[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, testing secure WordPress hosting, does the marketing match the reality?

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today we have Maciek Palmowski. Maciek is based in Poland and works at Patchstack, one of the companies in the WordPress ecosystem dedicated specifically to security. At Patchstack, Maciek collaborates with other security professionals on industry reports, bug bounty programmes, and solutions for agencies, product owners, and hosting companies aiming to secure their client sites.

I met up with Maciek at WordCamp Europe, and we discussed his presentation there. It examined the claims of secure hosting made by many WordPress hosting providers. He describes how Patchstack set out to test these claims with real world penetration testing, using 30 known plugin vulnerabilities across multiple hosts. Employing standardised methodologies and validating their results independently.

The findings are sobering. The majority of WordPress specific attacks still get through, and there’s a significant gap between the marketing hype and real protection.

The conversation starts with Maciek’s background, and how his journey in the WordPress security space led to a focus on the promises made by hosts.

From there, the discussion gets into the research approach, the selection of well-known vulnerabilities, consistent testing across different hosting environments, and the surprising result that even hosts with identical security tooling produce drastically different outcomes, showing it’s not just about the tools you use, but how you use them.

We talk about the Swiss cheese model of security, every layer will have holes, so you need multiple overlapping defences, and honest communication from hosts about their limitations.

We also explored whether an industry-wide standard, or badge, for secure hosting is feasible or even desirable, given how easy it is for strong marketing claims to outpace reality.

AI also enters the conversation, increasing both the speed and sophistication of attacks, and making patching, and processes, even more important, especially as the volume of vulnerabilities continues to rise and the time to exploitation drops.

If you’re interested in understanding what secure hosting really means, how to ask intelligent questions of providers, and the realities of WordPress security in 2026, this episode is for you.

If you’d like to find out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Maciek Palmowski.

[00:03:56] Maciek Palmowski: I am joined on the podcast by Maciek Palmowski. Hello Maciek.

Perfect. You did great.

[00:04:01] Nathan Wrigley: For some reason, your name has got into my head. A lot of the people that I interview, I struggle with their name, and I continue to struggle, but for some reason, I established many years ago that was how to say your name. And I think I’ve done it correctly ever since then.

[00:04:16] Maciek Palmowski: Yes you did. You’re almost having the typical Polish accent, so you’re doing great.

[00:04:21] Nathan Wrigley: So we are at WordCamp Europe, which is in Krakow, or Krakow, I don’t know how.

[00:04:26] Maciek Palmowski: Krakow.

[00:04:27] Nathan Wrigley: Thank you, that was good. And the reason Maciek is correcting my pronunciation is because Maciek is actually from Poland, which I suppose means that this is a bit of a, well, it’s like a home game to you.

[00:04:37] Maciek Palmowski: In a way so, but it’s also like a bit of a shame because I do like travelling when WordCamp Europe’s are happening. And, you know, just hopping on the train and going to Krakow, it was like a, I mean it’s cool because, yeah, the venue’s amazing, everything is great, but still I’m staying home, so yeah.

[00:04:53] Nathan Wrigley: Yeah, mixed feelings. So Maciek has done, or is going to do a presentation at WordCamp EU. Have you done it yet?

[00:05:02] Maciek Palmowski: I will do it tomorrow.

[00:05:04] Nathan Wrigley: Okay. And are you all set, are you one of these like really prepared people that has all the slides done, or are you last minute?

[00:05:11] Maciek Palmowski: Everything is ready. I already did one version of it at the Checkout Summit in Palermo, so.

[00:05:17] Nathan Wrigley: Oh I see. So you’ve had a sort of dry run of elsewhere.

[00:05:19] Maciek Palmowski: Of course.

[00:05:20] Nathan Wrigley: Excellent. So the presentation, which is going to be the focus of today’s conversation, is called Testing the promise, does secure hosting deliver? And I may as well read the blurb because it was a reasonably short one.

So it says, secure hosting, in quotes, is everywhere in WordPress. What does it actually protect against? We put this claim to the test with real penetration testing. 30 known vulnerabilities, multiple hosting providers, standardised methodology, validated by independent observers. The findings reveal a critical gap between marketing and reality. WordPress specific attacks succeed most of the time. That’s quite an alarming sentence. This talk shares the complete results and explains why generic security fails.

So, we’ll get into that in a moment. But as with all people, when I’m talking to them about security, I guess it’s good to establish who you are, and what your credentials are and what you’ve done, and how is it that you get to talk about security with authority. So over to you really, a little moment to give us your bio and tell us about you.

[00:06:20] Maciek Palmowski: Okay. So I work at Patchstack, and Patchstack is one of those few companies in WordPress space that are doing a lot in terms of security. We are constantly running this bug bounty for the whole ecosystem. We have quite a few solutions for both clients and hosting companies, and I work there right now. My role is, if I remember, the Growth Team Engineer, something like this.

But yeah, I do spend a lot of time working with other security people. So when we are working on all the reports, when we are checking the data, I’m also part of those teams that are working on it. So yeah, I think I know a thing or two about what is happening behind the scenes when it comes to WordPress security.

[00:07:02] Nathan Wrigley: Yeah, thank you. Always good to get that established though, right at the outset.

Patchstack is a company which is not a host though, I suppose that’s important to mention at the beginning. It’s a company which is in the security space, very much in the WordPress space, but perhaps more broad than WordPress, I’m not sure. But not a hosting company.

But obviously your presentation focuses its aim on hosting, I guess because that’s one of the places where the claim about security is most often made. You know, you’ll go to a, the landing page of hosting Company X, and you’ll see somewhere fairly near the top, secure hosting, or something along those lines. And you’ve decided to examine that in fine detail and look at these 30 vulnerabilities.

I guess really just tell us about this test and what it is that you decided to do and some of the items that came out of that.

[00:07:50] Maciek Palmowski: Okay, so maybe let’s start with how it even started, right? Because there was a trigger. At some point we published one report about the state of WordPress security. We tweeted about this. We got the response from none other than Matt Mullenweg, who kind of asked a very interesting question, but isn’t hosting companies taking care of this already?

And this was, kind of at this moment when we were, we thought that we know the answer that, no they aren’t. But to be honest, we didn’t have any broader proof about this.

We knew how it’s working at some hosting companies, but we could say that it was more of an anecdotal evidence that we had. So this was kind of the trigger that made us, okay, let’s check this. But not with one partner or two partners, but with more hosting companies.

So we did this research twice. First we just did kind of a beta run because we weren’t sure about the result and, is it even a good idea to go deeper inside of it? And during our first run, we were already very surprised because like the methodology was very simple. We just installed vulnerable plugins and we checked if we would be able to use the vulnerability. Because if the hosting is claiming that, we got your back, we are making your website secure, we have this and that, this means that they should protect against it. So it was as simple as that.

And when we were doing our first test, we were quite surprised because we saw, if I remember, that 80% of the attacks went through. 80% of the attacks. So our first reaction was, okay, we are doing something wrong. Okay, this was only few hosting companies, less plugins, but still the result were so surprising for us because we thought that, okay, that the problem exists, but it’s not that big of a problem. But it was.

So that’s why we did the second test. And this is about which the, my talk will be mostly when we tested more hosting companies, more plugins. And we saw that the problem still exists.

Of course it was, in some cases 70 few percent. So still, it’s a huge problem, especially if we are talking about some companies that are literally saying, you don’t have to install anything additional when it comes to security on your website. We got your back. They don’t. We found a lot of interesting things, but still the problem exists.

[00:10:21] Nathan Wrigley: So just deep diving into that a little bit, when tests like this are done, there’s obviously, the claim might be levelled, you know, obviously Patchstack would, this kind of maybe benefits Patchstack, if you know what I mean.

So let’s just sort of clear up what the test involved. So presumably the plugins that you chose are ones where it’s publicly known that there’s a vulnerability in this component or this particular file or what have you. So is that the case? This is stuff that, longstanding understanding that there’s a problem here.

[00:10:51] Maciek Palmowski: Yes. We only use the plugins that we had all the proof of concepts. So we know how have the vulnerability happened, what was the attack vector? They were all reported through our bug bounty programme, because that’s why we had the proof of concept. Yeah, and that’s it.

It was, like I said, it was as simple as that. We had a really broad mix of all the plugins. How many? It was 30 something of those plugins, if I remember. Different ones. Some were connected with WooCommerce. So, like a very broad selection of them. Different vulnerability types. So we try to mix it up as much as possible.

[00:11:27] Nathan Wrigley: Was the situation for each hosting company the same though? In other words, was the things that you did in one hosting environment the exact same as you did in another hosting environment? No. You mixed that up a bit as well.

[00:11:38] Maciek Palmowski: I mean we used all the same plugins, like the methodology was always the same. But we got totally different results. Even if, and this was one of the most interesting findings, because very often hostings will put a logo of some company that takes care of security. For example, say, Cloudflare. And despite using the same stack for security, they got different results.

[00:12:02] Nathan Wrigley: Interesting.

[00:12:03] Maciek Palmowski: So it turns out, in many cases, it’s not about the tools that you are using, it’s how you are using them, which was very interesting. And we did everything. We tried to enable every feature, every security features on those hosting, to kind of give them a chance to kind of make sure that they are defending the most as they can.

And the result in most cases was very simple. They were doing quite well with the generic ones like uploads, patch reversal, things like this, which are very generic in PHP. But with those WordPress specific attacks, they just failed miserably.

[00:12:44] Nathan Wrigley: That’s so interesting. The word secure hosting, which you’ll see all over the place, it feels a bit like using the word healthy on food. There’s no real definition of what healthy is. You know, a company selling chocolate could probably pretend that it’s healthy compared to something else.

[00:13:04] Maciek Palmowski: Like here, healthy chocolate is exactly, like in some cases secure hosting.

[00:13:07] Nathan Wrigley: Right. So what do you take from this then? I mean basically, is your survey saying that whenever you see the word secure hosting, be sceptical?

[00:13:16] Maciek Palmowski: Yes.

[00:13:16] Nathan Wrigley: Okay. As simple as that.

[00:13:18] Maciek Palmowski: It’s as simple as that. Because one of the things that we were always promoting, security is not a plugin, it’s not a one button thing. Security is a process. It’s layers.

And that’s kind of why we, especially after this report starting kind of using the term, Swiss cheese layer model. Because every layer will fail in some way. That’s also why you still need all the security solutions that hosting provides, because they do have a lot of interesting solutions against those generic attacks.

Because they’re doing really great when it comes to those generic ones. And that’s great because some of the attacks will be already dealt with. So whatever passes to the second layer, it has less work to do because a lot of it was already stopped at the first layer. The second layer should be something more WordPress specific that understand what is installed. And with this it can catch also a lot of it.

But still, you have to be prepared that, because again, this layer also isn’t perfect. Because there are zero days vulnerabilities, there are custom code, there are a lot of things that can happen, that your website will be hacked. I mean, weak password. Simple as that. That’s why you also need to have a layer, which will be more of what to do if everything else fails. Because you do need to know that you have to inform your clients, all the GDPR related things. How to kind of, I don’t know, use the backups.

In short you need to have procedures. You have to be prepared before the attack happens. Because let’s be honest, asking some lawyers about, what should we send to our clients? The moment when, well, the milk is already spilled. It’s like the worst moment to think about it. Especially that, hey, your website was just hacked. It’s not just a technical problem, it’s also a business problem. Again, with those GDPRs and everything.

So yeah, the more layers, the better. You still need to remember, every layer can fail in some place. That’s why the more, the better.

[00:15:29] Nathan Wrigley: Would you like to see a standard industry-wide definition of something like a badge or, I don’t know, let’s say for example, that you put the word secure hosting on your website, that has to actually stand for something.

Because obviously coming from the background that you do with a broad oversight on what that is, you have a vast amount of data at your disposal. You can see all of this kind of stuff. But every company can make the claim that our food is healthy, our hosting is secure. But I don’t know, in the model that we’ve got where any company can put anything they like on a website, I don’t really know how you do that, but some sort of accreditation or something. I don’t know.

[00:16:08] Maciek Palmowski: Honestly, it’s really difficult because as I said before, a lot of companies using the same tools were failing in different ways. So that’s a problem. On the other hand, like sometimes the, those stupid things like weak passwords. And it doesn’t matter that you had a, let’s call it a certified secure hosting, you still failed because your password was weak, you know? So, also certificates like this can backfire because some people might think I have a secure hosting, I don’t have to worry about things. And then you have 10 admin accounts for everyone.

[00:16:43] Nathan Wrigley: Is there is there something, some mark of that description that you, personally, that you go looking for though? Is there some credentialing system which you think actually does carry some weight? So for example, I don’t know, like the insurance space or the accountancy space or something like that. You have to have that accreditation in order to do business. Is there something like that? Is there a mark which hosting companies can apply for which you could have some confidence in it?

[00:17:13] Maciek Palmowski: Okay. So for sure one of those things would be, and I don’t want to say it as an advertisement, but it is a thing that you see that the hosting is thinking a bit better about security, kind of looking if they are a Patchstack partner. Because this kind of automatically means that they do have this WordPress, the security WordPress layer. So that’s already a good sign.

So yeah, I would start with this. I think that’s kind of one of the simplest ways, but again, Patchstack isn’t the only solution that does it. So looking for partners of such companies might be the best way to start because having those Patchstack aware security solutions built in, into the hosting is a really good sign.

[00:18:05] Nathan Wrigley: Yeah, okay. Now, the inevitable conversation in the year 2026 is AI. It doesn’t matter which area of WordPress you’re talking about. AI manages to get in somewhere. I am presuming that the landscape in terms of security only got more complicated because of AI. Because I’m imagining that attacks that needed to be conceived by a human can now be conceived in a fraction of the time by an AI agent. But not just one, maybe a dozen or a thousand or whatever it may be.

Let’s just talk about that for a moment. It feels almost as if AI and security are like, that’s a real systemic problem for the future of the entire industry. Because these things can happen so fast, a plugin vulnerability is discovered by an AI agent. It then discovers the attack surface, implements the attack all in a matter of seconds, possibly. What’s the position? Like, how do we stay calm basically in the year 2026?

[00:19:09] Maciek Palmowski: So the problem already existed around a year ago, because a year ago when we did our State of WordPress Security Report, we already saw that vulnerabilities are being used after around five hours after kind of being published. So five hours. That’s the first thing, because we still have a lot of people that say, yeah, just update your WordPress weekly and you’re good to go. No, you’re not. Looking at this number, you have five hours.

[00:19:39] Nathan Wrigley: Okay. Let’s just parse that at the moment. So the vulnerability is published. So there’s a whole thing there, like the vulnerability may well have been discovered prior to being published, so that’s a whole other thing.

[00:19:52] Maciek Palmowski: So first the vulnerability is discovered. Then at least how it works on, with our bug bounty. We inform the vendor they have, let’s say around a month to fix it. When they fix it, we publish everything and, yeah.

[00:20:09] Nathan Wrigley: Okay, so from the moment you publish, you can then detect that that is being leveraged within a space of five hours.

[00:20:17] Maciek Palmowski: Yes.

[00:20:17] Nathan Wrigley: Okay, that’s really interesting.

[00:20:19] Maciek Palmowski: But there is a problem. There is a really big problem. So if the vendor doesn’t respond, we still publish it.

[00:20:26] Nathan Wrigley: How long do you give them? Is it like.

[00:20:27] Maciek Palmowski: It is the one month.

[00:20:28] Nathan Wrigley: Okay, thirty days.

[00:20:30] Maciek Palmowski: Of course, if they reach out that there is some problem, they need like extra days. But in most cases, we’re talking about the vendors that just don’t respond at all. We publish it anyway.

But the problem is that, from all the vulnerabilities that were discovered last year, 50% weren’t patched at the moment of publishing about it. 50%.

[00:20:50] Nathan Wrigley: So half of the plugins where there was a known vulnerability, the vendor had been informed, they’d had this 30 day window. Half of them made no amendment to their code.

[00:21:01] Maciek Palmowski: Exactly.

[00:21:02] Nathan Wrigley: Okay. Wow, okay.

[00:21:03] Maciek Palmowski: Again, going back to this classical, yeah, just update your WordPress regularly. No.

[00:21:08] Nathan Wrigley: No, that’s a really different surface, isn’t it?

[00:21:11] Maciek Palmowski: It doesn’t work on so many levels. Because not only the problem is with the fact that, still the famous five hours, which also, it’s five hours now. It was much longer a few years ago. On the other hand, yeah, most of those, I mean around half of it aren’t patched, so the attacks will happen quicker than it get patched. So yeah, there is a lot of problems like this. And also the problem with security is that it’s really difficult to sell.

[00:21:39] Nathan Wrigley: It’s like insurance, isn’t it?

[00:21:40] Maciek Palmowski: Yeah. But insurance, okay, you see your car, your house, it’s real. It’s real, you kind of see it. The only category of websites that it’s much easier to kind of explain is e-commerce.

[00:21:54] Nathan Wrigley: Yes. You can feel the tightening on your wallet.

[00:21:56] Maciek Palmowski: They literally see the money. They can kind of really, okay, one hour of my website not working equals this and this Złotys or Euros or whatever. So that’s easier to explain. But for most people, yeah, security, meh.

[00:22:11] Nathan Wrigley: Yeah. That’s really interesting. So you mentioned, about this survey, you mentioned that fully 80% of your penetration testing resulted in something. What were the sort of, the high level items? Apart from that 80% figure. What were some of the other, because you said there were a few interesting things that dropped out of it. Can you mention anything else?

[00:22:31] Maciek Palmowski: So like I said, one of the things was that we learned that, despite using the same tools, we got different results. That was also a surprise for us.

[00:22:39] Nathan Wrigley: So let’s just figure that out. So at hosting company A, we’ve got a WordPress website with the same collection of plugins in. Hosting company B, exactly the same as far as you can make it the same, but things are different.

[00:22:52] Maciek Palmowski: No, no, they are, for example, they’re using for security the same tools.

[00:22:56] Nathan Wrigley: Right, okay.

[00:22:57] Maciek Palmowski: So in theory, if they’re using the same tools, we should have exactly the same results.

[00:23:03] Nathan Wrigley: So does that then point to a different set of configurations on the backend, or is it more curious than that? You just don’t quite know what’s going on.

[00:23:12] Maciek Palmowski: I mean because it’s not something that they will tell us. But yeah, in most cases, it’s all about configuration because the fact that you’re using a tool, it’s also important how you use a tool.

Also, with security is very often about, is something easy to use or is something secure? And kind of finding the balance. So some of the companies probably had a bit more aggressive configuration, which is better from the security point of view, but probably more often result in some annoying side effects for the user.

Also what, this was one of the most interesting things, but also what was very interesting because we contacted every company afterwards and we informed them that we did the test. Here are the results, what went through, what was blocked. And some of the companies did an amazing job of fixing whatever they could. On the other hand, we saw that some of the companies, because we did some extra tests later just to check what they did with our report, did nothing.

That’s one of the things about security in general, not about the hosting, about even having vulnerability in your plugin. That’s normal that we make mistakes. We’re humans, right? So that’s normal. What’s important is how we deal with them. If you have a problem and you fix it as quickly as possible, as good as possible, that’s great because you learn from your mistakes, you fix it, and you move on. Perfect. Good job. Now you are in a much better position than before. But if you get this, you look at it and you say, ah, this is fine, that’s the worst behaviour from the security point of view that you can have.

[00:24:57] Nathan Wrigley: I’m going to ask you not to name names here, but were some of the companies familiar to us?

[00:25:05] Maciek Palmowski: For sure, because we did test the biggest ones. But there is a reason why we didn’t want to name them, and it wasn’t about that we were afraid that I know someone will get mad or whatever. It was more about this weird side effect that could happen.

Some users would think, my hosting isn’t on this list, so probably I’m secure. Probably you’re not, you just weren’t in the test. Because we also did some site checks and everything. And we saw that a lot of those problems happen at most of the hosting companies. And like I said, the more important part was how did they reacted after getting the report. Like I said, it was a more common problem that we even thought.

[00:25:43] Nathan Wrigley: Do you, obviously, you know, caveat all of this with the fact that you work for Patchstack and what have you, do you see it even as the role of a hosting company to have any position on security publicly? Or would you prefer them not to make grand claims about things that you believe they can’t necessarily substantiate?

I don’t really know where I’m going with that question, but I’m just wondering if there’s just a sense that the language that’s being used is too strong. You know, secure hosting implies we’ve got all the padlocks, and the padlocks are there and you’ve got nothing to worry about. You’ve found a different picture. So I’m just wondering whether or not you would just prefer that the hosting companies stop talking about this altogether.

[00:26:27] Maciek Palmowski: I do think that’s, one of the biggest problem here is about the claims, the bold claims, the whole marketing around it. Sometimes even you can find documentation of some of them that, yeah, you don’t need to install any third party tool because we got you covered. We checked it, no they didn’t. So that’s kind of the problem.

It’s really more about the, how they market it. If they would say, okay, so we have a really performant hosting that does this, this and this. When it comes to security, kind of do it yourself. I mean we are providing this layer, but the rest is up to you. And that’s okay. That’s an honest claim. We are not doing everything for you. We are doing this part, but this is up to you. This would be much better.

I know that from the marketing point of view, it doesn’t sound as good as, we got all the security that you can imagine, don’t have to worry about this. Because that’s kind of the thing that very often managed hosts trying to sell, that you don’t have to worry about things. You just have to focus on whatever you have, writing content, selling stuff. If you have a e-commerce, whatever, that’s it. That’s kind of the only thing you should think of. Not about performance, because we got your back. Not about security, again, we got your back. And if you are paying for a managed hosting and suddenly they would start having like this different way of messaging to, it’s not that obvious that we have your back in everything. That would be very difficult for them.

So now it’s kind of the problem that, because everyone is kind of using this messaging, everyone else also has to. And also if we think about how a lot of those algorithms, look like that algorithms love bold claims. They want something white or black, not grey. And the truth is, most of the things we are talking about, it doesn’t matter, security, SEO performance, it’s everything in the grey zone. That’s why a lot of developers can end their talk with, yeah, it depends. There is no right or wrong. It depends because there are so many things you have to think about.

I could say that, and this is my kind of thing that, most of the websites that people have should be static. They don’t need even WordPress at all. This is a horrible claim if you’re a manager of a WordPress hosting, right? So that’s the thing. But it all depends on so many things, but yeah, the messaging is important.

[00:29:08] Nathan Wrigley: Yeah, if you were, on a personal level, if you were going out there looking and let’s say, if you can somehow put your job hat to one side, what would be the kind of things that you would be looking for? What questions would you be asking related to security if you were to be going to these companies?

From everything that you said, obviously it’s not black, it’s not white, it’s definitely grey. So every setup has some way of being vulnerable. But what are the kind of intelligent questions that you would be bringing to hosts to get some reassurance that at least they appear to know what they’re doing, even if they can’t make the claim that they’re a hundred percent cast iron, water tight? What might be some intelligent questions to start asking?

[00:29:49] Maciek Palmowski: One of the best questions you can ask is just, is there any solution in your security stack that is WordPress aware? Not the general one. Because if they only start talking about some web firewall, things like this, it’s already kind of a red flag. Because this is, overall, if we’re talking about firewalls, that’s not the correct layer about which, this is the generic one.

So this is the main question. How do you take care of WordPress specific attacks? Simple question. And if they will start responding, yeah, that we have this web application firewall that, in most cases this will be a sign that, no, we are not talking about the correct layer. That’s not it. It’s probably not aware about what is happening in WordPress.

[00:30:40] Nathan Wrigley: Okay. So given that this is a WordPress podcast, and we are at a WordPress event, that would be the beginning of your questioning is demonstrate that something in your stack is specific to WordPress.

[00:30:52] Maciek Palmowski: Exactly.

[00:30:53] Nathan Wrigley: Okay. And beyond that, is there any questions that, so let’s imagine that they come back with, yes, we have something specific, it’s WordPress. What would be sort of sensible follow up questions?

[00:31:00] Maciek Palmowski: I mean you can kind of start off about, okay, what exactly you are using? Because there is a limited amount of tools that are really WordPress aware. So if they will answer with kind of a product name, that’s kind of the easy way that then you can check it on your own. But that’s kind of the thing. Is it WordPress aware?

[00:31:19] Nathan Wrigley: Does it worry you in some way that there’s this perception out there that WordPress is insecure? You know, if you ask a thousand people, you’d maybe get 800 saying, oh WordPress, you know, we’re not touching that with a barge pole.

Do you worry that content like this, that you are putting out, that that might fuel that fire? Does it concern you in any way that it might lean into the argument that, I don’t know, somebody can link to that blog post from a rival CMS, or a SaaS platform, which does something similar to WordPress? Where do you sit on that?

[00:31:51] Maciek Palmowski: That’s a really difficult question. And this is one of the questions that when I talk on non WordPress events, I love to ask people. Is WordPress secure? And in most cases, I see that most of the room is, yes, it’s unsecure for sure. And I’m like, no, that’s not true. WordPress is secure. Every year there is just a few minor vulnerabilities in Core. That’s it. The problem is, of course, that WordPress on its own lacks some functionality. That’s why we install plugins.

And here we enter another problem because, okay, every year we have like thousands of those vulnerabilities in general in plugins. On the other hand, we have thousands of plugins. So kind of statistics will always look bad. But that’s why every time when you want to select a new plugin, you need to do some research. Yeah, I know it’s boring and everything but, hey, now we have AI, you can do it much quicker. It can help you a lot.

But looking at all those databases, for example, we have one database, WPScan has. There are those databases of WordPress vulnerabilities that occur to every plugin. And you can see, is the plugin you’re interested in had a lot of vulnerabilities? On the other hand, how it kind of looked historically. It’s not just about the number of them. In general, it requires some research.

And yeah, if we are just like looking at this, and this kind of vibe that right now we have that we are just about really bold opinions stated quickly that will fit one TikTok, yeah, WordPress is in a horrible position because, let’s be honest, it’s like, if you have, I’m not sure how many seconds does a TikTok movie has?

[00:33:39] Nathan Wrigley: I think 30.

[00:33:40] Maciek Palmowski: Okay, let’s say 30. So it will sound much better that you will say, yeah, WordPress is unsecure, which is not entirely true because it depends again. One of the most boring, especially again for those algorithms and everything, it’s a grey zone.

Because we are collaborating with a lot of companies that are making plugins, and we see how their security flow looks like. How they are dealing with vulnerabilies that are discovered. And honestly, I’m amazed how well some of those companies are doing it. They are very serious about it. They understand how important it is. For them it’s something very important.

