there have been a lot of extensions in the universe or in the WordPress ecosystem that might not fit in where this is going. So it’s just a. It’s a prototype kind of experimental way to do that. But check it out. You just have to enable the experiment in the Gutenberg plugin and then you can kind of try it out and work with it. It uses the common APIs. 

The other experiment is the dashboard. We talked a little bit about it because that’s the grid package was created for that. The dashboard to have administ page routes and sidebar menus as a shell to add additional grids on the dashboard. I’m interested to see. I haven’t played with it yet but I want to see if I can. So what are the dashboards? The dashboard right now is just a. The quick edit and the site health and the news that’s on your dashboard right now and a few other things and plugin kind of tap into that as well. But I have never have not seen yet and I’m still thinking about it to. Maybe Claude can help me with that. Having a quick edit that’s a block editor actually. So when you log in into your WordPress site you don’t want to kind of just do all the other admin stuff. You just want to create a new post. So why not have it on the dashboard and create a blog post right there from the quick edit. Quick Edit only gives you text based things but not block editor.

Isabel Brison: So a block based quick edit, do you reckon all the blocks. I reckon it would need to be A very simplified version of the block editor.

Birgit Pauli-Haack: Yeah. Yeah.

Isabel Brison: Maybe images, paragraphs, but yeah, that would be cool.

Birgit Pauli-Haack: Yeah, yeah. Lists. Yeah. Like an outliner kind of. Yeah. Very fast kind of. Yeah. Maybe come back to the white space, but kind of instead of having a classic editor, just build blocks with it. Yeah. So kind of a distraction free, quick edit, full set, toolbar on top kind of thing. I don’t know. When I’m bored, I’m gonna star B. Prototype it. Prototype it. Yeah. And get it in. Yeah. That. That was one of the things that a lot of writers said. I don’t want to deal with all the stuff I’m getting so distracted. Yeah. There’s announcements and all that. So let me just start my blog post. But anyway, and then there is a list of Media editor modal call for testing. We talked about it. There’s a whole in 23.1. There’s a whole list of bigger and smaller PRs that went in. I think the call for testing gives you all the ins and outs of it that I think was. Was it. Did you find anything for 23.1 that you wanted to talk about further?

Isabel Brison: Not. Not really. Apart from the things that you’ve already highlighted. I just thought. I already mentioned that the media editor is also on the site logo block. So you can test it on both blocks and that’s it.

Gutenberg 23.2

Birgit Pauli-Haack: So right into Gutenberg. 23.2 was released on May 21st and also with 204 PRs by 50 contributors and there were four first timers there. Congratulations. You got your first contribution to WordPress core. Yeah. And you got your badge. Well, you got your badge when 7.1 is released, I guess the first feature that is listed is the responsive global block styles with states. This is so cool. Yeah. What does it say? Can you walk us through it?

Isabel Brison: Yeah. So this was the first part of the work towards enabling responsive styles for blocks. And it’s with States because it leverages a style states API that was already built. So Maggie Cabrera was who did that initial work for the States API, and her part was just leveraging it for adding the ability to style pseudo states for very few blocks have pseudo states. Well, this might be extended, but it won’t be super extended because not all blocks need to have pseudo by pseudo states, I mean hover focus and things like that. So usually only interactive blocks would need those. 

And so States came about to cater to that pseudo element scenario. But it was always something that could potentially be extended further. And one of the use cases that had been thought out when this initial idea of having the states API was thought it was using it to be able to create responsive styles for blocks was one of the possibilities there. And I had been eyeballing all those issues that have been sitting in the Gutenberg repo for years about creating some mechanism that allows us to define responsive styles. And I finally had the opportunity to pick them up. And having that state’s work already partially done was great because, you know, sometimes it’s starting something is the hard part. And there were endless decisions in the repo about how should we build this and let’s do this and let’s do that and let’s not do that. And it’s like we should take this into account. You know, how you can talk and talk and talk and then it never actually starts because it seems like the problem is too big and too complicated. And the more that’s added to the discussion, the bigger and the more complicated it gets. 

But there was this little stepping stone. This states API had already been built. And so I thought, well, it’s already in there for pseudo states, let’s try building responsive. So we call them viewport states. I’ve been working on this with my teammate Dan Richards. We’ve both started working on this and thought, okay, let’s do as sort of a baseline for global styles, but then as a stretch goal, let’s try and do it for actual block instance too. So we managed to do both in the end, but for 23.2, it was only the global block styles that was ready. And this means when you go into the site editor and into the style section, where you have global styles, then you go into blocks. This only works for blocks. It doesn’t work for top level global styles yet. We’re not quite sure. Well, we’re not quite sure if there’s a need to add this to top level stars yet. It’s still something that’s being thought about because for a lot of them, so a lot of really sort of global basic elements like typography, you know, font sizes. Okay, we already have ways of defining them responsively even without using breakpoints. So we are using the clamp function. You can define a maximum and a minimum and you can pretty much, you know, manipulate it so that you get your different font sizes on mobile and tablet and desktop. So there is to some extent you already have that responsive functionality there. So that’s something that might be looked at later on for enabling actual breakpoints for those global styles. But for now it only applies to blocks so for each block you can go into the block, into the block’s global styles and you can pick a state. There’s a new little states drop down at the top and so by default you’ll be styling the default state that’s you know, no media query. And then you have a tablet and a mobile state and the tablet state is only, so it’s, it’s only from you know, the top level. Like what’s your maximum Breakpoint to the minimum, which is the maximum for mobile. So the tablet styles will only apply to tablet to that breakpoint and then the mobile styles will only apply to their own breakpoint. And that’s. Yeah, essentially that’s it. 

You can do anything color typography and spacing wise. So for most blocks you know, you have the typography, you have the colors, you have dimensions like not for most blocks you don’t have dimensions, you have, you know, margin, padding, block gap if the block has layout and you can define per break point what you want those values to be. And there are certain features that exist in global styles that do not yet work with, with that responsive logic and those. So when you enter that breakpoint you know, you get, you choose the tablet viewport and you’ll see that some of the tools might be hidden. So for instance, Duotone is one. You can’t set Duotone per breakpoint yet. This is something that will be worked on in the future but it feels like a bit like I’m not sure how many people will need to change the colors per break point. That’s not usually responsive styles are more about spacing dimensions, that sort of thing. So we focused more on those that felt like these are the ones that are really going to be used by most people and the more edge Casey ones if they don’t work out of the box, we sort of. Okay that, you know, that’s a problem for later. We’ll, we’ll figure it out later. And Duotone is one of those awesome.

Birgit Pauli-Haack: Yeah. Well a lot of people have been waiting for that a long time. So glad you, you finally started taking it.

Isabel Brison: I hope it’s useful. I just hope that folks can take this and like ok, okay, I can finally build the thing and yeah, and it works. And please, please, to anyone listening and wanting to try this out, if there’s anything that’s not working, if there’s anything you don’t like or you think, no, no, this should be different because it doesn’t work. Just please give us feedback. We need feedback because this is in the plugin now it’s aimed to go into 7.1. We still have those six weeks until beta one. Those six weeks will be iterating on the feature. The earlier we get feedback the better so that we know if there’s anything that really isn’t working for anyone then we can change it.

Birgit Pauli-Haack: Yeah. Yeah. Awesome. So that’s a 23.2. There’s also a WordPress components called WordPress Theme and that’s actually the theme for the admin section. We have definitely confusion things going on because we use the same term for multiple things that are totally different and have nothing to do with each other except they are now motion design tokens for duration and easing in the WordPress theme component. So if you want to use those for your admin pages and plugins, go have at it. I am really because it kind of gets you a little bit more into a more interactive way to build websites and I think we really like those or I do. Yeah. Although I’m not a motion or animation kind of person. But yeah, I like when it’s nice.

