Reading view

WordPress 7.1 Source of Truth

Welcome to the Source of Truth for WordPress 7.1!

Before you dive headfirst into all the big and small changes and pick your favorites, make sure to read these preliminary thoughts about this post and how to use it. If you have any questions, leave a comment or email me at pauli@gutenbergtimes.com.

A huge “Thank you” to Anne McCarthy, Justin Tadlock, Isabel Brison, Adam Silverstein, Ramon Dodd, Andrew Serong, Hans-Gerd Gerhards, Marin Atanasov, Krupa Nanda, Aaron Robertshaw, Ben Dwyer, Brent MacKinnon, Ashar Fuadi, and a lot more. It still takes a village. Also huge respect to the whole release squad on getting WordPress 7.1 over the finish line.

Estimated reading time

37–56 minutes

at

8,851 words

This article is also available in German on Krautpress: WordPress 7.1 Source of Truth – Deutsch

Table of Contents

Changelog

Any changes are cataloged here as the release goes on.

August 14, 2025

August 12, 2026

  • Corrected the Interactive states section: Global Styles state controls ship for the Button block only.
  • Change the order of Changelog items to newest updates first.

August 11, 2026

  • Updated the Highlight grid with latest iteration
  • Updated the Featured image with the 7.1 color schema

August 5, 2026

August 4, 2026

  • Removed On This Day widget information per this ticket. Punted to 7.2 pending more design input.
  • Corrected the "-current": { "color": { "text": "pink" }” code example.

August 3, 2026

July 31, 2026

July 30, 2026 – First edition.

Important note/guidelines

Try not to just copy and paste what’s in this post since it’s going to be shared with plenty of folks. Use this as inspiration for your own stuff and to get the best info about this release. If you do copy and paste, just remember that others might do the same, and it could lead to some awkward moments with duplicate content floating around online.

Each item has been tagged using best guesses with different high-level labels so that you can more readily see at a glance who is likely to be most impacted.
Each item has a high-level description, visuals (if relevant), and key resources if you would like to learn more.

Overview

WordPress 7.1 Highlight grid draft August 10, 2026

WordPress 7.1 rounds out the block editor’s styling controls and makes working with media noticeably smoother. Long-requested features let you style how blocks look across three screen sizes and in interactive states like hover and focus — all without writing custom CSS. The admin experience becomes more personal, too, following you with your own color scheme and toolbar across every screen.

Handling images gets a considerable upgrade, too. The new media editor modal brings free-form cropping, rotation, and metadata editing into one workflow, and client-side media processing makes uploads faster and more resilient, with broader format support and better-optimized files.

The new Playlist and Tabs blocks enrich the layout options available out of the box and make for more creative information presentation. In the same realm fall the expanded Icon API with custom icon collections, dynamic galleries, and background gradients for more blocks.

The unification of WP Admin and the block editors progresses as well: the editors now respect your admin color scheme, and the admin bar stays with you on every screen — including the editors and the front end.

While real-time collaboration has been punted to a future WordPress version, the asynchronous collaboration in Notes took real steps forward with inline notes on partial text selections, @mentions, rich text formatting, and multiple notes per block.

Beyond the headliners, core blocks receive many quality-of-life improvements and bug fixes to make editing content in WordPress streamlined, consistent, and fast — and developers get an expanding set of APIs to build on.

Resources

This release consists of features from the Gutenberg plugin version 22.7 – 23.6. Here are the release posts of those plugin releases:  22.7 | 22.8 | 22.9 | 23.0  | 23.1 | 23.2 | 23.3 | 23.423.5 | 23.6  Later Gutenberg releases contain bug fixes, backported to WordPress 7.1. release branches.

Assets 

In this Google Drive folder you can view all assets in this document.

Tags

To make this document easier to navigate based on specific audiences, the following tags are used liberally: 

  • [end user]: end user focus. 
  • [theme builder]: block or classic theme author. 
  • [plugin author]: plugin author, whether block or otherwise.
  • [developer]: catch-all term for more technical folks. 
  • [site admin]: this includes a “builder” type. 
  • [enterprise]: specific items that would be of interest to or particularly impact enterprise-level folks
  • [all]: broad impact to every kind of WordPress user. 

How can you use these? Use your browser’s Find capability and search for the string including the brackets. Then use the arrows to navigate through the post from one result to the next.

Short video on how to use the tags to navigate the post.

Priority Items for WordPress 7.1

WordPress 7.1 introduces significant enhancements to block-based design and editing. These priority features focus on responsive controls, interactive states, media management, and modernized Admin bar navigation.

Responsive styles for blocks

[theme builders] [site admin][end user]

Probably the most requested improvement of the block editor: after years of pushing intrinsic design for fonts and spacing, WordPress 7.1 makes responsive design a built-in, first-class part of the editing experience. The feature builds on earlier steps in this direction — the ability to show or hide blocks by screen size and the Navigation block’s customizable mobile overlay — and extends the idea to styling itself.

The feature is available across all block editors for Posts, Pages, Templates, Patterns,template parts and Navigation. Responsive styling follows a desktop-first model, letting styles cascade to smaller screens until you customize them for specific devices.

Viewport-specific values are currently limited to block sidebar settings (like typography, spacing, and colors). The controls work in Global Styles (affecting all instances of a block) and on individual block instances, across all block editors — Posts, Pages, Templates, Patterns, template parts, and Navigation. 

Any controls from the toolbar that can’t be set by viewport will be hidden when a viewport state is enabled. Among the most significant controls: viewport-level aspect ratio presets for Image, Featured Image, and Cover blocks, so each can be optimized per device (#78543). Alongside this work, the Layout controls moved from the Settings tab to the Styles tab, keeping all styling decisions together. 

Community feedback from the Call for Testing made sure this feature ships with an off switch via a new responsiveEditingEnabled editor setting: turned off, both the Responsive styles option in the View menu and the viewport selector in Global Styles disappear. It gates the editing interface only. Responsive styles already saved keep rendering as before. (#80814). See code examples are in the responsive styles dev note.

Follow the Call for Testing: Responsive Styling to learn how to invoke the feature and what to look out for, and find the technical details in the Dev Note: Responsive block styles and configurable viewports in WordPress 7.1. 

You can find more technical details in the Dev Note: Responsive block styles and configurable viewports in WordPress 7.1.

Viewport breakpoint customization

Themes can now define custom breakpoints in theme.json, so both responsive styling and per-viewport block visibility work from your design system’s breakpoints instead of WordPress’s defaults. For theme developers and designers, this provides fine-grained, device-agnostic control over responsive behavior. (79104).

JSON
"settings": {
		"viewport": {
			"mobile": "30rem",
			"tablet": "45rem"
		}
	}

Tracking: WordPress 7.1: Block visibility configurable breakpoints and theme.json integration (#75707)

This makes interactive design accessible to non-coders and theme builders. It eliminates the need to add custom CSS snippets for common interactions. 

Interactive states styling (hover, focus)

You can now style interactive pseudo-states (:hover, :focus, or :active) without writing any CSS. For the Button block, this works both per-instance and site-wide in Global Styles. For navigation link blocks (Custom Link, Page Link), the state controls are available per-instance in the block inspector; in Global Styles, the state selector is enabled per block, with Button as the first, so styling navigation states site-wide currently goes through theme.json.
An editor UI for the current-item state is also in development as part of the custom states iteration for 7.2.

The Dev Note give you more details Pseudo and custom style states in WordPress 7.1 and more code examples.

JSON

"core/navigation-link": {
  "-current": {
    "color": { "text": "#ff0000" },
    "typography": { "fontWeight": "700" },
    ":hover": {
      "color": { "text": "#0000ff" }
    },
    ":focus": {
      "color": { "text": "#00aa00" }
    },
    ":active": {
      "color": { "text": "#ff6600" }
    }
  }
}

Media editor modal and free-form image cropper

[end user][site admin]

The new media editor modal replaces the inline cropping tool, accessed via the familiar Crop button, and brings together free-form and aspect-ratio cropping, flip, fine-grained rotation with snap guides, and metadata editing in one unified workflow. (78653, 78935, 78792

This considerably improves the editing experience in WordPress Block editor. The goal was to eliminate the need for external tools for basic image editing. You can now exercise faster, more precise control over your images—fine-tuning framing, fixing orientation, or mirroring an image to better fit your layout in just a few clicks, all without breaking your editing flow.

For the Cover Block, this new media editor modal is hooked up to the Crop background image button. The option appears whenever the Cover block uses an editable image, and the block automatically recalculates its overlay color and contrast after an edit, so text stays readable even if the crop removes the image’s brightest or darkest areas (79258 )

Tracking: Media Editor Modal task tracking (#73771)

Client-side media processing improvements

[developer][site admin][enterprise]

When you upload an image in the block editor, your browser — not your server — will now handle the creation of all sub-sized images using a WebAssembly (WASM) version of libvips (wasm-vips), a high-performance image processing library. The result stored on your server is improved over what server-side processing produced until today: smaller files generated directly on your device. Server-side image processing CPU usage could decline by more than 80% on capable devices (79188)

The update also comes with broader modern image  format support that includes HEIC (the default format for iPhone photos), JPEGS with HDR gain maps (used by UltraHDR and Adaptive HDR), AVIF and WebP support built in. A great performance improvement is the GIF-to-video conversion feature for lighter, more efficient files that are faster to load on the front-end. This feature is opt-in right now. Uploads are also more resilient, with a progress indicator and automatic retries if your data connectivity drops off (76765, 79307).

For content creators uploading media, this update means better support for HDR images,  faster, more reliable uploads, broader format support, and better-optimized files without manual intervention.

Plugin developers should note that some server-side hooks, including `wp_generate_attachment_metadata`, `image_resize_dimensions`, and `wp_handle_upload` may not fire as before. The team is working on documentation and mitigation strategies. (74333)

More in-depth information is available in the Dev Note Client-Side Media Processing in WordPress 7.1

Icons now inherit color, and the Icons API takes shape

[theme builder][plugin author][developer][enterprise]

WordPress 7.0 shipped a built-in set of SVG icons for the block editor and the Icon block. With WordPress 7.1, this grows into a proper, public API: plugins and themes can register their own icons, group them into collections, render them on the server, and read them over the REST API.

For content creators, the most visible change is the Icon block’s picker: it now groups icons by collection, with a tab per collection plus an “All” tab, and your search query carries over as you switch tabs. Custom icons from plugins and themes appear right alongside the core set. The block itself picked up several refinements: it inserts a default icon so you’re never staring at an empty placeholder, offers flip and rotate controls in the toolbar, and shows text and background color controls by default.

For developers: Registering more collections

For developers, the pieces come together on the PHP side: register a collection with wp_register_icon_collection(), add icons with wp_register_icon() — from an inline SVG string or an .svg file — and print any registered icon with wp_get_icon(), including size, CSS class, and an accessible label. Icon names get strict validation, the registry’s register method is now public, and REST API endpoints expose collections and icons to your own code. A dev note with full code examples is on its way to the Make Core blog.

One breaking change to flag: all 330 icons in @wordpress/icons v15 now declare fill="currentColor", so icons inherit the surrounding text color by default. If you’ve been tinting icons with the CSS fill property, switch to color — it’s more reliable, since an icon may use fill, stroke, or both internally. If you register your own icons, add fill=”currentColor” to their <svg> element to get the same behavior.