[00:34:22] Nathan Wrigley: I suppose WordPress is a victim of its own success in that sense. And it would be a bit like, I guess a good analogy might be if you’ve got a car manufacturer and they produce a thousand cars a year and you compare them to Ford who make, let’s say, I don’t know, 20 million a year. And the question is, well, whose cars break down more often?

[00:34:41] Maciek Palmowski: Yeah. Do we look at the percentage of the number?

[00:34:44] Nathan Wrigley: Right. And if you say, well, 400,000 Fords broke down last year, and one of these other manufacturer, you can immediately see why there’s a problem there. And that I think is the landscape in which WordPress is often painted. The reason there’s lots of publications like yours bringing out WordPress information is because it’s the most popular thing. It makes sense to write about the most popular thing and to try to find the vulnerabilities and disclose them in a sensible way. So I don’t know what we do with that. It is just the way it is.

[00:35:15] Maciek Palmowski: I would also say there is one more interesting aspect because WordPress is considered unsecure because of the plugins. But what’s funny, for example, Elementor is also considered unsecure because there are plugins for Elementor. This is a very weird moment when the thing that brought WordPress to its bigger success, security wise, is its biggest problem right now.

Because WordPress did a lot of, I mean it was always great to, being as it’s kind of, let’s call it entry level CMS. For many people, it was also the way how they began the adventure with PHP development because it was so easy. Now we kind of have the, all the consequences of being that easy.

[00:36:06] Nathan Wrigley: Yeah, in a sense, this is going to sound ridiculous, we should be glad that there’s people talking about WordPress vulnerabilities, because it means the project is successful. And it also means that it’s, there’s an industry of WordPress security solutions, and there are people who take this very seriously and dedicate their lives to it. And you may not find that in some of these other ones, you know, some of the smaller CMSs and things like that.

I think we’ve probably hit about the sweet spot for the amount of time. But Maciek, I don’t know if there was anything in that report that you have got lined up in your presentation that I never got to. If there was a particular thread that you wanted to pull. If there is, go for it.

[00:36:46] Maciek Palmowski: No, I think we covered all the important things. And as you kind of said, this AI aspect, this will change so many things.

[00:36:55] Nathan Wrigley: Yeah, we’ll come back in two years and this conversation will be a very different thing.

[00:36:57] Maciek Palmowski: Oh, I think even in few months which will be very interesting. Yeah, so this aspect, it’s really very surprising. And I think that everyone who is right now kind of giving somewhere a talk about AI and security is in a very difficult spot because.

[00:37:14] Nathan Wrigley: Yeah, your content is going to look stale quickly.

[00:37:16] Maciek Palmowski: Yeah because you know it’s like, but a week ago everything changed. Yeah, I have to rewrite everything.

[00:37:20] Nathan Wrigley: Speaking of which, by the time that this goes out, hopefully you have managed to give out your presentation at WordCamp Europe. I will link to it and anything else that we’ve mentioned today in the WP Tavern post. So go and check that out. But I will specifically link to the wordpress.tv version of your presentation, which no doubt will have been created by then. So Maciek, thank you for chatting to me today. Good luck. I hope presentation goes well.

[00:37:43] Maciek Palmowski: Thank you. Thank you so much. Yes. I might need a bit because, you know, it’s WordCamp Europe. It’s a big conference.

[00:37:49] Nathan Wrigley: It is, yeah. Good luck. I hope that you manage to stay calm.

[00:37:52] Maciek Palmowski: Thank you.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, why accessibility in WordPress themes is easier than you think.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Jessica Lyschik. Jessica is a longtime member of the WordPress community who’s been working in the ecosystem since 2015. She’s spent years learning and advocating for web accessibility, both as a developer and as an active community participant, joining agencies, working on theme reviews, and helping improve standards.

Many theme creators assume that making themes accessible is an intimidating task, but Jessica’s here to show you that achieving an accessibility ready WordPress theme is more straightforward than you might imagine.

Her WordCamp Europe 2026 presentation, accessibility in themes, easier than you think, aimed to demystify the requirements for accessible themes. Explaining what the WordPress guidelines mean in practise, where the low hanging fruit is, and how both block and classic themes can reach accessibility ready status with manageable efforts.

We talk about the personal and moral journey that brings developers to accessibility. The technical hurdles and documentation challenges, and the ways in which things like AI agents are putting accessibility in the spotlight for everyone.

Jessica talks about practical steps that quickly improve accessibility, like using correct HTML tags, adding alternative text to images, and configuring skip to content links, and shares why building accessibility in from the start saves time and effort down the road.

We also explore the differences, and possible advantages, of block themes when it comes to accessibility, and why theme guidelines work the way they do, and the importance of interdisciplinary awareness across SEO, design, and content teams.

Jessica mentions helpful resources, influential leaders in accessibility, and the ongoing need for documentation improvements to help everyone level up.

If you’ve ever felt overwhelmed by accessibility requirements, or wonder why they matter, and how you can build better WordPress sites that work for everyone, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Jessica Lyschik.

I am joined on the podcast by Jessica Lyschik. Hello, Jessica.

[00:03:39] Jessica Lyschik: Hi Nathan.

[00:03:41] Nathan Wrigley: Nice to have you with us. This is my second interview at WordCamp Europe 2026. We’re in a beautiful, big media room. I’ve got to say, this is one of the nicest spaces I’ve ever had for these kind of interviews, so that’s really nice.

Jessica has already done, I want to say presentation but maybe it was a workshop. I’m not sure.

[00:03:57] Jessica Lyschik: No, it was a regular talk actually, yeah.

[00:03:59] Nathan Wrigley: Okay. And how did it go?

[00:04:00] Jessica Lyschik: It went super well, except for my slides went missing in between. That wasn’t so great. But the audience was very respectful of that, and I made a bit fun of it, so they laughed for a second and I tried, the media guys tried to fix that. We got it fixed in the end. I would’ve winged it anyway because I, like I knew what was coming up. But it’s always good to have your slides. It’s like seeing them, because for me it’s also visual reminder. It’s like, I need to see what I’m talking about, so I’m not losing track of it. But yeah, this was just a little technical hiccup. But overall I got very great feedback so far on my talk, and I’m very glad.

There were also quite a lot of people. I did not expect this many. And that makes me just super happy that people are actually interested in this topic, although it is sort of scary for some of them if they even like try to touch this topic. We can probably get into the details later. Yeah, just overall like, what does it do? Why do I need that? These unanswered questions that they have that they were like, ah, no, I’m not really interested into that.

[00:05:01] Nathan Wrigley: Oh, that’s nice a big reception.

[00:05:03] Jessica Lyschik: Yeah. And that’s just great to see because I think just as we all grow older, and I even noticed that, and I’ve said that in my talk, like I kind of get to appreciate when a website is accessible. I mean I’m still have a long time to go, hopefully in my life, but I start to appreciate the small things that make just browsing websites easier, to be honest.

[00:05:23] Nathan Wrigley: So I guess we should introduce the subject and then give you a chance to introduce yourself because it feels like in this context, the subject at hand, it’s important to know that you know what you are doing. It’s not, well, I suppose it’s a general skill in that it should be something most people know an awful lot about. But I fear that that’s not the case.

So the presentation that you’ve just given was called accessibility in themes, easier than you think. That’s nicely phrased. Let’s get them through the door.

And then the blurb that went with that, I’ll just read that into the record then everybody knows what we’re talking about. So it says, many theme developers assume accessibility ready requirements are hard to meet, but that’s rarely true. This session shares practical insights for real theme reviews, and shows how both block and classic themes can reach accessibility ready status with manageable effort.

So that’s the context of what we’re going to talk about today. However, as I just alluded to, could you just tell us a bit about you, how long you’ve been using WordPress, and then I guess if you want to focus a bit on your accessibility credentials and what you’ve been doing in that space.

[00:06:23] Jessica Lyschik: Yeah, of course. So yeah, I’ve been using WordPress, I think I started around 2005 or 6 already. So like dipped my toes into it, played with it around, just got a feel for it. But actually professionally, I started out in 2015 in the WordPress ecosystem.

Before that, I already joined the community. So I was working at another place that did not use WordPress before. And then in 2015 I joined a WordPress agency. Today they’re called Syde, for anyone who’s wondering. And ever since I’ve been into WordPress that long.

And accessibility in that case I have, I think it was a gradual process more of. It was not just like, I’m now doing accessibility. That just didn’t happen. It was, I learned it over time. And when I started learning about how to create a website accessibility was absolutely not a thing. No one cared about it. And it just became more and more aware for people, for developers, especially in the past couple years. I think we still have some way to go but like, as I said earlier, there were so many people interested in my talk. So I think we’re now at a pace where things get really interesting for many more people.

And yeah, I learned a lot along the way. Made a lot of mistakes along the way. But I’m glad I’m learning this. I’m still learning. So it’s always something that you continuously learn, because I think the hardest part to grasp for people is that, if you are abled, it’s like you can see, you can hear, you can navigate a device with your own hands, all stuff like that, you take it for granted.

And if you suddenly see or people tell you the perspective of like a blind person, a person who’s deaf, a person who may not be able to use a device like you do, maybe have a hand injury, or no hands anymore, that’s also happening. Then you start to wonder, okay, how do these people actually like use websites or use their phones or computers? And there are many different ways to do that. And I think if you have the chance to learn about this, it is absolutely eye-opening.

You can also then, there was a talk at WordCamp Leipzig this year, but also last year, I attended last year, by a blind person. And her brother was also blind. He was a developer. And they shared like how bad some websites are, and how they struggle to like get the information out of the website, and what crazy, crazy stuff people are doing to their websites that do not make it accessible for these people.

And then you are sitting there and wondering, oh my God. And sometimes I have to say, I even did this in the past and I didn’t know, but I’m glad today that I learned about this and make a better web essentially. Yeah, that’s why I’m here sharing my knowledge.

[00:09:11] Nathan Wrigley: It kind of sounds for me, so when I talk about accessibility, there’s always two strands to it. There’s like this legal bit where the governments are increasingly talking about things that will happen to you as a company that builds websites if you don’t follow guidelines. So that’s one side.

But there’s also this moral side. There’s the side of, we ought to do this despite what the law says. You know, it’s just a necessary thing. And it feels to me as if your journey in this was a moral one.

[00:09:38] Jessica Lyschik: More of, yes.

[00:09:39] Nathan Wrigley: Yeah, there was a definite need here. You know, in the real world when you see somebody, let’s say somebody who’s sitting in a wheelchair and they’re trying to get into a post office and there’s a step that they can’t get over, there’s no bit of you which doesn’t see that as unjust. Every bit of you says that character can’t get over that step. That’s wrong.

And yet, the bit of the world which is becoming increasingly the way that we interact, you know, we book flights, we file our taxes, we do our banking, we, all of these things, they’re completely invisible.

Most of the time we’re doing the internet by ourselves. You know, we might be sitting on a train, but nevertheless it’s a solitary activity, or we’re in our own home or whatever. And these pitfalls, the equivalent of the step in front of the post office is totally invisible.

And it also seems that the voice of the people whose lives are made more difficult is just drowned out. Somehow that anger that they must feel never seems to rise to the top quite enough that we all take the necessary steps.

I don’t know if any of that landed, and there was definitely no question there, but I’ll hand it back to you if any of that resonates.

[00:10:49] Jessica Lyschik: No, I think you, you’ve put it absolutely right. And the invisibility is the thing, because a step for us is visually, like we see it I mean. If you’re blind, you’re not seeing it. But let’s put it away for a second. But in the web, the invisibility is like the key thing. And I just talked to Anne-Mieke Bovelett about, who’s doing another accessibility talk this afternoon. She told me about like a company where they put effort into their website, making it more accessible. And their sales actually increased. So it can definitely help. This is just one example.

But there’s also a new player in the field that will probably even increase the interest in accessibility, and that is AI agents. Because AI agents, they do not see a website as we do visually. They rely on that the website is technically built correctly. Google actually just last month announced that they will focus on this. They will focus on the accessibility for the AI agent. I have put a link in my slides to that document. This is basically, I think something that will be easier to grasp for people for some weird reason. But it’s made more visible to them because if an AI agent cannot read your website, and I know we are probably still at the very beginning of this AI agent stuff, but I think this will increase over the next couple months or even years.

[00:12:14] Nathan Wrigley: That’s really interesting because when an individual, let’s go back 10 years, when an individual is creating a website, every single bit that you have to achieve is a minute of work or another minute or 20 minutes or an hour or what have you. And so there was this whole thing of just building the website, especially when page builders and things like that came along, just building the website to see what it looks like. And that whole accessibility layer just basically gets ignored.

However, that’s what you’ve just said is curious because the AI agent building the website, to the AI agent, that’s kind of no extra work to get it right, if you know what I mean? If it’s configured to do all of the bits correctly, I’m using air quotes around the word correctly, then in theory it should be quite a good custodian of accessibility when it’s building things. I guess only time will tell whether that actually happens.

[00:13:08] Jessica Lyschik: Yeah, but it’s also for like, not the agents itself building, but also the agents visiting your website. Especially if you do like, I think shopping will be the one thing that if you say, hey, I don’t know what the best coffee or what, this is like a good topic. Yeah, okay, here are three options. And then, okay, buy me option one, a kilo of these beans or whatever. The AI agent, if the shop is accessible, the AI agent could do the shopping for you. This is where things are going and progressing towards, that you are not actively anymore the person who actually goes to the online shop, puts it in the cart, goes to the checkout and does all that stuff for you. But if the agent knows all that, it can do it for you.

[00:13:50] Nathan Wrigley: Can I ask a question then? Because I may have, I think I’ve understood what you were just saying and curiously, I’ve never had that thought, the one that you’ve just expressed. I want to know if I’ve got it right. Are you saying that in a world in which we increasingly ask AI to achieve things on the web for us, if it’s built with accessibility in mind, it’s more likely to be able to achieve the result of, let’s say, buy me a kilo of coffee.

[00:14:14] Jessica Lyschik: Yep.

[00:14:15] Nathan Wrigley: That’s so interesting.

[00:14:16] Jessica Lyschik: Yeah because like, Anne-Mieke, whom I just talked about, shared a long document with me recently and I was just reading through it and was like, yeah, of course. Of course, if we technically do things right, we use the right elements, we do the right descriptions for everything that a computer, because AI agent is just a computer. Like assistive technology, like a screen reader who needs to read the right structure out of it and to fit the right content. But also is able to interact with stuff, like click on that button, put that in the cart, go to the checkout and so on. It’s basically the same. An AI agent is a screen reader.

[00:14:53] Nathan Wrigley: Yeah, that’s really interesting. I’m thinking of a map where I’m trying to get to a destination, but the map has no directions. Imagine a scenario where we set off from one place and our destination is here. What you are saying is all the instructions in between to get from the start to the end can be read if the HTML and all of the bits and pieces wrapped up in that are correct. I had never had that thought before. That’s so interesting.

[00:15:17] Jessica Lyschik: Yeah, that’s very interesting. And I did not focus too much on this topic in my talk, but I wanted to put it in there at least in one slide to give like the food for thought that people can actually think about it because this is like what’s hyped right now. I have not tried out this whole agent thing yet, but like from a developer perspective, I can totally see that this is something that will increasingly help AI agents to achieve stuff.

[00:15:41] Nathan Wrigley: Yeah. And presumably make it so that a whole tranche of people who struggle with the web as it is currently might be able to interact with their voice or whatever other technique they use. We’ve completely gone off the rails, but that was such an interesting aside, thank you.

[00:15:58] Jessica Lyschik: Yeah, I think this is something interesting to share. And as I said, I wanted to focus more on the technical details in my talk, so I left it kind of out. But I think it’s a great opportunity to share it here with you.

[00:16:08] Nathan Wrigley: Yeah. That was lovely. Thank you.

So let’s go back to the WordPress bits and pieces then, and I’ll just do the title again because hopefully that’ll refresh it in listeners’ minds. Accessibility in themes, easier than you think. Dear listener, if you’ve been using WordPress for any length of time, you’ll know that the themes still plays a giant part in the structure of your website and the way that people experience it.

So where are we at then in the year 2026? Does the theme still represent a huge part of accessibility? In your experience, is it easier than most people think to get an accessible website in the year 2026? We’ll get into block based themes and classic themes and all that in a minute. But essentially what I’m asking is, is it an easier thing to get right than most people imagine?

[00:16:51] Jessica Lyschik: Yes, because I think what scares people off from my own experience, there are requirements to get the accessibility ready tag in the wordpress.org theme repository. And these requirements, if you first read them, they’ll sound a bit cryptic and you do not really understand what they actually mean.

In my talk, I was trying to combine this, what the requirement says with what is actually meant by that. Because right now, and this is something I would like to improve for the future, I’ve already talked to people about this, and I will have another chat with Rian Rietveld about it later, or tomorrow. Let’s see when we can make that happen.

Because right now the requirements read like, okay, this must be achieved. This is what the website should do. Then there are some testing instructions, but you’re not told how to achieve it. What do you technically need to do in order to do that?

I noticed this while I was reworking. I found out about the requirements also just a month ago because the requirements got updated. I have a theme in the wordpress.org repository and I tried to apply these new rules and have another fresh look at it. I got the accessibility ready tag for this already when I first got the theme into the repository. But like it was a good refresher to like go over all the requirements because they have slightly changed a bit, they added new ones.

When I was there, I was like, okay, like I understand this now because I have learned about accessibility over the past couple years. For someone who is fresh to this topic and doesn’t know too much about it, it’s hard to understand. Because there are some descriptions of things like, basically what it means is that you need to use, for example, the right HTML tags, header, footer, the main tag. We have section and aside, which are available in HTML 5. But the requirements does not say this explicitly.

And I think this is where probably most people have gotten stuck in the past, because they did not understand like, what is actually required from me technically? Because the texts are not so much focused on that. And this is something I would like to contribute as well, to give back and to enhance. So it’s not there yet, but hopefully sooner than later we can add all this information so it gets even easier for people.

Because if you’ve done a website and you know about the HTML, you know about maybe a little bit of CSS, you know how to achieve this. You just need to connect the dots to what is relevant for accessibility and how do you do this in your HTML essentially.

[00:19:20] Nathan Wrigley: Yeah, I guess that’s a bit of a shame really, isn’t it? Is that the documentation is difficult to follow because I feel that accessibility is one of those things where if something is difficult it can get dropped basically.

[00:19:33] Jessica Lyschik: Yeah, people won’t do it.

[00:19:34] Nathan Wrigley: Yeah, because the majority of people browsing the internet can browse the internet despite your accessibility efforts, that will be the standard that they’re aiming for in most cases. So if it’s difficult to achieve these things and the documentation’s not really straightforward, every time somebody comes across a question and thinks, I don’t really know the answer to that, probably the quickest thing to do is just to, ah, push it to one side and not press through. But you obviously have and made it a bit of a goal.

So is there a particular accessibility requirement that developers in your estimation kind of overestimate the difficulty of? What I’m asking here really is about some low hanging fruit that you know about. In the scenario that we’ve just described where it’s easy to get put off and to sort of say to yourself, okay, I can’t do this. I’m wondering there are some sort of quick wins that you could describe that people could maybe achieve within the next half an hour, once they sat down at their machines?

[00:20:27] Jessica Lyschik: Yeah, I think there are definitely some. There is like underlining text in your main content, just underline the text. It’s one line of CSS, text declaration underline. For links, obviously, not for the entire text.

And there is like, as I said, the HTML tags. With block themes, it’s super easy. For example, you just need to configure that correctly in the editor, or use the correct template part and it’s basically done for you. Core does that. This is one advantage of block themes, but we can dive into this deeper later. Or the skip to content links also in block themes.

As an example, in block themes it is just like putting the content block in a group and assigning the main HTML tag to that group. And WordPress does the rest for you. It’s just like assigning this one little setting correctly and then you get automatically a skip a content link for block themes.

[00:21:18] Nathan Wrigley: Yeah, but curiously, if you didn’t know that small fact, that WordPress would handle that for you, if you don’t know, you don’t know. And you’d presumably go around the houses trying to figure that out for yourself and implement some custom version of that thing. Whereas in fact, what, three clicks, four seconds and you’re done.

[00:21:33] Jessica Lyschik: It’s super easy, yep.

[00:21:33] Nathan Wrigley: Yeah. Any more before we move on?

[00:21:35] Jessica Lyschik: I think these are like the most, absolutely the low hanging fruit is also if you use any images to add an alternative text. I think this is probably the most common one people already know. It is so easy. And even WordPress, even if you use classic themes, it’s already in the media library, the alternative text field. For block themes you have it directly at the image so it’s already in front of you. You just need to use it.

[00:21:57] Nathan Wrigley: Yeah, you just not ignore it basically. Yeah, that’s true.

So has this become kind of a habit for you then, over the last period of time since you’ve taken more and more interest in this? Have you got to the point now where this is just how it works? You know, in the same way that I drive a car and I use the gears and that’s all just second nature. Is it like that for you when you are building your themes? Because it’s now locked away in your head. Every time you do a thing that previously you would’ve omitted. You are now just in the habit. Has that been a difficult journey or fairly straightforward?

[00:22:28] Jessica Lyschik: I think it’s, like starting out with this, it would feel like a bumpy road. But for me it was, it’s a gradual process. But right now it’s really like, yeah, I just know that when I use a button in a context that is not like sending off a form to add an aria label to it, it’s like, it is baked into my brain essentially already because I know.

And I just had a very interesting example this week at work where there was a client reaching out saying, hey, we did an accessibility test on our website and it marked like two buttons that did not say what they’re doing. These were essentially missing the aria label because they had only icons on the buttons, not real text.

So if there’s just an icon, the screen reader cannot read, what is this button for, essentially, with just an icon? The win here was just to add the aria labels, because the fields were already there. This was also part of the Greyd.Suite, so from our product so I knew how to put it in there. And then it was like, oh no, like I have to do this 12 times, my colleague said. And I was like, yeah, okay, then you have to do it twice, 12 times. So 24 times. But be happy it’s not 200 times you have to do it.

So, and I said, do not take this personally. This is a great example of why putting accessibility at the very beginning of when you’re creating this makes life so much easier than rather when you just build a website and then you figure out you have to change 300 buttons. This is probably a crazy number, but just to give you an example, to change all the buttons manually again, going through every single page or whatever you have when you just could have taken the extra step, added the aria label, and then just be done with it.

[00:24:09] Nathan Wrigley: Right. That’s an interesting thought. And also the exasperation of your colleague there kind of perfectly sums up the problem. In that you see it as a problem. Does that mean I’ve got to do something 24 times? And there’s this sense of, ugh, I’ve got to do this work. And it feels like a chore. But then I suppose if you step back and look at what you’ll actually enable by doing those 24 things.

And I know that in the workday that’s hard to do. It’s hard to sort of step back and say, okay, if I do this thing 24 times, this will be the result, and lots more people will be able to, in this case, view the image.

[00:24:42] Jessica Lyschik: I mean this was like they started already working on. If you fix it now, you do not have to do it for the coming pages. So if you multiply that with how many pages more you need to do, once you get this one fixed, and ideally you need to change the aria label of the text changes obviously, but this was, I think for a header, in a header, where there was like, I think one sort of popover or popup. Fully accessible by the way, so don’t worry about that. And also a button to, I think for the phone numbers, like just a phone icon. And they could click on it and it would be something like that, along the lines. I don’t exactly remember what it was. But it was just like two icons in the header. And if you take that header, use it on, I don’t know, another 250 sites, you don’t need to do the work anymore.

[00:25:29] Nathan Wrigley: Okay. So you are painting a picture in which, get it right at the beginning, follow the guidelines, do the hard work once, then almost the career from then, from this moment forward, your life will be immeasurably easier if you build it into the theme or.

[00:25:45] Jessica Lyschik: And accessibility will not be taken as, ugh, and I now have to do this all. Because when you do it from the start, you have to make sure at the end of course that it still works. You may have to run into issues and redo stuff. That can happen. But I think you just have saved yourself so much work in the end if that requirement for some reason pops up later or so.

[00:26:10] Nathan Wrigley: I’m wondering, depending on the kind of nature of where you work, and how you do this. You know, if you’re a freelance, then this is on you. If you’re in an agency, then it may be that there’s somebody, you know, maybe there’s an SEO person, there’s a design person, maybe there’s an accessibility person. But it does feel like the moral argument states everybody should have some insight. Maybe you’re not right in the weeds of it, but you should have some knowledge of what the low hanging fruit is, at least.

[00:26:38] Jessica Lyschik: Yeah it’s, what’s the right word for it? Interdisciplinary. It is like not just the developer who needs to think of accessibility. It’s like, okay, we need to because like we provide a technical structure for it. But it also needs to be for the content people who write the blog posts, the pages, whatever, for SEO people to understand that.

And I think accessibility, if you want the entire website to be accessibility, everyone who works on a website needs to know about it. That an SEO person needs to know how to create a skip link, probably not. Or how to use, maybe to use the right text. But for them, the text would be just the, using the right heading structure, for example. This is also a requirement, that you do not use an H3 and then an H6 heading in your content, but you structure it correctly that you have the H1 on the top, and then every next level is H H2, and then every level under that is H3. So this way. They should know about this. But they do not need to know too much about the technical side. Because in the end, it all comes together and creates an accessible website.

[00:27:42] Nathan Wrigley: In your commentary a few minutes ago, you mentioned that there were some guidelines in order to put a theme on wordpress.org. Is that the nature of it? Is it a guideline, or are there some hard and fast rules, which will prevent a theme getting into the repo based upon a lack of accessibility? What I’m asking is, are there some things that you must do as of now, or is it very much, okay, if you do this, great, but if you don’t, we’ll let your theme pass anyway?

[00:28:09] Jessica Lyschik: Yeah. Let me explain this. So there’s this accessibility ready tag. So you have different tags for the themes in the repository. And in order to get the accessibility ready tag, you need to follow the requirements, the accessibility ready requirements, I think it’s completely called.

And these are as of now 18 requirements. I went through them all in my talk. We’ve already touched on some of these. Some are really low hanging fruit, some are, one of the newer ones are, a theme should not recommend or require a plugin that is not accessible. This is something else that the team came up with, which is an interesting one. There’s, I guess a lot of room for discussion.

But also another one is to have an accessibility.txt file in your theme. Which basically, it’s not a standard yet, but like close to a standard sort of, has information about what has been done in terms of accessibility. Are there any classes that you can, CSS classes that you can use to make use of texts for screen readers? So basically hide them visually, or hide these texts or items visually, but still have them read out by screen readers. So they’re not like discipline none where you just remove that basically from the accessibility tree, but make it still readable for screen readers. And just some more information about that.