Isabel Brison: Yeah. Little bits of discreet smooth animation here and there can really make a web experience.

Birgit Pauli-Haack: Yeah. It’s kind of a quality of life kind of thing. Yeah. Yeah. What else is in the 23? Yeah, the content types. It was an iteration on. We talked about it on the content types experiments with various improvements and post type and taxonomy management, duplicate view, quick edit actions. A ton of PRs have been added to that so it definitely is maturing and you can with 23.2 also the media editor modal had matured and there is now. I also will share in  the show notes a link to an overview issue on the Dashboard experiment so you can go back and read up about it, what it’s all about. Because there’s a whole lot of work still being done with that. 

Experiments

There’s also an experiment on the classic block migration notice. I’m just pointing that out because you might see it that the classic block might get deprecated or might not be available in certain situations.

Isabel Brison: Yeah. I believe the plan is to deprecate it and remove it at some point, but it’s a whole process because I guess lots of folks are using it. So it needs to be slow, give people time to adjust, choose alternatives.

Birgit Pauli-Haack: Yeah, well it has been in Gutenberg for eight years and all that and actually what I found is that some of the AI tools actually create blocks that need to be. That are looking like classic blocks and need to be migrated to blocks before they can be in the block editor canvas. So, yeah, those things also need to be kind of tested in that space.

Isabel Brison: Yeah, that’s a good point. With AI, with AI tools increasingly being used to build websites and create and. Or move content across from other places, it. You don’t want AI sort of adding the classic block to its knowledge base and suddenly deciding that the easiest way to do anything is to just dump all the content into a classic block,

Birgit Pauli-Haack: Which what they’re doing right now. Yeah.

Isabel Brison: So this is a good time to deprecate it so that. Okay, let’s. Let’s ensure that AI works properly, that it’s easier for AI tools to work properly and do things as we expect them to.

Documentation

Birgit Pauli-Haack: It hasn’t been merged yet, but there is also a documentation issue. It’s a big. It was a big undertaking that Juan Margarito took on, was that it was found that an AI can’t really find documentation on the block markup for each of the core blocks. And that was a documentation gap that was kind of found that none of the block library blocks had a readme so it wouldn’t. So what Guan Ma did, he created automatically from the block JSON files a readme for each block on documentation site and then created some tokens where you can have on the readme additional manual content that’s put in there and then have a parser go through that and put it into the block editor handbook. And that is a really. So it talks about the supports, it talks about the, the, the global styles design tool supports about the block markup and also the connection with other blocks. It’s a comprehensive documentation about each block and that’s in the block handbook. It will be merged. We had a hardware hangout on it. We had a proposal on MakeBlog, a core block about that. And I think it’s finally going to be merged within I hope a week, but maybe days.

Isabel Brison: Oh, cool.

Birgit Pauli-Haack: That’ll be super useful. So it will be in the, in the block edit handbook. It has an additional 80 pages, of course. Yeah. But they’re all connected and categorized by blocks. And so now block developers and there were some comments from the community where people said, well, I wish I had that when I was starting out learning about block development and now it’s finally coming. But it was a huge undertaking because it kind of created a ton of new code and that all needs to be reviewed. And it was so. But there were a lot of people kind of working on that. Guided or spearheaded by Guan Ma but it’s now coming and it’s really cool. I’m so happy that it made it.

Isabel Brison: I mean, you can never have too much documentation, but developers are crap at writing it. So, you know, nowadays we have tools to assist us in the creation of the documentation and we should leverage them.

Birgit Pauli-Haack: Yeah. And the hybrid version, automatic documentation plus a way to have also manual content in that is actually a good combination because for some of the blocks, Joe Dawson from the Accessibility team has said, okay, maybe we also want to have some documentation about the accessibility of blocks. And anybody who has comments on that can add it to the, the readme file of that particular block to elaborate on that. And that is outside of any automation. You can just add it to the page. And it was really cool to see that process working. I post a link to the proposal into the show notes just as a side note here. 

Gutenberg 23.3

And now we’re coming to 23.3. That was just released a day ago June 3rd with 270 closed PRs and 57 contributors. So we are ramping up to 7.1 kind of thing. And the first item on that is really cool that you can now that the notes section. And I think it was Adam Silverstein as well who worked on that.

Isabel Brison: Oh yeah, the multiple notes per block. Yeah. Oh, that’s cool. That’s really useful.

Birgit Pauli-Haack: Yeah, so you can have multiple threads or comments per block. That’s also helpful when you work with AI that comes in and kind of reviews some of your post and posts notes in there. So yeah, it was really helpful. And it’s also. And he found it to be necessary to have that. So what’s missing in the notes in comparison to Google Docs is that you can highlight a section and then comment on that section. So yeah, like, okay, you probably can delete this half sentence or something like that. And that you couldn’t do that up until now. And with the multi threads on the notes for a block you can highlight a section because if the paragraph is, I don’t know, 10 lines or something like that, you might have multiple comments on the, on that block. And now you can have that. So it’s really cool.

Isabel Brison: Yeah. So the note is attached to a part of a block and not to the block itself.

Birgit Pauli-Haack: Yeah, yeah. The next sections are a continuation on your quest for responsive styles.

Enhancements

Isabel Brison: Yeah, that’s part two, part two of the work which is enabling responsive styles for block instances. So again this, this was a part. So Maggie Cabrera had worked on the sudo style states for global styles and she had an open PR to add them to block instances. And Dan and I basically hijacked her PR with her approval of course. We asked Maggie first, can we just take this work that you. She was off doing something else. She wasn’t actively working on the PR at the time. We thought ah, we could just take that over and finish it and then build the responsive styles on top of it. So we did and that obviously there was work already pre-existing so it sort of made it easier to build it step by step on top of it. And now we have in 23.3 the ability to add responsive styles to. So any block, open a post, pick a block, open the inspector controls and then at the top where you have the block name you have this little menu which has a drop down that has the states. 

So again just like with global styles we have tablet and mobile. The default is what you get by default what you already had. And then you have a tablet breakpoint and a mobile breakpoint. And for those again as in global styles there were a few things that didn’t really work out of the box, a few of the controls. So we decided to hide everything that doesn’t work. So for now what’s enabled is only the controls that you can actually create responsive styles with. Those are pretty much all the block supports, the standard block supports like color typography, dimensions, block gap. Now layout is also supported and we aside a sort of side effect of that was that we ended up moving the layout panel into the styles tab. And well that was sort of. I’d been wanting to do that for ages I have to say because to me it didn’t make any sense at all that layout was in at the same time. Settings tab and Dimensions, which has controls that are intimately related to layout such as block gap was in the styles tab. And so I felt the. The only thing that makes sense is to have them side by side. If it’s not the same panel, which I still think we could maybe make it the same panel. But that’s another different conversation. But at least they’re side by side. So now layout is in the styles panel. That’s the reason why it’s in the styles panel. So when we have a responsive state enabled we’re only showing the styles panel in the inspector and only the controls that work, which is most of them. There’s a couple of things that we had to hide again, you know, duotonethings like that. 

And for block instances there are some blocks have custom controls and some of those custom controls should probably become Block supports. Some are like aspect ratio is a block support, but there’s only one block using it and there’s a couple of blocks that have their own custom implementation of aspect ratio. This is something that should change. I have an open PR to try and enable aspect ratio to work responsively because I feel that that’s one of the important ones that people will want to change aspect ratios for different breakpoints. So that’s in progress and what our plan is basically to try to get as much as we can working until 7.1.

Birgit Pauli-Haack: Awesome. So when I want to start testing this, I’m going to add a paragraph to my block canvas and then I go to the block inspector and say, okay, this paragraph, I want a different background for a different viewport. So on the mobile I want it green and on tablet I want it yellow and on desktop I want it gray.

Isabel Brison: Yep, you can do that.