The Dev Note Registering and rendering SVG icons in WordPress 7.1 holds all the details. 

Tracking: SVG Icon API: Iteration for WordPress 7.1 (#75715)

Admin Bar everywhere 

[all]

With WordPress 7.1, the WordPress admin bar which sits at the top of your site’s front end and other admin pages is now displayed when using block editor by default. It stays hidden when Fullscreen mode and Distraction-free mode are both turned on. 

Until now, entering the editor in its default fullscreen mode meant the admin bar disappeared, cutting you off from the rest of wp-admin. Since the admin bar now provides site context, the update also replaces the top-left W/site icon in the site editor with an explicit back button, making the navigation control more obvious (79197). 

With this update also comes a design refresh: 

  • your site icon replaces the home icon, 
  • the profile avatar becomes circular, and 
  • the command palette keyboard shortcut moves into the Admin bar to remove visual clutter and resolve shortcut conflicts. (79060

This keeps the familiar navigation with you on all screens again. 

Dev Notes with all the details for users and developer can be found here: Consistent navigation in WordPress 7.1 with persistent toolbar.

New Blocks

[all]

This release expands the block library with versatile new tools. These additions provide content creators with improved ways to display interactive media and organize information.

Playlist block

The new Playlist block lets you create audio playlists with waveform visualization, making it easy to showcase multiple tracks or podcast episodes in a single interactive player. Visitors can browse and play through your audio content without leaving the page. For content creators this provides a rich, modern listening experience built right into WordPress to highlight podcast episodes, track of music or talks. 

Each track comes with its metadata: artwork, artist name, track number, and track length. The tracklist itself is configurable — you can set the play order and toggle artwork, artist names, track numbers, and track length individually to suit the design of your page.

The WaveformPlayer visualization comes with a visualization style selector. You can set waveform and waveform background colors for more granular theming and show the track artwork on the play button, accessible for all visitors. The Playlist and Playlist Track blocks are available in the default block library.

This is the first version and contributors are working on improvements for the next WordPress version, too looking to add more waveform styles, shuffle and skip buttons, a hover overlay for more intuitive track scrubbing, as well as performance improvements.

Tracking: Playlist Block: Iteration issue for 7.1 (#77421)

Tabs block

The new Tabs block organizes content into separate tabbed panels that visitors click through to navigate. It’s a design pattern that presents information compactly without overwhelming readers with a wall of text. It’s a common layout for FAQs, product features, or any content where you want to show options side-by-side. For editors, it’s a familiar, flexible layout pattern now available natively in WordPress.

The block family consists of a Tab List for the navigation and Tab Panels for the content. Each panel accepts any blocks you like, and the tab buttons come with their own color, typography, border, and spacing controls, so the navigation can be styled to match your theme. Using the toolbar buttons you can reorder the tabs quickly. 

Under the hood, the markup and keyboard behavior follow the best practices set out in the tabs pattern from the W3C ARIA Authoring Practices Guide.

Tracking: Stabilize Tabs Blocks (#73230)

Improved Blocks and Block handling

Core blocks receive numerous quality-of-life improvements in 7.1. These updates refine existing editing workflows, simplify media handling, and provide deeper customization for layouts and design.

Block transforms: preview first, convert faster

[end user][site admin]

Switching a block’s look or type is now much easier to evaluate before you commit. When you open the block switcher in the toolbar, the style options a theme provides — say, a Button’s “Outline” style — show live previews on hover, so you see exactly how your block will look with the style applied. (75889) The same previews in the inspector’s Styles panel now match the toolbar presentation, so it no longer matters where you make the switch. (75989) A small polish fix also centers the Navigation block’s preview in its preview pane. (75741)

Transforms got more capable, too: a block can now transform directly into a variation of another block. Instead of converting to a Group and then picking Row afterwards, the transform menu offers Row or Stack as direct targets — one step instead of two. (78713)

The same “one step instead of two” thinking extends to legacy content. Pasting or converting an shortcode now creates a proper Embed block instead of leaving raw shortcode text behind, so embeds from YouTube and other services display correctly right away (77937)— and if you change your mind, undo restores a paragraph with the URL rather than deleting it. (77551).

The Shortcode block joins in as well: when its content matches a registered shortcode, it now offers block-specific transforms to convert it into the equivalent block. (77944)

For anyone maintaining a site with years of shortcode-based posts, that removes a tedious cleanup step on the way to block-based editing.

Combine gradient and image backgrounds

[end user] [theme builder][site admin]

More blocks now support background gradients through the new background.gradient block support, which layers a gradient on top of a background image instead of one overwriting the other — a translucent color wash over a photo, for instance, without custom CSS.

Previously, gradients lived only in the Color panel, stored as a CSS background shorthand that clashed with any image on the block. The new support adds a Gradient control to the Background panel next to the existing Image control, and the style engine combines both into a single layered background-image value on individual blocks, in Global Styles, and via theme.json. A follow-up allows modern color functions in standalone gradients, and the text and background color controls moved to the Typography and Background panels to match.

To place the two color settings for background and gradients in the sidebar together, the controls needed to be split up from the text color. So now the color settings for text color and background colore are in two different panels.

WordPress 7.1 ships with six blocks supporting the new gradients: Group, Verse, Accordion, Pullquote, Post Content, and Quote. More will follow, with a long-term plan to migrate the older color.gradient to the new system across all blocks. There’s no built-in migration path in 7.1 yet.

For extenders, opting in follows the familiar block supports pattern. Custom blocks declare it in their block.json:

JSON
"supports": {
	"background": {
		"gradient": true
	}
}

Themes control the setting via theme.json under settings.background.gradient (it’s also included in appearanceTools), and can define gradient values in styles — at the root, per block, or in style variations:

JSON
{
	"styles": {
		"background": {
			"gradient": "linear-gradient( 135deg, #000 0%, #fff 100% )"
		},
		"blocks": {
			"core/group": {
				"background": {
					"gradient": "var:preset|gradient|vivid-cyan-blue"
				}
			}
		}
	}
}

All the salient details in this Dev Note New Block Support in WordPress 7.1: Background Gradient (background.gradient)

Cover Block: control video embed providers

[theme builder][plugin author][enterprise][developer]

Besides gaining the new media editor modal for background images, the Cover block addresses a request from community feedback. When the block’s “Embed video from URL” feature shipped in WordPress 7.0, site builders asked for a way to curate or disable it. WordPress 7.1 adds a new allowedVideoProviders attribute to restrict which video providers are offered, or to remove the URL-embed option entirely by allowing none (#80092). Existing embeds keep working; only new URL input in the editor is restricted. 

The details are already reflected in the Cover block’s documentation.

Gallery and the attached images workflow in the Media Library

[end user][site admin]

Images you upload while writing a post have always been “attached” to that post. This specifically true for older sites, pre-Block editor. Attached images where no accessible as an cluster and need to be added the block editor canvas one at a time. WordPress 7.1 finally puts that relationship to work in the editor, via an additional filter drop-down item Uploaded to this post in the Media Library Inserter modal. Photos and other media you’ve uploaded stay within reach for reuse instead of disappearing into the media library. 

The Gallery block is the showcase: instead of hand-picking every image, a single Use attached images button populates a dynamic gallery from all media attached to the current post (#78796). For content creators, this makes assembling image galleries faster and more flexible. It also helps reorganize image on older posts. The Source panel provides options for sorting the images. This brings the block editor handling of Galleries up to par with some features of the [ gallery ] shortcode.

To have entire freedom to control the Gallery block, the Detach feature comes in handy. A Detach button in the toolbar and in the sidebar’s Source panel, makes out a stand-alone Gallery without the dynamic connetion to the post’s image. Using it help user to edit/upate the gallery block. 

Below video visualizes the connection between a list of image attached to a post from the Media Library and the gallery block with the new feature. 

Tracking: WordPress 7.1: dynamic galleries and post-attached media iteration issue (#77117)

It’s a step back toward the simplicity of dropping photos into a post and having WordPress do the arranging. It’s the first visible piece of a larger effort around dynamic galleries and post-attached media, with dynamic queries by date and eventually categories or tags ahead.

Image Block: Mark as decorative toggle

[end user][site admin]

Screen readers announce every image to their users — but some images, like dividers and design flourishes, carry no information worth announcing. The Image block’s new “Mark as decorative” checkbox tells assistive technologies to skip such an image entirely on the front end, by rendering it with role=”none” in the published post. It now eliminates the question, did we forget an alt=text or was it a deliberate decision to leave the alt-text empty?

There is further processing to come with the checked box. Marking an image decorative clears its alt text and disables captions and links, since an image that links somewhere or explains something isn’t decorative by definition. Until now, the accessible route was knowing the empty-alt-text convention; the checkbox makes the intent explicit, machine-readable, and available to every content creator. (78064)

Login/out Block Improvements

[theme builder][site admin][developer]

The Login/Logout block has an option to display a full login form instead of a simple link — but until now, that form’s submit button ignored your theme entirely, rendering with plain browser-default styles that stuck out next to every other button on the site. With a block theme active, the submit button now carries the standard button classes (wp-block-button__link and wp-element-button), so it automatically picks up the button styling your theme defines in theme.json — colors, border radius, and all — with no custom CSS required. The block follows the same approach the Comments form already uses, resolving a mismatch first reported back in 2023. (76746)

Navigation Block and Link Creation

[theme builder] [site admin][end user]

The Navigation block picks up several improvements that give site builders more freedom in what a menu can contain and where it can be edited. The Login/Logout block can now be nested inside submenus (#75497), handy for tucking account actions into a “My Account” dropdown instead of spending a top-level slot on them. New links can be created directly from the sidebar List View in the Site Editor (#75918), so building out a menu no longer requires clicking into each item on the canvas. And the Home Link block gains previously missing controls (#76672), bringing it up to par with its navigation siblings.

One behavior change to note for theme builders: the Navigation block no longer force-propagates its font size down to individual menu items (#77419). Until now, every navigation link, submenu, and page list item received the parent’s font-size markup — and because relative units multiply, nested dropdowns compounded dramatically (1.5em became 2.25em, then 3.375em).

The block now relies on standard CSS inheritance instead, which also fixes mismatched typography between the editor canvas and the front end. Most themes need no changes, but themes that target has-{slug}-font-size classes directly on nav items should check their menus — the Miscellaneous Editor Changes dev note includes a filter to restore the old markup if needed.

Search block Styling

[theme builder] [site admin][end user]

A styling gap is closed in the release for the Search block: color settings now apply to the search input field even when the search button is disabled (77219), so your search boxes match your design system regardless of which display options you choose.

The block also embraces modern HTML: it can now render inside the native <search> landmark element, which carries search semantics for browsers and assistive technologies without the manual role=”search” attribute. Because dropping that attribute could break existing theme CSS, the feature is opt-in — per block via a new HTML element selector in the Advanced panel, or site-wide with add_theme_support( ‘search-element’ ) (#78485). Default output is unchanged, with a path to making the modern markup the default in a future release.(78485)

Query block

[theme builder] [site admin][end user]

The Query block received an additional filter to control the list of blocks: You can now exclude the current post from a list of posts. This is useful when you want to add a list of posts with related posts. (64916).