Yeah, you need to meet all these requirements with your theme if you want this tag. But you can still like do not care about accessibility and still get your theme in the repo if you want.

[00:29:40] Nathan Wrigley: Would you like that to be flipped? Would you like that to be, because I mean we’re a very open ecosystem, aren’t we? And would you like to see though a day where you don’t meet these 18 guidelines, you don’t get the tag, you don’t get to play, you’re not allowed in the repo? Or is that a touch too far?

[00:29:56] Jessica Lyschik: Let me share some numbers, I think. So there are like 14,700 plus themes in the repository right now. All themes. At least that’s the number I can access. I don’t know if there’s maybe a bit more, I don’t know. But this is the public number you can access. And out of these themes, I think if I saw the correct number, it’s like just 270 have the accessibility ready tag. So then that is like 1.5% of all themes who have that tag.

So I think it will be extremely hard to force sort of, if you want to flip that, force that onto people. And I think we need to do a more gradual way. And that’s what I’m sharing my knowledge because I think it is not that hard. If you can improve the documentation for it, it will be even easier for people. And I think this is the way to go instead of forcing like, because we do not like to be forced to things we do not understand.

[00:30:50] Nathan Wrigley: That’s right. Yeah, that’s interesting. I wonder if there’s a future in which that slowly gets ramped up.

[00:30:56] Jessica Lyschik: I think with the AI agents, we will have an acceleration on this, I guess. So maybe not in WordPress themes, in the repository directly, but I think the attention will be put there and then like, oh, maybe we should make it more accessible. Let’s read into this. And I think these guidelines are also very interesting, maybe not just for WordPress themes. I mean, of course they’re for the repository, but you of course can apply them to your own custom theme, definitely. You do not have an absolute check like the team will do for you. But nothing stops you from using them even on a non WordPress site.

[00:31:30] Nathan Wrigley: Do the guidelines, do they feel like they’re kind of firmly fixed or is it always a movable feast?

[00:31:35] Jessica Lyschik: They’re relatively fixed.

[00:31:37] Nathan Wrigley: Okay, so if you were to swat up, for want of a better word, on what there is right now, there’s a good chance that the rug will not be pulled out from under you in six months, a year, two years time.

[00:31:46] Jessica Lyschik: No, I think the last time the requirements got updated was in 2012, 14. I would need to ask, Joe Dolson did the initial, or was working on the initial thing. And so it has been a while since this got updated and they just got updated last month. So I don’t think that they will be changing anything.

The one I talked about, not requiring or recommending plugins is the one, this is something, it kind of creates a grey area sort of. And I think this will be put to discussion. It’s like, I don’t mind, but I can see many people like really, not raging against it, but like raising questions about it. If this is something that should be a requirement.

But I think for like the actual technical stuff, I don’t think that there’s much that should change, because like they’re based on the WCAG requirements. These are like the standard requirements that also have, I’m not sure if they’re used on governmental things, like on the European Accessibility Act, but I think they’re a sort of base for that. And it’s not like completely this. So the theme requirements are not like the WCAG requirements 100%, but like a subset of it, sort of.

[00:32:57] Nathan Wrigley: Yeah, it’s a fairly slow moving ship in other words. If you acquire the knowledge today, you’ve got a good chance that in a year, two years, maybe even five years, the knowledge that you’ve got will need amending. But most of it will broadly work several years from now.

[00:33:11] Jessica Lyschik: It’s with like development in general. So like you always need to be constantly learning. And I think if you learn about accessibility today, I think you’re in a very good spot. Because like of course we have European Accessibility Act and governmental requirements, at least in Europe we do have them. But I think there’s already so much information out there, that it should be relatively easy to onboard you. And I think this is just beneficial if you learn, it’s basically about learning about how to use things correctly. And if you’ve got that, then you’re absolutely good to go.

[00:33:45] Nathan Wrigley: So not that long ago I suppose, we had block themes coming around, which is an entirely different way of creating themes in WordPress. So you’ve got classic themes, which is the way it always used to be. And now we’ve got block themes. Is there a striking fundamental difference in the way that you might approach accessibility if you were used to doing block themes? Is there a whole lot more to learn? Maybe it’s more straightforward if you’re using block themes. Just tell us about how those two things differ.

[00:34:08] Jessica Lyschik: Yeah. It is more straightforward actually. Core is handling stuff for you. So accessibility just got a tad bit easier if you use block themes actually. In classic themes, you have to do a lot of things manually. You have to make sure that the elements are right, that the skip link is there, for example, things that we touched on already. And in block themes, if you use the correct blocks on the correct structure, Core handles stuff for you.

For example, there’s a requirement labelled form fields. So when you use a form or the form fields should have a label to it. In themes you don’t really have that because usually you should not put like, something like a form in there. There are two forms that by default come with a theme that are the comments form, but that’s completely handled by Core. And there’s the search form on the search results page.

But in block themes, both of them are handled by Core. Both of them are accessible because Core handles it all for you. You just need to place them and actually not do anything to them. It is that straightforward.

And same for like template parts. If you want to use header and footer, just use the template parts and use them. You can assign them a header template part as header of course, and one as footer. And then the HTML text will be automatically added correctly for you. So there’s not too much that you need to do manually anymore, just get that right.

And as I say, I really love block themes for the much easier accessibility, or the way you can make a block theme accessible. This is so much easier than with a classic theme.

[00:35:38] Nathan Wrigley: So presumably though, it sounds like there’s meta knowledge, if you know what I mean. You’ve got to know which block to put in which spot, and which block wraps this other block, and the parents and the children. But if you learn that, and if you make that, we were talking about habits earlier, if you make that your habit, and then save that habit and save the theme and what have you, you are painting a picture where it’s significantly more straightforward because you don’t have to think about it in many cases. Well, that’s the wrong way of phrasing it. You don’t have to do that hard work.

[00:36:07] Jessica Lyschik: Exactly. If you have like a, sorry to interrupt you here, but if you have a theme that already gives you the correct examples, you can build off from that theme. For example, if you’re creating a new template, you can use an existing template and then just adjust it to what you need. If you need to change like colours or something but you have the structure already correct. You do not need to think about doing the structure again and maybe just have a check that it’s actually the right one. But if you just copy what’s already there, that is part of the theme, that’s actually super easy.

[00:36:38] Nathan Wrigley: I’m going to link to your presentation, which I know by the time that this goes out will be probably on wordpress.tv, I would’ve thought by that point. But I’ll link to your presentation and all of the different bits and pieces.

But I’m curious, who in the WordPress space, and maybe not the WordPress space, maybe outside of that, who do you follow or try to get guidance from? Maybe that’s a YouTube channel or a blog, or a, I don’t know, government based website. Maybe it’s just wordpress.org, I don’t know. Where do you go to swat up on all of this?

[00:37:06] Jessica Lyschik: Ooh, there are some very good resources out there. So I do follow like people within the WordPress community. I mentioned a few names already, like Joe Dolson, Rian Rietveld, Amber Hinds from Equalize Digital. They do a lot of stuff in that area. And then I also follow Sara Soueidan, she’s a developer from, I think Lebanon, if I remember correctly. She does great stuff on accessibility. There is a few more names. There are some good resources out there. I can probably research that for you because I cannot remember the names right now.

[00:37:39] Nathan Wrigley: I’m putting you on the spot. I’m sorry.

[00:37:40] Jessica Lyschik: Put me on the spot. That’s okay. I’ll share some links with you that you can then put in with the podcast information. There are some great resources both within the WordPress community but also outside of it that can give you a very good overview. And I think it’s just interesting to follow people who like can build the bridge between, okay, this is a requirement, this is how you technically do it, and this is why you do it.

[00:38:05] Nathan Wrigley: I have a friend who’s recently been on the journey of trying to go from zero to really quite proficient in this space. He’s found a bunch of YouTube channels and several of the names that you mentioned there, particularly the Lebanese lady that you mentioned.

And I think followed a course that they put together and found that structure profoundly helpful. The dry documentation, I think was the way it was described on the WCAG website can sometimes I think be a, you know, it’s hard to get into that in some way.

You know, if this all sounds like a lot of work, there’s definitely resources out there, which, fun is perhaps the wrong word, but make it more engaging. There’s videos to watch, and channels to follow and blogs to read and all of this. And so it turns this, I’m doing air quotes, dry subject into something a little bit more manageable and easy to take in.

[00:38:52] Jessica Lyschik: Yes. Yes, because like the WCAG requirements, like they’re hard to read. It’s like reading, the HTML 5 spec. This is also super hard to read.

[00:39:01] Nathan Wrigley: Yeah, it’s the cure for insomnia.

[00:39:03] Jessica Lyschik: Yeah, sort of. And it’s, yeah, I think if we have, not more content, but the right content available to people in the right spot, I think this will be beneficial for everyone.

[00:39:14] Nathan Wrigley: Yeah. I think unless there’s something else you want to cover off, I think, Jessica, I’ve asked everything I wish to. Is there anything you think we’ve omitted or are you happy to call it a day there?

[00:39:24] Jessica Lyschik: I think we’re, I mean we could go on probably for days. But I think for now it’s, we’ve covered every topic.

[00:39:32] Nathan Wrigley: Well in which case, what I’ll do, dear listener, if you go to the WP Tavern website and search for Jessica’s post, I’m not sure what number it will be as we’re recording it, go there and anything that we discussed, and any names that we discussed and those kind of things, I’ll put a link and obviously if Jessica supplies any other things she mentioned, we’ll add those in as well.

So Jessica, thank you so much for chatting to me today. And now that your presentation is done, you can relax and enjoy the rest of the spectacle.

[00:39:55] Jessica Lyschik: Yes. Thank you so much, and thanks for having me.

[00:39:57] Nathan Wrigley: You’re welcome.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, the risks of legacy PHP in WordPress and why upgrading matters for security.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players. If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you or your idea featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Milan Petrović. Milan has been deeply immersed in the WordPress ecosystem since 2007, developing an array of plugins, especially for expanding bbPress forums, and running his own company, creating plugins before joining the Freemius team as a full stack developer. With nearly two decades of hand-on experience, Milan has witnessed firsthand the evolution of both the WordPress and PHP landscapes.

Many WordPress users may be only partially aware of PHP. Perhaps they’ve noticed version numbers in their hosting panel, but few of the millions of WordPress users understand the real impact that PHP versions have on the security and performance of their websites. Milan is here to shine a light on why embracing newer versions like PHP eight isn’t just good practise, but a crucial step for security and efficiency.

Milan begins by recounting his journey through WordPress development. The conversation gets into the heart of his recent WordCamp Europe presentation, which tackles how legacy PHP code exposes sites to thousands of open bugs and vulnerabilities. And why relying on old versions is, as he describes, an active invitation for automated exploitation.

The discussion explores the contrast between running legacy code, and using the native shields of modern PHP, and highlights how PHP 8 not only closes security holes, but also delivers major performance boosts, reducing memory usage, and accelerating speed.

If you’re wondering why you should care about the PHP version your site is running on, or you’re a developer interested in practical ways to harden your code, Milan unpacks both the existential risks of outdated PHP, and the step-by-step benefits for hosts, agencies, and plug-in developers alike.

He introduces his Vulnerability Lab plugin, designed for developers to see firsthand how code exploits play out differently across PHP versions, and makes the case that modernising can happen gradually, one update, one plugin at a time.

If you’ve ever questioned how your hosting choice, or plugin stack, could affect your site’s future. Or you’re ready to take the first steps towards building more secure and future proof WordPress products, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Milan Petrović.

I am joined on the podcast by Milan Petrović. Hello Milan.

[00:03:58] Milan Petrović: Hello Nathan. Thank you for having me here.

[00:04:00] Nathan Wrigley: You are very welcome. We’re in a beautiful, beautiful media room at WordCamp Europe. And I know that you have already done your presentation because we just had a little chat about the fact that you’ve done it and it went well and all of that.

Do you want to tell us a little bit about you and your background working with code and developing and security and all of that kind of stuff? And then we’ll talk about your actual presentation and how it went.

[00:04:25] Milan Petrović: So I started with WordPress almost 20 years ago, so way back in 2007. And I created a lot of plugins for WordPress, and I especially have a lot of plugins for bbPress for expanding forums. Yeah, people still use forums these days. So that was, I really like bbPress and all the stuff I did with that.

I have been working as a freelancer for a lot of years. I have my own company that was doing plugins, it’s called Dev4Press. But in 2024, I joined the amazing team at Freemius. So for almost two years I am a full stack developer at Freemius. And that was a really nice change of pace for me and the work I usually do before that. So yeah, that’s a short of it.

[00:05:13] Nathan Wrigley: Yeah. That’s great. Thank you. And so the presentation that you did that is now over, goes like this. I’m going to read the entire blurb because it’s short enough to read, and it says, secure by design, hardening plugins with PHP 8.x. In the WordPress ecosystem, we’re often forced to choose between supporting the lowest common denominator of hosting and implementing modern security. But in 2026, writing legacy PHP 7 code isn’t just a bad habit, it’s an active invitation for automated exploitation. It’s time to stop playing whack-a-mole with sanitisation, and start building products that are secure by design. This talk isn’t just another slide deck on security tips. Through comparisons of a Vulnerability Lab plugin, you will see how common exploits like authentication bypass, and server side request forgery succeed on legacy code, only to be neutralised by the native shields of the latest PHP. You learn how to leverage the modern PHP patterns to ensure your plugins are resilient to a wide range of exploits.

Now into the show notes I will put Milan’s wordpress.tv presentation so that you can go and watch the entirety of it. I guess basically if at any point you get confused, that would be a good idea, pause this podcast and go and check that out. But, how did it go? How well received was it?

[00:06:33] Milan Petrović: For me personally, I’m very satisfied with how how it went. I don’t know, it’s a bit overwhelming to be honest, but I am very satisfied and I got a lot of questions after the talk. I met a lot of people that liked what I had to say. And I think it’s good feedback to have, for something that is more technical like this was.

[00:06:52] Nathan Wrigley: Well touching on the fact that it’s more technical, I have to confess that I think you are going to have to shepherd me through this, because a lot of the content that you I think probably got stuck into is beyond my pay grade. But hopefully we’ll get through it.

Now at WordCamp Europe, where we are now, I don’t know what the ratio is, but I’m guessing that a significant proportion of the people out there are not developers. They kind of know that PHP is a thing. They realise that WordPress is built on that, but they don’t really have an understanding.

They’ve probably heard of PHP 7. They’ve probably heard of PHP 8, because somewhere in a control panel that was shown to them. But maybe there’s not much of an understanding of the fact that it gets better over time. It gets secure over time. I think there’s probably a notion of, well, my website works. Why do I need to change anything?

So let’s get into that. What were you talking about in your presentation? What’s changed in the landscape of PHP more recently that you brought to the fore that you shared with your audience?

[00:07:51] Milan Petrović: Yeah, I think that PHP 8 was a big milestone for a lot of things. And I’m not sure, but I don’t think that the wider communities are kind of aware about the impact of the PHP, or the server environment in general, on how the websites work and how secure they are. Maybe the WordPress in itself needs to spread more awareness about that.

Because right now we get a notice in the dashboard that maybe the PHP needs to be updated. But for a lot of website users, that can be too much and too little information at the same time, because they may be not aware of how to do things on their hosting site.

We need to spread more awareness about how important the changes in the code are when it comes to the newer PHP versions, and what they can do to improve the security. And how developers should be starting to use more of those new features and the new things that PHP provides on a language level nowadays.

[00:08:49] Nathan Wrigley: WordPress has got this real legacy, I suppose is the right word, of supporting legacy code. So WordPress itself is supported way, way, way back. You can keep using versions of WordPress, which are many, many, many years old. And I wonder what your stance is in terms of PHP, whether or not WordPress runs versions of PHP which are far too old, in your opinion.

So in other words, should WordPress have a policy of, I don’t know, 8.x only? Or is 7 okay. And I don’t know what other CMS platforms, you know, Drupal, Joomla as was. I don’t know what they do, I don’t know what their posture is.

[00:09:32] Milan Petrović: I think that one of the most important decisions that, it was done with WordPress early on, is that backwards compatibility, because it opened the doors for a wider adoption. Because you don’t need to change server every year, or you don’t need to upgrade your software that often. And that helped a lot of hosting companies to provide WordPress hosting very cheaply, because they didn’t have to have the latest PHP, they didn’t have to invest much more money into all that. So WordPress got a lot of adoption from backwards compatibility policies.

But in the same time, that also proved a bit of a problem. Because even the WordPress Core code is kind of stuck because of that policy of backwards compatibility. And it’s not only compatibility with old versions of WordPress, but the old versions of PHP. And we are running now maybe six years behind end of life PHP versions. Because PHP 7.4 end of life was four and a half years ago. And we still support it in the Core.

[00:10:33] Nathan Wrigley: Yeah, I guess it’s a nice thing to support it. And it, as you described, it was a great way of onboarding the millions of people that came along. But things have moved on.

What would be some of the top level items? And I’m inviting you to open the scary book and sort of give out the worst case scenarios basically of running legacy code. So really, go to town, frighten us all. What are some of the horrors that await if you’re quite willing to, as a hosting company, support seven point whatever or beyond, six or five, or dare I say it, four, who knows? What are some of the terrible things that await us?

[00:11:08] Milan Petrović: To be honest, when I was researching some of the statistics and things like that, I was kind of scared when I saw that there are 3 or 4,000 open bug reports for PHP 7 and PHP 5, which are still in use today, and there are WordPress websites running on both of them in the millions. And there are 3 or 4,000 open and confirmed bags that are never going to be fixed. Never. So PHP 7 has thousands of bugs, and I’m sure that not everything security related, but a big chunk of those bags are related to security.

And there are open exploits that run on the PHP level. They don’t care really about if you are using WordPress or using something else. It’s more like a exploit on the level of a, on a server side that can be quite scary because you, even the technical people are not really sure what are all those bugs. Who is going to go through 3,000 or 4,000 bug reports?

[00:12:05] Nathan Wrigley: Yeah, so just to sort of describe that, the fact that there is no more updates to the 7 branch of PHP means that all of those bugs which are publicly available, anybody can go and read great detail about what they are. Well that then means that any hacker can do that, and probably did like a dozen years ago. And so really you are painting a picture there of you are asking for trouble.

[00:12:30] Milan Petrović: There are hosting companies that maybe do things a bit differently because you don’t need to run PHP as it was created. You can build your own version of PHP. You can patch bugs on your own. And a lot of hosting companies are doing that. But in the same time, that also poses a problem. You are going to run WordPress in your own plugins on a platform that is not actually officially PHP supported. It can have some different quirks that make your code run a bit differently.

A while ago we had the Facebook running their own PHP build, that was quite different from the public PHP. But they used it, and other people started using it. So I don’t know. Still I think that the official PHP is the one you should be on because you never know what other issues. Even when hosting company patches the PHP they’re using, maybe they’re opening doors to something else that is not quite documented on that level.

I think that the best policies, I don’t expect for WordPress to adopt the latest PHP or only supported PHP versions, but to kind of move quicker on the adoption of the newest version. So maybe we should be quicker to adopt PHP 8.0 or 8.1 is a next minimal required version for WordPress.

[00:13:50] Nathan Wrigley: When you say you don’t expect WordPress to do it, is that simply because it doesn’t have a history of doing it? Is there a technical reason why WordPress could not keep up with the latest version? I know we’ve got this plugin architecture where there’s thousands and thousands of developers who are all doing their own thing, and there’s all of that. Is there any technical reason why WordPress couldn’t be on the cutting edge, most up-to-date, latest version?

[00:14:15] Milan Petrović: There are two factors in all that. First one is you can declare, PHP 8 is the minimal version we support. We don’t support PHP 7.4 anymore. And that means that you don’t need to make any changes in WordPress at that point. You can declare it because WordPress is compatible with all PHP versions. It works on 8.0 and 8.5. That’s no problem. But say that branch 7 is no longer supported, you’re kind of pushing other developers and hosting companies to improve their support for newer versions.

And you don’t need to make immediate changes to WordPress. But at that point, you are open to modernise the code because now you can have more stricter typing across the board. There are some strict typing things in older PHP versions, but with 8.0, you can do all of that. And it doesn’t have to be a process that is done immediately. It can be done gradually. You can update parts of the WordPress Core over time. And it’ll take a few years, to get up to date, but at least you are closing doors to some older versions of PHP, and you are pushing developers as well for plugins to have that policy.

Right now, each developer can have their own plugins supporting any version of PHP you want. For my plugins, I have policy of 8.0 as a minimal version since this year. And, I’m updating the code as I go along. I don’t do it, it’s impossible to do it all at once. And for WordPress, it’s going to be even worse to make it all up to date. But declaring PHP 8 is a minimal required version, would be a great step in the right direction for wider adoption.

[00:15:51] Nathan Wrigley: Yeah, I think the problem is simply one of the user base, isn’t it? There’s just millions of people, thousands of developers all doing their own thing. And casting 8.x, 8.0 and above as the new minimum, there’s going to be a moment where some things do go wrong.

So that calendar plugin that you’ve been using for ages, which just works. And sure, you’ve never really received any updates from the developer, but it just works. Everybody’s booking on my calendar and we are all good. And then suddenly PHP 8 is required and it turns out the calendar plugin now no longer works.

You can imagine those kind of stories a million times over coming to the fore. But equally, we got to move on. There’s no way of, you know, because we can’t in 10 years still have sites on 7.4.

[00:16:43] Milan Petrović: We have sites on five point something. I recently checked the official WordPress tracking. 7.4 is on 20% even now. So we are far away from WordPress ditching the 7 branch. And I think there are still few percent of PHP 5 in all that so.

[00:17:01] Nathan Wrigley: Yes, I regularly look at the, it’s like a little donut chart, isn’t it? That is often produced and you gradually see the eight point x whatever section of the pie getting bigger as they produce the next survey. But you’re right, it’s still a significant chunk that’s on 7 and below.

And whilst when I look at that chart, it doesn’t really bring any alarm bells to the fore, I just think, oh, that’s a shame. But now that you are presenting this talk, and giving me this information, I realise that that attack surface is worse.

When you gave that talk, who is your target audience? Were you directly sort of aiming at the hosting companies who presumably can do a lot of work very quickly? You know, they could take a million people onto 8 with a little bit of development work and on the back end of their platform. Or are you really encouraging the general WordPress user, like me, to take a bit more interest and make sure that I am going into the cPanel or whatever it is and updating myself? Or is it a bit of both?

[00:17:59] Milan Petrović: For everyone actually. It’s for developers to be more aware of what they can gain with the new PHP versions. It’s for hosting companies. Because it’s not only about security when it comes to the newer PHP. The PHP is faster and faster. So each new version gets you 5 or 10% more performance without doing anything. So PHP 8.5 is more than 50% faster than PHP 7.4. So that’s a significant update.

And I have even, one slide was showing how much less memory PHP 8.5 used to run exactly the same piece of code. So it’s pretty wild to see that hosting companies are maybe the biggest factor in all this. They will gain a lot more because they’re going to free a lot of resources to run more websites because PHP is going to use less memory and it’s going to be faster.

So I understand they need to invest a lot of money to do all that. But, I don’t know, I think that gains from that are very significant, on that level alone.

[00:18:57] Nathan Wrigley: Yeah, so you described there are really compelling scenario. You know, it’s quicker, it uses less memory, you’ll save money. I mean what else do you need? You’ve just presented the entire argument.

However, it hasn’t happened. So technically speaking, why do you think it hasn’t happened? Is there an acquisition of new knowledge that is difficult to take in? Is it that simply you would have to, I don’t know, retrain your staff? How do you understand that it hasn’t happened? What are the reasons people are digging their heels in and not making these updates?

[00:19:25] Milan Petrović: I kind of make the group of two or three types of hosting companies. One, and that’s usually more expensive managed hosting solutions. They are forcing the updates. They’re not maybe on the latest version, but they are forcing their users to use at least three or four versions of PHP back. So maybe 8.2 or 8.3, which is a great step in the right direction.

There is also a problem of support. If something starts breaking, they’re going to be the first one to be asked about that, because they made the change to the server. So why now website that was working yesterday is no longer working today because of some change made on a hosting level. So there are a lot of factors to play into that adoption.

But on the other hand, there are a lot of developers that have moved on with supporting PHP 8. A lot of plugins are very much updated and, especially popular plugins. They invested a lot of time to do the update. It’s getting easier to support it. But on the other hand, you have very old websites that are simply cannot move without proper testing, without updating the plugins. And there are cases when you cannot simply update one plugin because something else may break, or you made some changes that will make some other thing break. So it’s a big puzzle that is definitely not easy to solve, but maybe we should start some work on that as a community to do it, and to move people along.

I don’t want to say force the change, but make people aware of the benefits. Make people aware of the risks if they continue to run the old and outdated software. And the same goes for not updating plugins, not updating WordPress. No matter how much work is done in that regard, there are still most likely some exploits on a WordPress level for very old versions that at some point someone is going to find out about and exploit.

[00:21:16] Nathan Wrigley: I mean I guess the motto of WordPress was democratised publishing, which means basically make it available to everybody. No matter your level of expertise, make it available to everybody. And I’m sure that if you were to grab the CEO of any hosting company and say, I can save you money, I can save you resources, and all of those things that you outlined earlier, they would, yeah, we know, we know. But we’ve got thousands of non-technical people using WordPress.

I kind of have this analogy in my head, and it goes a bit like this. Several years ago, I bought a bike. And it sits in my garage and there is my bike. And I expect my bike to work tomorrow in the same way that it did four years ago. And in 10 years, I expect my bike to work. I don’t expect there to be an update to wheels or gears or the saddle. It doesn’t need an update. It’s just a bike. And I need my bike to be a bike and nothing more.

And I get the impression that many people treat their WordPress website as the same thing. This sort of static commodity that, sure enough, they pay a monthly fee for it, but it’s this website. It’s a thing, and it doesn’t need changing. And so what I’m trying to say is, I’m fairly sure that the hosting companies are met with that an awful lot. The customers who just, it’s a bike, it’s a website. Do you know what I mean?

[00:22:37] Milan Petrović: Yeah, but you need to maintain your bike. If you don’t do it, it’s going to, your belt is going to rust, your wheels are going to be deflated or whatever. A lot of things can happen with it if you don’t maintain it. So, we don’t need to upgrade everything all at once, but we can start from someplace. We can do it gradually. But still, WordPress needs to be the platform that leads the charging that, because it’s going to force other developers to do it. It’s going to force hosting companies to start doing it. And it’s not a big jump on moving just that one version, but it’s going to help to move things along faster. Let’s see how it goes in the next few years. But I really don’t expect for WordPress to drop 7.4 for at least a year or two, maybe even more.