Birgit Pauli-Haack: Okay. Yeah, so that’s how I will change it.

Isabel Brison: You go into. So you give the default. The desktop is the default. I guess we’re not mobile. We were never mobile first really. I mean Gutenberg has from the beginning being a dev stop first experience. And that’s how it’s sort of turned out to be. So you have default desktop and then you can go into the tablet state, you can select the tablet state and then whatever you add to the visible controls in the block inspector in that state is exclusive to that state. And you can go into the mobile and choose a different color for that and save everything and then you can go and do the good old resizing. Well, in the block editor we leveraging the responsive preview, the sort of device specific preview to show you a preview of what the styles are as you’re editing them. And then once you go into the front end, you can resize your window to your heart’s content and see all the changes happening.

Birgit Pauli-Haack: All right, all right. So that is really cool and I’m looking forward to kind of testing it out and trying it out and have opinions.

Isabel Brison: Yeah, yeah, no, lots of opinions, I’m sure. And one of the things that I feel like we haven’t got 100% right is the previewing because you switch like you go enable mobile state for this block and it switches you to the mobile preview. But then you can select another block while still being in the mobile preview and then you’re not in the mobile state for that blocking. So I feel like this is something that we’re working on. We need to improve that experience and feedback. Again, very welcome. What are your opinions on this and how you think it would be the most intuitive to work with.

Birgit Pauli-Haack: Well, awesome. Yeah. I’m thinking maybe we should actually have a demo hallway hangout about that somewhere. Let me think about that. Well, I have a time issue because I’m going on vacation.

Isabel Brison: Okay. Yeah.

Birgit Pauli-Haack: Coming back to the beginning of July, but yeah, definitely. Maybe find somebody to do a demo video or something like that. Well, the demos are all on the PR, so definitely check those out because they’re the best way to learn how to use that and how what works or what doesn’t work. Yeah. All right. What’s else in 23.3?

Isabel Brison: There was so much. Well, the media editor was stabilized, so now it’s no longer an experiment. You get it by default whether you want it or not. Again, I mean, we hope to get feedback on that. I think it’s a pretty good piece of work, honestly.

Birgit Pauli-Haack: Yeah, it is. Yeah. Yeah, absolutely. Yeah. Just wanted to. You said it in the. You talked about it. But if you are looking for the layout panel after 23.3 Gutenberg plugin install, it’s not hidden, it’s not lost. It’s in the Styles tab now.

Isabel Brison: Yes.

Birgit Pauli-Haack: Some content creators that are not interested in this, all that, they might have a little oops, where is it? Kind of thing. It’s in the other tab now. Yeah.

Isabel Brison: And that is. It might be weird for blocks that still have a Settings panel. So, for blocks, what happened with the group block? For instance, the group block only had layout and position in Settings, so we moved position into styles. Because it makes sense. Position is a style. And now the group block doesn’t have a Settings tab. So you open the group. I think it’s much easier because you don’t have clicking, clicking, clicking. Everything’s there, everything’s visible. Layout, position, all the other controls in the same tab for other blocks. For instance, the navigation block still has a bunch of stuff in Settings. So if you put a navigation block on the page and suddenly you’re, oh, where’s the layout controls gone? Okay, they’re in the Styles tab. They’re no longer in the Settings tab.

Birgit Pauli-Haack: I just wanted to point that out. People kind of miss that part because they’re so excited about the responsiveness. 

And then there’s also. Oh, there was one thing that was fixed. It was a. I would say it was a bug, but it is an enhancement that the additional CSS. If there was an error in there, you wouldn’t see that when you get back into the post again, until you interact with the additional CSS field, you wouldn’t see the error message. So unless you interact with that, you wouldn’t see that it’s actually not working. That has changed. That now has a little notification that there is something in the additional CSS that’s not valid CSS for those who muck about with that. Yeah. And here it is. The PR78653 has the modal media editor, image cropper modal being the default experience for the block editor. It’s out of experiments in. Another thing for 23.3 is that Gutenberg upgraded to React 19. This is important for plugin developers and those who have a very tight handle on the dependencies for their work. React 19 is now the default and there might be dragons out there. Please, please, please, yeah. Give feedback on that. Create issues what works and what doesn’t work. Especially what doesn’t work. So those can be fixed PR 7.1 so you don’t have any surprises later on. What else? I think those were the, the big items.

Isabel Brison: Yeah, I mean I’ve, I’ve been sort of like under, under my responsive styles rock for these past few weeks just working on that. Very, very fixated on getting this thing right.

Birgit Pauli-Haack: So I have to say nothing.

Isabel Brison: I mean it’s definitely got a huge amount of attention to. Yeah. What else is out there?

Birgit Pauli-Haack: Definitely God’s work.

Isabel Brison: Hopefully it’s worth it.

Birgit Pauli-Haack: Yeah, absolutely. Yeah, absolutely. Yeah, I think that’s it. As I said, there are 270 PRs. So. Yeah. And it just has been released for a while ago.

Isabel Brison: There’s a lot of enhancements and bug fixes and stuff in here.

Birgit Pauli-Haack: Yeah, that’s it. I think we are good. So, dear listeners, you will see on the Weekend Edition and the Gutenberg Changelog will pause during my vacation. I’m going on vacation next week, which is June 15th and I’m coming back in beginning of July. So in time for 7.1 beta, you’ll hear us again and you will read us again. 

I’m so happy, Isabel, you are here on the show to walk us through all the good things that come with Gutenberg to 7.1, especially the responsive parts. The responsive parts. I like that. Responsive parts. Thank you so much for taking the time out of your busy work schedule and be on the show and walk us through that.

Isabel Brison: No worries. You always enjoy this show.

Birgit Pauli-Haack: Well, thank you so much. And as always, dear listeners, the show notes will be published on GutenbergTimes.com podcast. This is episode 1311 31st. And if you have questions or suggestions or news you want us to include, send them to changelogutenbergtimecs.com that’s changelogutenburgtimes.com

Thank you all for listening. And until the next time, and I see you in July. 

Isabel Brison: Bye bye.

💾

Calls for Testing, Gutenberg 23.3, Block MCP and more — Weekend Edition 367

Howdy,

This is the time of the year when publishing on the Gutenberg Times becomes less frequent. I will be on vacation and back at the beginning of July with the weekend edition, just in-time for Beta 1 of WordPress 7.1. Three more Gutenberg plugin releases will happen before that.

What also happened was that someone grabbed my instagram account in this AI hack at Meta. Although Meta reports this as resolved, I probably won’t get my account back. I am now actively looking for a better way to share my photos without the overlords that can’t keep things tight. 🤦‍♀️ It’s not that I didn’t know better. <sigh/> 🤷‍♀️ It’s a cautionary tale for what’s in store for all internet services handing over crucial business processes to a gulliable AI.


I had the great pleasure of going on the OpenMakers show with Abha Thakor to talk through what WordPress 7.0 “Armstrong” means for you. First, the safety bit: test on a staging site or Playground before updating, and check your PHP. Then the good stuff. Visual revisions show edits in context with color coding. Notes keep feedback inside the editor. Patterns gain content-only editing, blocks can hide by device, and new AI connector APIs give developers a unified foundation. Real-time editing waits for a later release.

Yours, 💕
Birgit

WordCamp Europe LiveStream was up and running and Friday’s keynote can be watched online. Two worlds collide: WordPress at CERN with Joachim Valdemar Yde and Francisco Borges Aurindo Barros. The Livestream are all routed to the WordPress YouTube account. The schedule is posted on the website.

Over the course of the weekend more recordings will be uploaded to WordPress TV > WordCamp Europe 2026.

On Saturday, Matt Mullenweg, co-founder of WordPress and CEO of Automattic will close out WordCamp Europe 2026 with his keynote. Afterward, the organizers will reveal where WordCamp Europe 2027 will take place. Tune in around 2:15 UTC / 8:15 am EDT.