General quality of life improvements. 

Pattern editing experience improvements

[theme builder] [site admin] [developer]

WordPress 7.0 shifted pattern editing to focus on content changes rather than exposing every tool, treating patterns more like single blocks. In 7.1, work focuses on UX refinements based on feedback, bug fixes, and general maintenance. For users inserting and customizing patterns, this means a more polished, predictable experience with fewer rough edges.

Tracking: WordPress 7.1: Pattern Editing Iteration (#75717)

  • Pattern Editing and Block Fields: Highlight selected block (74841)
  • Pattern editing: show root block identity when editing pattern sections #79417 

 Block Width and Layout Controls

[theme builder] [site admin] [developer]

Refines spacing and layout tools to be more intuitive. The Columns block no longer shows a confusing ‘Skip’ option in its layout picker, the Button block now uses the standard width control system, and spacing controls display in a more logical order when unlinked. These changes remove friction points that tripped up editors when building complex layouts.

  • Button: Migrate to width block support #74242 
  • Columns: Remove redundant Skip option from layout picker #78405 
  • Re-order spacing side controls when unlinked #66317 

Link Control and Preview Enhancements

[theme builder] [site admin] [developer]

When linking to pages or posts, the link picker now shows ‘Homepage’ instead of just ‘Page’ for your site’s front page, and uses the actual entity link title for previews. These small improvements make link creation feel smarter and help editors understand exactly what they’re linking to before publishing.

  • Use entity link title for link control preview #77155 
  • Link Picker: Use Homepage badge instead of Page if Homepage #75929 

Additional CSS Validation

[theme builder] [site admin] [developer][end user]

Additional CSS is now validated both on mount and via a new dimension validation endpoint for sideloaded styles. These checks prevent malformed or insecure CSS from breaking your site’s appearance or introducing security risks, giving you more confidence when adding custom styles.

  • Validate additional CSS on mount #78682 
  • Add dimension validation to sideload endpoint #74903 

Block Editor Attribute Handling

[theme builder][developer]

The block editor now correctly targets the right block when copying direct insert block attributes, fixing edge cases where attributes would apply to the wrong block. This fix ensures that copy-paste and duplication workflows behave as expected.

  • Block Editor: Fix target block for copying direct insert block attributes #77877 
  • Block Editor: Allow overriding `disableContentOnlyForTemplateParts` setting #79191 

Image handling improved

[end user][site admin]

A set of small fixes makes working with images more predictable. If an image points to a media library item that has since been deleted, the editor no longer treats it as a local attachment, preventing confusing errors. The crop button only appears when cropping is actually available for your user role and image type, so you’re never offered a tool that can’t work. 

And the featured image field now shows placeholder text making clear at a glance what goes there.

  • Image block: Validate attachment ID exists before treating image as local #77178
  • Image/Site Logo: hide crop toolbar when editMediaEntity is unavailable #76626
  • Set placeholder to featured image field #76342

Post Template Layout Improvements

[theme builder][site admin]

Ensures the Post Template block’s fallback styles only apply when appropriate, preventing layout conflicts when custom minimum column widths are defined. This fix gives editors more predictable control over query loop layouts without unexpected style overrides.

  • Ensure Post Template fallback styles don’t apply when minimumColumnWidth is defined #77411 

Post Title Block Enhancements

[site admin][end user]

The Title block gains a placeholder attribute, letting you show helpful text when no title has been entered yet. This small addition improves the editing experience for custom post types and guides content creators to fill in required fields.

  • Post Title: Add placeholder attribute #7601 v22.7.0

Block Inserter Enhancements

[site admin][end user]

Makes discovering and adding blocks easier with visual polish to the inserter interface. The search input now stays visible while scrolling through block options, and the inserter button animates to clearly signal when the panel is open. These small touches reduce friction when building pages and help editors stay oriented while exploring block options.

  • Block Inserter: Animate inserter button icon to signal open state. #78306 
  • Make Block Inserter search input sticky while scrolling #77698

Editor enhancements

Beyond the block improvements, the editing experience itself picks up refinements across the board. Notes mature into a fuller commenting workflow. Visual revisions gain a more detailed timeline. And your site’s brand identity gets a dedicated home in the Site Editor.

A Dev Note provides a list of miscellaneous Editor changes.

Notes move toward a full commenting workflow

[end user][site admin][developer][enterprise]

Notes, the inline editorial comments right in the editor, continue to mature, with several additions in this release that make asynchronous collaboration richer and easier to act on without leaving WordPress.

The headline feature: inline notes. You can now attach a note to a specific text selection rather than to a whole block. Select part of a paragraph, add a note, and the highlight stays anchored to that text as you keep editing around it. A single block can carry multiple inline notes, sorted by the order they appear, and none of the highlighting shows up in the published post. Also, blocks are no longer limited to a single conversation, either — you can start multiple note threads on the same block.

The conversations themselves got more expressive, too. Notes now support rich text formatting — bold, italic, links, and code. @mention autocomplete makes it quick to pull a colleague into a thread. Longer notes collapse behind a “Show more” toggle, and a “Resolved” divider in the sidebar separates finished discussions from open ones, so it’s easy to see what still needs attention.

Tracking: Notes iteration for WordPress 7.1 (#76316)

Dedicated Identity section

[site admin][theme builder][end user]

A new Appearance > Editor > Identity screen consolidates your site’s logo, favicon, title, and tagline into one easy-to-find location, with inline editing so you can crop and adjust images right there. This eliminates hunting through Settings or digging into templates just to update foundational branding. For new site builders especially, it makes setting up your site’s identity quick and straightforward. Existing site owners have an intuitive place to update the data.  (76264, 76116)

Visual revisions improvements

[site admin][end user][theme builder]

Building on the visual revisions introduced in 7.0, the revisions screen gains a paginated timeline in the inspector with more detailed information about each revision, making it easier to understand what changed as you scrub through versions. (77333)

Changes  made via autosave are now labeled in the revisions timeline and make the autosave notice work with the visual revisions UI.(79950, 79947)

Apply Globally now with review panel

The block inspector’s Apply globally action which has been a one button push of the block’s local style changes to Global Styles, has received an upgrade in WordPress 7.1 so designer can have a more granular control, on which part of the styles will make it into the global styles.

The button now opens a review modal instead, listing each modified style with its current and new value. All changes come pre-selected; deselect any you want to keep as local overrides, and only the checked styles are applied. Undo still restores the previous state in one step. What was a somewhat risky action is now a deliberate choice. You see exactly what will change across your site before committing. (#79839)

Admin / Workflow updates

Updates to admin and workflow tools in 7.1 improve navigation, content management, and site administration. These changes are designed to reduce friction and help you work more efficiently within the WordPress dashboard.

Organized command palette

[all]

The command palette, the quick-access menu you open with keyboard shortcuts,  now groups results into recent, suggested, and matching sections, and remembers your recently-used commands across sessions. The visual design has also been refreshed to make scanning results easier. This helps you navigate WordPress faster by surfacing the tools you use most often right at the top. (75691)

Change a comment’s parent from the Edit Comment screen

[end user][site admin][enterprise]

Ever needed to fix a comment that landed in the wrong thread? The Edit Comment screen now has an “In reply to” control in the Save box — hit Edit and you get a dropdown of the post’s other comments, listed by the author with a short excerpt. Top-level comments just show “None.”

You can’t create broken threads with it: the dropdown hides the comment itself and anything nested under it, and the server double-checks on save — the new parent has to be on the same post and can’t be the comment or one of its own replies (anything invalid gets bounced with a WP_Error). If the current parent wouldn’t normally show up in the list (a pingback, say), it’s kept in there as the selected option, so saving without touching the field changes nothing. Works without JavaScript too, and there are tests covering the validation. (65570)

See an excerpt of posts without titles

[end user][site admin]

If you publish posts without titles for instance for quick status-style updates, the Posts list has been pretty useless for telling them apart: just a column of identical “(no title)” links. 

Now, in Compact view, untitled posts show the first 15 words of the excerpt right after “(no title)”, so you can actually see what each post is at a glance. 

The checkbox’s screen-reader label gets the same text, password-protected posts keep their content hidden, and the Extended view is unchanged since it already shows excerpts.(65022).

Media Library: infinite scrolling is back on by default, with a per-user opt-out

[end user][site admin]

The Media Library grid now uses infinite scrolling by default, so attachments load continuously as you scroll instead of behind a “Load more” button. For anyone who prefers the previous behavior, there’s a new personal option: a “Disable infinite scrolling in the Media Library grid view” checkbox on the profile screen. The setting only appears for users who can actually upload files, since others never see the attachment grid.

For developers, the existing media_library_infinite_scrolling filter still works and now takes top precedence: a hooked filter always wins, followed by the user’s profile preference, with infinite scrolling enabled when neither is set. Note the filter’s default value has flipped from false to true as of 7.1.0, so any code relying on the old default should be reviewed. The change ships with unit tests covering the new user option and the full precedence chain (65564).

Read the Dev note: Media Library infinite scrolling is now enabled by default, with a per-user opt-out.

Hosts can now tune speculative loading defaults

Since WordPress 6.8, speculative loading lets browsers prefetch or prerender pages a visitor is likely to open next, making navigation feel near-instant. WordPress ships with deliberately cautious defaults — and until now, changing them required an mu-plugin. With WordPress 7.1, hosting providers and site owners can adjust the default mode and eagerness through environment variables or wp-config.php constants. A well-configured host with page and object caching in place can opt its sites into more aggressive speculation and pass the speed gains on to visitors. The real-world data hosts gather this way will also help inform whether core changes the defaults for everyone in a future release. The technical details are available in the core ticket (#65624).

Developer Goodies 

[developer][theme builder][plugin author][enterprise]

WordPress 7.1 provides developers with expanded APIs, theme.json capabilities, and system improvements. These tools offer greater control over site design, block behavior, and system integrations.

Post editor iframe now always on

Other editors in WordPress—the site editor, the template editor, and block, template, and device previews—have been unconditionally iframed for a long time, going back to the template editor’s introduction in 5.8. The post editor was the holdout: starting in 7.0, whether it ran isolated depended on the blocks actually present in a given post, so a post using only Block API v3+ blocks got the isolated canvas, while a post containing even one older block (API v1 or v2) dropped out of it entirely. That meant the same site, even the same author, could see the editor behave differently from post to post. In 7.1, that condition is removed: every post editor is always iframed, regardless of theme type or block API version.

For most people writing and editing content, this is good news—no more switching behavior depending on which blocks happen to be inserted. Block developers have a bit of homework, though: the iframe has its own document and window, separate from the admin page where editor scripts run, so any code that reaches for the global document or window to touch the canvas will now be looking at the wrong place. The usual fix is to get the canvas’s document from an element inside it (via ownerDocument and its defaultView) rather than the global object, and to use useRefEffect for attaching and cleaning up canvas event listeners.

Read the dev note on the 7.1 changes and the block migration guide for more details.

Ryan Welcher published a guide and a demo plugin. The post editor is going full iframe: what block developers need to know before WordPress 7.1 with code examples and instructions how to fix things if necessary. 