[00:23:24] Nathan Wrigley: I loved your rebuttal of my bike analogy there. That was perfect. That’s exactly right. The bike will rust, the wheels will be deflated and all of that, yeah. So we need to drag the WordPress users along.

Now, in your presentation, you mentioned something that I have never used, the Vulnerability Lab plugin, which you used to demonstrate the attack. Can you just tell us a little bit about that? Because I’d be curious to follow that up, and maybe some people listening to this would too.

[00:23:47] Milan Petrović: I started it for, created for this talk specifically to add few examples and to run the code that is going to show those things if you run the plugin on the old version and the new version of PHP. And I do plan to expand on it because there are a lot more PHP security elements that can be demonstrated in that way.

So it can show you, you have like a, in many cases the same code, but if you run it on one platform, you’re going to get one result. And if you run it on the newer one, you will get something different. So it’s useful to show, and some of those changes are quite small, those attributes that you can add to the code are very, very small, but they can really help you to improve security of your plugin.

And there are more complex security measures that can be implemented, but the format of the talk wasn’t really suitable to mention everything. But this was like something to get you started on the path of discovering what else PHP 8 can offer, when it comes to improving the security of the plugins and what possible exploits and vulnerabilities are there.

I try to use some obvious things that are very easy to spot. And I’m sure I did made some of those errors myself in the past. So some of those examples are something that I dealt with when I was upgrading my code. So I’m sure that a lot of people can see similar problems in their own code, and similar kind of solutions that can help them to overcome those and to make them much more resilient in the future.

[00:25:17] Nathan Wrigley: So is your plugin designed primarily, would you say for developers in mind, or is it something that just a typical end user may get some mileage out of?

[00:25:26] Milan Petrović: No, it’s more for developers that they can see, they can run that code and see how it behaves on the old version and the new version to demonstrate some of those things. And I will definitely expand it to include more examples in the future. Even for myself to like a document, what can happen if you run something in the old version, and the new version?

I had some suggestions coming to me like, maybe like a pattern library that is going to show what is the pattern that we use with old PHP and how to improve it with a new one, and document which version of PHP is going to support it, and how it’s going to improve the code.

[00:26:01] Nathan Wrigley: So is the idea then that you would instal it on various different, let’s say that you’ve got a live site and you’ve got, I don’t know, a development site and another development site, is that you would put it on each of those, different PHP versions, and just sort of compare and contrast what.

[00:26:16] Milan Petrović: Yeah, that can be used.

[00:26:17] Nathan Wrigley: Yeah, in that way. And what’s the reporting that you get? Is it kind of error logs, you know, that only a developer would be able to understand, or is it in plain language that somebody like me could understand?

[00:26:26] Milan Petrović: Right now it’s a bit technical because if you run a certain part of the code, some of those elements do have a visual component in the admin section. You will see, one of the examples, if it’s run on PHP 7.4, it’s going to result in a fatal error for sure, depending on the server settings. And if you run it on the new version, you will get a full code running and executing as expected.

So it’s a bit of a development thing that developers can use themselves to show maybe to potential clients or to website owners what is going to happen if they continue to run the outdated versions of the PHP. So it’s not just, yeah, the PHP 7.4 is bad, but here it is, why it is bad actually.

[00:27:12] Nathan Wrigley: Okay, that’s a really interesting use case, isn’t it? So if I’m an agency owner and I’ve got, I don’t know, a client over here who is absolutely wedded to this plugin, this calendar plugin say, and we know that the development of that plugin has ended years ago, then trying to persuade that client to find something new, or have something new built is difficult.

But with the capabilities of the plugin that you’ve created, you’ll be able to show in a sort of readable human way, okay, right. That’s all very well, but we’ve got to get onto PHP 8.0. And when we do that, this is going to happen.

So that’s actually quite a useful tool for agencies to be able to dangle things in front of the noses of their clients. Potentially, I don’t know, get some new work out of it as well, because there’s this extra work that needs to be done to bring it up to the modern standards.

[00:28:01] Milan Petrović: Yes. And one example especially demonstrates not only security, it demonstrates the performance. It shows you how much memory that piece of code is using on old version. Almost half the memory is going to be used less with a new version. So that’s very on the nose demonstration on security, and the performance in the same time. So things like that can help. And I will definitely try to invest more time in showing more examples and anyone can contribute.

It’s a plugin available on GitHub, so any contributions in that regard are welcome. And we can maybe all work to create like a list of patterns that are something that a lot of people can use, and show different people how the PHP can help them move along.

And again, I don’t want to sound like we don’t need whatever WordPress is doing. We still need to use all the security enhancements that WordPress has built in the Core. Escaping, sanitisation. All that is still very important because you cannot solve everything by upgrading PHP and upgrading your code to use some of the PHP features. There are still a lot of security elements in WordPress itself that are very important and should not be replaced, or removed, from the code. There are patterns that are crucial to ensuring the security is on a top level. So combination of what WordPress already has, plus everything we get with the newer PHP is something that we should strive in the future, and to make things better.

And it’s not that complicated to start with the process. You can start upgrading small things. You can start with stricter typing. You can start with very small changes, and then gradually you can add those new attributes. You can replace some of the functions that you may be used with old version of PHP, but there is something better in the new version. So that’s something that everyone can do. Do a bit at a time so not everything at once. Spend time and make some gradual upgrades, and that’s going to help moving along.

[00:29:57] Nathan Wrigley: You are obviously here to talk about where PHP meets WordPress, but presumably you, yourself are gaining intel from the PHP community. Is there a resource, like a central PHP resource that you would direct people to, or would you rather steer them towards kind of WordPress resources? The things that people are doing in the WordPress space and the hosting space. There’s not really a question there, but it’s more where do you find your information? Where’s the most reliable place?

[00:30:25] Milan Petrović: You need to check everything. PHP website is a really good resource to find the information about what’s coming in the next version of PHP, because the preparations take up to a year to release a new version of PHP. So they’re now on a cycle that every December we get a new feature version. So in December this year, there is going to be PHP 8.6. And you already know most of the things that are coming to that version. You have the detailed list of changes for every PHP version. And that’s something that any developer should look at, and to see maybe something that will drive them to upgrade.

In the current usage of third party libraries, there are a lot of libraries used in PHP that have moved on beyond 7.4. There are a lot of libraries that now require 8.1 or 8.2. If you depend on some library for, I don’t know, parsing URLs, or doing something else, something for security, something for whatever. You may face the problem that if you want to use the latest version of that library, you will need to have the newer PHP version. So you are kind of forced to upgrade your plugin requirements to meet with the requirements of the third party libraries.

And outside of WordPress ecosystem, those libraries will move much faster with the adoption of newer PHPs versions than WordPress itself, because they don’t deal with millions and millions of websites that are affected. They are creating the library the best way they can. And they want to ensure that their library is secure, that their library has access to the latest features. So they are going to bump requirements for those libraries on their own. And if you are depending on it, you need to do it yourself for your plugin. So it’s kind of, those libraries are kind of forcing the hand of some developers to upgrade, even if they maybe are not ready at this point to do it.

[00:32:15] Nathan Wrigley: Yeah, it certainly sounds like there’s no lack of information out there. If you make your business to find the information, then it’s all there. You’ve just got to make the effort to go and find it.

I’ve kind of run the gamut of everything I wish to ask. However, I’m very conscious, as I said at the beginning, that this conversation is a little bit above my pay grade. Is there anything that I missed that you wished you had been asked that you wanted to get across?

[00:32:38] Milan Petrović: No, I think we covered a lot of stuff in that.

[00:32:42] Nathan Wrigley: Well I’m glad to hear it. That’s great. Yeah, thank you.

In which case, I’m assuming, given that you’ve come to an event like this and you’ve put a plugin on GitHub, you are sort of semi available, or very available, to have conversations with people around this. And if that’s the case, where’s the best place to find you online? A website or an email address or a Twitter handle or whatever.

[00:33:00] Milan Petrović: We included the slide with the contact information. So even the email, if someone wants to get more information, they can do it on various social networks as well. So any input about all that is welcome. And I’d be happy to help if someone needs, some pointers or additional information to get started with all this.

[00:33:21] Nathan Wrigley: Well, thank you. That’s very much appreciated. As always, if you go to the show notes on the WP Tavern website and click on the episode involving Milan, you’ll be able to find, buried probably towards the bottom, all the different bits and pieces, the wordpress.tv video that will go with his presentation and various other links that have been discussed during the course of this episode.

So with that said, Milan, thank you so much for chatting to me today. I really appreciate it.

[00:33:47] Milan Petrović: Thank you. It was really great, and I appreciate your invitation for the interview.

[00:33:52] Nathan Wrigley: You are so welcome. Thank you.

[00:33:53] Milan Petrović: Thank you.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, building trust and collaboration in the hosting industry with the Secure Hosting Alliance.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you, and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today, we have David Snead. David has been involved in the hosting industry since 1999, starting out as legal counsel for one of the earliest shared hosting companies, and going on to work with over 50 others. He helped found the i2Coalition, serve as in-house counsel for cPanel and WebPros, and now leads the Secure Hosting Alliance.

If you’re listening to this podcast, I’m sure that many of you will have worked closely with hosting companies. Perhaps you run an agency, or business, that depends on the reliability, ethics, and security of hosting providers. David is here to talk about cross-industry collaboration in the hosting world, specifically around improving security, professionalism, and communication between hosts.

The conversation focused on why, and how, the Internet Infrastructure Forum, or IIF, is building a framework for real-time intelligence sharing and abuse reporting, aiming to help the entire ecosystem detect and prevent attacks faster than adversaries can adapt.

David talks about the challenges hosting companies face, especially smaller ones, in keeping up with security, and how this evolving project hopes to ease this by sharing actionable, non-proprietary abuse information across registrars, hosting providers, DNS services, and more.

He discusses the growth of both the Secure Hosting Alliance and the IIF, the business case for collaboration, and the nuances of legal and technical information sharing across borders.

If you’re in hosting, run a web agency, or just want to know how the backbone of the web is working to stay more secure and connected, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so, without further delay, I bring you David Snead.

I am joined on the podcast by David Snead. Hello David.

[00:03:20] David Snead: Hello.

[00:03:21] Nathan Wrigley: Very nice to have you with us. David’s got a really interesting background, and a really interesting, I’m going to use the word project. I don’t know if that’s the right word. It feels like it’s got more solidity and it’s got a lot more history than that. It’s something which is, I think going, but we’ll find out a little bit more about it. It’s all about the hosting industry and trying to get hosts to, I guess communicate with each other in ways going forwards.

[00:03:44] David Snead: That is a part of it. There are really two goals and one is to level up the ethics and professionalism in the hosting industry. And the second is to facilitate more comradery and interaction among hosts. Something that folks felt occurred in the early 2000s, and with all the consolidation that occurred went away. And so that’s something that we’re also trying to facilitate.

[00:04:16] Nathan Wrigley: Okay. So given that we’re going to be talking about hosting, I guess it’s a good idea to paint your credentials and find out a little bit more about you. So a short opportunity to just tell us a little about you and your background in WordPress and hosting specifically, I suppose.

[00:04:29] David Snead: Sure. So I have been working in the hosting industry since 1999. As I often say, I was working in the hosting industry when hosting was cool. It is not so cool anymore. In fact most people don’t really pay attention to it.

You know, and I started as a lawyer for a hosting company, and I was in-house counsel for a company that actually owned a hosting company and was one of the earliest hosting companies that specialised in shared hosting. And so I was their general counsel. And for some reason it stuck, and I’ve just kind of turned it into a career.

So after that I had a private practise as a lawyer and I worked with probably 50 different hosting companies, mostly writing policies that nobody ever reads, which makes me super fun at parties.

And then from there, my friend Christian Dawson and I formed the i2Coalition as a response to some legislation in the US that would’ve been kind of the death nail for internet providers. So we started the i2Coalition. I then went in-house for cPanel and worked at cPanel and WebPros for 10 years, and then started the Secure Hosting Alliance.

[00:05:52] Nathan Wrigley: Okay. So you’ve got all all the history. That’s pretty good. You know, if we’re going to talk about hosting.

[00:05:57] David Snead: All the hosting history in one person. That’s kind of a very scary idea, no?

[00:06:02] Nathan Wrigley: But that’s excellent. So do you still offer counsel? Is that still, so you haven’t sort of sidestepped and do half of the week on a sort of more technical basis? It’s still the legal side that you’re involved in.

[00:06:13] David Snead: I do. Right now I’m doing mostly M&A work for, it’s weird. So I don’t know if anybody has ever said this to you before, but web hosting is kind of like the Hotel California. It’s like, once you start in the web hosting industry, you never leave. And so I have all these clients from 15 years ago who are now running like little baby hosts, and they’re talking to bigger hosts and they want to get acquired. So I’m doing some of that now. I am not writing any of the policies that nobody ever reads because that was just, I did that for too long.

[00:06:51] Nathan Wrigley: There were too many moments parties.

[00:06:53] David Snead: Yes, exactly. Yeah.

[00:06:55] Nathan Wrigley: Okay, so I’m going to read into the record the title and the blurb that went with the presentation that you are doing or done.

[00:07:02] David Snead: I did it yesterday.

[00:07:03] Nathan Wrigley: Okay, we’ll get into that in a moment. So the title is coordinating the fight, cross industry collaboration, and the blurb goes as follows. WordPress hosting threats cross company lines. When one provider falls victim, the entire ecosystem suffers. This session explores how the Internet Infrastructure Forum, or IFF, enables hosting providers, registrars and registries to coordinate abuse response through real time intelligence sharing. Learn how operational collaboration helps responsible operators detect and stop attacks faster than adversaries can adapt. And why working together produces results no single provider could achieve alone.

When I read that, immediately was, yeah, that’s a really sensible idea. Why are we separately, as hosting companies, I say we, I mean the hosting companies. Why are they all trying to do the same work over and over again, separately? When presumably this aspect of the work, the security bit is something they all have in common.

[00:08:05] David Snead: Right? So that’s the fundamental question, right? So the IIF is a voluntary organisation that is made up of everyone in the infrastructure stack. So from registrars, registries, DNS providers, hosting providers, cloud providers, everyone in the stack. So it is facilitated by the Internet and Jurisdiction Foundation. They’re based in Paris, and they’re the actually the secretariat for it.

And what it’s designed to do is create a common way for everyone who’s in the infrastructure stack to share information about abuse and abuse issues. And it’s one of the fundamental problems that you referred to is everybody is operating in a silo, right? And that’s mostly because that’s the way the internet is architected, right?

So the internet is architected, so it’s distributed, right? Registrars and registries basically do their own thing with domain names. They might have a small hosting component or maybe a cloud component, but by and large, all they do is domain names.

Hosting providers probably resell domain names, but they’re not part of that industry. And so how do they all coordinate? And that’s what the IIF is trying to facilitate, is more information sharing among the participants.

[00:09:39] Nathan Wrigley: Well I imagine some of the hosting companies are probably fairly good. You know, they’ve got a giant customer base. Let’s imagine hosting company X over there, they’ve got millions of customers. They’ve got a huge budget that they can put over to, let’s say, security things. Well that’s all well and good, brilliant. But then there are other companies who are much scrappier. You know, they maybe have only a few thousand customers. And so their budget for the exact same work is going to be reduced.

How will this work? Is it going to be like a subscription service basically? Will you have a membership, which is in some way equal to the number of clients that you’ve got? Will there be some expectation that, okay, we’ll look at your revenue, your membership will be equivalent to a percentage of your revenue? How will that all work?

[00:10:20] David Snead: We don’t know. This is a very early stage project. Right now we are in a prototype phase where we have just figured out what information folks should submit to the secretariat.

So the way it works is, you submit the information that you collect for a particular abuse issue to the secretariat, who then enriches it with all the other information that’s been submitted and sends it to the right person.

So a great example is, let’s say a registrar reported a phishing domain. They turn off the phishing domain and they have maybe a timestamp, an IP address where it was submitted from. They submit that to the secretariat, who then finds the hosting company who is providing the services for the hosting and says, this came in about this particular site. Can you take action on that? So that’s the way it works.

Right now it’s very early stage. It’s in the first phase of a test, and we’re going to look at whether the way we’ve architected it, or the way the group has architected it, actually makes sense.

[00:11:39] Nathan Wrigley: Is this going to be then a sort of slow on ramp whereby you bring a few companies in at the beginning, hopefully. And then one or two more and iron out the wrinkles, and then some more and some more? Because I imagine, if you just threw the switch, everybody’s in, a lot could go wrong at that point. And I’m guessing there’s going to be more of a slow on ramp.

[00:12:00] David Snead: So you’ve pointed out my particular frustration with the IIF, and the reason that the secretariat is moving slowly, right? So fortunately, or unfortunately, based on my cultural background, I’m just sitting here going, this needs to move faster. We need to have everybody involved, we need to have all the hosts involved, we need to have all the registrars and registries. And other folks who are a little bit more skilled in this type of work say, no, we need to figure out what we’re doing and that requires a small number of people.

The phase that we’re in right now is looking for more folks who are interested in sitting at the table and being part of the discussion. Particularly in the hosting industry and in the web design and marketing industry. Those are folks who don’t generally participate in these kind of industry led collaboration exercises. And that’s the reason that I’m at WordCamp, is to talk to web designers, marketing agencies about why they should participate in something like this.

[00:13:13] Nathan Wrigley: So this really isn’t bound in any way to WordPress, is it? It just so happens that WordPress has a significant chunk of the internet, so this is a good place to start. But if you happen to be a, I don’t know, Drupal user, or you’re just into writing PHP code or whatever it may be, this is still applicable. There’s no real WordPress layer to this. This is just a good place for you to come because, well, there’s probably, what, 30 hosts, 100 yards away from us out there.

[00:13:37] David Snead: I know. And I haven’t seen all of them yet.

[00:13:39] Nathan Wrigley: Yeah, there’s work to do. But agnostic to any platform, basically.

[00:13:42] David Snead: It is completely platform agnostic, yeah.

[00:13:43] Nathan Wrigley: Okay. Okay, that’s interesting. But WordPress is a, is certainly a good place to start.

Now, I’m imagining, if I was a hosting company and I was the chief executive, I definitely have some questions for you in terms of, okay, we’re going to share our valuable intel with you, what are you going to do with that? How can we trust you? How do we know that the sharing is going to be done effectively and what have you?

So I guess really what I’m getting to is, what is the assurances or checks and balances that you, in the end, will hope to offer the host? That you can assure them that, look, if you hand us this body of work, you don’t need to think about it again. You can trust us to do it honourably, effectively, collaboratively. You get where going.

[00:14:26] David Snead: Yeah, yeah. And I suspect that you wanted to be a lawyer at some time, because that’s one of the issues that we’re facing. Information that can be shared freely, as an example, in the United States, might not be capable of being shared so freely in the European Union, or in Brazil, or in India or someplace like that.

So one of the things that’s being done, not by me, but by another group, another working group that’s part of this, is analysing the legal issues around information sharing.

The information that’s being shared, to answer the proprietary and confidentiality question, is not proprietary or confidential information. So it’s things like timestamps, domain names, IP addresses for the initial abuse submission. Things like that that really don’t indicate some sort of company confidential information. And it’s further abstracted into xarf, which is a language that’s used for abuse reporting, that we all can share. And so I think that the only thing that would be of concern is whether that information is personal information that’s subject to jurisdictional restrictions around the world.

[00:15:48] Nathan Wrigley: Would the idea be that this organisation would do the remedial work? So is there any notion that, let’s say for example, some sort of security problem was discovered by hosting company A over there, and they share that intel with you. Maybe the question is kind of asking, will you then appoint people to figure out what the patch is for that? Or is your idea just to, oh, red flag, we’ve got this problem, now you all know about it. Is it just information sharing as opposed to fixes?

[00:16:17] David Snead: Yeah, it’s the latter. So the thing that we’re solving for right now, so there’s just one issue that, one abuse issue, that we’re testing out and it’s issues related to fake shops. And so the fake shop issue is the test abuse issue for the project, and where folks are sharing information. It’s a particular problem right now with credentials harvesting. And so that’s what we’re trying to look at.

[00:16:43] Nathan Wrigley: And how has the conversations that you’ve had thus far, how have they gone? Has this been warmly received or are you facing a little bit of pushback?

[00:16:50] David Snead: So, look, I’ll be very direct with you. If something isn’t just an immediate threat to them, it’s very difficult to conceptualise why you should participate. And I am pretty used to answering that question simply based on the political work that I do with the i2Coalition. But once you talk about, so let’s use fake shops as an example. Fake shops, and you’re providing services to fake shops, actually has an impact on your bottom line.

So if you are providing, let’s say, payment processing to an entity that is running a fake shop, it very easily can make your credit card processing charges higher. It ends up eating bandwidth. It will tax your abuse resources.

One of the things that you referred to initially is, you know, larger hosts have a lot of money. I wouldn’t say they have a lot of money, but they have more bandwidth to handle a vast fire hose of abuse issues. Most smaller hosting companies might only get five or six abuse issues in a month. But if you have a fake shop, that’s going to generate a huge amount of abuse, and it’s taking away resources that you can use to actually grow your business. So that argument actually is relatively persuasive in getting folks to pay attention.

I find that the business argument around abuse is a much more compelling discussion than kind of moral persuasion. I don’t think moral persuasion works in the context of a community that is trying very hard just to keep their heads above water.

[00:18:42] Nathan Wrigley: It feels to me from what you’ve just said, and I could be reading too much between the lines, but it feels to me as if a good target audience would be smaller hosts to begin with, simply because they’re probably going to be more receptive because they have less bandwidth themselves. And so would welcome anything that can make the burden of sharing this information easier. So 10 of the small hosts combined is, well, it’s much bigger than each of them individually would be, whereas I suppose you’ll have to get a critical mass of them on board until maybe some of the bigger hosts start to look at you with favourable eyes, let’s say that.

[00:19:15] David Snead: Well, so we have some pretty large hosting companies who are participating. So as an example, both GoDaddy and Newfold are participating. But we also have smaller hosts. But I agree with you, the information that’s being provided, particularly since it is actionable, realistic information that can be adapted for bespoke systems, is invaluable, right?

So if you only get five or six abuse complaints and you get an abuse complaint, and you can go to the secretariat and say, we got a complaint about this domain, and the secretariat says, here’s what the registrar did. Here’s what Cloudflare did. Here’s the information they provided us. And you can use that to make a decision on how to address that problem. It saved you hours and hours and hours of research time.

[00:20:09] Nathan Wrigley: Technically speaking, what would the conduit of information both toward you and away from you look like? So if I’m hosting company X, how are you imagining that I will supply you with that information? But also, if I’m just looking for information from you on a daily, weekly basis, whatever it may be, how do I receive that? Is this like a, I don’t know, a website or an API or?

[00:20:33] David Snead: It’s an API. So it’s a file. It’s just a general file download.

[00:20:37] Nathan Wrigley: Right, okay. So it’s readily available 24/7?

[00:20:40] David Snead: Right. That’s the goal. Right now it’s not, but the goal is to kind of figure out a way to make something like that possible.

[00:20:47] Nathan Wrigley: Yeah, okay. I also suppose that the hosting companies, whilst this is good for their business if they can minimise costs and hand a lot of this work over to you, there’s a part of them which would also probably like to put some sort of badge on their website to say, this is what we’re doing. We’re part of this alliance, for want of a better word. Is that something that you are looking to develop as well, you know, some sort of credentialing system to demonstrate that you’re in this?

[00:21:12] David Snead: So that’s not something that the IIF is working on. It’s something that the Secure Hosting Alliance does. The Secure Hosting Alliance has a trust seal that we give to hosts who fulfil our Trust Seal Certification provisions. But that’s not something that the IIF does.

Talking about like why, other than business reasons, folks should participate in this, one of the things that is going on that I would suggest that most hosts know about, is there’s a little bit of a moral panic going on in the world about what contents you have. And regulation is actually a very real thing for the hosting industry, who has not ever been regulated. This is the time where you can say, hey, this is what we’re doing, right? We’re dealing with issues. This way a trust seal is the same thing, right? It’s something that you can say, we are actually taking steps to make the internet a better place.

[00:22:18] Nathan Wrigley: I think if you are a general agency owner or, I don’t know, just a freelancer, hosting is one of those things that you, once you’ve done it once, you’re in it for the long haul until something goes wrong. But you’re also browsing around for any tiny indication of why is this host slightly different? You know, what is it that they’re doing that, I don’t know, is faster? What is it that they’re doing that’s more secure? So it feels to me if you had a credentialing system and I began to hear about it and see it pop up again and again, it would be one of the metrics which I would weigh up when looking at hosting.

[00:22:51] David Snead: I would think so. One of the things that a trust seal does is it indicates that there’s been some vetting of the host. That someone has determined the things that are important to the hosting industry and are important to the web design industry. The agency industry are also important to the host.

Great example of that is one of the provisions of the Secure Hosting Alliances’ Trust Seal Certification is that a contract is presented to the customer before they sign up, which is super customer friendly.

One of the things as a lawyer that you hear about all the time when people are dissatisfied with their services is, yeah, well, I never saw that contract. Or it was just a hyperlink in an email that I got. That’s one of the differentiators for a Trust Seal certified host is that the contract is actually presented to them, to the customer beforehand.

[00:23:57] Nathan Wrigley: So in terms of the WordPress crowd, is this a thing that you are pitching only to hosts? Like when you step out of here, are you trying to have conversations only with hosts? Or is there some bit of the WordPress community, the freelance, the agency owners? Are you trying to communicate with them just to scope out what they need?

[00:24:15] David Snead: So for both the Secure Hosting Alliance and for the IIF, it is that. I really enjoy talking to agencies and developers about whether this is important to them, or why it might be important to them.

[00:24:31] Nathan Wrigley: In terms of how long this project’s been going, I’ve only heard of it because of your participation here, but I don’t know if you’ve been banging this gong for a decade or, I mean you’ve been in the industry for long enough to have been banging it for decades. Is this a new initiative or is this something which has a long and storied history?

[00:24:49] David Snead: So the Secure Hosting Alliance has only been active for a year, a little bit over a year. I’ve been talking about abuse for a long time, but the Secure Hosting Alliance has only been around for a year.

[00:25:01] Nathan Wrigley: And have you, in that year, got any intuitions that you’ll be here for another year? Is it basically going in the right direction?