Developing Gutenberg and WordPress

Arthur Chu walks you through what’s new in Gutenberg 23.3. The modal media editor is now the default for cropping. It pulls cropping, flip, rotation, and metadata into one place. The experimental customizable dashboard grows too, with five new widgets you can drag and resize. Responsive styles now reach individual blocks, so designs adapt per screen.


Rae Morey reports that Gutenberg 23.3 brings an experimental, customizable WordPress dashboard. It’s the admin’s biggest structural shakeup in years. You can drag, resize, and rearrange widgets like Welcome, Activity, and Site Health to fit how you actually work. It’s the first testable preview of a long-discussed overhaul. Enable it under Gutenberg > Experiments to try it.


Jarda Snajdr reports that the React 19 upgrade has been reverted in Gutenberg. Shortly after 23.3.0 shipped, many plugins built for React 18 started crashing. The APIs barely changed, but the runtimes clashed: React 19 rejects elements made by a bundled React 18 JSX helper. So 23.3.2 rolls back to React 18. The team still plans the upgrade for 7.1—this time with a feature flag and a compatibility layer.


Isabel Brison and I chatted extensively about the latest Gutenberg plugin releases 23.1 to 23.3 and discussed the responsive controls now available in the Gutenberg plugin for desktop, tablet and mobile view ports. The episode will drop in your favorite podcast app over the weekend.

Rich Tabor shares a few “little big things” for WordPress editing. The idea is simple: complexity has piled up, and small fixes can clear it. His PRs make block locking a one-click job in List View. They keep you in place when editing synced patterns, instead of whisking you off to another view. And zooming out reuses the familiar Patterns Explorer. He’s not precious about them—contributors are warmly invited to take them over the line.


Dave Smith walks you through an interactive prototype reimagining the WordPress Site Editor around user goals rather than system architecture. Built during Automattic’s Radical Speed Month, it keeps the same blocks, templates, and data model intact while changing entry points, language, and defaults. Since internal research flags the Site Editor as the top driver of negative support outcomes, you’ll see how remapping it around what you want to do could ease that friction. It’s an experiment, not a roadmap.

Calls for Testing for WordPress 7.1

With WordPress 7.0 out the door, contributors shared a series of Calls for testing this week to prepare for WordPress 7.1. The schedule is tight with Beta 1 slated for July 15, 2026.

Ramon Dodd puts out a call for testing the new Media Editor Modal. Cropping in the block editor hasn’t changed much in years, and the old inline tool leans on a limited third-party library. This new standard way of Image edition inside the Block editor replaces it with a WordPress-native one. You get freeform and aspect-ratio cropping, flip, rotation, and metadata editing in one place. The quickest way to try it is a ready-made Playground link. Feedback is welcome via the comments or GitHub.


Anne McCarthy announced a collaborative editing outreach effort for WordPress 7.1. After real-time collaboration was pulled from 7.0, this gathers real-world early adopters across many hosting setups to find bugs faster. It lives in one Slack channel, #collaborative-editing-outreach. If you’d use collaborative editing regularly and run the latest Gutenberg, you’re invited—through the cycle, with a test team badge at the end.

Rae Morey has the skinny for you in Contributors Launch FSE-Style Outreach Program to Get Real-Time Collaboration Ready for WordPress 7.1


Adam Silverstein puts out a call for testing client-side media processing, now targeting WordPress 7.1. Here’s the idea: when you upload an image, your browser resizes and encodes every size locally using VIPS in WebAssembly, before anything reaches the server. That eases CPU and memory load on hosts and brings modern formats like AVIF, WebP, HEIC, and JPEG XL to every site. Browsers that can’t cope fall back quietly to server-side. Try it in Chromium with the latest Gutenberg.

Plugins, Themes, and Tools for #nocode site builders and owners

Brian Coords invites you to a live panel on practical AI workflows for WordPress and WooCommerce on Tuesday, June 30, 2026, at 10am PDT. Hosted with Shani Banerjee and featuring Nik McLaughlin, Kyle Runner, and Suzanne Kolpakov, the conversation covers WooCommerce MCP, the WordPress Abilities API, Pressable MCP, and making your own plugins more agent-ready. You’ll come away with practical ideas for managing stores and guiding cautious clients, plus open Q&A. Can’t make it live? Register anyway for the recording.


Nathan Wrigley talks with plugin reviewer Luke Carbis about the future of WordPress plugins on the Jukebox podcast. Here’s the worry: plugin submissions have quadrupled in a year, largely AI-generated, so good plugins struggle to stand out. Carbis floats ideas you can test: logging into your site with your WordPress.org account, installing from your own Git repos, or a commercial marketplace funding contributors. They also weigh AI ethics, a generational backlash, and his proposed AI-disclosure header for the directory.


Wes Theron published a new training video and you can learn how to customize your site’s navigation menus with AI. Once your site is connected, you describe the change and the agent makes it. You’ll learn to add a page to your header, remove an outdated link, and reorder items. It also covers building dropdown menus under an unclickable parent, adding a footer menu, and linking to blog categories. The point: clear menus help visitors find what matters.

Theme Development for Full Site Editing and Blocks

Ajit Bohra and the LUBUS team released Color Palette Block 2.0, a free plugin for building and sharing color palettes in the block editor. It grew out of their own client and internal documentation needs. It’s handy for brand kits, design systems, and style guides. You add swatches manually, pull from your theme, or generate random ones. Pick from four display styles—Square, Polaroid, Circle, or Droplet—and copy each color as HEX, RGB, HSL, or a CSS variable.


Justin Tadlock shares a playful tutorial on registering custom icons for WordPress 7.0’s new Icon block. Since the public registration API won’t land until 7.1, you’ll learn a clever workaround using PHP Reflection to reach the protected WP_Icons_Registry::register() method, bundling SVGs in your theme through an Icon enum and registrar class. Built on work by Ryan Welcher and Nick Diego, it’s educational fun—not for production, where Nick’s Icon Block plugin still does the job properly.

 “Keeping up with Gutenberg – Index 2025” 
A chronological list of the WordPress Make Blog posts from various teams involved in Gutenberg development: Design, Theme Review Team, Core Editor, Core JS, Core CSS, Test, and Meta team from Jan. 2024 on. Updated by yours truly. 

The previous years are also available:
2020 | 2021 | 2022 | 2023 | 2024

Building Blocks and Tools for the Block editor.

Casey Burridge introduced Block MCP, GravityKit’s open-source WordPress MCP server. The problem it solves is familiar: existing MCPs treat a post as one HTML blob, so AI edits strip block markers and break your layout. Block MCP exposes each block as an addressable unit with a stable ID. Your agent can make surgical edits, batch up to 50 changes atomically, and undo any of them. In their tests across Claude models, only Block MCP worked reliably.

Need a plugin .zip from Gutenberg’s master branch?
Gutenberg Times provides daily build for testing and review.

Now also available via WordPress Playground. There is no need for a test site locally or on a server. Have you been using it? Email me with your experience.


Questions? Suggestions? Ideas?
Don’t hesitate to send them via email or
send me a message on WordPress Slack or Twitter @bph.


For questions to be answered on the Gutenberg Changelog,
send them to changelog@gutenbergtimes.com


Featured Image:


#219 – Austin Ginder on How AI Is Exposing Hidden Threats in WordPress Plugin Updates

Transcript

[00:00:19] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case, how AI is exposing hidden threats is WordPress plugin updates.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact forward slash jukebox and use the form there.

So on the podcast today we have Austin Ginder. Austin has been involved in the WordPress ecosystem since 2010, and since 2014 has run Anchor Hosting, a business that manages thousands of WordPress websites. While he’s a developer and automation enthusiast at heart, in recent months Austin has found himself at the forefront of a burgeoning crisis in WordPress, security supply chain attacks targeting plugins.