Abilities API opens up its execution pipeline

The Abilities API arrived in WordPress 6.9, and 7.1 gives extenders real control over it. Four new lifecycle filters let plugins step into ability execution — short-circuit it entirely (think caching, rate limiting, or maintenance mode), transform input, layer on extra authorization rules, or reshape and even recover results. Two more filters add custom input and output validation on top of JSON Schema, and a new wp_ability_invoked action fires on every invocation — even failed ones — handy for logging and auditing. The core info abilities return more user details, input over the REST API now arrives properly typed, and wp_prepare_json_schema_for_client() strips PHP callbacks and WordPress-only conventions before a schema goes out to REST clients, MCP integrations, or AI tools.

A new public metadata flag rounds it out: declare once that an ability is meant for external clients, and REST, MCP adapters, and future integrations use it as their default — with channel-specific flags still able to override, and permission callbacks still guarding actual execution.

Finding the right abilities gets easier too: wp_get_abilities() now accepts arguments to filter registered abilities by category, namespace, or meta — with the same filtering available on the REST endpoint.

Details and code examples in these dev notes:

Global Styles and theme.json 

Text Shadow support for theme.json

Theme authors can now define text shadows directly in theme.json via a new textShadow property under styles.typography. It works everywhere you’d expect: at the root level, per-block (say, a shadow on paragraphs only), via style variations, and on elements — including pseudo-selectors like a link’s :hover state. Any valid CSS text-shadow value is accepted, including stacked multi-shadow definitions. Block placeholder text in the editor resets the shadow so it stays readable regardless of what the theme sets.

JSON
"styles": {
		"typography": {
			"textShadow": "1px 1px 2px red, 0 0 1em blue, 0 0 0.2em blue;"
		},
		"blocks": {
			"core/paragraph": {
				"typography": {
					"textShadow": "1px 1px 2px red, 0 0 1em red, 0 0 0.2em red;"
				}
			}
		},
		"elements": {
			"link": {
				":hover": {
					"typography": {
						"textShadow": "none"

More details in the Dev Note: Text Shadow Support in Global Styles

Text-Align Block Support Migration

Nine more core blocks (Post Date, Post Excerpt, Post Navigation Link, Post Title, Query Title, Site Tagline, Site Title, Pullquote and Term Name) now use WordPress’s standardized text-align system. As part of a larger migration effort this update ensures consistent alignment controls across the editor and makes these blocks behave predictably alongside newer blocks. 

WordPress EndUser are not supposed to see any changes and existing blocks continue to work. Theme designers are now able to style any of these blocks text align via theme.json property. The code example shows how to set the center as the site-wide TextAlign default. And `”textAlign”: false` disables the feature for this block 

JSON
{
	"version": 3,
	"styles": {
		"blocks": {
			"core/pullquote": {
				"typography": {
					"textAlign": "center"
				}
			}
		}
	}
}

Block Visibility

Adds settings.blockVisibility.allowEditing to theme.json, allowing themes to disable the block visibility feature entirely.

JSON
{
  "settings": {
    "blockVisibility": {
      "allowEditing": false
    }
  }
}

When set to false, the toolbar button and block options menu item are hidden. In this regard, it makes this block support consistent with color, typography etc.

blockVisibility.allowEditing follows the layout flag. The reason is the two-fold nature of blockVisibility at the block supports level: a bool means don’t render the block at all, but viewport settings allow users to control visibility per viewport.

The object shape also leaves the door open to extending block visibility to triggers, not only blockVisibility.viewports but others like post type or whatever. (76559).

Block Supports: CSS variables by feature selector

Block Supports now generates CSS custom properties based on a block’s feature-specific selectors, not just its root selector. Some blocks—the Button block is the example given—define their outer wrapper and an inner styling target as different elements, and previously there was no way to output a preset variable (like a dimension size) onto that inner element specifically. Theme and plugin authors building design systems now have a way to target the right element per feature, without needing custom CSS to work around the mismatch.

A minimum-width option for block dimensions

Blocks already supported height, minHeight, and width. What was missing was a way to stop something from shrinking too far—so a layout element wouldn’t collapse into an unusable sliver on a narrow screen. Minimum-width closes that gap, mirroring how minimum-height already works.

It’s opt-in at the block level: the control stays hidden in the inspector until a block explicitly enables it, though it shows by default in the global styles panel. Theme-defined dimension presets carry over automatically, so existing spacing scales just work. The Group block is the first to adopt it.

You’ll find more details in the Dev Note New Block Support in WordPress 7.1: Minimum Width

Design System Theme Provider 

The first version of the design system’s theme component arrives in WordPress 7.1. It consists of standardized CSS custom properties that follow the W3C Design Tokens specification. You probably won’t spot the difference right away — the default theme was deliberately built to match existing styles — but this is the machinery that will power the admin color scheme in the Site Editor. You can read more details on the future direction in the Merge Proposal: Design System Theming 

The Dev Note has more: Design System Theming in WordPress 7.1

Admin color schemes in Site Editor

The Site Editor’s sidebar and interface now respect your chosen WordPress admin color scheme instead of always showing a dark background. This brings visual consistency across the post editor, Site Editor, and admin dashboard. If you’ve personalized WordPress with a color scheme you prefer, that choice now carries through everywhere you work. 78397

Mix static HTML with editable blocks

A new innerContent block support lets a block keep static HTML fragments interleaved with editable inner blocks as the canonical source of its own markup. In practice, this means a hand-written HTML structure can have just a piece of it—a paragraph, an image—editable in place, while the rest stays fixed and can’t be moved, removed, or rearranged.

The Custom HTML block is the first adopter: pasting HTML with a block comment delimiter embedded in it (for example, a <!– wp:paragraph –> block inside a larger static <div>) makes that inner piece editable directly in the canvas, while the surrounding markup remains locked in place. It’s a narrow, developer-facing capability for now—the HTML block is the only place it’s wired up—but it opens the door for custom blocks to offer the same kind of “mostly static, partly editable” experience going forward. (79115)

The dev note can be found on the Make Core Blog: Editable blocks inside the Custom HTML block 

Block Bindings for list-items and inner blocks

The List Item block has gained Block Bindings support. A List Item’s content can now be connected to a data source—a custom field, a pattern override, or another registered source—so individual entries in a list can be populated dynamically rather than typed in by hand. The change registers content as a bindable attribute for core/list-item.

A related fix rounds out the feature: previously, if a bound List Item also contained a nested sub-list, that nested list was dropped when the binding was rendered. Now a List Item can carry a bound value and a nested list beneath it at the same time. In practice, this means multi-level lists—say, a team member’s name pulled from a custom field, with a nested list of their current projects underneath—can now be fully dynamic without losing structure.

Tracking: Block Bindings in WordPress 7.1 (#77199)

Connectors authentication improvements

The Connectors framework, which manages WordPress’s connections to external services like AI providers, now supports username and application password authentication as an alternative to API keys. A merged pull request adds a default connector form for this method, along with the underlying authentication type, mirroring the equivalent API already available in WordPress Core.

The change also handles the practical details: saved passwords are masked in the UI and over REST, credentials can be set via constants or environment variables instead of the database, and a companion Core patch keeps the two in sync. For connectors that require an account login rather than a bare API key, this removes the need for a custom settings screen.

This lands alongside a broader open proposal for a PHP-side field registry that would let connector authors declare arbitrary settings—model choice, temperature, custom URLs, and more—the way register_setting() works elsewhere in WordPress. That registry isn’t built yet; the application password work is a first, concrete step (new auth method, not new field types), addressing one of the two gaps the proposal identified rather than the full vision.

Tracking: Connectors: proposal for a PHP-side field registry for connector configuration (#78647)

Blocks package stabilizes two experimental functions

The Blocks package stabilizes cloneSanitizedBlock and sanitizeBlockAttributes, dropping their __experimental prefixes now that the functions have been stable in practice for some time. The old __experimental-prefixed names still work but will log a deprecation notice, so plugins or themes importing them directly should switch to the new names.

Post author notifications: the filter decides

The notify_post_author filter now has the final say: approval status is checked before the filter runs, so it receives an accurate default and returning true reliably sends a notification — even for unapproved comments. Sites forcing notifications with __return_true should switch to a callback that checks approval, or they’ll start receiving emails for spam and moderated comments. (#64217). More Details can be found in the Dev note The notify_post_author filter now has the final say on post author notifications

Accessible tooltips and toggle tips API

WordPress adds a core mechanism for accessible tooltips (51006), offering an alternative to the title attribute, which is not available to keyboard and touch users. Two new functions cover different use cases: wp_get_tooltip() exposes an accessible name when a control has focus or hover, such as for icon-only buttons, and wp_get_toggletip() implements a popover disclosure with extended help information that stays open until dismissed. Both generate accessible markup that avoids excess verbosity for screen readers and follows best practices for voice command users.

The first toggle tip in core explains the “Remember Me” option on the login screen (55343). Plugin developers can use the functions for their own settings screens and metaboxes. (62741).

Dev Note is now available with the details: Introducing name and informational tool tips in WordPress 7.1

Filtering Site Editor screens

Plugin developers can now configure the Site Editor’s Pages, Templates, Template Parts, and Patterns screens through four new PHP filters — one per screen. Each filter adjusts the DataViews and DataForm components powering these screens: the default view (layout, sort order, visible fields), the layouts available to users, the preconfigured views in the sidebar such as “All” or “Drafts,” and the fields shown in the Quick Edit form.

This creates a single place of configuration per entity, with more screens — including the editor inspector — planned to draw from the same source in future releases (#76544). Code examples are in the Dev Note: Filtering Site Editor Screens in WordPress 7.1.

Post list table markup changed for accessibility

An eleven-year-old accessibility ticket is resolved: in post list tables, the row header (th scope="row") moves from the checkbox column to the title column, so screen readers identify each row by the post’s name rather than by a checkbox that may not even be present. (#32892).

Extenders should check their CSS and JavaScript: selectors like th.check-column or ones expecting the title and row actions inside a td need updating. The dev note Post list tables row headers changed lists the affected patterns, and keeping both td and th selectors preserves compatibility with older WordPress versions.


A list of all the dev notes can be reviewed from the Make Core blog

💾

💾

💾

💾

💾

💾

💾

WooCommerce 11.0.1 Release Notes

Dot Release

WooCommerce 11.0.1 is available now

This dot release is now available for download. Review the fixes below.