[00:25:09] David Snead: It is going in the right direction. So we started out with two or three charter members. We now have 25 hosting members. We have three security vendors who are members as well. We have, I think, 17 Trust Seal Certified members, and we’re launching in 2027 a trust seal for security vendors who provide services to hosting companies.

[00:25:40] Nathan Wrigley: I know that several owners of hosting companies listen to this podcast. They may very well be the people that you’ve spoken to already, but if they are not, and they are people who would like to investigate this further, I suppose the thing that’s going to be in their head is, okay, Nathan and David, you’ve explained what I’ll get out of it, what do I need to put into it? So is this an annual financial commitment? How does it all work from that point of view?

[00:26:02] David Snead: Yeah, so you become a member of the i2Coalition. And so the Secure Hosting Alliance is a working group of the i2Coalition. So you would be a general member and you would participate in the Secure Hosting Alliances’ working groups. You also have the ability to participate in the i2Coalition as a whole, which is a much larger trade association that represents almost everyone in the internet infrastructure vertical. Mostly doing policy work, primarily in the US and the EU. Although there’s, we’re doing some work in India right now as well.

[00:26:40] Nathan Wrigley: And does membership allow you to steer the future of the project? I know that lots of chefs in the kitchen results in terrible food, but that, I fear, is something that could happen. You’ve got 87 members, 260 members. And then the 260 members all start to bicker and, you know, we want this, no. You see how it goes.

[00:26:59] David Snead: I do.

[00:26:59] Nathan Wrigley: What’s the position there? You know, is there sort of gated levels of membership? How are you organising all of that?

[00:27:04] David Snead: There are not. The membership is based on self-reported revenue. The membership is not horrifically expensive from my perspective. And I think that that, most of our members would say that it is, it’s actually relatively affordable, particularly for the small to medium sized hosts. And registrars or design agencies, anyone who’s participating.

The question about, who’s running the show, comes up quite a bit. We haven’t really faced that issue, particularly in the Secure Hosting Alliance. Folks seem to get along. But the organisation runs on the idea of rough consensus. And so decisions end up not being controlled by one member or not. Some of the i2Coalition has some very large companies who everybody knows about, who get along with startups, and folks against whom they compete directly. And policies still get made. The organisation still moves forward.

[00:28:11] Nathan Wrigley: Yeah, I guess you’re in a space where, obviously all of these hosting companies commercially are vying for everybody else’s business. But in this particular situation, that is not the case. Nobody’s vying for their websites to be less secure. They all want the same level of security. So at least in that sense, you would hope that consensus could be maintained even if, commercially, the two companies that are in the room, the 10 companies that are in the room might be commercially at loggerheads with each other. At least on this they could agree. That would be the hope, I suppose, anyway.

[00:28:47] David Snead: It seems to be, not only the hope, but the actual way that things work. You ask about how compromise is reached. What comes to mind is I have a much different concept of privacy than, particularly when I was at WebPros, than other folks in the i2Coalition had. And another company just called me up and we worked through our disagreements about how privacy should be handled within the i2Coalition and were able to move forward.

The industry I’ve found to be hugely collaborative, particularly the hosting industry. Everybody knows what their competitor is doing. But when it comes to addressing an issue like, how are we going to deal with abuse as a community? Folks come together. CEOs of hosting companies while they compete tend to be relatively good friends.

As I said at the very beginning, it really is like the Hotel California, right? You come in as a CEO of a hosting company, you grow it and you sell it to another company. All of a sudden you’re at the bottom again with a server in your grandma’s basement, you know, trying to start again.

[00:30:08] Nathan Wrigley: It’s a really curious effort. I suppose really at the bottom of this entire podcast is your endeavour to be heard and to reach out and get some conversations going. So with that in mind, where do people find the information about this? So maybe there’s a website that we could mention. But also, is there a specific place where you hang out? Is there a place where you would like to be contacted most?

[00:30:33] David Snead: Sure. So our website is hostingsecurity.net. I’m not too afraid of getting too much spam. So folks can email me at snead@i2coalition.com And the two is the numeral two. So it’s snead@i2coalition.com. And I’m happy to answer questions.

In terms of hanging out, I am at most industry conferences in the hosting industry. In the WordPress industry, I’ll be at WordCamp US. We also participate very heavily in ICANN. So there is an i2Coalition member at every single ICANN meeting.

[00:31:12] Nathan Wrigley: So if you go to wptavern.com and you search for the episode with David Snead, S-N-E-A-D, you’ll be able to find those details. I’ll put everything into the show notes. So anything that I missed? Was there a particular focus that we didn’t touch?

[00:31:26] David Snead: No, this is actually one of the most thorough podcasts I’ve been on recently.

[00:31:31] Nathan Wrigley: That’s love to hear it. Well, David Snead, thank you very much for joining me today.

[00:31:35] David Snead: Glad to be here. Thanks for having me.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case how WordPress Credits bridges education and industry in the WordPress ecosystem.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Ivana Ćirković. Ivana is a digital marketer with 18 years of experience working both in and out of the tech industry, and currently leads marketing at WPBakery. She’s an active participant in WordPress events, having attended, and spoken at, numerous local and international word camps over the years.

In this episode, our focus is on the WordPress Credits initiative. We learn how this program, launched by the WordPress Foundation, connects students with real world opportunities to contribute to the WordPress ecosystem, earn certifications, and increase their competitiveness in the job market.

Ivana discusses her own experience as a WP Credits mentor, working with students as they learn about digital marketing, remote work, and other open source contributions. We explore, how universities can modernise their curriculums, and real world value for students by participating in the initiative, and how businesses can get involved, not just to support the community, but to help shape and discover future talent.

The program’s evolving structure also gets attention, and we learn how students are guided through hands-on activities such as translation or documentation, and how their progress is tracked publicly via profiles on wordpress.org. Ivana shares the opportunities and challenges for both educators and businesses with thoughts on accountability, mentorship, and the need to bring new faces into the WordPress community.

If you’re interested in the future of WordPress, education, or bridging the gap between academia and industry, this episode is for you.

If you’d like to find out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Ivana Ćirković.

I am joined on the podcast by Ivana Ćirković. Did I get that right?

[00:03:14] Ivana Ćirković: Yes. Excellent.

[00:03:16] Nathan Wrigley: Thank you. This is my first interview at WordCamp Europe 2026. I’m guessing because we’re on the first day of the event and it’s quite early in the morning, it’s 10 in the morning, I’m guessing you cannot have done your presentation yet?

[00:03:30] Ivana Ćirković: Not yet. Tomorrow.

[00:03:32] Nathan Wrigley: Do you get nervous with these kind of things?

[00:03:34] Ivana Ćirković: I get nervous all the time. I’ve been doing this for 12 years, it never gets easier. It is what it is.

[00:03:39] Nathan Wrigley: Well, the presentation that you are doing is going to be the focus of what we’re talking about today. So do you just want to tell us a little bit about the topic that you’re talking about, but also just give us a bit of a general bio about who you are and what you do. So just tell us about you and about your presentation basically.

[00:03:56] Ivana Ćirković: Okay. First thing first, I would like to introduce my presentation, or the talk, that is build up around WordPress Credits initiative, which is something that WordPress has rolled out late last year in December. And I applied to be a mentor to support students into their entering into WordPress. Got accepted, did my courses, passed them and started working with students on their, first entering the WordPress society, how everything works, contributing.

And out of all of this, I came up with the idea of sharing the story about WordPress Credits. What it is, why it is important, not just for the WordPress community, but also for universities all around the world for businesses to support, because there is an angle and huge opportunity for them too. And hopefully inspire people to join and become part of it more.

As far as I’m concerned, my name is  Ivana Ćirković and I am a digital marketer for 18 years. I’ve been working inside tech organisations, tech industry, but also outside of it. So I’m the multiverse. And lately, for past couple of years, I’ve been working in WPBakery, in marketing their product, and talking to people, sharing knowledge of what we do, how we do it, and so on. In the meantime I am attending many, many WordCamps, local and international ones, giving lectures, giving talks about digital marketing and all things related.

[00:05:39] Nathan Wrigley: So are you here at this event, not just to give your presentation, are you also here on behalf of WPBakery to represent them and the products that they have as well?

[00:05:47] Ivana Ćirković: Yes, we are sponsors. I am speaker, I was table lead for marketing on Contributors Day. So we are wide into the ecosystem.

[00:05:56] Nathan Wrigley: I have to say, having only been in this event space for about an hour, I’m actually deeply impressed by this particular event. It really is a gigantic venue. It’s so pleasurable as well to see the WordPress community in such large numbers here. And so we’re looking forward to a really good event.

Okay, let’s kick off with the topic at hand then. So it occurs to me that many people listening, whilst they’re using WordPress and they’re kind of, I don’t know, they’re building websites for people, and they’ve got products and plugins and they’re just general users. It may be that the community piece, and the educational piece, is nothing that they’ve heard of before. So would you just tell us a little bit about what WP Credits is as far as you’re concerned, just to give us that broad background of what it is?

[00:06:40] Ivana Ćirković: Okay. So WP Credits program is initially made to bring new young people into the WordPress, to broaden the ecosystem with the new fresh blood, new contributors. And to do so, WordPress Foundation initiated this program to connect with universities all across the world. To connect students to some programs, to learn about WordPress through contribution. For that, they will get graded and get certification, which in the end will help them be more marketable, and have more modern knowledge of what is needed in today’s job market, and to be more competitive and more appealing to potential employers.

So by doing so, WordPress Credits aims to broaden the ecosystem, to strengthen the WordPress community, and WordPress itself. But also to put new generations in more marketable place, and to help them get more profitable jobs.

[00:07:45] Nathan Wrigley: Thank you. That was a really nice summary. In terms of your personal commitment to it and what have you, how did you fall into it as a thing that you were doing? And is this something that you get sponsored for from WPBakery, or is it personal and simply a sort of philanthropic thing that you are doing on the side?

[00:08:01] Ivana Ćirković: Yeah, so basically, I’ve been doing education my whole professional life. So it’s something that comes natural to me. In my local country, in Serbia, I do informal education for high schoolers and primary school’s children about digital marketing, digital literacy. This is like very natural to me. I’m being sponsored by WPBakery to do so.

And the program works like, initiative needs people, needs more mentors to get involved. More than it needs like product and businesses to support with their products. So if there are businesses who are maybe interested in support through their product, know that you need to put your people first to actually get involved and contribute, and then you can offer products as the side piece, so to say.

[00:08:52] Nathan Wrigley: So yeah, it seems that you’ve got a lifelong interest in education as well. Okay, that gives me some sort of hook there.

Okay, if I was to say WP Credits to the people outside, the people who already knew about it, I think would probably peg it as entirely educational in nature, just an education initiative. But curiously, your presentation, the notes that went with that and the blurb that went on the WordCamp Europe website, you kind of make the point that it’s much bigger than that, and you get into businesses and the students themselves and universities.

So the students in universities bit, well, that’s the education piece. But the business bit, what’s going on there? Because I definitely hadn’t drawn that intuition. I thought education from top to bottom. But business, okay, where does that fit in?

[00:09:37] Ivana Ćirković: I will get the hot insights from the talk. So basically, there is more than what meets the eye, so to speak. Businesses have unique opportunity to shape people they want to employ by getting involved as mentors. They also get the chance to see firsthand how those young minds work in real environments, in real contribution. And they get the chance to pick and choose who they want to employ by seeing them work on some real things. Whether it’s documentation, whether it’s translation or programming, developing something, AI.

We need more people who know what they do, although they are young. By having students in this program, they are working on not fictional things, but actual things that really contribute to community and businesses as a whole. By supporting this initiative, businesses then in relations to that can get more insights into who they want to employ. So on top of that, they are building the better market for themselves as well.

[00:10:42] Nathan Wrigley: I guess the student university piece is fairly obvious. You know, WP Credits and the people working on that project communicate with universities, they’re probably easy to find. You know, if you go to a phone directory for example, they’ll all be there. And it’s an easy thing to do. You phone up the university and see if there’s interest. And I know that some universities have taken up the WP Credits program. And it seems to be, as far as I can work out, it seems to be working very successfully.

How are you going to make the connection with businesses? Because that seems like a much more scattered, I don’t know if you’re going to be working with big businesses, you know, huge companies or if it’s going to be kind of more the businesses on the street, the smaller businesses, that kind of thing. So, I’ll just sort of hand it over at that point.

[00:11:23] Ivana Ćirković: So basically, web agencies, businesses around WordPress, we know they have an issue with new employees onboarding last, let’s say three to six months. That cost time and money and other people who are teaching them what needs to be done and how.

Then we have WordPress Credit students who are already doing that junior type of work within contribution. They’re already onboarded through using Slack, knowing how to do remote work, what needs to be done. So businesses supporting WordPress Credits initiative can choose those students and spend less time and money and energy in onboarding them because they already went through that by doing WordPress Credits program.

[00:12:10] Nathan Wrigley: Yeah, I guess if you are a small web agency, it’s highly likely that you won’t necessarily have an induction program finely tuned, so that the young people that are coming through have this sort of specialised system where they can get some accreditation. It’s probably more, okay, I’m going to assign you to John this week and then next week you’re going to go over to Susan and follow what they’re doing.

So is there a sort of structured program that, let’s say a web agency based in London could drop into and receive documentation about? Where are we at with that whole process for the busineses?

[00:12:44] Ivana Ćirković: Yeah, so since this initiative is still fairly new and we already have just one generation of students that are passed the program, this is something in development. So at the moment, we still don’t have like a specific structure that is based just for agencies and businesses in general, but it is something that we are considering and working towards too. So definitely.

On the other hand, the upper management organisational team might not be aware to the fullest what am I about to talk. So it might come as a surprise to them, but also it is something in the works as well. So give us some time and we will come up with something.

[00:13:26] Nathan Wrigley: Yeah, it feels like that would be something really credible. Because if you’re a small business owner, the last thing you want to be doing is kind of wasting time. And onboarding somebody might be something that you’d have to divert weeks into, you know, syphoning employees off, writing documentation, SOPs, those kind of things. And if you could just pick something up off the shelf that was tried and tested over many years, that would actually be really handy. So good luck. I hope that that initiative comes off.

In terms of students, if you were a student, let’s say you are at a university, or you are looking for work, what would you say would be some of the top line items that you would mention as to why WP Credits is worth looking at? Because, you know, if I’m at a university, there’s probably a thousand different things that I could be doing. WP Credits would be in competition with all of those. Why do you think it’s something that young people should be taking care of to look at?

[00:14:17] Ivana Ćirković: Yeah, I would think differently, in that sense. Universities curriculums are outdated comparing to the industry that we are living and working in. So WordPress Credits gives something that is in trend. That is happening now that people are using and working now. So students who choose to go to this program are gaining the most efficient and not outdated curriculum, and things that are being worked on in this moment.

And this is bigger than WordPress. It is initially for WordPress, but the knowledge students get, nobody can take that away. They learn to be outspoken. They learn to use all the necessary remote work tools that is applicable in all the industry.

So we are really encouraging them to be very marketable employees and people who have portfolios, whether they choose that category that brings them portfolio. That is very transparent throughout whatever they do. Because on wordpress.org, every contribution is noted. So they’re building their own business brand by doing WordPress Credits. And in that way they are more marketable and can get more business opportunities.

[00:15:42] Nathan Wrigley: I didn’t realise that the wordpress.org profile, is it the profile that you mean?

[00:15:47] Ivana Ćirković: Yes.

[00:15:47] Nathan Wrigley: Each time you participate in one of these credit programs, that will be a badge, for want of a better word, that you can display and it will be freely available for the public. And presumably that will be difficult to acquire. That’s the wrong word. What I mean is, it won’t be simple to acquire. You will genuinely have had to.

[00:16:07] Ivana Ćirković: Yes, you need to do the work. Let’s say students are interested in translation. So they go to Polyglots team and they get assigned to a mentor who is on weekly basis working with them on onboarding, helping them how to navigate through wordpress.org website, translation, what needs to be done. And basically, for that student, they need to translate to have approved translation, 150 strings approved.

So that doesn’t mean, okay, I will translate 150 words. No, no. You might need to translate 500 words out of which 150 is approved. And this is the bare minimum you need to do in order to get that badge that you contributed. Because that contribution, each contribution needs to be something very specific and tailored to help other people. That is very open and helpful.

[00:17:00] Nathan Wrigley: So you mentioned translations there, which obviously is just one of multiple things that you could do, and we could list them all out, but we won’t. How is that curriculum, I’m doing air quotes, how is that curriculum decided upon? In other words, how do you decide, okay, I’m going to do a bit of translation, I’m going to do a bit of work on Core, I’m going to work for the Plugin Review Team? How is that decided? And, how is it decided by the institution, I guess that that’s going to equal something which our university will stamp as part of your degree, let’s say?

[00:17:33] Ivana Ćirković: Yeah. So basically, that is all arranged between the foundation and universities. You won’t get IT students doing marketing if that’s not their preferable choice. So students opt in. They’re given the whole like curriculum, categories of things they can contribute to. And the one they choose, this is the one they stick to throughout all the programs.

So you cannot switch in between like translation and documentation, or plugins, or WP-CLI whatever. The whole program stick to one chosen category. And that is all aligned with the, let’s say, topic of university. So IT is preferable for IT related contributions. Communications are also more favourable towards translation community, marketing. So it’s aligned that way.

[00:18:23] Nathan Wrigley: So flipping that round, so we’ve been talking about it from the point of view of the students. Now let’s just flip it around to the point of view of the university. I guess the same thing applies. They would have to communicate with the Foundation and say, okay, these are the kind of things that we wish our students to do. These particular strands, we will, you know, if they do 500 translation strings, that will count as something. I guess there’s got to be some interface between the Foundation and each university to establish what a credit equals.

[00:18:50] Ivana Ćirković: Yeah, common ground as to how WordPress Credits adds to the official curriculum of the university. And the thing that university get out of it, they are in position to offer modern, in trend, teachings, and that makes them more appealing to next generation of students. Because the more their existing students who are in the WordPress Credits program are succeeding, the more desirable the university gets to newer generations because they don’t teach outdated curriculums. They’re aligning to what is now efficient and needed in the job market.

[00:19:30] Nathan Wrigley: I suppose also as well, when I was at university, there was a choice of about, I don’t know, four things to do each year. Something like that. You could do this or this or this. And you had to pick one of them and that was your pathway. This feels much more wide open because knowing the WordPress ecosystem, I know that there’s dozens, maybe multiple dozens of different things that you could be involved in.

So that’s quite appealing as well, isn’t it? You know, you can just take a little nibble of this one thing, and another nibble of this. And so there’s potentially multiple dozens of different pathways that you could pick. And whilst you say that, once you’ve decided you’ve got to stick to that, well, that’s fair enough, but the fact that you’ve got so many different ways that you could choose. That to me as a university student would’ve been really appealing. The fact that there’s so many different things that you could do.

[00:20:15] Ivana Ćirković: Yeah. And once they got in, the overall input that we get from students that, first they don’t know that something like this exists. And once they go deep and start work, it’s like, wow. The whole mind just shifts, and they are amazed by all the possibilities that they can do within WordPress that isn’t talked about.

[00:20:36] Nathan Wrigley: Yeah. And I presume they get to do it in the way that the WordPress community works, which is remotely distributed and when you wish to do it. So long as I, you make the end of the university period of whatever a semester is or something, so long as you make the deadline, you can do it at night or in the early morning or.

[00:20:57] Ivana Ćirković: Exactly. So they are training to be like workers as we all are today, that are not restrained with some deadlines or by official university rules. They’re accountable for the final output. How will they come to that output? It’s entirely up to them because, yes, they are young but they’re not so young that they cannot be held accountable for their actions. So they need to do the work. We got weekly mentorships and assessments. So it’s a fun ride.

[00:21:31] Nathan Wrigley: So just touching on that, the sort of ongoing support that every student needs, because with the best rule in the world, there’s a proportion of students who will leave everything to the last minute. I’m looking at myself in the mirror when I say that. So that ongoing support, it’s a weekly sort of huddle. And is that like a one-to-one thing or is it a one to many thing?

[00:21:50] Ivana Ćirković: Yeah, so depending on the number of students, if a mentor has a one or two students, it can be one-to-one. If there are more like five or six, it’s better to have a group meeting on a weekly basis, and then Slack chats in between if anything is more needed than that.

So basically we go through what they did last week, are there any setbacks or they need additional help, or do they need information from other parts of the team? Are they interested in something else? So we are really trying to get them involved in a way that matters to them.

One of the things that each student needs to do, no matter section they chose, is to create a blog and to have weekly blog posts. So we discuss about that. What interests them. Whether they want to be something personal like, or professional like. So it’s very interesting to see how they think and how they express themself and how they build their online persona.

[00:22:55] Nathan Wrigley: Do those huddles take place on a, let’s say university by university basis? So for example, when you join and you mentor students, are they from the entire WP Campus project, or are you doing it from the university of this town and the university of that town?

[00:23:13] Ivana Ćirković: No, it’s mixed and matched.

[00:23:14] Nathan Wrigley: So, okay, well that’s a real strength as well it feels, because presumably then you’re on a call with people potentially from all over the world. Certainly people that you may not have encountered before. And those sort of serendipitous chance encounters can sometimes be some of the more meaningful ones. You know, work comes out of those things, and meetups come out of those things, and unexpected things come out of those things. So that must be really nice as well, watching those kind of things happen.

[00:23:42] Ivana Ćirković: Yeah, it’s like nothing I experienced before. And just to have the privilege to talk and work with those people, you never know what can come up out of them, and out of our connections. And I get inspired every time we have chats and they make me want to be a better educator.

[00:24:03] Nathan Wrigley: Oh, that’s interesting.

[00:24:04] Ivana Ćirković: So, yeah, that’s my take out of all this.

[00:24:06] Nathan Wrigley: Yeah. Okay, so there’s actually some psychological benefit for you as well. You get a real nice feeling of it. Okay, that’s really good.

So with the best will in the world, a university, every year there’s a cohort of children, young adults, whatever it may be, whichever institution it is, and a proportion of them will work diligently and hard and they will succeed. And some others maybe not so much.

How does that work? How do you ensure that everybody gets through it? And I don’t know if there’s enough data to answer this question. Again, I’m doing air quotes, how is the pass rate? Do most people that embark on this get through the necessary things? Or is there a fair bit of, I don’t know, discipline, for want of a better word, that needs to be applied and cajoling people to get through it?

[00:24:46] Ivana Ćirković: Yeah, so I touched base on the accountability. So we have not strict rules, but recommendations. Weekly mentor chats, async communication through Slack. They all have weekly tasks that needed to be done. So if a student don’t answer the message or come to weekly mentor call three times, they are no longer WordPress Credit students. And that is the accountability.

You need to show yourself that you are willing to do the work. So if you don’t care, we won’t force you to do that if you don’t want to. We will set reminders, we will call back, we will reach out. But if you are no show, no tell anything for three times, then evidently you are not for that. You don’t wish to be there, and we won’t force you to be there.

[00:25:40] Nathan Wrigley: And then in some way, are you required then to report that back to the institution and sort of say, okay, we’ve reached the end of the road here, and then it’s for them to figure out how that impacts. And presumably the students can.

[00:25:53] Ivana Ćirković: Their grades, yeah.

[00:25:53] Nathan Wrigley: Yeah, their grades what have you, okay. Touching back on the sort of business side, because we’ve dwelled a lot with students and universities and we’re going to stay with students, because that’s really the underpinning of the whole thing. How has the business side of things, is it taking off? You were describing that it’s kind of like a new thing. Have you got any sort of success stories or anecdotal evidence that people do in fact want this?

[00:26:15] Ivana Ćirković: Yeah, so it’s still fairly new, so we don’t have those anecdotes yet. One of the reasons why I’m here at the WordCamp Europe is to find out and to get new perspective from businesses to like reach out to them to see what they think about the program. Would they want to be evolved. And how to give tips, maybe how we can improve. So stay tuned for more.

[00:26:38] Nathan Wrigley: Yeah. And it is interesting, when you walk around an event like this, I don’t have the exact numbers, but the demographic is definitely skewing older. There’s not so many 18 year olds. And if this community wishes to carry on, at some point the age demographic will get to retirement age.

[00:26:57] Ivana Ćirković: Yeah. Just last night we were talking. I’ve been in the community for 11 years. And for 11 years all the same faces are here. And we really need new faces. But to get new faces, WordPress Credits is one part of the solution. But then again, we need to meet young people where they are. And they are not on the conferences, they are not on websites, they don’t use websites, they don’t care about websites. They are on very specific social media channels. And if we want to get fresh, new, young blood, we need to go there and to present what we do in a way that matters to those kids.

[00:27:35] Nathan Wrigley: In terms of success, if you were to, I don’t know, let’s imagine that we could cast our minds forwards five years, let’s go for that. What would you like to have happened with WP Credits? Would you like, for example, to see a bunch of 20 somethings wandering around in an event like this? Does it matter that they’re involved in the community and doing WordPress events and contributing to Core and those kind of things? Or is success just more broadly, people are using WordPress? You know, it’s still a project. What’s your take on, what does success look like in five years?

[00:28:08] Ivana Ćirković: For me, I would like to see more young people involved. Yes, we will always have users because in its core, WordPress is a very useful tool. And I’m happy to stumble upon that tool many, many years ago to use it both personally and professionally. But I really want to see young people involved in a way that we were involved 10, 15 years ago, and to see what can happen with WordPress.

I strongly believe it’ll be transformed, not with AI or all other flashy trends. WordPress has always been about people. And we need new people, we need young people to get it where it needs to be.

We are getting older and don’t have strengths or stamina to do so for how many long years. By having new kids, fresh perspectives, I’m really excited to see what they can come up with next.

[00:29:08] Nathan Wrigley: Yeah, it’s kind of handing over the baton in a way, isn’t it? Seeing what the future holds. Yeah, I definitely have concerns that the age demographic is skewing. And no matter what has happened in the past, I don’t see it being backfilled with younger people moment.

But I think that’s largely because we just assumed that that age demographic would fill itself, because we were excited about it, so the younger generation will be excited about it. Well it turns out the world moved on. And TikTok came along, and YouTube became a massive thing and mobile phones and all the different platforms became a thing. And so the attention was put elsewhere by many young people.

And so I suppose we needed to come up with a system where we are, in a sense, just putting it in front of their face and saying, look, it’s here. You know, you’re a university student, you are somebody looking for work in a small business. Here’s a credible way of getting involved in something which potentially could change your life. That seems like the most credible way of doing it at the moment. And I guess we’ll just have to see what the next five years brings.

In which case, is there anything that you felt you wanted to touch on that you wanted to get out of this chat before we finished?