A chance discovery during a malware cleanup on a client’s site, propelled Austin into what would become a wider investigation of plugin vulnerabilities. What he uncovered is both alarming and timely. Bad actors aren’t just hacking sites directly, but are instead infiltrating the supply chain, either by purchasing plugin companies and weaponising them, or by hijacking plugins and pushing out malicious updates. These attacks are subtle, often shifting plugin update servers away from wordpress.org to rogue channels where malware can be distributed, leaving end users in the dark, and their sites at risk.

We trace Austin’s journey from accidental security investigator to creator of the WP Beacon Project, a resource aimed at tracking, documenting, and alerting the WordPress community to known supply chain attacks.

He shares how AI tools have radically changed what’s possible in threat detection and forensics, enabling individuals, and hopefully someday, the larger hosting providers to identify patterns and root causes behind widespread infections.

We get into case studies of specific plugins compromised in recent months, the challenges of auditing over 60,000 plugins in the wordpress.org repo, and the complexities of stopping these attacks once malicious code is in the wild. Austin also discusses his hopes for greater collaboration with hosts and security researchers aiming for better automated monitoring and response.

If you manage WordPress websites, create plugins, or just care about the future of open source security, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Austin Ginder.

I am joined on the podcast by Austin Ginder. Hello, Austin.

[00:03:40] Austin Ginder: Hey, good to meet you.

[00:03:41] Nathan Wrigley: Very nice to meet you too. I was put in Austin’s way by I think Courtney Robertson.

Thank you Courtney for that because, on a different podcast, which I do, we were talking about an item, which is very much in the news at the moment. It’s all to do with plugins and security. And whenever I say security, any of the people that I have on the podcast, I feel it’s pretty important that person gets a chance to stamp their credentials into the podcast about themselves. Because it’s one of those areas where a little bit of knowledge can go a long way. Tell us about your background, WordPress hosting, security, those kind of things.

[00:04:16] Austin Ginder: Sure. So I’m a developer, first off. I’ve been running a WordPress hosting service since 2014, and I’ve been working in the WordPress space since 2010. A long timer. I love automation. WPCLI commands, bash scripts. I’m in the weeds on a technical basis.

But in terms of security, I wouldn’t call myself a security expert, which is ironic for this conversation because of some of the things I’ve been finding over the last month or so. And it’s all thanks to AI. AI has been my friend. It’s just right place, right time, getting lucky and also just a mix of everything is changing right now in the world.

[00:04:56] Nathan Wrigley: Yeah. Thank you for that. So as you’re about to hear, we’re not gonna be talking at from the perspective of Austin demonstrates how to fix a particular challenge in WordPress. It’s much more of a general thing, and an alert really. It’s a bit of a call to action about a problem which has been systemic in the WordPress ecosystem, well, forever really, since I guess, plugins came along.

And this is all about really change of ownership of plugins, and I could do a job of trying to describe the scenario here, but do you want to just run through what you’ve discovered in the last few weeks, and the three or four incidents that you’ve uncovered and what they mean and how they’ve come about?

[00:05:37] Austin Ginder: Yeah. So in particular, we’re talking about supply chain attacks, and a supply chain attack is a different kind of attack. It’s not a direct, my site got infected with malware or something like that. It runs a little bit more deeper. It’s a scenario where either it can happen a couple different ways.

A hacker might get control over the plugin repo itself, maybe a credential breach, where they sign in and they are acting as the author, and they push out bad code. As a user, you just update your plugin and you don’t realise you’re updating to something that’s harmful for your website.

So that’s one scenario. The other scenario which is crazy to me, but like hackers literally buying companies and then weaponizing the plugins themselves and distributing them through the official channels. So that’s the big story that I was covering this last month. That is just what possesses someone to spend six figures to buy a suite of plugins and then weaponize them and try to get away with it? No, that can’t happen.

[00:06:42] Nathan Wrigley: Except, it does. So let me just reiterate what’s going on there. So if you’ve been to the wordpress.org repository, or indeed you’ve downloaded plugins from third party vendors, maybe a pro version of a plugin or what have you. Usually there is some aspect of the WordPress admin UI, which enables that plugin to be updated by clicking a link or perhaps automated, the update will happen.

Increasingly, I think people are being, have been encouraged to click enable automatic updates. So it just ticks over in the background. Perhaps while you’re asleep, it gets updated to the latest version. This in a universe occupied only by honest people would be absolutely fine. We’d have no problem that.

However, the scenario that you are describing is that kind of invisibly it’s entirely possible for somebody to sell their plugin or indeed maybe even have their plugin repo hijacked in some way. But let’s go with the sell their plugin scenario, because that’s the easiest one to get a hold of. Sell it to somebody.

Obviously, I would imagine in most cases, assuming that person is a good actor, is just going to carry on doing the nice things that the plugin does, updating the code, and doing security updates and what have you. However, there is zero guardrail to stop them putting whatever they want into the plugin.

And so overnight, a plugin which has been working for a decade or more, doing its job, now suddenly is masquerading. And it may be that the functionality of the plugin is also still there. It’s not like suddenly the plugin just stops working, or it’s really obvious what’s going on. It may be that just a few lines of code have been adapted, modified, there’s some backdoor smuggled in to the plugin. An end user would never know that this was going on. Have I summed that up? Is that about where we’re at?

[00:08:35] Austin Ginder: Yeah, these are bad actors trying to hide themselves. They’re sneaky. They don’t do things that are obvious. Like they’re not just uploading malware to WordPress plugin repo. What they’ll do instead is they might slip a third party updater, which is against the guidelines, clearly. But they can do it a little bit more sneaky.

So if they can get a third party uploader put into their plugin, then they can actually hijack the plugin. Meaning you download a plugin from wordpress.org, and you run auto updates, and it updates not from the wordpress.org version to the newest wordpress.org version. It offloads to their own compromised update channel.

And then once it’s on the update channel, wordpress.org has zero visibility, and you’re just running a hijacked plugin and you don’t even know it. Unless you go in and you run a verify command, from the command line or, you’re scanning for things like this. And then after they get the plugin hijacked, that’s when they compromise your site.

They could do SEO spam attacks, or display ads, or poison the search results from Google’s perspective. Many different things that they do to try to recoup their money in the investment.

[00:09:50] Nathan Wrigley: So let me just run that by you again. So just to make sure I’ve understood. So in this scenario, the plugin, it is like a one time thing in a way, but we’ll explore that as well in a moment. The plugin is acquired by somebody else and potentially some of the behaviour that you’ve seen is that the only part of the plugin that they modify is the location of the update server.

Now, typically that would’ve been over at wordpress.org, and every time you click the update button, you are receiving the repo version of it. However, this updated version will then offload to a third party server somewhere. And at that moment, wordpress.org loses all visibility of what’s going on. As far as they’re aware nothing has happened.

You are now just getting updates from elsewhere. You would never see anything. But obviously whatever payload they wish to put into that plugin is completely invisible to wordpress.org.

Now, I suppose the wordpress.org version, there’d be a telltale sign that this was happening because there would be new and modified code to indicate, oh, look, there’s a third party server in play here. But WordPress org has no visibility into what the malicious code being updated onto your website is. Again, is that about where we’re at?

[00:11:07] Austin Ginder: Yeah. Everything on wordpress.org is open source. Even the platform itself is open source, so you can see the full code, how everything operates there. And in addition to that, all of the plugin activity happens on SVN, which is like the raw pipeline.

So all of the data is there and available to anyone to go in and audit the data, but it’s, it’s an after the fact situation. Like after a situation happens, you can go back to the raw data and run a full audit to try to piece together all these missing pieces. And all these missing pieces would’ve been impossible to correlate together if it wouldn’t be for AI. Like now we have a superpower where we could just run AI through it all. If we feed it the right points, we can start to make the correlation after the fact as to what happened.