Updates

  • Increased compatibility for the upcoming WordPress 7.1 release
  • Performance and security improvements
  • Released: August 10, 2026
  • Security update: Yes
  • Database update: No

What’s in this release

Admin settings initialize consistently across WooCommerce admin pages. This fixes a Payments settings bug that could show a false business-location mismatch warning for stores outside the United States. (#67532)

Password protection covers product short descriptions across embeds, Product Summary blocks, and block-based single-product templates. Shoppers must enter the product password before these summaries appear. (#67557)

Store API payments for existing orders enforce each coupon usage limits correctly. (#67549)

Store API cart tokens are read from one request source and validated before a customer session loads. A PHP_CodeSniffer rule catches direct token reads in future Store API code. (#67550)

Guest session cookies now use a stronger, salted hashing scheme. Legacy cookies remain valid until they expire so guest carts survive the upgrade. (#67408)

Single dismissible notices in Cart and Checkout blocks are sanitized before rendering. Entity-encoded HTML in Store API error messages is displayed as safe content instead of executable markup. (#67476)

The [woocommerce_review_order] shortcode renders only on WooCommerce’s managed review-order page with a matching order key. Requests from other pages or with the wrong key return no order content. (#67552)

External product button labels pass through text sanitization when submitted to REST API versions 1 through 4, and the Product Button block escapes labels on output. (#67558)

Automatic featured-image matching by SKU requires the current user to have the edit_product capability for the matched product. An image upload cannot change a product the user lacks permission to edit. (#67530)

Activating a Marketplace subscription requires activate_plugins for plugins or switch_themes for themes. The endpoint also rejects unsupported product types. (#67567)

The onboarding theme-installation endpoint checks the WordPress install_themes capability. Users without that permission cannot install a theme through onboarding. (#67533)

Analytics CSV exports validate report_args against the selected report’s REST schema. Unsupported orderby values are rejected whether an export is queued through REST or directly in PHP. (#67551)

Analytics order reports accept only recognized date columns from the woocommerce_date_type option or a date_type query argument. Unknown stored values fall back to date_paid, while unknown per-request values fall back to date_created. (#67554)

Writing a log no longer requires scanning the entire wc-logs directory, reducing checkout latency on stores with large log backlogs. Cleanup processes bounded batches until the backlog is empty, and the woocommerce_order_step_logging_enabled filter lets developers disable place-order debug logging without changing the site-wide threshold. (#67410)

The Orders list is compatible with WordPress 7.1’s updated list-table markup. Checkbox interactions and responsive layouts work correctly with both the old and new primary-cell markup. (#67364)

The product-review list-table test accepts both the older check-column markup and the markup introduced in WordPress 7.1. This keeps pre-release CI compatible with both versions without changing runtime behavior. (#67517)

The Add Product screen’s JavaScript-count test accounts for the wp-tooltip and wp-sync scripts added in WordPress 7.1. This test-only change does not affect runtime behavior. (#67473)

The post WooCommerce 11.0.1 Release Notes appeared first on The WooCommerce Developer Blog.

WordPress 7.1 RC, 7.0.3 Security Release, Block Runner, New Playground UI and more — Weekend Edition 372

Hi there,

It was another busy release week: the WordPress 7.0.3 security update, WordPress 7.1 RC 1, and Gutenberg 23.7 all landed. More on each below — but before you keep reading, update all your sites to 7.0.3 now. This newsletter can wait… 😉


If you are traveling to Phoenix: safe travels, and pack a sweater — the AC will be cranked up high in every building! This year, I will see you on the WCUS Livestream.

Have a great weekend!

Yours, 💕
Birgit

Developing Gutenberg and WordPress

WordPress 7.0.3 shipped as a security release fixing twelve vulnerabilities, so update your sites right away if automatic background updates aren’t already handling it for you. Release lead John Blackbourn lists the fixes, including a pre-auth XSS on the login screen that could lead to PHP code execution, several contributor-level stored XSS issues, and a multisite privilege escalation. Backports reach all supported branches down to 4.7, and 7.1 RC2 carries the fixes too.

To appreciate the huge effort by the security team to get this release out, consider the numbers: until earlier this year, there were 20 to 30 reports per month; now that number has jumped to 450 per month. Both security updates, 7.0.2 and 7.0.3, were backported not only to the two officially supported versions, 6.9 and 7.0, but all the way back to version 4.7. That’s two dozen major versions that needed updating. See also Rae Morey’s story in The Repository: WordPress 7.0.3 Patches 12 Vulnerabilities as Bug Bounty Reports Climb to 450 a Month.


August 19 is the scheduled final release date, and Benjamin Zekavica announces WordPress 7.1 Release Candidate 1 ready for your test sites. Since Beta 4, more than 145 updates landed — 57 in the Editor, 88 in Core — plus new features like the Icons API, shareable revision links, and email notifications for @mentions in Notes. Plugin and theme authors: wrap up testing and bump your “Tested up to” to 7.1. WordPress Playground lets you try it straight in the browser.


Milana Cap counts more than 310 Core Trac tickets, twenty new hooks, and roughly 600 Gutenberg enhancements in the WordPress 7.1 Field Guide, your linked index of every dev note for the August 19 release. Highlights range from client-side media processing and the always-iframed post editor to the SVG Icon API, responsive block styles, and the persistent admin bar. A candid closing section covers what didn’t make it, from the Classic block’s reprieve to real-time collaboration and React 19.


The post editor is always iframed in WordPress 7.1, and the escape hatch that let one apiVersion 2 block pull a whole post out of the iframe disappears. That’s the compatibility risk topping the developer’s audit list for WordPress 7.1 by release coordinator Benjamin Zekavica. He sorts each section by risk level, walks through the SVG Icon API’s strict sanitizer, responsive block styles, and the new DataViews filters, and closes with a checklist for your August 19 release.

The Gallery block’s ambiguous “Convert to images” button becomes “Detach,” complete with a modal explaining what happens — one of many refinements Jonathan Bossenger walks through in what’s new in Gutenberg 23.7. You’ll also find the Global Styles inheritance UI now opt-in via the Experiments page, LaTeX errors in the Math block waiting until you leave the field, and fixes for floated blocks overlapping sticky ones and Pullquote line heights in the editor.

Plugins and Tools for #nocode site builders

Variable product pages load roughly 9 to 12 percent faster and large stores get snappier Order screens, Brent MacKinnon reports in what’s new in WooCommerce 11.0. Analytics also grows more trustworthy: refunds now count in the period they happened, session counts exclude bots, and you can rerun incomplete historical imports. Guest customers can claim past orders when they create an account, and a Checkout Recovery beta lets you test messaging before a full rollout.


Getting Site Editor changes out of the database and into version control has frustrated agency developers for years, and Brian Coords argues agents make it urgent again. His experimental agent-first approach to Create Block Theme, wp-theme-control, wraps the upcoming WP-CLI 3.0 wp block commands in bash scripts and an agent skill: a plan command lists database changes, then you dry-run, export them into your theme, and optionally clear the database copies. He’s collecting feedback ahead of his WordCamp US talk.


Clients pinning comments straight onto your live pages — no logins, no email chains, no PDF round-trips — is the pitch of Ben Elwood‘s Reviso client feedback and approvals plugin. Among other page builders it’s native to the block editor, with threaded replies, status tracking, and review links that work even in maintenance mode. Version 1.5.2 switches on Suggest mode by default, so reviewers propose wording changes like tracked changes and your team applies them with one click.


Bas Buis released Dynamic OSM Maps, a plugin that adds interactive maps without Google API keys or recurring fees. The lightweight block runs on OpenStreetMap and Leaflet: in the free version you enter addresses manually, while Pro connects your custom fields — coordinates, addresses, or repeaters — for unlimited markers and popups. That opens the door for directory and listing sites to render stored location data straight onto the map.


Emily Rapport opens with Dutch tulip mania to frame the rush of llms.txt files and AI-visibility subscriptions, then does something rarer: shares a year of her own content work with real Search Console data. Her rewritten maintenance page climbed from position 50 to 13 and collected exactly five clicks — yet three inquiries arrived saying “I asked ChatGPT.” Her takeaway: publishing consistently across real topics beats chasing one niche, and you still can’t reliably trace an AI recommendation to a page.

 “Keeping up with Gutenberg – Index 2026” 
A chronological list of the WordPress Make Blog posts from various teams involved in Gutenberg development: Design, Theme Review Team, Core Editor, Core JS, Core CSS, Test, and Meta team from Jan. 2024 on. Updated by yours truly. 

The previous years are also available:
2020 | 2021 | 2022 | 2023 | 2024 | 2025

Building Blocks and Tools

The WooCommerce Developer Blog follows up its All Products proof of concept with the why behind it. Veronica Fasulo and co-authors lay out the value of DataViews and who it’s for: you describe a field once and it powers the list column, Quick Edit, bulk edit, and forms, instead of four hand-wired implementations. Merchants get switchable views without page reloads, extension developers get registration instead of DOM patching — and the team openly asks whether DataViews is even the right foundation.

What’s new in Playground?

A customizable Dock, auto-save, and live visual previews of your saved instances headline the new WordPress Playground UI, which Fellyph Cintra demos on WordPress.tv. The video walks through importing projects from GitHub or Zip files, previewing Core and Gutenberg pull requests, and the built-in file editor, database manager, and error logs — plus switching WordPress versions all the way back to 0.7. Feedback goes to the Make Playground blog or the #playground Slack channel.

AI in WordPress

Vercel, a major platform shipped the Vercel AI Gateway Provider plugin, by former Core AI team rep Felix Arntz. One API key unlocks hundreds of models from over 40 providers. Any AI Client plugin on your site can route text, image, and video generation through the Gateway — including the Photo to Post demo from Jonathan Bossenger’s tutorial. Automatic fallbacks kick in during provider outages, and you pay provider rates without platform fees.


Your AI agent designs a beautiful page, and Gutenberg freezes it into one uneditable Custom HTML blob. Human Made’s answer is Block Runner, now open-sourced on GitHub: a deterministic Node CLI that converts generated HTML into properly nested native blocks — wp:cover, wp:columns, wp:buttons — with real attachment IDs, and validates every result against headless Gutenberg. In the team’s benchmark, raw models writing block markup score 35 to 73; paired with Block Runner, the same models hit 93 to 99.

Readers may remember Chris Huber’s Block Format Bridge from a few months back — it tackles the same gap from inside WordPress, converting Markdown and HTML server-side at insert time, while Block Runner works the pipeline side with its validation gate and CI hooks. Two open-source answers to the same question is a good sign the agentic content problem is getting real attention.

A third piece of the puzzle: the official WordPress agent-skills repository takes the prevention route, teaching AI coding assistants to write valid block markup in the first place. For a lighter-weight approach, you can also point your AI agent straight at the updated Core Blocks Reference, where each block’s page now documents its markup, attributes, supports, and allowed nesting.

Need a plugin .zip from Gutenberg’s master branch?
Gutenberg Times provides daily build for testing and review.

Now also available via WordPress Playground. There is no need for a test site locally or on a server. Have you been using it? Email me with your experience.


Questions? Suggestions? Ideas?
Don’t hesitate to send them via email or
send me a message on WordPress Slack or Twitter @bph.


For questions to be answered on the Gutenberg Changelog,
send them to changelog@gutenbergtimes.com


Featured Image:


#228 – Priscilla Collado Ramirez on Reducing WordPress Beginner Anxiety

Transcript

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the themes, the blocks, and in this case, reducing WordPress beginner anxiety in a multitude of ways.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Priscilla Collado Ramirez. Priscilla travelled 14 hours from Costa Rica to attend WordCamp Europe, making her one of the furthest attendees at the event, and for good reason. She’s an educator, fashion designer and wellness coach, and has a unique perspective on a challenge many in the WordPress community face, how overwhelming WordPress can be for beginners.

Having once quit WordPress 17 years ago, due to information overload, and a lack of community support, Priscilla’s story comes full circle, as she now dedicates herself to helping entrepreneurs and creatives find their way in the WordPress ecosystem. Her work focuses on demystifying those first confusing moments, offering practical steps, and much needed reassurance for anyone who’s ever opened a fresh install and wondered, what on earth do I do next?