[00:30:15] Ivana Ćirković: No, I think you did it masterfully. And we touched base on everything that needed to be said.

[00:30:20] Nathan Wrigley: Perfect. In that case, I will say Ivana, thank you for chatting to me today. Fingers crossed that your presentation goes well tomorrow, and that you pack the place out, and that by this time next week, you are extremely busy with the WP Credits program. Thanks for chatting to me.

[00:30:34] Ivana Ćirković: Thank you. Thank you for inviting me.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, how WordPress education programs are growing.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today, we are joined by three WordPress Education Initiative leaders, Destiny Kanno, Anand Upadhyay and Maciej Pilarski.

Together, they have spent years at the heart of WordPress training and outreach, working in roles spanning community education management, plugin development, and credit program administration. Their efforts have helped shape student engagement and university partnerships across the globe, introducing thousands of learners to WordPress.

The conversation focused on the current landscape of WordPress education with particular attention to three key initiatives, the WordPress Credits Program, Campus Connect, and Student Clubs.

Each initiative is designed to provide unique entry points for students of all ages and education levels. From high schoolers building their first site in a library to university students earning official credits for open source contributions.

We discussed the different approaches these programmes take. WP Credits ties student work directly to academic credit and mentorship. Campus Connect provides flexible, community driven, events in diverse locations and Student Clubs foster sustainable, peer led, learning within schools and other institutions. We explore how these models feed into each other, building a sustainable ecosystem for ongoing growth in the WordPress community.

We also get into the importance of repeat campus partnerships, the need for scalable facilitator training, and the role of recognition, certificates, badges, and public showcases in keeping students motivated and validated in their journey.

If you’re curious about the growing movement to bring WordPress knowledge to the next generation, or are looking to get involved with education in your local community, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Destiny Kanno, Anand Upadhyay and Maciej Pilarski.

I am joined on the podcast by Destiny Kanno, by Anand Upadhyay and Maciej Pilarski. Hello, one and all. Nice to have you with us.

[00:03:29] Destiny Kanno: Hello. Thank you.

[00:03:30] Anand Upadhyay: Hello.

[00:03:31] Maciej Pilarski: Hello.

[00:03:32] Nathan Wrigley: So a few months ago, back in, I think it was September 2025, I was joined by two of the three participants on the call today. I was joined by Destiny and I was joined by Anand. We were also joined at that point by Isotta, but she’s not on the call today. We’ve obviously got a wonderful replacement, Maciej who’s going to do a fabulous job explaining the bits and pieces here.

But the intention of that episode, which you can find on the WP Tavern website, it’s episode number 183, was to find out about all of the overlapping education initiatives in the WordPress space. And it was born, I think, largely out of a sense of curiosity on my part, but also a somewhat sense of confusion, because there were lots of things which were going on. Some of them seemed to be slightly overlapping. There was a conflict of names in some cases. So that episode was laying out the groundworks of what has been happening in the WordPress space.

When that conversation finished and we’d click the stop record button, I said, that was absolutely fascinating. This seems to be moving at such a rate, wouldn’t it be good to revisit this whole subject in about six months time?

Well, we missed that target, but here we are, maybe eight months later. I think my intuition at that point was correct, because being a close observer of what’s going on in the WordPress community, I think it’s fair to say that the educational space has been somewhat turbocharged during the last eight months.

And so today’s episode, with the help of the three people I’ve just mentioned, is to describe what’s going on, what’s changed, maybe some things that have been mothballed, but certainly a lot of things that are new and interesting and have gained a lot of momentum.

But I think, dear listener, the intention of this episode is to get you involved. Is to get to the end of this episode and for your curiosity to have been turned into action. To have gotten you out of your chair, written an email, turned up to an event, helped organise a thing.

So please have that in the back of your mind. If you’re sitting listening to this in a car, at your desktop, there is actual action that could be taken at the end of this. I think the intention of all four of us on this panel would be dearly for that to happen.

Okay, let’s establish the credentials of the people that we’re going to be talking to today. So we’ll just do a little potted bio of you one at a time. So we’ll begin with Destiny, if you could just tell us a little bit about you, your relationship with education in the WordPress space, I suppose would be apropos.

[00:06:01] Destiny Kanno: Yeah, absolutely. So again, Destiny Kanno. I’m currently working as an education program manager sponsored by Automattic. And I work directly with the Make WordPress Community Team. And I also work adjacently with the training team as well, because education training materials, they go pretty hand in hand. And I’ve been doing this now for about four years and, yeah, it’s just evolved since my original time working on Learn WordPress, and that relaunch that happened, to now, yeah, these wonderful programs that are spreading like wildfire as you said.

[00:06:37] Nathan Wrigley: Fantastic. Thank you so much. Okay, we’ll move over to Anand for the same sort of introductory moment.

[00:06:43] Anand Upadhyay: Yes. So my name is Anand Upadhyay, and I run the WordPress plugin development company, WPVibes. Apart from that, I’m very much involved in the WordPress community and I contribute in multiple ways. It can be documentation, it can be Core, Polyglots. But I’m also keenly involved in the community part, and specifically I can say with the education initiatives, I started with WP Campus Connect in WordPress Campus Connect in 2024. And since then, after that we started joining hands with Destiny and we started evolving this program in a much bigger shape. So that’s it.

[00:07:16] Nathan Wrigley: Okay. Thank you so much. And last, but by no means least, Maciej.

[00:07:20] Maciej Pilarski: Yeah. Thanks for having me. My name is Maciej Pilarski. So I’ve been doing anything related to WordPress pretty much since 2007, so that’s been a while. But the biggest breakthrough for me was 2014 when I actually volunteered to WordCamp Europe in Sovia, Bulgaria. That opened my eyes to the whole community, everything that is happening around WordPress.

And since then, pretty much I’ve been working for multiple companies from the WordPress ecosystem. I joined Automattic in 2016. For many years I’ve been a Happiness Engineer, and since October last year, I’ve joined Isotta as one of the admins of the WordPress Credit program. And since that time, I will have been helping her out to grow that initiative.

And Destiny mentioned, it spreads like fire because at that time we had six universities onboarded, now we are at 21. The 21st, we got it after WordCamp Asia actually through a connection made there. And it’s our first institution from Africa, from Uganda. A huge shout out to Stephen Dumba, who I connected with during the event. And after that, pretty much a week after we signed our first partnership from Africa. So we’re actively growing and getting new institutions on board.

[00:08:42] Nathan Wrigley: Thank you so much. Gosh, there was an awful lot in there, wasn’t there? That was really interesting. We’ll try and unpack quite a lot of that.

Firstly, a sort of slightly personal message from me. I don’t usually reveal much about myself on this podcast. I take the position that I’m a, kind of like an interested party, but don’t really give much of my own thoughts. However, this is different because I cannot think of a more interesting, meaningful, moral, let’s go with that word as well, use of time than educating people. It simply is the most profoundly useful thing to do with your life.

Now, obviously people will have different opinions about that, but the juxtaposition of free open source software, in this case WordPress, and education is a real sweet spot for me. I just think that is such an amazing thing to be involved in, to have going on in the background.

If you think about it, an open source project, like how many open source projects have this level of stuff going on in the education space, this real international footprint. Things going on which we’ll find out about in a minute. It’s really fascinating.

And I am sure that the listenership to this podcast, the vast majority of people listening will never have encountered much of this before. Maybe they’ve seen stuff on Learn because they want to technically learn about WordPress in an online capacity, but we’re going to be delving into real world events affecting real adults, real youngsters.

And so anyway, that’s my little bit at the beginning, just how curious it is that the project is so big that we’ve got this international footprint of education. And so I suppose what we should do right at the beginning is lay out the different initiatives and just name them, and try to figure out how they differ from each other. Just so that we’ve got some kind of awareness.

So I don’t know which one of you wants to take that, but if maybe you take one each or something, I don’t know. If we just want to lay out the, just erect that tent basically so that we know what the initiatives are called, and how they differ from one another. So I’ll open that up. Whoever wants to step in.

[00:10:48] Maciej Pilarski: I can start with the Credits Program. So the Credits Program is based, it’s a contribution based program, internship, initiative by the WordPress Foundation that connects higher education students with the global open source community. So basically it’s an opportunity for the students as part of the educational curriculum to contribute to the WordPress community.

There are two types of courses that the students can do. One of them is 50 hours, the second one is 150 hours. Usually the students do that during a full academic semester. And as part of that, students are first onboarded into the WordPress ecosystem and the wider open source ecosystem where they learn not only about WordPress, but open source as a whole, and how crucial it is for the internet.

Then the second phase is picking the contribution area to which they would like to contribute. All the contributions areas basically are the ones that are listed at make.wordpress.org. So any team that is listed there, students can pick from that area. During that phase, they work on a particular area that they have selected.

And finally, during phase three, they wrap up the whole achievements, the contribution, what they did, they publish a final post. And what is also very important as part of the credit scores, students have also assigned a mentor from the WordPress community that guides them through the whole process. We don’t leave them alone. We connect them with actual mentors from the WordPress community that are vetted by us, that guide them through the whole journey into the contribution and the whole WordPress ecosystem.

So it works on multiple levels. For me, this connection is also special because it builds this bridge between the previous generation of WordPress contributors to the new one where they are introduced and can start working on any fields of contribution.

What is also important is that this is not limited to technical universities. Pretty much any type of university can participate in the program. The first university that we started with was University of Pisa, and it was the humanity studies. So the students from humanity field were the first group who started the Credits Program. There’s room for pretty much anyone from any field.

[00:13:18] Nathan Wrigley: Okay. There’s a lot there. Wow. I’ve just been taking notes and I’ve almost filled an entire A4 page. So WP Credits, the WordPress Credits Program, I guess the name sort of gives it away. The idea here is that you trade time for university or higher education credit. So credit being, I suppose if you were to atomise your three year degree, you might do, I don’t know, 12 modules or something like that. The idea is that one of those modules, perhaps it’s more, becomes something in the WordPress, but also curiously the free open source software space as well. I didn’t actually know that.

The idea is that you link up with real world institutions. So the first one was Pisa, and maybe we can get into which other ones have come along. And in exchange for 50 hours or 150 hours, you will be given that credit, which can then go to the overall awarding of a degree or whatever it is that you are hoping to get.

You’re then linked up with team members, WordPress community team members who will mentor you and shepherd you through this process. And the idea is that it culminates, I think you said in a final post, which I suppose in a sense is a bit like a dissertation or something like that, you sum up all the different bits and pieces. Yeah.

[00:14:29] Maciej Pilarski: Once that happens, the students also receives an official certificate from the WordPress Foundation, signed by Matt himself, that certifies that they completed the course. And what is also important to know, the whole progress through the course and what they did during the course, it’s also stored on the wordpress.org profile. So any contributions that they did, for example, photos that they’ve uploaded, this all will be visible on the wordpress.org profile. And they also receive a special badge dedicated to students who graduated from that program.

So it really gets them started into the WordPress ecosystem, and at the same time creates something like a small portfolio for any future company that would like to, for example, hire them. Because they have a proven history of contributing to the ecosystem.

[00:15:20] Nathan Wrigley: Okay, so that’s an interesting quid pro quo, isn’t it? So the idea is you do all this work, which on the face of it, I suppose looks very philanthropic, you know, you’re giving up your time, but you get a real thing at the back end of it. You get a certificate. You can then presumably apply for jobs and indicate, okay, I’ve done this, I’ve contributed in this meaningful way.

What I think is really interesting there, and it kind of gets lost, I’ve worked in education in the past and I know the red tape that’s involved in doing anything in the education space. There is so much red tape. And I can only imagine what’s happened in the background to enable these kind of things. You know, the back and forth, the tennis of emails that go on and on and the proof that’s required to categorically show that this thing that we are doing is worth something. You know, it’s not just this Mickey Mouse. We use that expression, Mickey Mouse kind of qualification that really, it doesn’t actually require any hard work. It’s just there, nothing really in it, but you get an accreditation anyway.

I can only imagine the hard work that has gone in every single time you touch a new institution, trying to convince them that this is legitimate, that this is real. You’ve just kind of glossed over all of that by just describing what is in existence, not necessarily what has gone on to make it happen. I know that there’s probably more than the three of you involved in this, but my profound thanks for all of that hard work, which presumably is utterly and completely invisible. And I can only imagine what’s going on there. So yeah, thank you for all of that.

[00:16:54] Maciej Pilarski: Thank you for that.

[00:16:54] Nathan Wrigley: So that was WP Credits. So that was one wing of the things that we’re going to discuss today. Should we move on to another one and maybe somebody else wants to take the helm?

[00:17:03] Anand Upadhyay: I think Destiny can take Campus Connect and then I will take Student Clubs.

[00:17:06] Nathan Wrigley: Okay. Destiny, let’s move over to you and see what you can tell us about something different.

[00:17:11] Destiny Kanno: Yeah, so I’d love to tell you more about WordPress Campus Connect. And the way we ended with WordPress Credits, I think is also very critical to the story of Campus Connect because, you know, it started with Campus Connect first, and that’s how organisers such as Anand and Pooja like were able to get those connections with the universities through being boots on the ground, you know, having those relationships. Proving through action that these activities that we’re doing with the students are having real impact and are showing real results.

Slowly building up these kind of case studies in a way has helped open a lot of doors, especially with Campus Connect now, we’ve done a lot of events, especially since we last talked. Like I think this year alone, we’ve already had 22 Campus Connect events. So, like it’s not even half the year and it’s quickly becoming one of the biggest run events, WordPress official series.

But these events are like a way of opening the door, right? Hey, here’s a free learning opportunity for your students. And as you said, like the red tape is there. A lot of institutions are like, wait, so what’s in it for you? Why is, there’s a little bit of dubiousness sometimes in the reaction, right? You’re going to give your time to educate our students, why? But once they see, it’s like, no, we really are just passionate about spreading WordPress, showing students what’s capable with their website, how it applies to different skillsets as well. Like it’s not just for coders, it is for marketers, it is for designers.

You know, there’s so many career opportunities that once we just get the foot in the door and we’re able to showcase that, a lot of institutions are like, okay, now I get it. I do want to highlight in Anand’s case, like they’re going to have their third WordPress Campus Connect in Ajmer this year. You’ve got repeat institutions. I’ve heard you also have institutions that are like, when are you going to come to our place and teach WordPress? You know, once the fire is lit and people see how bright and shiny it is, like people want to get involved.

But as you said, like getting it to click for people, that is like the most difficult part. And I’ll give an example of, right now in Japan, we had our first WordPress Campus Connect event on the 9th of May. So I’m like, woo hoo. Like it finally happened. But we have this community in Japan that is like very passionate, very active. So when I first was like introducing the concept of Campus Connect, people were like, okay, but like how do we do this? What’s it about? It takes like a lot of presentations, a lot of going to people in person and talking. Helping them even shape the conversation that they’re going to have with the institution to sell this amazing gift of WordPress on their campus.

And after this one on the ninth, like now we have a case study in Japan that others can now use to be a starting point for those conversations going forward. So I think, once you have that one step, the gate just slowly opens until it’s just, the doors bang open in each way. But yeah, we’ve seen really great success with Campus Connect and it’s just like honestly, it just keeps growing.

[00:20:30] Nathan Wrigley: Can I just ask a quick question? So I just want to draw a very clear line for everybody that’s listening to this, what the difference may be between Campus Connect and WP Credits. Because from the description that we’ve had so far, it may be that you’ve fallen into the trap of thinking, well, they sound like they might be the same thing. So could you just, Destiny, just tease out where Campus Connect differs? Maybe in the nature of the event, the timing of the event, the availability, the age group, those kind of things that separate WP Credits from the Campus Connect initiative.

[00:21:02] Destiny Kanno: Yeah. Thank you, that’s like a really great distinction to make. So whereas WordPress Credits is geared toward higher education, Campus Connect is geared toward, honestly any level of students as long as they’re able to browse the web safely, and enjoy and participate.

So that means, Elementary school students now are pretty good at devices. High school students, college students, vocational students. We honestly kept the door pretty open in terms of what a campus means. We’ve even had a Campus Connect event in Uganda in a library, the Lira Public Library because students were able to go there right?

We were trying to make it as barrier free for students wherever their campus is. And so that’s, I think, the main difference. It’s more wide ranging in terms of who can participate as a student. And then also the fact that it could be a one-off event, so a one day event. A lot nowadays are multiple day events, they’ll maybe go two times out of a month, or a couple days consecutively. And then after that it’s up to really the organisers in the institution whether or not we have another addition on their campus the same year, or the next year.

[00:22:15] Nathan Wrigley: I’m going to tease out a few things. I just want to point out to, me as an English person, that is to say, not an English speaker, but somebody from England, campus has a really defined definition, and it’s usually bound to a university. Whereas it sounds like the description here, campus literally means the place where education happens, not it’s 18 years old and older, you know, people doing degrees, bachelors and PhDs and that kind of thing. Basically, if there’s an institution somewhere, that’s what the campus is in this case. Okay.

So the WP Credits program sounds like you forge your relationship with the university, and correct me if I’m wrong, it sounds like it takes place inside that institution, and it’s part of that program and what have you.

The Campus Connect initiative is much more ad hoc. It could be a one-off, it could be monthly, it could be inside a library, it could be inside the school, it could be an inside an institution. It feels a bit more like, I don’t know, a WordPress Meetup, but geared towards a younger audience or something like that.

And the minimum age requirement is really driven by your capacity to type on a keyboard and hold a mouse and those kind of things. And that’s kind of curious to me because I think my educational experience was always younger children. It’s really interesting how patterns are laid down at a very, very early age. Patterns that go on into much later life get laid down, typically at incredibly young ages. So this is fascinating for digging into that.

And it’s not just about, say, the code, it sounds like code is on the menu, but it could be about marketing, it could be about design. Basically the gamut of anything online, CMSy, those kind of things. Okay, is there anything you want to add? Did I misunderstand anything there, or misstate anything there?

[00:24:02] Destiny Kanno: No, I think you’re completely right. We’re trying to convey that WordPress isn’t just a blogging software that I think is still a lot of people have a mentality of. Like there are many ways to utilise it that goes beyond that.

And one thing I did want to add are a couple numbers. So since WordPress Campus Connect became official in May of 2025, an official WordPress event series, I should say, we’ve had 42 completed events, with 71 participating institutions, and over 5,500 students have been reached.

[00:24:37] Nathan Wrigley: That’s something else. 42 events, 71 institutions, and I think you said five and a half thousand individuals. Good grief. I don’t know what the measure of success is for this, but that feels like success to me.

I mean, imagine turning up to a WordCamp, like a flagship WordCamp and five and a half thousand people descending on you. You’d feel slightly overwhelmed. That’s a lot, isn’t it? Gosh, that’s pretty remarkable. Wow. Congratulations.

[00:25:05] Destiny Kanno: And the majority, the outcome, the students make a website. So we could almost count those students as also new WordPress websites that are live now on the web. So within a year, organisers around the world have been able to make that happen.

[00:25:19] Nathan Wrigley: Could I just perhaps draw another distinction as well, just very quickly, because it sounds like the WordPress Credit system, because it’s binding itself to institutions, it sounds like there might be more paperwork going on there, and maybe more high level meetings that need to take place. Whereas Campus Connect feels much more community driven. It’s the kind of thing that, quite literally, anybody listening to this podcast with a fair wind could have one of those going in a handful of months. If they’ve got the right initiative and they can find the audience for that.

Again, is that about right? There’s sort of more opportunity to become involved with the Campus Connect initiatives. You don’t need to have that academic background or have a point of contact at a university. You basically just need a building, some interest and a bunch of students.

[00:26:02] Destiny Kanno: Yeah, the key thing is, you know, having a real connection to the campus that you’re going to present at. But you’re exactly right. We tried really hard to lower the barrier to organise these events. Because I don’t know if you’ve organised a WordPress event before, there’s kind of a lot of hoops you have to jump through. And we’re like, okay, how can we think about this in a different way?

And I think that also has positive repercussions for how we organise other events too, that are, changes are being thought about too so that we can enable people and empower them to put these events, instead of bogging them down and process and a little bit of bureaucracy to say.

[00:26:38] Nathan Wrigley: So what’s really curious about that as well is we’re all in different parts of the world, aren’t we? People on the call today are in Japan and I’m in Europe and, Anand, are you in India? I think.

[00:26:47] Anand Upadhyay: Yeah.

[00:26:47] Nathan Wrigley: Yeah. Each of those events, I guess would look quite different. The kind of nature of the attendees, the nature of the kind of building it might be in, the institution. And it really is, you just grab what’s around you I suppose, and work with that. If you’ve got a connection to an institution, you can go for it. Maciej, I feel like I crosstalked you. I think you wanted to say quite a few times and I’ve just interrupted. I’m very sorry.

[00:27:08] Maciej Pilarski: No worries about that. So I wanted to add that those initiatives set backgrounds for each other. Because in some uni institutions, the interest sparks with a Campus Connect event, and that gets the institution interested in those initiatives, which sets background for WordCamp Credit.

And it happens also the other way around, where we start with an institution that starts credits and then we get the students interested in WordPress in general, the community, which leads to a Campus Connect event during the Credits Program. What is important is that those initiatives don’t compete with each other. They support each other.

[00:27:51] Nathan Wrigley: Right, so there’s a lovely virtuous cycle there, isn’t there? Where the two things can be going on in harmony, one promoting the other and they’re definitely not in competition. Okay. That’s really interesting.

One final question on Campus Connect, and I’ll direct this at Destiny, just because she’s been handling that. With the WP Credits thing, there is this moment where you hold the certificate in your hand and you go, yay, did it.

Is the same thing true of Campus Connect or is it more of a show up to the one event, you know that you did that, that was great, you can file that away in your own head as a thing? Or is there some sort of accreditation, or certificate giving, or badge giving, or profile updating that might go on on wordpress.org? Is there any sort of thing that the attendees receive, and I suppose that the people that are organising might receive as well?

[00:28:37] Destiny Kanno: Yes. So we do have a certificate of participation that students can receive signed by WordPress Foundation Executive Director, Mary Hubbard. And that just needs to be requested by the organisers ahead of time, because we need to get the signature and all that. So yes, they can come away with that. And we’ve heard really positive things about that, like it motivates them. They’re like, yeah, I did something, which they did.

[00:29:01] Nathan Wrigley: There we go. That was WP Credits and WP Campus Connect.

Can I just say at this point, dear listener, if at this point you’re thinking hang on a minute, there’s a lot going on here, don’t worry, there’ll be show notes. If you go to the WP Tavern website, there’ll be show notes. I’ll try to list out as many sensible links to get you to the root of each one of these initiatives, so that you can begin your journey and fan out from there.

I’m not sure what episode number this will be, but if you just go and search for, oh, I don’t know, Destiny or Anand or Maciej, you could probably find the episode that way. And all the show notes will contain all of the links.

Right, in which case, I think it might be Anand’s turn. What have you decided to take on Anand?

[00:29:39] Anand Upadhyay: So I will be sharing my thoughts on the third part of this whole education initiative ecosystem. So that is a Student Club. Just a few minutes before you were giving the analogue of meetup with this Campus Connect. So I would like to share the same analogue with us because we are more accustomed with like other terms of WordCamps and Meetups and contributer days.

WordPress Campus Connect is kind of like a WordCamp happening in the campus, because it’s like a big day event that holds everything happening, different kind of sessions, maybe workshops happening. So I would compare it with that thing.

And same way, credits thing, Credit Program is kind of like ongoing contribution series because more focused on the contribution part because the student devote 150 hours of their program. A lot of period goes to the contribution.

And now the same way we, if we talk about the Student club, it’s similar to like the Meetups that we have. But these are the in campus meetups for the students and by the students. How do things get started? Like the Campus Connect introduce the WordPress to those campuses and to those students, but since most of the campus, it’s a once in a year event. So once this event has sparked something about the WordPress in the students. So keeping that momentum going on, that’s where the Student Clubs come in.

So with the Student Club, it’s kind of like, as I mentioned, it’s like an in campus meet program. So a student can gather themselves, they can form a club and a couple of students can be nominated as club organisers, student club organiser from their campus. And then they organise the in-campus events, maybe like once in a month or twice a month, depending on academic calendar. There are a lot of hurdles in doing those things continuously.

But they usually do once or twice a month. They do a kind of a meetup in their campus. The students gathered together. They learn from variable resources available from WordPress. And from those resources, they share with the other students. It’s kind of a group learning, group study, that we use. Education live, we always do that. It’s kind of a group study. They’re learning from themselves. If someone has learned something, they are helping others to learn those things.

So I would just like to give some of the examples from my city. There are multiple Student Clubs are going on. When we went to the campus, we just taught like a small group of students about the WordPress, because we’d have some limitations of the resources, of the setting arrangement. We cannot call all the students of the campus and, okay, come together and I have a amazing workshop. So we have given the WordPress walk through to the limited number of students.

After that, they form a Student Club in their campus because they got very much interested. Then the first session they did was like, they started teaching to their juniors, like the students who have just entered the campus. They took a session for them. So they told, whatever we have told them, they have taught the same thing to the juniors.

After that, in the next few session, they experimented different things. Like in some session they’re just doing a fun quiz around WordPress. And in some sessions they are doing a kind of like a, I would say like a hackathon kind of thing. So they are just picking up a website. Or you can, just similar to the speed build challenge that Jamie do. So they have just one website open on the screen and everybody’s like cloning that website.

So there are different ways students are engaging through those student clubs. So it is helping to keep the momentum going on so that the student keep learning about WordPress and they are also connecting with the community members for the guidance about how they can learn more. What should they learn next if they are sharing their experience. Like we have covered these things and, what should we go next?

And in the recent WordCamp Asia, they’re also one of the Student Club lead from my city. She joined the event and there are conversation with the, like other community members who has offered them like, okay, we can come to your campus, or we can do, have a webinar for your campus where we can teach you particular subjects, particular topics. Maybe they can talk about SEO, maybe they can talk about plugin development.

So this is also opening the horizon for them, to learn from people across the world. So that is how the Student Clubs are happening. The examples I’ve gave, again, from my own city because I’m closely mentoring them, but there’s similar things are happening across the world.

So it is helping to create a kind of sustainable environment for the long-term sustainable environment in the campus. So the next time when we go to that campus, we are not going to teach like the basics of WordPress, because we want like, the ecosystem should be built within the campus, so every student know about the WordPress. Because last time when we went to the campus, we have to tell everything about WordPress because why you should learn WordPress.

So the Student Clubs, my ambition is that, wherever the Student Club is from, next time a Campus Connect event is happening, next time we should not tell them about what is WordPress and why they should learn this thing. There should be already a sustainable ecosystem.