[00:11:59] Nathan Wrigley: Okay, so essentially what you are saying, I think, is that the work of checking this, prior to AI, let’s go with that, it was just too humanly intensive. There were 60 plus thousand plugins on the wordpress.org repo, going back and having a human inspect every single update, every single file, every line of code is, as you can imagine, a completely unrealistic process.

However, now AI really its superpower is its capacity to take a giant corpus of data, and then do things with that data. It’s almost like it can capture the entirety of the internet in one hit. And so that’s what’s enabled you to weed out this sort of stuff.

I have to ask from a personal point of view, why are you doing this? And I don’t mean that the way it sounds, because obviously it’s philanthropic. I’m extremely grateful that you are doing this. But how did you end up taking this on as a, I don’t know, a hobby, a pet project, a sideline?

[00:12:59] Austin Ginder: This is completely accidental, right? The backstory is in February, I saw a huge shift at my own customers websites, where sites that have been secure for years and years, all of a sudden was getting malware. The short version of it is while I was doing some malware cleanup for a customer, I uncovered one of these big back doors, and it was just like going through the process.

So malware cleanup before AI was always a little bit of a dicey thing. You can check all the boxes, make sure everything looks good, but you never had the certainty that it was all a hundred percent clean. Did I miss something? But with AI it’s very easy to do a thorough, in depth, investigation.

How did this happen? Where did it come from? Is my site actually clean now? It just crawls over all the files with Claude Code and other tools, and it gives you a nice report. When I had some recent, my own customers that got malware, and I ran through the forensics level style that AI can give, it uncovered some things that made me question, maybe I should look upstream, maybe I should look at wordpress.org. And I started to feed that into the AI and sure enough, there was something there and it was story worthy.

[00:14:13] Nathan Wrigley: So presumably that was then bound to a particular plugin. So your customer, something went wrong, you pointed the AI at it, it gave you a report, pointed you to the wordpress.org repo. And that in theory could have been the end of that. You clean up your client website and move on.

But it sounds like this became much more than that, because over the intervening days and weeks, you found that this was alarmingly, not just a one-off. This was a pattern. And I think the last time I was reading about this, I think you’d found four. I don’t know if four plugins is now up into some other figure or not, but certainly at the time I was reading you’d found four plugins with exactly the same strategy. I don’t know if they were from the same vendor or what have you. Just tell us where you’re at in the middle of May 2026.

[00:15:07] Austin Ginder: Yeah, so I’ve now published four more or less in depth research. Now, I wasn’t the sole finder of all these, but I was the one who actually pointed the AI at it, and got to the root of it. And it uncovered some other things that previous folks hadn’t found. So the crazy thing is all four situations are completely different, and that’s the wild thing.

So the one was, the source was the WordPress Plugin Team. So they saw there was some bad activity happening, with a set of the Essential Plugins package. So that’s like a 30 plus plugins. So they closed down all the plugins. They issued an alert, Hey, your site might be compromised. And they actually put code in the patch of the plugins that would check the wp-config file, was it tampered with by the plugin authors themselves?

So one of my customers saw the notice flagged me. I scanned it, saw it was compromised, and then that’s when I uncovered how big of a deal it was, the Essential Plugins. It was actually a purchase of a company. That was just one of them.

The other three situations, again it’s all kind of part, it stems back to me overhauling my security system for my clients. The other one was flagged by a new security feature I was implementing where I check all of my customers JavaScript embeds.

I’m basically scanning changes over time, hoping to catch like a credit card skimmer, or something else like that for my own customers. Well one of them came back. Something’s weird. It was a widget logic plugin that was embedding some weird sports JavaScript code for one of my sites. And I kept digging and digging into it, and sure enough, it was another supply chain attack on that particular plugin.

So, in all these instances, the WordPress Plugin Team has been fantastic. Very responsive and closing down the plugin, and applying patches, and getting the out there. Yeah, it’s weird. I had no plans to building something like this. I just stumbled upon it and every situation was a different story.

The last one I’ll share is, I was messing around with this idea that, I wonder if I could use AI to hunt through my own customer’s plugins to detect plugins that are running different versions of the code base. You might have Jetpack installed with the latest version, but maybe there’s a variant version Jetpack’s running. That’s the core idea, or the core concept.

So I built this tool with AI to scan my own customers, and it found a variant version of the Quick Redirection Plugin installed. I’m like, what’s going on here? So I dig into it and I had 12 sites running a version of the plugin that wasn’t on wordpress.org. So then I threw it through AI. It told me the difference. And sure enough, like you had to keep digging to get actually get to the answer what happened.

But that was a situation where many, the plugin author themselves offloaded most of their customers to a hijacked version. And my own customers years later were running a hijacked version. So I wasn’t directly searching for this stuff, it just came up, and then I’m like, after you get three of them, it’s alright, now I just wanna see if I can find one.

So I built the scanner and while I was scanning the top 2000 WordPress sites, I found one, and it was active. It was active, meaning the plugin, it’s called Scroll To Top. It was wired in to 20,000 sites, but it wasn’t active. So a lot of these bad actors, they will take their time, get a plugin that’s compromised in a lot of people’s sites, and then when the moment’s right, pull a trigger. And then at that point they can start to flow in bad content or SEO and actually do the compromise.

The one that I actually found was a compromise scenario, from what I can tell, the bad actor hadn’t actually pulled the trigger yet. So it was a success story.

[00:19:13] Nathan Wrigley: Yeah, that is really, kind of makes it more alarming in a sense, doesn’t it? Because once I suppose there’s an active exploit, and people are beginning to report what’s going on here? There’s some strange behaviour on a website, I presume at that point eyeballs will fall on what’s going on and work will be done.

However, as you’ve just described maybe months, weeks, possibly years, a plugin can have incredible functionality. It might gain widespread adoption, because it’s doing this one thing particularly well. Just with this dormant code sitting there waiting for the moment that’s opportune. Maybe there’s some scenario in the real world in which it will become a timely thing to be able to deploy that.

That’s really alarming, isn’t it? Because who knows how many websites are currently sitting there with as yet undiscovered, back doors, or problems that we simply don’t know about because they haven’t been triggered? Yeah, that one is really alarming.

Austin, I’m going to give you a little opportunity because you keep saying my clients, and I don’t think we painted the context of that. Just tell us a little bit about what you do and how that aligns you to have, have an eyeball on so many websites. I think currently, when you say my clients, I think it’s true to say that you’ve got something in the order of 3000 websites that you manage. Now, if you were building those as client websites, that’s a lot of clients. Just tell us what it is that you do, and that might widen the debate a little bit.

[00:20:39] Austin Ginder: No, I don’t do consulting work anymore. So back in 2014, I transitioned into web hosting full-time. I run Anchor Hosting, and my business is, it’s a pretty simple business model. I resell other managed WordPress hosting services, and provide all of the support and maintenance on top of it.

So I primarily use web hosts like Kinsta and Rocket.net. They are larger companies. They have a lot more eyeballs on it. I like to layer as many layers between me and the web host infrastructure as I can, so that I can actually solve what I want to solve. And that’s the WordPress maintenance part.

So I have a little bit more visibility than some. So that is more unique position than most. And I actually would say if there’s any takeaway from this conversation, the takeaway is any hosting company out there that has more data than me, they are sitting on a gold mine and they don’t know it.

Because any site that gets malware, that is the gold. If you can point AI at every malware situation or attack, you can sometimes back channel it to figure out where it actually happened, and start to paint a bigger picture. I would love to get my hands on like a web host that has millions of sites and run some scans, because that’s how you’re going to discover it, weed it out.

[00:21:59] Nathan Wrigley: And there’s maybe patterns going on. I don’t suppose every hacker of WordPress plugins is some kind of evil genius. They might just be, I think what’s often called script kiddies. The idea being that they are taking templates and copying and pasting these ideas far and wide.