The conversation is focused on why newcomers often feel stuck, paralysed by too many choices, the classic it depends advice, and a fear of breaking something or everything. We get into the importance of understanding individual learning styles, whether linear or spiral, as Priscilla labels them, and meeting students where they are, sometimes with literal breathing exercises and wellness techniques to lower stress and unlock real learning.

Priscilla explains how confidence in WordPress is built through action, and why celebrating small wins, like successfully installing a single plugin, is essential. She also shares her approach to bringing holistic, calm, and patient mentorship into WordPress education, something that’s as relevant for agency leads as it is for first time bloggers.

If you’ve ever felt overwhelmed by WordPress’ infinite possibilities, struggled to find your place in its community, or just want practical wisdom on making the path easier for beginners, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Priscilla Collado or Ramirez.

I am joined on the podcast by Priscilla Collado Ramirez. Although I know that’s not the correct way to say it, would you please say your name for me?

[00:03:44] Priscilla Collado Ramirez: It’s good, it’s good. I’m Priscilla Collado Ramirez, and I’m from Costa Rica.

[00:03:48] Nathan Wrigley: Well, I appreciate it. Thank you. You get the award without a doubt coming the furthest, I think, to WordCamp Europe this year. I don’t know how many miles it is, but you said, I think it was 13 hours.

[00:03:59] Priscilla Collado Ramirez: Yeah, 14 hours on the plane. Today is travelling. But it’s all worth it, because this country in Europe, it’s beautiful. So I can do it all the years, all the months. Yeah, I can do it.

[00:04:13] Nathan Wrigley: I have to ask though, why come all the way across, so many hours on a plane and what have you. Do you have a community where you are? Is there a thriving kind of Costa Rican WordPress scene? I don’t know anything about it.

[00:04:28] Priscilla Collado Ramirez: Okay. Yeah, in Costa Rica is a big community. It’s the biggest community in whole Latin America, in Costa Rica. I have a friend, she works for GreenGeeks web hosting, so she empowered me to do this. And the WordCamp Europe, because being a speaker is one of my dreams come true.

I already do it in my country, but I want to get more knowledge and know more people. And when she told me about this, I said, yeah, I can do it. Yeah, I want to do it.

[00:05:06] Nathan Wrigley: That is remarkable. A 13 hour plane journey. That’s pretty impressive. And I confess, I didn’t know that Costa Rica was sort of the place to be if you’re in South America. But now I do. Thank you. And I know that you’ve basically just come out of the presentation room, you’ve just finished the subject that you were talking about.

And the subject that you were talking about is really interesting to me at least, because this casts me back. I’ve been in the WordPress space since about, I don’t know, 2015, something like that. So I’ve got a few years under my belt.

But I do remember at the time when I began using WordPress, turning up to events like this and feeling a bit like a fish out of water, not really knowing what to do. Not really knowing what to do with the software, either. Not really knowing what I should install, whether I should install anything, whether I was using the best thing, or the worst thing or what have you. And that kind of was the nature of your subject.

But rather than me telling everybody what you were talking about, do you just want to summarise what it was that you stood up and presented about?

[00:06:02] Priscilla Collado Ramirez: Yeah, of course. And I feel the same way that you.

Well, my talk is about why WordPress feels overwhelming for beginners. I was that beginner that I don’t want to install. And WordPress, it’s great, but sometimes gives you too many options, right? So for beginners, sometimes that options feels paralysing because we need to start with one at the time.

I saw all the topics for this event, and I think, yeah, maybe I can share a little bit of my story with WordPress. And I talk about, I quit WordPress 17 years ago.

[00:06:47] Nathan Wrigley: You quit it?

[00:06:48] Priscilla Collado Ramirez: Yeah. I’m a quitter.

[00:06:50] Nathan Wrigley: My story going back, oh, 12 years or whatever it was, that’s nothing. You got 17 years. That was when you quit. Okay, carry on. Sorry.

[00:06:58] Priscilla Collado Ramirez: Yeah, no, 17 years ago, I was at university, and I was studying advertising and web design. I saw the options, too many options, too many things, I don’t know. And I feel overwhelmed. And I said, this is not for me. I’m so dumb. I’m slow. No, no.

And 17 years later, I’m here as an educator, and I help entrepreneurs and beginners to understand the WordPress environment.

[00:07:29] Nathan Wrigley: What brought you back then? After all that period of time away, what was the catalyst that brought you back? Why did you explore it again?

[00:07:36] Priscilla Collado Ramirez: Because I have a fashion school, and I saw my students deal with web designers and sometimes they charging so much money. I see it in the beginners, in my students, I saw that we have a problem with understanding that sometimes the things are not too difficult. We can learn about new tools and new WordPress.

[00:08:06] Nathan Wrigley: Okay, so this was all about your students then. So this was an idea of, I guess the world is kind of an expensive place to be, and one expense that you can get rid of is the cost of your website. There’s tools out there. You can, if you wish to, build it yourself. And then you found WordPress again. How is it the second time? Did you ever go through, I’m going to quit it for a second time, or was it better the next time you came across it?

[00:08:29] Priscilla Collado Ramirez: Yeah, and my brother is an engineer and I’m in like a category of non-technical people because I’m a fashion designer. I’m an educator, and I’m a wellness coach. And I think, yeah, maybe I can study a little bit, and if I use my education tools to understand how the brains for the creative people works and try to, out of the box, that sometimes the engineers have, and the creative people. It’s like a disorder, a disorder brain. I can help to these people to understand this environment in this community. And they can do it like I do.

[00:09:22] Nathan Wrigley: Yeah. So we’ll get into the bits that you think are problematic with beginning with WordPress in a minute. But just going back to your students and what have you. How’s it been for them? When you are looking at what they’re able to do, has it been a road of success, or has there been quite a lot of failure for them? Basically sum up how your students have coped.

[00:09:43] Priscilla Collado Ramirez: Okay. I don’t know, there’s two types of students, right? So we have the students that have a linear path learning. Some students learned like A, B, and C. Okay, you understand things easily. But some of them don’t understand the things like that.

So I try to create a platform, or we can call it like a type of education, and helps to understand, first how their brain works, and later understand the type of learning that I can teach.

[00:10:24] Nathan Wrigley: Okay, let me just make sure I understood that. So you try to figure out what their brain accepts most readily? And then once you figure that bit out, then you begin the WordPress education from there. Okay, that’s interesting.

And you say there’s kind of two types that you’ve kind of determined. And what are those two types?

[00:10:40] Priscilla Collado Ramirez: Lineal.

[00:10:41] Nathan Wrigley: Oh, so I think probably linear, like straight lines.

[00:10:46] Priscilla Collado Ramirez: Yeah, we have the straight lines and the spiral.

[00:10:49] Nathan Wrigley: Okay, yeah.

[00:10:51] Priscilla Collado Ramirez: So my mind is on the spiral. And that’s why I feel dumb in these technical environments. But I learned that if you learn some topic at the time and without the stress, you can do it and you can follow this community.

[00:11:10] Nathan Wrigley: So you just used an interesting word there. You said that you have felt, maybe you don’t feel it here, I don’t know if you do or not. But you said you’ve felt dumb in the past. You know, you’ve turned up to the events and you felt like a fish out of water, we might say that. Just. What the heck am I doing here? Where do I fit into this jigsaw puzzle?

And obviously you felt it long and hard enough that, firstly you left, and then come back, given it a second shot. So what are the things that you have felt dumb about? What are the things that have perplexed you in the past? What are the things that have drawn you to making this presentation?

[00:11:47] Priscilla Collado Ramirez: I felt in that time overwhelmed for the too many options. I feel that in that time in my country, WordPress wasn’t so popular and was a men’s environment. There’s no women. So I feel like, I don’t know, I’m not from, I don’t know what to be here. And now, four years ago, I’ve been talking with the women community on WordPress and I feel like, I don’t know, confident and they believe in my knowledge.

And I think that, yeah, I can do it again. I can approach to the community and I can learn, and I can be like a mentor too, and help beginners to understand that it’s not the technical environment. It’s how the community engage with your goals and can be used, and how can help with your goals.

[00:12:50] Nathan Wrigley: So I’m just going to dig into something you said a moment ago, which was about the community where you are. I don’t know if it’s still the same, but you implied that it was mostly men.

Have you found female WordPressers where you are? Or have you had to get on Zoom calls or something like that in order to find that community? Or has it grown so that it’s not just men where you are now?

[00:13:14] Priscilla Collado Ramirez: Yeah. I assist to the first women speakers in 2023. And I saw like, okay, this is a WordPress group for women. And that group was for speakers from WordPress, but women. So I was like, okay, WordPress is not only men’s, WordPress is not only technical people. And, well, I can approach to that community. 17 years ago wasn’t like that.

All men and square men. Because I know there is a lot of spiral men, but in that age, yeah, was like square men and my brother is a little bit like a square. And I was like, no, I’m funny and I want to talk, and I want to be a speaker and what. Now I feel that I can approach to my goals with WordPress because I changed my mind and my feeling about the community and WordPress.

[00:14:20] Nathan Wrigley: So just moving away from the community side and all of that kind of stuff, just dealing with the, actual software that you download from the internet and you put on a server somewhere, and then you begin to build a website. I presume that that’s part of this as well, that it’s difficult to begin because when you install a version of WordPress, you’re kind of left to your own. You know, there’s not really much in the way of assistance. You have to find the assistance somewhere. You have to a YouTube channel or some friendly person that will stand over your shoulder and help you out.

What are the sort of impediments, the problems that you think we have for people beginning with WordPress that you would like to be solved?

[00:14:58] Priscilla Collado Ramirez: Yeah. First of all that everybody thinks that WordPress is only a website. And I want to share this. WordPress is not only a website, right? It is a community. And you can approach and say, I wanted to learn about how to do a blog and how to do a website. But the community is more than that. I think that people don’t understand yet that what is WordPress?

[00:15:30] Nathan Wrigley: Yeah. well I went for, I probably used WordPress for four years, maybe three and a half, four years, something like that, before I knew there was any kind of community. I mean I realised that there was something because the software got made. So I realised somewhere behind the curtain, there must be people doing this. And I’m getting it for free, so they probably are not getting paid mostly to do it.

But I didn’t attend because I didn’t know there was anything to attend. And then I showed up to an event in London, which was probably my closest larger event at that time. I was quite surprised. I was thinking, okay, so there were about 600 people there, I really wasn’t expecting that. I thought maybe there’ll be like 12 or 15 or something. Showed up, 600 people. And for me that was kind of the moment WordPress became a little bit more interesting, because I realised that, okay, it isn’t just pixels on pages, it’s not just the websites. There’s actually a whole community of people behind it.

And one of the things that I discovered fairly quickly was that those people shared, there was a lot of overlap between them and me. You know, just a lot of things in their lives seemed to sync with a lot of things in my life. We had broad agreement on a lot of things. We all wanted the project to be successful. And so discovering the community, like you said, was a really important thing.

But nevertheless, I still think I would’ve carried on using it even if I hadn’t of discovered that community, because by that point I’d got over the problem of what plugins to install and how to actually use the software.

Yeah. So let’s move on to that. In terms of the actual software, so we’ve got the community, we know that exists. What are some of the problems that you’ve seen, I guess with your students, or maybe personal experience? Some of the problems with the actual software. What are some of the things that you’ve encountered?