And I feel that all these three programs are like very much interconnected. And the real impact of these programs, we will be able to see in the next two or three years. And there will be a regular ongoing activities around WordPress in the campus.

And these are also kind of a balance program as well. Like the Campus Connect is introducing WordPress to the students, Credits Program is motivating them more towards like the contribution part. And I would say that Student Clubs is more inclined towards getting new users to the WordPress. Because if we keep on focusing on the contribution, contribution, but if we discard the like increasing the number of new users, so we are not going to win. We need a balanced state.

The Student Club is trying to, learning how to build website, how to mastering the skills of the WordPress. And later on, many of them are going to join the contribution part as well.

So this whole ecosystem is built around bringing more people to the contribution, bringing more people to use WordPress, build websites, as in, for the individuals as a business as well. So that’s how all these three programrs are very much interconnected, and growing together fast.

[00:35:16] Nathan Wrigley: It feels like, of the three things that we’ve talked about, so WP Credits, Campus Connect, the Student Club, this final one that you’ve just covered, it feels like that’s got a very flat hierarchy to it. In other words, there’s like this peer learning. So it feels like more or less anybody can show up and demonstrate anything, which might then lead to somebody else thinking, okay, that was interesting, I’ll take on next month’s one because I’ve now seen that’s doable. Less hierarchy, if you know what I mean? So a much more flat structure.

[00:35:45] Anand Upadhyay: Because when we started Campus Connect, we also get a lot of attraction in the local community as well. And people join our Meetup groups. But then it becomes difficult for us, how to plan about the topics for our meetup. We have some experienced professionals coming in. We have some students coming in, and we plan the topics that suits the professionals. The student will feel like, okay, what’s they’re talking, we are not getting anything in our mind. If we bring the topics, very basic topics and the professionals who are joining the community meetups, they’ll feel like, okay, these are very basic stuff, why am I coming here?

Student Clubs giving them their own platform, giving them a own opportunity. Okay, these are all the familiar faces. It is also giving the opportunity to come on the stage, come onto the stage and get out of your fear as well. It is also generating leadership qualities in them. Okay, we have to keep this momentum going on and we have to keep the activities going on. So there are a lot of ways, apart from learning WordPress, there are a lot of other ways it is helping the students as well.

[00:36:40] Nathan Wrigley: When you have to stand up in front of a bunch of people and deliver something, obviously there’s a whole bunch of us that are just really confident at doing that, quite happy to stand up and do that kind of thing off the bat. But equally, there’s people for whom that is just the most terrifying experience possible. You know, standing up in front of two or three people, oh boy, you know, anything above that is just off the books.

And I was just wondering about that, whether or not there’s, in this particular style of event, the Student Club, whether there is a growing corpus of, I don’t know, previously done topics or topic suggestions or slide decks or anything like that, which might enable people to feel that level of confidence? I don’t know if that’s something which is being put together. Just resources which enable somebody who doesn’t have the confidence, let’s go with that word, who then may gain that confidence. And I’m going to pass this to Destiny because she’s waving her hand.

[00:37:30] Destiny Kanno: I was really hoping I could shamelessly plug this project. This is like, you’ve said the most opportune thing. So I’m actually developing right now what I’m like tentatively calling the Meetup Activity Library. It comes with like kits on certain topics. So for example, WordPress Playground was the first one I built. But it comes with the facilitation guide, which is a doc. So the facilitator can read through, understand the steps they’re going to go through in the activity, how to pace it. And then a presentation deck which they would display, if that’s available to them, to the folks that they’re presenting to. And it’s a hands-on activity only. So it’s not only presentation. The facilitator of course guides and talks them through things, but then people are getting hands-on experience with that topic along the way.

[00:38:16] Nathan Wrigley: That is a beautiful remover of barriers, because I think just having that little document, that little crutch, you don’t have to feel that you, okay, I’ve got to come up with a topic. Not only have I got to come up with a topic, but then I’ve got to research the topic, deliver the topic. If you can have it all on a thing that you can crib from, I don’t know, it just arms you with that confidence as you walk in. I think that’s such a brilliant topic. And, Maciej.

[00:38:40] Maciej Pilarski: Both Destiny and Anand mentioned two keywords, sustainability and facilitator. The goal of also getting all those educational initiatives going is also create in a sustainable way. We’re not pushing for numbers, but growing them in a smart way where we don’t get too many students so we get overwhelmed. We need to have enough mentors to accommodate those students, and also enough facilitators to be able to scale the program, to grow it in the future.

And it’s exactly what Destiny is now doing, the Facilitator Training Program, which gets more people from the educational sectors, community organisers, everyone on board, to jump on those educational initiatives and help us to grow. Because the number of every, all those students involved in participating in those programs is increasing and we need to be able to accommodate them. And through the Facilitator Training Program, this allows us to do that.

[00:39:42] Nathan Wrigley: It’s so interesting in open source software spaces as opposed to corporate spaces. I suppose the metric of success for anything like this in the corporate universe would be how many people showed up and gave us money in exchange for this knowledge or, you know, something akin to that. Basically a metric of humans in a room and money gained. And of course, the measurement of this is so not that.

I did wonder, Destiny obviously very proudly rattled off the statistics for Campus Connect, you know, the five and a half thousand attendees and all of that. I wondered if there were success criteria of some kind in the background, which guide you. You know, it’s not like, okay, well we didn’t meet that we’re going to abandon it all. But more, things like you would like to see happen, so aspirational goals. It sounds from what Maciej was saying that maybe the attendance growing slowly over time is some kind of measure of success. Maybe there is none of that, but I’ll just open that one up to see if you want to take that.

[00:40:38] Destiny Kanno: I think one definite measure of success is repeat events on certain campuses. So if the campus is saying, we love that, please come back, or please come again soon. I think that is a really great indicator that, not only did the students get something great out of it, but the school believes in it. And that’s what we want to do. We want to create these systems that, not only bring people into WordPress, but also continue this cycle of, you know, growth within the community, but also ownership by the institution.

Another measurement of success is the institution is like, okay, great, how do we learn how to do that ourselves? So we have some folks now working in the institution that are organising WordPress Campus Connect events that are helping facilitate these Student Clubs. So the faculty and educators themselves, they’re directly getting involved. And that for us as community members too, whose volunteer time is quite limited, as Maciej was saying, like it is a great multiplier that makes everything much more sustainable.

[00:41:45] Maciej Pilarski: So from the WordPress Credits perspective, we don’t hope all the students to turn into contributors. That would be amazing but that might not happen. I can share with you some numbers. So currently we have 450 students globally enrolled. For the whole program so far, 75 graduates.

We hope that some or as many as possible of those graduates who completed the program will stay and become active contributors to the WordPress community, stay engaged.

That’s one of the goals we are aiming for the Credits Program, to not just get this done, but this is building the next generation of contributors. We know that like we are ageing, we’re getting older every year. We are not getting younger, unfortunately. Getting those students staying in the community allows us to build those next generations of WordPress contributors that will also have completely different perspectives to how the community functions, how it was built.

What brought us here might not move us forward. So these new students will bring us this new, fresh perspective of how they would like the community to function and move it to the future, to be current, to stay up to date with what’s happening globally.

[00:43:00] Anand Upadhyay: That’s why it’s very difficult to like measure the impact in numbers because how it is impacting in the longer term. But yeah, it’s going to impact. And I would say also, like Destiny mentioned, one of the metrics is like this campus is willing to have the Campus Connect again and again in the campus.

So I just want to share one more. Like I just recently got a call from one of the faculty coordinators from one of the campus where we have a Student Club. And now they have like two months of vacations. And he called me like, okay, now the vacations are going on, students will not be here, so what can we do for the students to keep their involvement with the WordPress in those two months? So can we do something online? Can we do something like this?

When we get these calls, these kind of communications, that these are interactions that we have, this gives us a sense of like accomplishment. Okay, yeah, we were able to create some kind of interest in the students. Because we cannot expect that if we are going to like any campus and 100 or 200 students are participating in our Campus Connect, they are all going to jump into the WordPress. They are getting a lot of different kind of opportunities as well.

There are other technologies as well, which are, some students are going into that, some students are going into that. But we are showcasing the WordPress as one of the career opportunities. And they have a choice of multiple options, so they will choose what they do. But yeah, the impact will be seen in the next few years. Just like Maciej said, mentioned that he went to the WordCamp as a volunteer and it’s bring him into the community.

And the same is with me. I attended the WordCamp and just after coming out of the WordCamp, I started the Meetup group in my city. So I got inspired from that. So that is a result of that WordCamp. And that cannot be measured in the numbers. That can only be sensed when we are doing this kind of conversation. Okay, that WordCamp helped me, that WordCamp helped me.

The same way in future, these students who will join the community or the WordPress industry, they will be talking about, okay, I got first introduced about WordPress through a WordPress Campus Connect event or I got introduced to the contribution through WP Credits Program. So when these conversation will be happening in the future, then we will say that those are the real metrics that we are looking for.

[00:45:00] Nathan Wrigley: That’s really interesting, and I like that. It sounds like there’s not so much a focus on statistics, you know, literal, brutal numbers, more kind of playing it forwards and measuring the impact over many years, not, you know, a handful of months into the future.

[00:45:15] Destiny Kanno: So yes, we’re not like, okay, here’s our KPIs, you know, and here’s our hard metrics. But one thing I really noticed that our community is, it could be better at doing, is just talking about what happened. Because then you hear all these success stories and there are numbers in that. So like for example, Ajmer again, Women’s Day event this year. 50% of tickets sold were to students. And that’s directly because of the involvement in going to these campuses and teaching WordPress. And I’m like, that’s amazing, that’s direct injection of 50% youth into the WordPress community.

[00:45:52] Anand Upadhyay: And they sold out so fast.

[00:45:53] Destiny Kanno: And they sold out really fast, yeah.

[00:45:55] Anand Upadhyay: The organisers were hoping like, now we have to pitch out to sale our tickets. And they have planned a social media campaign around that. Okay, we will be periodically pitch a student on the social media to encourage the ticket purchase. And within one day, we sold out. And the whole social media campaign was like their whole planning was gone. We don’t have tickets.

[00:46:14] Nathan Wrigley: It’s really interesting that there’s all this success going on, and yet, as Destiny said, it is hard to get that discovered. Maybe it’s a case of shouting louder about the previous success. Maybe things like this podcast will help in some small way for things like that.

But I know what you mean. There’s a lot of people talking about the code, and there’s a lot of people talking about the plugins and the themes and whether or not we’re going to get collaborative editing in version 7 or 7.1. All of that seems to suck up all of the oxygen in the room. And yet, without a throughput of, let’s go for young adults, coming into the WordPress space, there’s not really a great deal of hope for a project over decades unless we get people of a much younger age beginning now. And I’ll just hand the torch to Maciej because I think he’s got something to add.

[00:47:05] Maciej Pilarski: But this is also changing because at WordCamp Asia, we were able to introduce the educational table during the contributor day. And I’m also organiser of WordCamp Europe that’s going to happen really soon in two, three weeks, beginning of June. And during WordCamp Europe, we will also have a contributor table, dedicated to education, but for the first time also educational track.

During the second day, we will start the whole day with topics related to education. We will have a discussion panel rethinking learning in WordPress that Mary will be participating. And later in that afternoon, we will have actual students, who take part in the program. Sharing the experience, presenting the results. Not only students from universities, but I’m also leading a group of high school students who’ve been working for the whole past semester with a teacher on some projects related to WordPress building websites. So they are super eager and excited to show them.

We will also showcase some students, teachers stories, how both of those sites motivated each other, learn from each other, and basically help us keep growing the community.

So WordCamp Europe definitely will feature some of those things. And we’re slowly introducing more and more those things into those flagship events and into the broader community.

[00:48:28] Nathan Wrigley: Really nice. Yeah, that’s really nice to hear. I think it’s a difficult circle to square, the idea of making this stuff visible so that everybody’s aware of it. Even if they’re only interested in running their agency, or writing code or whatever it is. Maybe to realise that this is some version of the underpinnings of the WordPress community without which the software ultimately doesn’t exist.

And it is quite curious. I don’t know if I’m reading between the lines here, I think I’m not, but I get the impression that, I’m going to use the phrase like, I don’t know, from higher up, let’s put it that way. It feels like education is taking a more central place. It feels like for example, Mary Hubbard, it feels like you’ve got a real advocate there. Again, I could be reading between the lines, but it feels like the words coming out of her mouth, I hear the word education coming out of her mouth quite a lot when she’s on stage.

So it feels like you’ve got some big hitters, let’s go with that. I don’t know if you’ve got anything you want to add to that, but it feels like the importance of this is more profound this year than it was a few years ago.

[00:49:33] Maciej Pilarski: You are correct. Mary is a big supporter of that and she also created this space for us to grow those initiatives that like allows us to grow that. Isotta started the first Credits Program at the Pisa University as an experiment. And from there it was proven that this actually works. It gets us universities and new contributors.

And then on the other side, there was those Campus Connect events that also organically grew up on their own. So basically there was a need. It feels like there was this hive mind somehow that worked also for all of us. All of us felt this need to introduce those things. It looks like we’ve reached a certain growth level for the community that we organically felt that that’s the direction that we should start heading.

[00:50:24] Nathan Wrigley: Yeah. What’s interesting there as well is that it very much overlaps with maybe a concern. So we’ve touched on this at various points without saying it out loud quite. If you go to, and I’m going to exclude WordCamp Asia 2026 from what I’m about to say, because that event was very different. If you go to a typical WordCamp, the age skews, and I’m doing air quotes, older. You don’t typically look around and see a bunch of teenagers.

So that’s a concern. There’s this, like a pyramid, like a reverse pyramid, and if we don’t get the younger people coming up, the edifice of this entire project kind of becomes a lot more shaky. And we’ve lived through 22 plus years of WordPress, and I think quite a lot of those people began, a lot of the people who’ve been involved in the community began their careers using WordPress and they’ve kind of moved through WordPress as it’s evolved over those 22 years.

And not to, I don’t know quite how to say this. At some point they’re going to stop contributing. Their age will become something, you know, they want to retire or they want to move on or do some other things. Unless we build the scaffolding and put things in place so that young people feel they’ve got a place here, feel that, I don’t know, some proprietary system is not the way they want to go, they want to support the ethic of open source.

Unless these building blocks, these educational building blocks are put in place, then that’s going to be a bit of a concern. So to your point, Maciej, it organically grew. And what a nice thing that it did kind of organically grow because it’s sorely needed at the same time. There isn’t really a question in there. But anyway, there’s my observation. Anand, did you have something to say? I think you did.

[00:52:04] Anand Upadhyay: Yeah. So just want to add that thing you have raised recently. So the way that we want to teach the students about the open source as well, because if you go to the WP Credit curriculum, so the initial lessons, they learn through the, given to them to learn from the learn.wordpress. So it’s all about like open source ethics, and how the WordPress community, WordPress project works.

So this opens up their mind about the open source. Because in the education system, it is something that is not clearly mentioned. There are simple, just simple definitions around the open source. But open source is much more than those definitions.

And especially the open source community like WordPress. It’s more about the people. So the students also learn about how the community is working, how the people are working from the different time zones, people are joining hands for running the bigger events like WordCamp Asia or these Credits Programs. The students will learn all those things as well, and I’m sure when they will join as a contributor in the future, they will have lot of experience before joining as well.

[00:53:02] Nathan Wrigley: Thank you. I love that expression, by the way. You just dropped it in in the middle of a sentence there. You said people are joining hands. What a perfect summation of the entire enterprise being discussed today. Maciej, you raised your hand.

[00:53:14] Maciej Pilarski: Yeah, and besides the community goals and keeping it going, I have also a very personal goal that also is behind all of those things that I do. From my own experience, I had a pretty difficult and bumpy educational path, let’s call it. Unlocking those possibilities for those students, helping them out, making it easier for them, it’s one of my very personal goals, because I know it does not need to be very difficult or crazy when you study, especially when you are young. You’re not sure fully which direction you would like to go. So creating for them, one of those opportunities that might click for them is also something very personal and close to my heart. Because not everyone needs to struggle or have like difficulties, so.

[00:53:58] Nathan Wrigley: I am so glad you said that because that encapsulates all of it. That’s the entire point. It’s got to be that, right? So we’ve spent a long time talking about the minutiae of this, that, and the other thing. It all goes, like they’re spokes on a wheel. And the whole point is that little bit in the middle, which is the child, the adult, the human being somewhere who just wants to make use, wants to grow, wants to learn things, wants to figure things out.

With open source, with this kind of learning, there is potentially zero impediment, or at least very few impediments to actually get that learning underway. And so I think maybe we lost sight of that in this conversation a little bit. So I’m glad that you grounded it there, Maciej, right towards the end. That’s perfect. Destiny, was there anything you wanted to say? I don’t know if you were indicating that you did.

[00:54:48] Destiny Kanno: I know we’re like probably over time, but there’s still so much to share. Like even thinking about keeping WordPress relevant, right? For us and then also for youth. I think about the new AI Leaders Credential that was announced and is being worked on. And how tying WordPress to AI is like really helping students engage more, and see like the relevancy of it in a different way. Not even for the students, like for me, that’s challenging me and I think other organisers and learners of WordPress to be adaptable and think about WordPress differently in a new way of this year as AI keeps advancing.

And then you were also talking about wins, right? How do we celebrate that? I did want to surface, we have the Education Buzz Report, which goes out every month, which aims to try to surface all of these educational wins that are happening in the community. And I just have received some further collaboration from marketing to hopefully also broadcast that on our socials going forward so that we do get the word out.

And lastly, like celebrating the students too. There was a post that went out about the Student Clubs and the success. And we just want to make sure that in this, that they feel seen, right? And that this feels like a space for them. And I know WordPress Credits, we’re working on something to showcase, no, something went out recently. A post went out recently to showcase some of the successes of the students. And we just want to keep highlighting that as well. Because their work and the way they operate, especially because they’re coming in with different lenses, is really important to showcase and highlight and make sure that they feel like they deserve that.

[00:56:26] Nathan Wrigley: Yeah, there was a post, I’ll try and link to it. I think it was like a week ago about the Student Clubs. There were three or four images, three or four photos and there were so many smiling faces in those pictures. It was absolutely lovely. Lots of people gathered in classrooms. I couldn’t exactly tell where, but it was just so nice seeing people kind of enjoying WordPress, having a nice time, bit of camaraderie, hanging out with each other, learning things. It was absolutely wonderful.

Unfortunately, I think time might have got the better of us. Hopefully, dear listener, what you’ve gained is an understanding that there’s so many layers to this educational initiative. It doesn’t appear to be in any way standing still. It’s growing. It’s interesting. There’s a lot going on, and you can be involved.

I will put links in the show notes to any of the places where I feel you would be best making a start with that. Maybe the contributors to this panel can drop some things, you know, if they’ve got a particular link. So again, wptavern.com. If you want to go over there, we will look for the links.

This giant edifice that you maybe know nothing about, and maybe at the end of this episode, some parts of you is tuned in and thinking, I would like to be involved in that. And the truth is, you can be. It’s all available to you to get involved and you could start today.

So there we go. With that said, I’m just going to say a great big thank you to Destiny, to Anand, and to Maciej. It kinds of feels like we need to come back. Let’s do it again in six months or so, and we’ll see where we’re at. Oh, I’ve got a lot of nodding faces. That’s nice. So maybe we’ll revisit this in a few months time.

But seriously, from the bottom of my heart, Destiny, Anand and Maciej, profound respect to you and all of the different things that you are doing. Thank you so much for chatting to me today.

[00:58:13] Anand Upadhyay: Thank you.

[00:58:13] Maciej Pilarski: Thank you.

[00:58:14] Destiny Kanno: Thank you.

Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case using AI everywhere at rtCamp.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you or your idea featured on the show. Head to wptavern.com/contact/jukebox? And use the form there.

So on the podcast today we have Rahul Bansal. Rahul has a long and accomplished history in the WordPress ecosystem. As the founder and CEO of rtCamp, a company he started 17 years ago, he’s led his agency through the rapidly changing landscape of the web, helping enterprise clients such as Google, Fortune 500 companies, and major publishers solve complex problems with innovative WordPress based solutions.

rtCamp specialises in everything from large scale website builds, to more bespoke projects like Chrome extensions and SaaS connectors, and has grown to a team of hundreds over the years.

Today’s episode takes a deep dive into Raul’s recent talk at WordCamp Asia, which focused on what it will take to launch and scale an enterprise WordPress agency in the future.

The conversation focused on real, hard won, lessons from rtCamp’s journey, but also how rapidly the playbook is changing with advances in technology, particularly the explosion of AI tools and workflows.

We discuss Rahul’s philosophy around hiring, namely building a team of people whose strengths complement each other rather than just replicating your own skillset. This approach has allowed rtCamp to adapt to new challenges, fill gaps in expertise, and whether major industry changes.

We then explore how this idea of complimentary sets can also apply to choosing the right kinds of clients, those who value your expertise because they need what you offer, rather than simply hiring somebody who does what they already know.

A theme that emerged in the conversation was specialisation. Rahul outlines how, whereas rtCamp’s earliest differentiator was a simple focus on WordPress, when virtually nobody else in India was, today’s agencies must drill down much further to stand out choosing niches within niches, such as WooCommerce, or payment gateway integrations, and becoming recognised experts in those areas in order to thrive in a much more crowded field.

Towards the end of the episode, the discussion turns to what might be the most significant topic for agencies today, artificial intelligence. Rahul describes how recent advances in AI have not only altered his agency’s practises, but given them a firm mandate. If something in rtCamp can be done by AI it will be.

We talk about how AI is being leveraged inside rtCamp to automate and optimise everything from sales and proposal writing to project management, and even technical proof of concept builds. With a unified platform for all business processes, the agency is now able to significantly reduce costs, speed up delivery, and focus on higher value consulting and creativity, reshaping roles and team composition as a result.

If you’re interested in what it takes to stand out and succeed in the evolving world of enterprise WordPress agencies, how to confront uncertainty with both optimism and realism, and how AI can become not just a bolt-on feature, but the operational backbone of your business, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Rahul Bansal.

I am joined on the podcast by Rahul Bansal. Hello, Rahul.

Rahul Bansal: Hello Nathan. Thanks for having me here.

Nathan Wrigley: You are very welcome. Rahul and I were both at WordCamp Asia and that is going to be the main focus of the podcast today. We’re going to be talking about agencies, growth in agencies, and then probably delving into AI a little bit at the end because of a recent announcement that came out of rtCamp, which is the company that Rahul founded many years ago.

In order to, I suppose, lend credibility to a conversation about agency work, would you mind Rahul, just introducing yourself and tell us a little bit about who you are, what you do in WordPress, and maybe give us a few little interesting facts about rtCamp and what you do over there.

Rahul Bansal: So I’m, as you mentioned, founder and CEO of rtCamp. We started this 17 years ago. We primarily help large enterprise client, sometimes we build websites for their marketing team, which is the most common use case of WordPress. But at the same time, we help large tech companies like Google communicate better with the WordPress ecosystem for their offering. Like sometimes we build products that includes neither thing, neither plugin, but something like Chrome extension. For large companies sometimes we build like SaaS connectors for technology companies.

Yeah, so we work with, like a big companies really Fortune 500, and the idea is to deliver something related to WordPress in one form or another form.

Nathan Wrigley: If you go to the rtCamp website, you can probably Google it I would’ve imagined, then you’ll be able to get some impression of what the company is like.

I think last time we spoke you were into the sort of 200 employees level. I’m not sure if those numbers have gone up or down or what have you. But you get an impression of how large it is. And one of the interesting things that I spotted during my time at WordCamp Asia was just how vibrant the community, the WordPress community is. So maybe we’ll get into that a little bit as well.

I’m going to concentrate to begin with on the presentation that you gave at WordCamp Asia. If you would like to see that, wordpress.tv will have a video. And if the video is already available, I will link to it in the show notes. But the presentation that Rahul gave was entitled, how to Start an Enterprise WordPress Agency in 2026. And I’ll just read the blurb that goes with it because it was fairly short and easy to manage.

Building a WordPress agency business for large enterprises. In this talk, I’ll share the story of how rtCamp grew from a small WordPress shop into a globally recognised enterprise agency, trusted by Fortune 500 companies and major publishers. If you’re starting an agency today or looking to move up market in 2026, this session will give you a realistic roadmap building on real lessons from my personal experience.

So I suppose what I’m going to do at the beginning, Rahul, if it’s all right with you, is just ask you to tell us some of the bits and pieces that you mentioned during that. Some of the advice that you would give an agency owner beginning in 2026.

Rahul Bansal: Yeah. So first, like I deviated a little bit from the blurb because when I applied this talk I had a different frame of mind that, hey, I’m going to do this. And then as I was preparing the talk, and in during those months, especially like last few months, the AI has reshaped everything. And then I realised that a lot of what worked for rtCamp won’t work even for rtCamp if I start again today.

Rather than making it as a nice story about what worked for us, I lean more towards practical advice, and that’s where the essence remained. But I focus more on the 2026 part, because when we started, it was 2006. The first time when I used WordPress was 2006. rtCamp started in 2009. 20 years is a big time. And then at the end of this 20th year, like we are going through this AI led change.

So a lot of things that worked for me won’t work anymore. And that is how I restructured my talk to take enough from our history, enough from our learnings, what worked for us.

The way we hire is very different. And after the talk, if that one line that stick with the audience, that many people told me that the hire your complementary set was the most different idea. And it’s timeless idea. It’s relevant in AI world also.

So the idea was basically that we have this bias that when we try to scale, like basically when we go from freelancing to agency business, the idea of building a business, we try to find people like us. But my idea was that we should initially, especially, we should find people who are opposite of us. Like I was good at engineering, bad at sales, so my co-founder is sales heavy. My English was not good. His English was very polished.

So I literally listed down my weakness and found people who were opposite of me. Even interesting part was that, to the few initial hires I asked the questions, whose answer I had no idea whether they’re saying right or wrong.

So that was the most interesting idea and I think that’s still relevant today. I will do exactly same thing if I have to start building a new agency. I will build in WordPress, build in AI, any kind of business I will, my initial few hires will all together will cover each other’s weaknesses.

It’s at certain scale then you need to replicate, like, you need 50 engineers, you need 20 React engineers, you need five people who can write same proposal. That comes much later. But starting is all about finding your complementary set. And this was inspired by a set theory from math class that I attended in when I was like some 12-year-old. That stuck around before the life. And that is what I put in this talk as a biggest lesson we learned and that worked.