And therefore I suppose patterns would emerge and maybe as you said, some of these larger hosts would be able to spot that pattern, and get out in front of these different problems which have, as yet, been undetected.

Okay, so you’ve then taken an additional step. You’ve got yourself a URL, wpbeacon.io. Dear listener, as is always the case, anything that we mention today, so the links to the articles which Austin has written, I will put those in the show notes, but also I’ll link to wpbeacon.io. Just tell us a little bit about that and that, how that’s helping the community.

[00:22:52] Austin Ginder: So WP Beacon was again, an idea I threw together last month. Not a whole lot of planning. But it was just like, okay, I’ve got three of these now. These are basically in depth investigations. Where do you put it? Because this is different than a typical vulnerability database. Like a vulnerability database is really good about endeavour to find bad code.

This is not bad code, this is bad actors. They’re two completely different problems. So I built WP Beacon as like my place to put all these findings. And the idea is actually have it be a legitimate feed for other folks, like another metric or another vulnerability database, but for supply chain attacks in particular.

[00:23:39] Nathan Wrigley: And so I suppose the idea being that people who are, I mean obviously if you’ve got one WordPress website, it’s fairly unlikely that you’ll come across WP Beacon, because you’re not in the business of being in the community or what have you. But if you are somebody that’s, I don’t know, managing multiple clients, half a dozen or what have you’re in the WordPress space, this is the kind of thing you might want to know about.

I suppose you are then hoping to be some sort of gatekeeper of knowledge around whether a supply chain attack has occurred. So let’s say for example, I’m considering putting a new plugin in. I find something on the wordpress.org repo, and it looks fine. Everything about it is screaming, yes, install me. I would go over to WP Beacon. I see that you’ve got a search on the homepage. There’s a list of the number of installations that have been covered, authors, tracked plugins that are being watched and what have you. I would be able to, in some way, interact with that website and gain an understanding of, yep, we’ve got nothing on them. Everything looks fine, or no, hold on, have a second thought. This thing happened last month. Is that again? Is that kind of what’s going on there?

[00:24:45] Austin Ginder: I think end users might find value in it, but I think the better target audience is, this is missing security research that security people don’t have. I see it as that. It’s like when I do a report and I put it up on WP Beacon, those identifiers of these bad actors can then be, action can be taken on that by real legitimate security people.

So I have a friend, his name’s Sal. He used to work at Kinsta. So when I was dealing with one of these cleanups, I was messaging him privately. I’m like, hey, Sal, look what I found. And he is oh, gimme a second. I’m going take their compromise server offline. I’m like, what do you mean? So he whips it out and he gets their domain suspended, website taken offline. And this is like the crucial gap, right?

The research person wants to make people’s site safe. So if you’re out there and you’ve got a hijacked plugin installed and you don’t know about it, you need a research person, and a security person, to take care of the issue for you. And that is like taking down their infrastructure, taking down the bad actors infrastructure.

[00:25:51] Nathan Wrigley: Oh, that is interesting, yeah.

[00:25:53] Austin Ginder: My goal of WP Beacon is just like, this stuff needs to be more visible. We need to be drafting and documenting this is how the supply chain attack happened in this case. And here is all of the identifiers for the security firms to go for, and take down their infrastructure. To give some sort of incentive that like this kind of behaviour isn’t going to be tolerated or a signal to the bad actors like, we’re coming for you. We’re going to find you, we’re going to weed you out.

[00:26:21] Nathan Wrigley: Yeah, so that’s interesting. So connections with hosting companies would certainly be beneficial, wouldn’t it? Because let’s say a bunch of hosting companies are pointing their staff at the WP Beacon data, then you could probably satisfy, I don’t know, 60, 70, 80% of WordPress instal by communicating with the bigger hosts. Because I imagine that’s where the majority of WordPress websites occur. I presume another angle would be the .org repo itself. The team over there, the Plugin Review Team and the Security Team and what have you.

One ray of light, I suppose is that if you fix this, then you have fixed it. Whereas a lot of security problems keep coming back. Well, no, that’s not entirely true, is it? Having said all of that, I was fairly confidently thinking if you can, if you can get the plugin turned off so that it can’t be installed anymore, that’s one thing. If you can switch off the supply chain server, that’s another thing. But there’s going to be loads of different scenarios. It might be that they don’t have a supply chain server. It might be that they’re just defacing your website. And how do we disable that that particular functionality and the plugin?

I believe that wordpress.org has in rare situations deployed the, we will overwrite your plugin. I don’t know how to describe that, but I have a memory that in the past, something so catastrophic had happened inside of a wordpress.org repo, that there is the capacity for WordPress to say, okay, we’re taking command here, and we’re going to rewrite your plugins. I don’t think that’s very common, but I think that is something that can be done.

[00:27:59] Austin Ginder: In these situations, that’s exactly what they did. They reverted a patch, closed down the repos, and their patch is what stands.

[00:28:08] Nathan Wrigley: Right.

[00:28:09] Austin Ginder: So I think a lot of what my, what I’m trying to do is complimentary to what everyone else is doing. And I think it’s a little bit more, it’s an unexplored area, what WP Beacon is exploring. We have all this data, let’s see what we can get out of it.

But I do share your optimism, and also I would love this to just be a solved problem, and six months later we shut down WP Beacon, like it’s not even needed. But that’s just not how the world works, right? What I do hope will come from this is the bad actors that have been operating for years, 10 plus years, we make it harder for them to operate. I think that would be a more realistic success story of this project.

One of the bigger findings I found this past week, in the last few days, is this bad operator he’s been operating for the last 13 years. And what happens is his accounts get shut down, his plugins get shut down, and he just tries again. He opens up new accounts, new plugins, and he just keeps trying. We’ve got to make it a little bit harder for them.

[00:29:09] Nathan Wrigley: And also what’s really interesting there is that this is not, for you at least anyway, this doesn’t feel like a finished story. This kind of feels like, for you, now that you’ve put yourself in this seat, if you like, it feels each week possibly something new will be coming along, something that you’ve explored? Is that the case? I would like for you to say no at this point, no, there’s nothing new happening, but I the feeling that there’s quite a lot that you are uncovering on a daily, weekly, monthly basis.

[00:29:37] Austin Ginder: I do think it’s going to be harder and harder to find interesting things based on the raw data, using my technique of just going through and auditing things? That’s a good thing, right? If it’s harder to uncover these problems, that’s a positive indication that something’s happening.

So I think I’ve been extremely lucky by reverse engineering a problem. Like, how does the malware get here? Oh, okay. So then figuring out that there’s a bigger issue at hand. And I also think it’s one of those scenarios that we all think people are searching through the data, but they aren’t. I’ve got a $200 month Claude Code subscription, and I can search through the data with that. It’s actually feasible for individuals to start auditing the data and to get more eyeballs on this in a way that would never been possible before.

Yeah, I would encourage people to think bigger. If you’re an individual, you can take your site, download a backup and run it through Claude Code and do a file by file audit. It might take a few, Claude doesn’t like to do this, but it might take a few wranglings. No, look every line of code and tell me what you see. Do you see vulnerabilities? Do you see malware? Do you see any harmful things there? And an individual can do this, and they can get a very high level detailed report unique for their site.

[00:30:55] Nathan Wrigley: That’s interesting advice. Maybe in the future, some of the pain that you’ve been through with Claude trying to get it to behave in the way that you expect, maybe that be interesting data to put out? What are the prompts which you’ve seen that work and so on?

One thing which dawns on me, and I don’t really have the answer to this, because the wordpress.org repo, for good reason, has been wide open. What I mean by that is, lots of people can submit code. You don’t necessarily have to have a certain type of credential, or be a certain type of business and so on.