[00:17:21] Priscilla Collado Ramirez: Yeah. I encountered that there’s too many options, and the people do not know how to install. And that’s a beginner’s questions. Why should I install plugins, themes? And for technical people it is like, okay, it depends.

[00:17:39] Nathan Wrigley: Oh always it depends.

[00:17:41] Priscilla Collado Ramirez: Always, it depends. And, for beginnings, that feels paralysing.

[00:17:45] Nathan Wrigley: Okay. That’s an interesting phrase, isn’t it? So when you mean paralysing? So we say it depends, meaning, oh, try everything. See what works. Where you are saying that in your experience, it depends means don’t do anything, we don’t know, not sure.

[00:18:00] Priscilla Collado Ramirez: Yeah. And the beginners don’t know what to do, right?

[00:18:03] Nathan Wrigley: Okay, yeah, that’s not helpful, is it, it depends, really when you say it like that?

Okay, so how do we overcome that? I don’t know what we do apart from keep saying, it depends. I guess we’ve got to try and encourage people to try this.

Okay, let me rewind a bit. So my parents, when I put the phone in their hand for the first time, the mobile phone, I had it all set up for them, you know everything was working, and I gave it to them and assumed that they would have the same approach as me. Which was, just play around with it and then you’ll figure it out.

Oh, no. No touching anything was, will I break it? Is this going to destroy it? If I press delete here, does that mean the whole thing’s going to like be, does this app going to disappear at this point?

So, I think that’s what you’re saying, is basically there’s this fear that if I install something and then I don’t need it, or I don’t like it, well then what do I do? Is it kind of that? This fear of it.

[00:18:59] Priscilla Collado Ramirez: Yeah, because you feel overwhelmed, and you feel paralysing. And you feel like, okay, there’s a learning path, right? So we have the excitement. So, yeah, I’m going to do WordPress. Then confusing. What is this? And then it is like, no, I don’t know, maybe this is not for me because there’s so many options.

I try with my students to go one step at a time, and understand, first, what is a plugin? Right? Do you need a plugin or not? Do you need a theme or not? Do you need SEO plugin or, I don’t know?

So I am trying to, first of all, work with entrepreneurs because some entrepreneurs sometimes doesn’t get it. I don’t know, what is an email? How to send an email. They are so intelligent, and so capable to learn things, but sometimes, like as educators or mentors, we have in our minds that people learn easily. And sometimes it’s not. So you have to teach like a child. And not because the people was stupid, right? It is like because that people, the learning process is different.

[00:20:30] Nathan Wrigley: Yeah, I suppose you’ve got to just get to the point where you’re comfortable. So for some people who are, I don’t know, let’s go for the word technical. Technical people who’ve got a background in using computers, they do it all day, every day. And they experiment with new things. I suppose if you put them in front of WordPress, they’re off. They’re just going to do that kind of thing. But I totally get what you mean.

So for me, technology, I will experiment and I’ll play, because I know that nothing can basically actually break. If something goes wrong, I can just delete it. So I’m thinking about apps on my phone, on my computer, and WordPress, and plugins, and themes and all of this. I fully understand that nothing will kill it. Well, hopefully nothing will kill it, and I can just remove what I don’t understand.

But then again, you pick me up and put me into a different industry, I’ll be that person. I’ll be the person that needs the baby steps, I think you said that needs the child steps, because I’m not in familiar territory. So I can’t think an example off the top of my head, but pick me up, basically put me anywhere there’s no technology, and I will feel that same anxiety. What do I do? can you check that what I’ve done is safe? Okay. Can you double check? And will you triple check just to make sure that everything is safe. And I suppose that’s what you’re saying, is just little baby steps. get people into it. And once they’ve gone through the baby steps, hopefully they can act on their own.

[00:21:54] Priscilla Collado Ramirez: This is a phrase that I been thinking too much in this talk, because it is some word that you said, and you said about confidence. And I wrote that confidence does not come before action. Confidence is built through action.

[00:22:14] Nathan Wrigley: Yeah, that’s true, isn’t it? And so everybody at some point has to go through that barrier. Some people seem to be full of confidence, regardless of what is, but there’s a lot of people who are not. And if you walk them through the baby steps I suppose, as you said, and tell them, do you need a plugin? What is a plugin? This is a plugin. How do you get a plugin to be put on your website? Can you delete a plugin? And then same thing with themes and custom code and all of those kind of things. And does that work? Do you notice that people go from like, ah, fear, to oh, this is all right.

[00:22:47] Priscilla Collado Ramirez: They think, this is not so hard that I was the, I will be. I don’t know, I have all types of students and all types of socioeconomic types. And I have students like 50 to 60 years old. And they think, no, I’m too old to think learning website, and learning design things. And I’ve been creative. The constructivist system is a strategy in education, the constructivist, and the principle idea is you learn by doing.

[00:23:27] Nathan Wrigley: Confidence through action, like you said, basically.

[00:23:29] Priscilla Collado Ramirez: Exactly, exactly. And so you can be on the learning path, making little mistakes and getting more confidence to feel safe in the learning environment.

[00:23:42] Nathan Wrigley: Are you a patient person?

[00:23:45] Priscilla Collado Ramirez: Sometimes.

[00:23:45] Nathan Wrigley: Yeah. Because when I was earlier describing my parents and the phone, there’s kind of a bit of me, which when I’ve demonstrated the same thing nine times, and every time the output of those, okay, do it this way, do it this, okay, now do this, now this. And on the 10th go, it’s still the wrong thing in the exact same way. I just wondered if there was a bit of that? If there is just some impediments which, I don’t know, some people just never get over. If WordPress is just generally too hard for some people. Or do you always pursue it and succeed? Do you always get people through, and get them to that confident stage?

[00:24:23] Priscilla Collado Ramirez: Yes. Yeah, yeah. Every day. Yeah. Like every day. And I think that the mentor and the educator has to feel love with that work, and teaching with love, first of all.

And then, understand that people doesn’t learn in the same way. I can say older people because I’m older, and you saw an older people, and you think, this is older than me, but it isn’t.

[00:24:55] Nathan Wrigley: Yeah. and some people are kind of, what, we would describe as kinesthetic learners. So they doing is the way. Some people are kind of auditory, and they hear the solution and they learn from hearing. And other people it’s visual. You know, they see the, watch a video and, oh, I’ve got that now. And I guess you’ve got to figure out which ones, how they fit in. If I show you once, you’re fine. If I show you once, well that’s not going to work. You’ve got to actually do it and copy me. And once you’ve figured out what kind of learners they are. You must have a lot of time for these people by the sounds of it.

[00:25:25] Priscilla Collado Ramirez: Yeah, of course.

[00:25:27] Nathan Wrigley: Yeah, and do you literally have an endless amount of time to educate them or do you have like a, I don’t know, you’ve got 10 hours or whatever it is and after 10 hours we’re going to get new people in? Or do you just stick with them throughout the whole journey?

[00:25:38] Priscilla Collado Ramirez: Yeah, yeah. And most beginners and most entrepreneurs isn’t that way, right? And they’re so excited to understand the process. And when I explain how the brain works, they think, oh, yeah, it’s not the system, it’s me.

[00:25:59] Nathan Wrigley: But also I can do something about it.

[00:26:00] Priscilla Collado Ramirez: Yeah.

[00:26:01] Nathan Wrigley: Yeah, okay. That’s interesting. Okay.

I’m going to give you superpowers for a minute. I’m going to say that you are in charge of WordPress entirely. It’s up to you what we do to improve this experience. What would you change? that could be the software. It could be education that you suddenly provide, you know, you would whip up many, many courses or whatever. I don’t know. I’m just curious to know what you think.

So again, superhero powers. You get to decide the future of WordPress. What little changes would you make here and there?

[00:26:32] Priscilla Collado Ramirez: I’m going a little bit too far off WordPress, and I’m going to bring wellness tools first.

[00:26:41] Nathan Wrigley: Okay. So it gets bigger.

[00:26:42] Priscilla Collado Ramirez: Yeah, it’s bigger. I’m a wellness coach first of all, and first you have to try to understand the stress, and your mind. And then you can learn. I feel like my superpower will be an educator in wellness first, because we have to manage the stress of learning.

[00:27:04] Nathan Wrigley: So you have to approach the computer, but calmly. You have to get there and arrive in an equanimous state. Nice and calm.

[00:27:14] Priscilla Collado Ramirez: Yeah, and understand that the delete button doesn’t exist. Because you are going to learn that, yeah, you can delete it, but you are going to breathe, and stay calm, and you won’t be delete anything because you, on the learning process of your mind understanding that everything is a process.

After that, I have an idea, I don’t know my superpower, I would like to do the mentor of the mentors first.

[00:27:49] Nathan Wrigley: Oh, teach the teachers.

[00:27:51] Priscilla Collado Ramirez: Yeah, yeah. Because we have mentors in WordPress, but the mentors sometimes doesn’t study at the university education, right? Is an engineer trying to teach another engineer, or an engineer teach to entrepreneur or a beginner, so their minds works different.

[00:28:14] Nathan Wrigley: Yes. I’ve encountered this in the real world. You know the educator who gets really angry with you and tuts, sort of goes tut tut, because you’re not doing what the way they would do it. It just turns out that, if you just ask me in a different way, I’ll probably figure it out.

[00:28:29] Priscilla Collado Ramirez: Yeah, exactly.

[00:28:30] Nathan Wrigley: Sorry I interrupted, carry on. So educating the educators.

[00:28:33] Priscilla Collado Ramirez: And in all the fields is the same way, because I’m a fashion designer too, but I have to learn how to be an educator, and how to try to explain some things to my students and try to get off to my mind box.

So I want to make some changes too, and add some of these tools on WordPress. I don’t know, maybe this is my superpower, like be a spiral mind.

[00:29:07] Nathan Wrigley: Yeah, yeah. But I think teaching the teachers. So I think we would use the word pedagogy for that. Meaning, how to teach basically. The science, if you like, of imparting knowledge. And maybe there is nothing like that at the moment. And if there isn’t something like that, it would be interesting to explore how different people with different minds and different approaches. Maybe your first idea of everybody approach the computer in a calm way. Maybe that gets rid of some of that problem. At least we’re approaching and we’re not getting we begin.

But I think you’re onto something there, in that I know that I don’t learn in the same way as my children do. I don’t learn in the same way as my parents do. And so having that in the background, and educating the educators so that they’re aware that those kind of things exist.

Okay, you’ve still got the superpowers. Is there anything else that you would do before I take them away?

[00:29:56] Priscilla Collado Ramirez: Okay, okay. I think that understand the brain is a supercomputer. It’s also a big topic because you can programming your mind. I would love to teach that people can programming itself. I don’t know what other superpower.

[00:30:17] Nathan Wrigley: Well that’s okay. You’ve had it for probably about five minutes now. That’s more than most people get.

So yeah. So in your experience, I know that you are obviously trying to overcome this problem, and it sounds like you get most people through it, and people manage to come out the other side and are, you know using WordPress successfully. But despite that, do you still think out there in the wider community, not where you are, do you still think that people are being turned off by the problem at the beginning of, I don’t know what to do. I think that I should be able to figure this out, but I can’t. I’m frustrated. It’s annoying me. Ah, move on, or forget the whole thing altogether.