The second most specific thing that I would say, practical advice, like that was more about hiring advice, but that is not only hiring address, that is, I advise in many walks of life applicable.

When you’re looking for your client, you have to look for complimentary set there as well. Because you are trying to sell to agencies like yours, your margins gets hit a lot. You need to find people who do not understand WordPress at all because then, that is why your expertise become more important and premium for them, because they need to depend on you. They value you more. You are not commoditised for them.

So that hiring your complementary set works across the board. But then the most specific advice I gave that I didn’t follow myself, I would say. Actually there was nothing to follow that. When I started WordPress was just a blogging platform. There was custom post type were not yet part of WordPress Core. Everybody was just building blogs. We were playing around themes, and the race was to make our blog look unique. The metric usually was like traffic and how many email subscribers you got.

So there was no niche to pick. Like, that was the only thing WordPress was doing. And after post type, people started building a lot more than WordPress. Actually people started pushing WordPress earlier, and as a result of that, WordPress created those APIs to make it easy to extend WordPress beyond blogging platform.

But today, in 2026, there is so many things happening. And if you’re starting new and you do what rtCamp did on day one, like, hey, we are WordPress agency. That is not going to work.

It worked for us 20 years back because we were like, probably only one in India at that time who said at that time that we will be only taking WordPress project. Because India was a land of outsourcing. Like in supply chain, it was like a, it’s like a Chinese manufacturer saying that, hey, we are only going to assemble if you are building for iPhone. So it’s like, hey, we are only going to write PHP if it is going to end up as a WordPress theme or plugin. We are not going to do what was Cake PHP project at that time. We are not going to write custom PHP script.

So in a way we picked the whole WordPress as a niche among the largest set of choices available to us. But if your largest set of choices was building a iOS company, like mobile app company. Mobile app was big because with the introduction of iPhone, there was a sudden shift and huge demand for iOS apps, and we haven’t built one till 17 years. Like literally we built our first iOS app, public iOS app last month.

That time we were like, well, we are going to only do WordPress. So now that advice translate into, pick a niche within WordPress because WordPress itself is the web now. That time, WordPress was very small. Now you can choose e-commerce. Within e-commerce then you can probably pick WooCommerce. Within WooCommerce then probably you can pick like, depending on your market, payment gateway specialisation, ERPs, back office specialisation, subscription based businesses.

Start by picking a niche as small as possible and then go bottoms up, rather than starting with everything. So that was the key takeaway of my session, I would say that. Pick a niche, position yourself as a expert in the niche. Don’t just say that, hey, we build WooCommerce store, or we build WordPress site.

Nathan Wrigley: Okay. Yeah, I’ve got all of that. So firstly, hiring. That’s an interesting one. Hire people that are different from you. I was imagining when you were saying that, I wonder how long you can do that, because you can’t, eventually, you have a company of a hundred people and all of them are not the same as you. Eventually it must be nice to find somebody who’s a little bit like you.

But then also you mentioned picking clients who will trust your expertise, I think is a good way of describing that. Because they themselves are perhaps not expert within that WordPress platform.

And now of course, moving forwards, what worked for you in terms of being a WordPress agency 17 odd years ago, that was, as it turns out, really successful. But now you are going to be amongst tens of thousands in India alone, if all you say is that you are a WordPress agency. So you need to go a little bit more specialised and niche down.

I wonder, Rahul, with the benefit of hindsight, it’s always easy to look back and sort of see for example, from my perspective, I see rtCamp as an entirely successful enterprise. You know, you began all those years ago, and decisions were made and you grew and you grew and you grew and you grew, and now we are where you are now. Committing a lot to WordPress with incredible growth and a really amazing agency on your hands.

But I’m just wondering, looking back, with the benefit of hindsight, were there any moments where you made some decisions where you were very nervous about how it was going to be?

So for example, one of those could be WordPress. There was no writing on the wall that said WordPress will be the successful CMS. That really could have gone either way. It could have been Drupal, it could have been something that some kid in a basement created. So I’m just wondering, are there moments when you look back and you think to yourself, gosh, I am so glad that we did that random choice than all the others that we could have made?

Rahul Bansal: Yep. So it’s a reality that, one of the co-founders we lost, within the first year of company formation was because, I refused to add Joomla to our offering. And Joomla I think was market leader at that time when we started. So we were like more like engineers, like some were good at sales, some were good at communication, but we were all from the same kind of school, like we didn’t know if there was any survey existed.

So we didn’t back by any data. The only reason we chose to stay with WordPress or build this agency with WordPress because we were using WordPress. So rtCamp for the most part, people missed that. So rtCamp was not started as an agency. rtCamp was basically a media company, a blog network. And that blog network was running on WordPress. As a technology blogger. It’s like just imagine WP Beginners, like that is more relevant example.

So by the way, we, and WP Beginner were operating at the same time, that’s the power of niche. Like say I chose to focus on WordPress and say very very well. And my technical blog was everything like from iPhone to Windows operating system to Mac OS update to web APIs, to HTTP2. Whatever, like it was a larger technology blog So we were more like a stripped down version of TechCrunch rather than picking a niche. And Syed picked this WordPress as a niche.

Both were contemporaries in that same era. Now just imagine Syed in those days I started an agency. So we were using WordPress, we needed to stand out because, social network or blogging or web was still a fancy place. Like minimalism wasn’t the trend. It was how much you can push, like how you can make your website look different without using Flash. That was the coolest thing. Like how much you can push jQuery, how advanced CSS you can write. So all those things led to we customising our WordPress a lot.

Another thing that worked in our part was, our blog was one of the biggest in India. Globally also, it had good traffic. In fact, it had so much traffic that one of the most Googled keyword in my name was Rahul Bansal, how much money this guy make. Like that was the first question I used to get asked because traffic was insane. We used to get a lot of traffic.

That led us to writing nice WordPress code. In early days, like especially when I was freelancer, I had to write amazing WordPress code that will scale and host it in a way that it will also scale. So not only WordPress, we choose Nginx before it become a norm. Like before there was. anybody started any WordPress managed hosting company. We managed to scale WordPress at a very high level.

And so now we, are this famous blog running on WordPress handling so much traffic, on Linode’s $10 something plan. Customising it. So we got this natural market. We got initial customers were technically our competitors, like other tech bloggers. It’s like TechCrunch hiring Mashable to customise their blog So something like, because Mashable has a tech team. So that was at early story of rtCamp.

And then we realised that we are making more money and faster money via customising WordPress. So we started cutting down on our editorials. And then, slowly, slowly like the business has shifted from, being a blogging agency, to WordPress custom development agency. That’s why we chose WordPress.

And that has been the principle since then, like we only sell what we use. That was the reason we didn’t, so it wasn’t any ideological decision. So the ideology is at open source level. So rtCamp is committed to providing open source solution to its client from day one.

Joomla tick that box. But Joomla didn’t tick the box that we use Joomla. We don’t use Joomla. There was no reason for us to have our blog running on WordPress and website running on Joomla, and that’s why we stick around WordPress when there was no data, no trend. And I think in hindsight it was just luck. I would say like it could have backfired.

Nathan Wrigley: Well, okay, I really like this story. Firstly, I like the fact that you are identifying luck as a component, because I think too often when you listen to people who have had success, they sort of chart this narrative of how brilliant the decisions were along the journey and how impeccable, you know, we did this and then we did this, and then we did this, and then we did this. But never a nod to luck.

And of course, with the benefit of hindsight, we did this, we did this, we did this does lead to where you are now. But I really enjoy it when founders and people have that confession in them. Yeah, there was a bit of luck.

But also, and we’ll get onto this in a minute, because a big part of what you are about to do, or have recently done with your business kind of leans into what you’ve just been saying.

It sounds like you were led by what was in front of you, if you know what I mean? It doesn’t sound like there was a great big, okay, by 2016 or 2026, we want to be here. It was more like, okay, this is where we’re at now. These are the things that are coming to us. Okay, looks like WordPress, not only are we using it, but it looks like people want us to help them to use it. Well, let’s go there then. Let’s put the blogging to one side and let’s become more of a, I don’t know, a technical helper for you and your website.

So there’s this sort of lucky piece, but also the willingness to steer into favourable winds, if you know what I mean? I love that story. Thank you very much for that. I also admire your humility in all of that. That’s lovely.

So the next thing then, I suppose that I want to get into is some change in the landscape at the moment. And again, this maps to what you were just saying about move where the wind takes you. We all know that AI is a thing. You cannot have missed that. But I think a lot of people are taking nervous steps into their business and how they’re doing things with AI and maybe biting off a little bit here with AI and leaving the rest as it is, and biting off another chunk here, and leaving the rest as it is and slowly moving into AI.

You have a very different approach. And I will link in the show notes to a blog post on the rtCamp website, which I read several weeks ago. I’ve got to say, I was a little bit, not surprised, that’s the wrong word, but it was written in such a way that I thought, gosh, now that’s interesting.

Because in it you painted the case that rtCamp in the future is going to do AI everywhere. And I know we hear that all the time. You know, we’re going to use AI here, and we’re going to use AI there. You have painted your colours on the mast, and literally, I think you said, if it can be done with AI, it will be done with AI. There will be no stone left unturned.

Okay. Firstly, why? Why have you got that approach? What’s the reason? Now, I’m sure it’s fairly obvious, but lay it out for us anyway.

Rahul Bansal: Yeah. So I don’t know from where it comes, anytime I see things going south across industry like COVID or, like AI, like everybody was gloomy, my brain kind of think of opposite. So in my brain, I’m not building, I’m actually imagining an AI only agency with humans required to probably feel capture. That’s how my brain works. So it’s like AI first.

Then again, like WordPress, so I have been lucky more than once in my life. So before this AI came, this famous saying by Steve Jobs like you can only connect the dots looking backward. Three to four years ago, riding on the digital boom, we survived the COVID, like all agencies grew. rtCamp grew a lot more, and a lot faster in very short span of time. And to manage this humongous workforce, we needed to refactor a lot internal tooling, softwares, processes, to the point that we have internally codified our mission that we want to build McDonald’s of consulting business, inspired by that movie Founder. That was also part of my talk at WorkCamp Asia.

And in fact, I had somebody to literally a complimentary set example. I know we want to build this, but I don’t have that kind of mental model. So that’s the brief I give to our chief delivery officer that you have to give me this. McDonald’s of agency business.

We start thinking of every process that we can repeat, and we realised that we need to take control of our software stack. And we ended up finding something, in open source. That’s, I would say truly a spiritually aligned to the WordPress ecosystem called Frappe ERPNext, which handle our accounting, payroll, project management, CRM. So many business processes in one single source of truth, like single source of truth for so many things. Earlier it was all siloed data.

So this was started with a different intent, to scale rtCamp, 2000 people, 5,000 people, 10,000 people, because that was a business model then. Agencies growth with capacity. You want to sell more, you need to hire more. Basically agencies growth was limited by on one dimension, the inventory, human inventory you can have. So we started implementing this open source back office software automation with the idea that we will own, central piece of our operating system of connecting, getting thousands of people working together.

Then AI happened, and then we realised we don’t need to hire those many people anymore. Year on year, we moved from 200 to 250, but I think next 50 will be very slow. Because, now we are no longer aiming to sell, or hire people. But as luck would’ve been, we ended up creating this system of record, which is unified and cleaned. When we think of a client or a project or a human. All aspect of their metadata is available in a single system.

So that is why we can leverage AI more than a company, agency to agency. For agencies using say, Jira for project management. QuickBook for accounting, some other software. If their operations is scattered across 6, 7 software, we have leverage over them. Not only we are paying very less because all our software is open source. The data is first party. Like sitting duck there to query in any way we can. We are not limited by SaaS providers, enterprise plan or this AI capability.

So that is where we realised that we can take this huge bet on AI where we can now build a lot more, in a lot less time using AI across the board. And if you look at a business like not just WordPress business, when you buy something, like you buy a car from a car company. You are actually paying for everything that company does, advertising, researching on the EV technologies, hiring a brand ambassador to put billboard, sponsoring F1. Anything that company does. every penny they spend on their business, the customer ends up paying it.

So we thought like now we have a single stack, which technically takes care of 70 to 80% critical nature of our business operations. From when the lead enters the CRM, the project management, time entry, people’s new management, everything is linked. Everything is beautifully linked in a single unified interface and database. So why don’t we just use AI to cut down the cost.

Because now we cannot charge by hours, we can try, but, it’s not making sense anymore for clients. They want us to commit to fix output bid. Now when we say, hey, we can migrate this thing for 100k, or we can build this website for half million dollars. So those numbers, traditionally, and actually all the time will include all the operation cost. Like my salary. I’m not doing any coding work, but my salary will be eventually paid by all the clients. Electricity bill that is also going to be paid by all the client.

So we thought like rather than just thinking AI to build a website, let’s use AI to bring our operational costs dramatically down. Because we have single source of truth for maximum data we have, and that is where we went all AI in. Now it’s like we can submit a proposal in one third of the time.

In old days we used to build PPTs. Now we vibe code a WordPress demo site and attach it to the proposal. Hey is this something that you want? Not just the screenshot, not just the Figma, like we are actually building Playground, like websites, and launching them and sharing those links to the client. Go play with it. We are even trying to copy the design systems if they’re migrating. So migration is a big category of work we do.

So that is what we mean by going AI ready. So we are leveraging AI to reduce the cost of sale, increase probability of winning the project by pitching them something. And then while estimating the effort, like let’s say we would traditionally say, oh, this might cost us a thousand hours. Now we blindly said Make it 30% less, as if it will be done in 700 hours and it will be, sometimes it backfires.

But then on some project it’ll be 500 hours. In some project it’ll be 900 hours, but average will come back to 700 hours. Then again, the idea is we have a central operating system, which gives us, like bird’s eye view of how healthy our projects education are. Are we getting returns on our AI engagement? And all this is possible because few years back we took a bet in different direction.

Like we choose WordPress because we wanted to be a better media agencies, and that was what media agencies were doing in the early days. But we ended up building an agency business with the WordPress. Likewise we choose this Frappe ERPNext software. To operationalise our back office. But now it is starting out to be our advantage point in this areas like we are able to do AI a lot more. In the end, it’s all about bringing the cost down at certain quality. You have to keep the quality up, and just make it more affordable. If that is not. as a business you cannot do that with AI, then something is wrong.

So AI is not about building something new. I have another approach. So if you’re an agency people are hiring you to move things from A to B, like you are the movers and packers of internet. I put crudely, what rtCamp does. We move things, like a shipping company who moves your house, remove you from Sitecore to WordSpace.

And that’s still big part of our business. We don’t have to reinvent or reimagine different experiences all the time. Sometimes we have to just do what everybody’s doing, the boring part. Put AI there to make it efficient, more cost effective. And if you do that, that means more people wanting to shift to new house. Again, a different approach. People think that they need to build something out of the world to benefit from this AI way.

My idea is that pick a boring thing and make it so affordable that people who were sitting on the fence, just imagine travel, Middle East travel. Like this is a very actually a bad example, might sound inhuman, but, say like X number of people wanted to experience Dubai as a destination, but let’s say, it was beyond their budget. For some even unfortunately now suddenly that comes within their budget, they will be able to do that.

People wanted to move to WordPress Initially, agencies were quoting a hundred thousand dollars for that big shift. Now if you can, suddenly you can do it in 50k a lot more people will shift. So, you don’t have to do things like out of the world thing. You don’t have to invent new. You have to sometimes just make existing problem more efficient to solve.

And it was not always about money, especially in large client. It was not always about 100k versus 50k versus half million versus 1 million. It was about timeline. It’s like you are refurbishing your home and it is going to take three month, then it’s a different mental model, like to put up yourself in a hotel or a second home for three months. If a magically a new company appears and hey, we can refurbish your home overnight. You don’t mind checking into hotel for one night. And that is where I feel like this WordPress will be net gain because of AI. Agencies has to be optimistic, and think differently to gain from AI.

Like, what people are doing is everybody’s trying to act like a ChatGPT, OpenAI, it’s their job to invent AI algorithm. We are agency. Our job is to apply AI, not invent AI. We don’t have to think of what is Opus 4.8 will do. Let cloud engineers think of that.

So we need to understand we are AI’s consumers or consultant, and that is where some people are getting it wrong by vibe coding things that they’re not able to sell to anyone. Then they will cry that, hey, six months later they will realise they built stuff nobody bought. Now they don’t have money to pay AI bills, or their developer salaries and then they will try that, hey, AI took over job, AI killed our business. No, think what existing problems we can solve with AI cheaply, efficiently, with better quality. And a lot of work is there to be done.

Nathan Wrigley: There’s a lot in there, but one of the things that I’m taking out is. So prior to AI coming along and demonstrating to us all what it could do, which by the way didn’t kind of happen overnight, although it feels like it did, there was a sort of, a year in which we could suddenly see, oh boy, it’s getting much more performant and much more interesting. But prior to that, it sounds like post COVID, you kind of inspected your business and were thinking, okay, how can we refine everything that we’ve got in the business and how can we put it all into this one system?

And again, with the benefit of hindsight, and I’m maybe going to use the word luck, maybe that’s not the right word. You, having done that work, then meant that when AI did come along, you weren’t trying to link up four or five or six or ten different things. You had this one source of truth. Which meant that you could cut waste, for want of a better word. You know, waste could be measured in terms of dollars or it could be measured in terms of time or it, whatever it may be.

You happened to be in that place because you’d done that preparatory work, not necessarily knowing that AI was going to come along and make all of this fun stuff possible. But with the benefit of hindsight, that’s exactly what it did.

And it’s curious, you said 70 or 80% of the business could be streamlined in that way. And I’m so staggered by that number. I thought you’d be in the kind of, I don’t know, 20, 30% or something like that. But a full 70 to 80%. So does that mean 70 to 80% of the things available, or do you mean that you were able to cut 70 to 80% of the cost or the time? Because I wasn’t sure which 70 or 80% you were meaning.

Rahul Bansal: It meant different things. First like, as I mentioned that we are not thinking AI adds just something to sell, but something to consume first. Because, again, dog fooding principle. We managed to sell WordPress better because we were a blog network. That’s why we could understood publishers better. We got into this Frappe ERPNext consulting because we built our backend with it. Now before we make any promise with AI, we have to be net gainer with the AI. And we believe that our internally, we will be.

So there are two parts, actual cost of building something and the meta cost. Like cost of sale, like the writing proposal. marketing costs, like case studies, going to even preparing for articles. Non build cost is definitely, we are able to bring, I would say it’s already half, but it’ll be, further down. I will give you a very simple example.

Like in early days is when somebody used to submit rtCamps form, inquiry form, a human, would manually check like, Hey, what is the domain name of this email id? Are they on LinkedIn? Some 30 minutes and then they will write a note hey, this looks like a good quality lead. We are fortunate that we get a lot of inbound inquiries, so we had to have prioritise, like which leads we are going to respond first.

Now, as soon as somebody submits a form an AI integration does that, within minutes. And the notes are much more details, it creates action items. Across like WordPress our Frappe CRM, our Slack, everything runs like a clockwork, and we don’t need a human. So that, junior human job is definitely gone. So in sales team, we used to have like this entry level job. That is no longer there. Some jobs are actually going to get vanished. So now going on a call, meeting notes, a lot of those things are getting automated. So the cost of sale has dramatically came down.

What is the effect? Like, say we can now assume flat 10% discount compared to earlier pricing when we are thinking of a migration project. Like, let’s say, in early days, we used to think like hey, anybody wanting to migrate from Adobe Experience Manager? We must assume that they need to pay us 100k. On the initial call, we can say, hey, that would probably cost something like minimum 50,000 dollars.

The minimums, the starting numbers has came down because we need less energy to have those pre-sales conversations. Less number of minutes of ours spent building those demos. Very fast discovery. Data mapping sometimes happens in minutes. In fact we did one 10 days to prepare this migration literally in five days, that was unthinkable. And that included data migration, QA testing, like automation testing where somebody built a bought in panel, which would randomly open a Zendesk ticket and verify that all metadata and deploys are migrated into new health desk system, all within five days.

This is where I have been saying that the cost of building custom solutions will fail. For like so low, like it’s 60, 70, 58. Like definitely more than half. It’ll be reduced by half more. People will buy custom solutions. So agencies are going to grow from here in just these one or two years. Because agencies, to price something upfront, we need consistencies. Like I’m running an airline and if my jet fuel is my biggest cost, and that is out of my control. Then how do I price my tickets? That’s AI hallucination, which is, I would say the jet fuel version of aviation industry.

Something happens in Middle East and fuel prices goes up. A war starts. So now when AI hallucinates so it’s like what we are internally tracking, or what we call as a KPI or internal metric is that, worst case, AI gains, that’s already 20%. Best case is more than 90%. In some cases it’s literally 90%. This range will keep compressing and that’s what I think 70% is my expectation in two years. We will have that maturity that, the build time will fall by 70%. That means. the client companies will hire more agencies to do more work.

WordPress will emerge as a winner, not only for its ecosystem, but its ability to expose structured data without any proprietary walls. AI was so fast that only an open source can keep up with it. In fact, we are seeing more migration inquiries with with the AI boom.

Nathan Wrigley: Oh, interesting. I was going to ask a sort of follow up question. Do you think that you, so you were mentioning, how to describe it, a rising tide carries all boats, or you certainly implied that the pie is getting bigger, if you know what I mean? So you are getting more phone calls, more migrations, more work, and you can obviously do that more affordably. And because you can pass on some of those savings to the clients, the price point lowers and so you get more inquiries because there’s this virtuous cycle of price going down, but quality staying the same or getting better.

I wonder if you, given your success in the past, I wonder if that transition will be easier for you, because the phone is already ringing, than it would be for somebody who was beginning in 2026? Because we all know when you begin, getting the phone to ring is probably the hardest thing. You know, getting those first 5, 10, 15 reliable clients, whatever it is that makes you work.

I wonder if you are in a uniquely good position, having a history of clients, a roster of clients that will come back to you. And also just being famous, for want of a better word, in the WordPress space, for doing the kind of things that you do. I wonder just what your thoughts are on that.

Rahul Bansal: They’re both pros and cons. The only con for rtCamp is that our business model, a big part of what’s traditional like setting our flagship revenue stream for last 8 to 10 years was staffing solutions. We used to provide engineers, sometimes to other agencies, sometimes to publishers. So usually they used to have the leadership layer with them. We were more of executors, and if AI within the IT industry, the first casualty of AI revolution was that people who code, or people who can only code but cannot think. But luckily our hiring was very different.

While it is taking time, so as I said, net headcount addition has been slowed down. I think this is probably first time rtCamp’s career site doesn’t have any engineering opening. If we would’ve been like a publicly listed or like a shareholder owned company, we might have got mandate to fire a hundred people right now, because we have already gained by, so much that, our one third of our WordPress engineers are currently out of work when the work is rising.

Because traditionally, when we needed eight people, now we were able to do in four people. But now we are using this. We have our own challenges, going from one kind of business to another kind of business model. The switch is causing some friction, but we are communicating it openly. We are giving people like more freedom. You give us ideas like which part of the entire business equation you can optimise. Is it editorial experience, is it migration cost? Is it data mapping, visual testing? So people are constantly building.

So change is there. Change is scary. It is scary for us also because we don’t want to fire people. We don’t want to lay off people. We want to return this team. From here onwards, we don’t see we are hiring more engineers for at least a year, because we have enough of them. But, we are so optimistic about this WordPress growth and the pie getting bigger.

We are hiring more sales and marketing team. Two days back I was telling like traditionally, we had this 90 to 10% ratio, like in 200 people, our headcount team, we would have 20 people. That would be, we can call as a sales and marketing department, I think next 50 hires will be only sales and marketing.

Nathan Wrigley: Oh, that’s a big skew, isn’t it? So you’ll go to more like 30% marketing as opposed to 10% marketing.

Rahul Bansal: Yeah sales and marketing. By the way, when we say sales, sales in rtCamp means slightly different. It’s more of a initial consulting, basically making those solid promise, which can be backed by engineering, not over promising. So our sales team needs are more like a WordPress consultant, but we have a category within rtCamp which we call Growth Engineers, who are some of our best coders. But rather than writing code, they go on the first client call and make promises on behalf of WordPress which are practical, feasible, and real.

That is what our internship look like, because coding is race to bottom. Eventually the cost of building will shrink to the point that you don’t need many, you won’t need many traditional developers in any agency. You will need people who can imagine what needs to be built. There might be 20 different ways and which way this project should be executed. That prompt engineering, context in engineering.

So the value is shifting and it’s definitely shifting away from people who can only code. That is why, probably from two years now, we might be at 300 people. Hundred of them will not be coding at all. But they will be prompting AI. They will be building vibe coded prototype in pre-sale stage to gain that customer confidence like early on that day. What you want is possible with the WordPress. It won’t cost that much. It’ll be given you fast enough that your life won’t be disrupted for many months, like your business operations won’t be disrupted for many months, so this is a thing

Nathan Wrigley: Yeah, nobody could deny that we’re in interesting times. I think a lot of people are very confused by what’s going on at the moment. You know, they’re trying to figure out a path. They’re trying to figure out how it affects their business. They’re probably in, I would imagine, quite a lot of cases, quite keen to stick to the ways that they’ve done it in the past. But certainly the picture that you’ve painted over at rtCamp is that you are aligning yourself with a very different future, kind of embracing AI, seeing where it can take you, trying to adapt your business. Being optimistic about it rather than pessimistic. Because I think there is quite a lot of pessimism around there at the moment. But seeing the opportunity and seizing it.

Absolutely fascinating. There was so much to unpack there. I feel like we could talk probably for another nine hours about this because it genuinely is never ending. I would love to prize back the curtain a little bit more. However, time allows only this much. So what an interesting conversation. Thank you very much, Rahul.

Just before we end, could you just tell us where we can find you online, should somebody want to, you know, maybe they’re experiencing a bit of anxiety of their own. Their agency is in a rudderless ship at the moment and they’re trying to figure it out. Where can people get in touch with you best?

Rahul Bansal: I am actually available on all social networks. I use LinkedIn least and email is most level way, I’m a bit old school there. But, yeah, Twitter. I check daily.

Nathan Wrigley: I will link to your bio in the show notes, but also, I will link to the presentation that you gave and any other bits and pieces that we discussed that I can find links for. I will mention those well. So head to wptaven.com, search for the episode with Rahul in it.

Thank you so much for chatting to me, and all I can say is all the best. I hope that all of the intuitions that you have turn out to bear fruit and be fruitful for you.

Thank so much for chatting to me today.

Rahul Bansal: Thank you Nathan.