However, if you look out there in the broader tech landscape, things like, I don’t know, the Mac App Store or the iOS App Store or Google’s Play Store. I wonder what their approach is to firstly the onboarding of new plugin developers. But then what the inspection is for updates. When code comes through and it’s purporting to make a minor change to a particular app on your phone, what is being done there?

And I’m guessing that in the WordPress space, the fact that it’s run often by volunteers means that those kind of things are just going to be different. And perhaps those things need to be looked at. There needs to be potentially some more friction that’s added, or some more steps. And I know that a lot of work has been done by the Plugin Review Team to automate as much of that as possible, and to put some steps in place to make it so that those submissions get inspected in a more timely way. But I don’t have an answer. I’m certainly no expert. But it would be curious to see if there’s any lessons to be learned from the broader tech community.

[00:32:30] Austin Ginder: Obviously the openness of WordPress is its power. App Store versus Android, right, kind of comparison? We’re more open source. You could just do what you want. There’s pros and cons, right? So how do we make what we have more safe? And I think the answer to that is everything needs a hundred percent code audited.

How do we get there as quick as possible? That’s a token question. Like, how many tokens can we spend to audit everything? I have fairly good coverage now for my own customer base. What I do is whatever leftover usage I have, I’m auditing all of my plugins. And I do it in a way that’s efficient, meaning I only audit this one plugin version once. That gets assigned to a hash, a unique hash. Then I know, oh, okay, so all of my sites using that same variant are covered.

So a hundred percent code coverage is what we need to do now. And then long term, also in concurrently, we need to start auditing any changes that come over the wire. It’s a lot, right? Like wordpress.org is very popular. There’s a lot of code, but I do think it’s in a realm of realistic. If you are able to shave out a lot of the noise, we don’t have to audit everything. We don’t have to see every CSS file you’re changing, or image you’re changing. But we do have to look over every PHP line, every JavaScript line, that there’s nothing harmful in there. And then eventually we’ll start to catch things.

And I don’t think it’s necessarily a one off thing. We don’t have to wait around for Automattic to come up with a solution. The data is out there. Anyone with a laptop and a subscription could just create a mirror and see, what changed over the last, day, and then start auditing that. I think people think it’s too impossible.

[00:34:18] Nathan Wrigley: It feels like a large cliff that you’re staring at, at the beginning of this. And certainly in the past before AI, that cliff was, I imagine, more or less impenetrable But now the way that you’ve described, perhaps AI can be co-opted to do a lot of this work for us?

I wonder what you’ve got, if you’ve got any thoughts on the sort of permissions system. So I know that other, let’s say CMSs and certainly devices like Android devices and iOS devices, they come with permissions based systems. So for example, this code, it’s allowed access to the root file structure. Or it’s allowed access to the camera, or whatever it may be.

And I know that there’s been debate in the WordPress ecosystem recently about whether something like that would be a good idea. At the moment, plugins, all bets are off. If you put a plugin in, it’s more or less got access to anything on your WordPress website.

That’s an absolute strength of WordPress because it enables anybody to do anything. But I suppose given that it can enable any anybody to do anything, it also prevents a very large threat surface as well. I don’t really have the answer to that. I just think that’s a curious thing to raise and see if you’ve got any thoughts.

[00:35:29] Austin Ginder: I guess my initial thought is I don’t necessarily want my WordPress site to feel like my laptop, where I’m constantly clicking things.

[00:35:35] Nathan Wrigley: Yeah. Grant permission for this.

[00:35:38] Austin Ginder: I don’t know what the solution is either. I think some of those ideas are great when you’re thinking about making something from scratch, but they are not as relevant when you’ve already have an existing ecosystem. Like you can’t, I would think it’d be very hard to bring some of those concepts into WordPress at this point. We’re already past that.

[00:35:59] Nathan Wrigley: That ship has definitely sailed.

[00:36:00] Austin Ginder: I want to be in the Wild West. I want to be able to code and do what I want to do. And especially with AI. If I got an idea, I just want AI to go to town, write me up the plugin to my spec, and not have to deal with some of those extra safeguards.

It’d be great if we could find some way to make things more secure from an architectural standpoint, but that’s an architecture problem probably best suited for a new project.

[00:36:22] Nathan Wrigley: The truth is that this will never, ever be solved. I mean security problems online. There will be a no point in the future at which everything is always safe, because humans are ingenious, and there are really credible, credible is the wrong word. There are ways to make money, or to make it worthwhile for the bad actors to be doing the bad things. And so long as those incentives exist, there will be people trying to hijack websites, undermine the security of your computer or phone or whatever it may be. But this is certainly an interesting one.

And it’s such a shame because with the benefit of hindsight, this was so obvious, and yet it hasn’t been a news story. Maybe it has in the past, I’ve certainly not come across it. But this whole supply chain thing is fairly new to me, and fairly alarming in the simplicity of deployment.

You literally purchase, or somehow get hold of, a popular plugin, not necessarily even a popular plugin, a plugin. And then instantaneously every one of those websites is up for grabs in whichever way you would like to grab it. Definitely something that the WordPress community’s going to have to wrangle with.

Okay. I think we’ve hit the sweet spot in terms of time Austin. If it’s all right with you, we will wrap it up there. However, before we go, do you just want to drop a few little bits about where people could contact you? I am more or less certain that somebody listening to this podcast will have thoughts for you about getting in touch, helping out, or what have you. So tell us where you can be found.

[00:37:55] Austin Ginder: You can find me just by searching for my name, Austin Ginder. There’s not many Ginders. I’m on X, that’s my main feed. And you can also read along on anchor.host. I do blog posts there pretty regularly.

[00:38:09] Nathan Wrigley: Okay. In which case I will just point everybody to the wptavern.com website. If you go and use the search feature, search for Austin Ginder. Austin, spelled in the usual way. Ginder, G-I-N-D-E-R. You’ll find the episode and anything that has been mentioned, any links or what have you, we will link to there.

So thank you for chatting to me today about what I wish didn’t exist, but it does exist. Austin, thank you so much.

[00:38:34] Austin Ginder: Thank you. This was a pleasure.

On the podcast today we have Austin Ginder.

Austin has been involved in the WordPress ecosystem since 2010, and since 2014 has run Anchor Hosting, a business that manages thousands of WordPress websites. While he’s a developer and automation enthusiast at heart, in recent months Austin has found himself at the forefront of a burgeoning crisis in WordPress security, supply chain attacks targeting plugins.

A chance discovery during a malware cleanup on a client’s site propelled Austin into what would become a wider investigation of plugin vulnerabilities. What he uncovered is both alarming and timely, bad actors aren’t just hacking sites directly, but are instead infiltrating the supply chain, either by purchasing plugin companies and weaponising them, or by hijacking plugins and pushing out malicious updates. These attacks are subtle, often shifting plugin update servers away from WordPress.org to rogue channels where malware can be quietly distributed, leaving end users in the dark and their sites at risk.

We trace Austin’s journey from accidental security investigator to creator of the WP Beacon project, a resource aimed at tracking, documenting, and alerting the WordPress community to known supply chain attacks. He shares how AI tools have radically changed what’s possible in threat detection and forensics, enabling individuals, and hopefully, someday, the larger hosting providers, to identify patterns and root causes behind widespread infections.

We get into case studies of specific plugins compromised in recent months, the challenges of auditing over 60,000 plugins on the WordPress.org repo, and the complexities of stopping these attacks once malicious code is in the wild. Austin also discusses his hopes for greater collaboration with hosts and security researchers, aiming for better automated monitoring and response.

If you manage WordPress websites, create plugins, or just care about the future of open source security, this episode is for you.

Useful links

 wordpress.org plugin repository

Claude Code

WordPress Plugin Review Team Handbook

Anchor Hosting

WP Beacon website

Austin on X

💾

❌