[00:30:53] Priscilla Collado Ramirez: Okay. I give you some tools. I wrote it. Limit the choices. Yeah, because one plugin at a time. Yeah, understand one topic at a time.

[00:31:05] Nathan Wrigley: When you say that, are you, meaning, let’s say for example, that we’re getting into the, oh, I don’t know, the realm of SEO, we’ve managed to get into that subject. We know that there’s like 500 SEO plugins. Just show them one, just pick one, concentrate on that one and figure out how that works. And then maybe reveal that there’s others or something like that.

[00:31:25] Priscilla Collado Ramirez: Yeah. But sometimes, maybe I have to understand your world first, and maybe you don’t need SEO tools? Because maybe you wanted to sell, I don’t know, plants. So do you really need a SEO plugin? Yeah, maybe not. So I have to understand your business first, or your purpose first, and then I can share you one plugin for that.

[00:31:56] Nathan Wrigley: Right, so, but at the end of the day, it’s still limit it rather than the plugin overwhelm. 78,000 plugins on the repo or whatever it is. One at a time is probably for a beginner more than enough. Learn how to install it. How to uninstall it. Learn the kind of things that you can do with it, whether that’s SEO or a form plugin or whatever. Okay, it looks like you’re ready for another one, yeah.

[00:32:15] Priscilla Collado Ramirez: Yeah. I have, normalise confusion.

[00:32:19] Nathan Wrigley: Okay, so be happy with being confused and muddled up.

[00:32:23] Priscilla Collado Ramirez: Yeah, because it’s a new topic for you. So you have to understand that it is fine if you feel confusion, because your brain is adapting to that learning process.

[00:32:34] Nathan Wrigley: Yeah, we’re not good at that, are we? We’re really good at being annoyed by confusion. Confusion’s the enemy in many ways, isn’t it? But it’s really not. I mean, who can expect to learn something new and immediately understand everything? No, but we don’t allow ourselves to do that, do we? We get annoyed with confusion.

That’s a good one. I like that. Carry on, sorry.

[00:32:54] Priscilla Collado Ramirez: And celebrate the small wins. I’m doing right now. I’m realise that I have to celebrate the small wins, because sometimes we overwhelm and have too many expectations. It is one step at a time, baby steps.

[00:33:11] Nathan Wrigley: So that one is basically when something goes right. So once you’ve got over your confusion and something’s gone right, sit back, examine it. Ah, well done. Pat on the back kind of thing. Yeah, okay. That’s nice.

[00:33:22] Priscilla Collado Ramirez: Yeah. And emotional reset tools.

[00:33:26] Nathan Wrigley: Okay. You’re going to have to explain that one.

[00:33:29] Priscilla Collado Ramirez: Okay. I’m going to explain you here, because I want to explain you pretty well, and sometimes I get I stuck in the language.

Okay, when beginners get frustrated, we must do simple pauses, like breathing. The process of breathing is called pranayama. In pranayama is the art of the breathing. When we born, the first thing that I will do is breathe. And when you are crying, the people say, no, no, breathe, breathe, right? And when you are, I don’t know, when you swimming, and you.

[00:34:09] Nathan Wrigley: Drowning maybe.

[00:34:11] Priscilla Collado Ramirez: Drowning yeah, you want to breathe. So the breathing is so important.

[00:34:16] Nathan Wrigley: So this is part of the pausing thing. Just pausing, breathing, okay.

[00:34:20] Priscilla Collado Ramirez: Yeah. They also reduce the cognitive overload. And help beginners continuing learning with more clarity, that regulates the brain and the stress.

[00:34:32] Nathan Wrigley: So I don’t think I do any of those things when I’m learning. I just sort of plough on and expect myself to do really well. And when I don’t, I get miserable and annoyed. And I don’t ever think about, okay, calm down, breathe, congratulate yourself. The thing is I mostly do learning by myself. You know, I’m in a room and I watch a video or I read something, and so there’s nobody there to tell me to breathe, calm down, relax, congratulate yourself. So I’m glad these people have got you in their lives to, make all of this happen.

Sorry, carry on.

[00:35:03] Priscilla Collado Ramirez: No, no. And one of the phrases that I want to the people understand is the learning doesn’t happen in stress. It happens when the mind feels safe enough to explore.

[00:35:19] Nathan Wrigley: Yeah, well I can identify with that. That makes perfect sense, doesn’t it? When you’re uptight and worried about things, nothing sticks ever, does it? So back to calm, I suppose.

[00:35:30] Priscilla Collado Ramirez: Yeah yeah.

[00:35:31] Nathan Wrigley: Yeah, that’s all good advice. Yeah I wish I could do it.

[00:35:36] Priscilla Collado Ramirez: Yeah. And sometimes, yeah, the people feel overwhelmed with the stress first. I have too many mentors that causing me stress and, I don’t know, they don’t give me confidence in anything of I been learning.

[00:35:55] Nathan Wrigley: It sounds to me like what you are proposing. We would probably call it holistic. So it’s treating the mind, the body. They’re the first bits. If you haven’t got those intact and working for you, it doesn’t matter how many times you read that book, you’re never going to learn anything.

[00:36:12] Priscilla Collado Ramirez: But sometimes the word for holistic for technical people is like you’re a hippie.

[00:36:17] Nathan Wrigley: Well, there is a bit of that, isn’t there? I think technical people often have an approach to this kind of stuff, which is fairly dismissive, sort of at arm’s length. Because it’s not science, if you know what I mean. It doesn’t sort of come under that umbrella. I wonder how much resistance actually, if I put you in, you know, had a chat with a thousand of the people out there at the moment.

[00:36:38] Priscilla Collado Ramirez: Oh, the people go away.

[00:36:38] Nathan Wrigley: Yeah, okay. Okay. But you know it works. And everybody knows this kind of stuff works. Because if you’re calm, I suppose the difficulty would be, you’ve got to allow yourself to accept that you need to be calm, and you need to be approaching it in this kind of way. And that’s difficult. I would find that quite difficult. You know, if I came to your educational institute, if you like, if you were teaching me WordPress, there would be a bit of me at the beginning, which would be thinking, okay, just tapping the watch, and thinking when does the WordPress begin?

And you are probably saying, we need to be calm now, you know? So I guess you’re going to have to fight that fight.

[00:37:13] Priscilla Collado Ramirez: Yeah. Yeah. And last year I was a speaker in my country, and I’m talking about how manage the stress, the people that works like eight hours on the computer. You can use too many tools to release the back, the breathing. And everybody needs release the stress. Sometimes in technical environments, the people don’t engage with the holistic path because they think that.

[00:37:46] Nathan Wrigley: Yeah. I confess I’ve had years of doing that kind of stuff. Just expecting my body to be able to keep pace with whatever I’m doing, and expecting that if I sit in a chair for 12 hours, that everything’s going to be fine. I’m just going to stand up and walk away. And of course, it’s not.

Do you know, it’s really interesting, I don’t know that anybody’s doing this. Maybe you know a load of people that are carrying out this kind of a practice. But it feels like you’ve kind of, forgive me if I’ve got the wrong language here, but it feels like you’ve kind of bolted something close to meditation onto technology. Which is really curious, because I don’t know that anybody, maybe this is common where you are. I don’t know, but.

[00:38:27] Priscilla Collado Ramirez: No, it’s not. It’s not because I’m a sound therapist, and I’m a sound healer. The sound can heal you. I am trying to people understand that you can’t live like a computer. You are not a computer. You can program in your brain like a computer, but you are not a robot. And you need to stop.

[00:38:51] Nathan Wrigley: I think, we’re too attached to our devices, aren’t we? I think whenever the mobile phone came along, we finally gave up free time. And email is there 24/7. Social media’s there 24/7. Technology’s there 24/7. Yeah, breathe is basically what you’re saying.

[00:39:10] Priscilla Collado Ramirez: Yeah. And in my country, no, it is not common. It is not common and it is a little rare. And maybe in another country it is normal to finish your labour at work and meditate one minute.

[00:39:26] Nathan Wrigley: Oh no. Nobody does that where I live, no.

[00:39:30] Priscilla Collado Ramirez: I don’t know if there is any country, doesn’t do it, right?

[00:39:32] Nathan Wrigley: That would be nice. Yeah you’d probably feel really good after that.

[00:39:35] Priscilla Collado Ramirez: Maybe in China? Maybe Japan?

[00:39:38] Nathan Wrigley: Maybe where they a different approach to living. Do you want to roll your thing out? The way that you are doing this, do you want to roll that out to other people? Do you want people to kind of approach you and, I don’t know, study what you are doing, and then go off and do that kind of thing elsewhere? Is that part of why you’ve come to an event like this? To sort of preach the gospel of this idea, this way of learning?

[00:40:01] Priscilla Collado Ramirez: Yeah, yeah. I would love to. I would love the people understanding maybe, I don’t know, create me a plugin about wellness. I don’t know.

[00:40:12] Nathan Wrigley: Okay, so anybody listening to this, Priscilla wants communication with people who think they might be able to step in. I know of several people who have, let’s say things like meditation as part of their daily ritual and things. In which case, anybody who’s listening to this, where’s the best place to find you online? If people want to get in touch and talk about these wider problems, education, learning, calming down, meditation, those kind of things, where would we find you?

[00:40:37] Priscilla Collado Ramirez: On Gravatar. On WordPress page, and Instagram too.

[00:40:42] Nathan Wrigley: I think I’ve got the details of most of those, but if I don’t, I will get them from you, and I will put them on the WP Tavern website. So if you search for the episode, dear listener, with Priscilla in it, I don’t know the number of that episode just yet, but if you search for the episode with Priscilla in it, if you’ve got intuitions that you’d like to help out, go and find this episode and you can reach out. And you never know, maybe something will come of that.

So Priscilla, thank you for chatting to me today.

[00:41:07] Priscilla Collado Ramirez: Oh, thank you too. And remember to breathe.

On the podcast today we have Priscilla Collado Ramirez.

Priscilla traveled 14 hours from Costa Rica to attend WordCamp Europe, making her one of the furthest attendees at the event, and for good reason. She’s an educator, fashion designer, and wellness coach, and has a unique perspective on a challenge many in the WordPress community face: how overwhelming WordPress can be for beginners.

Having once quit WordPress 17 years ago due to information overload and lack of community support, Priscilla’s story comes full circle as she now dedicates herself to helping entrepreneurs and creatives find their way in the WordPress ecosystem. Her work focuses on demystifying those first confusing moments, offering practical steps and much-needed reassurance for anyone who’s ever opened a fresh install and wondered, “What on earth do I do next?”

The conversation is focused on why newcomers often feel stuck, paralysed by too many choices, the classic “it depends” advice, and a fear of breaking something (or everything). We get into the importance of understanding individual learning styles, whether linear or spiral (as Priscilla labels them), and meeting students where they are, sometimes with literal breathing exercises and wellness techniques to lower stress and unlock real learning.

Priscilla explains why confidence in WordPress is built through action, and why celebrating small wins, like successfully installing a single plugin, is essential. She also shares her approach to bringing holistic, calm, and patient mentorship into WordPress education, something that’s as relevant for agency leads as it is for first-time bloggers.

If you’ve ever felt overwhelmed by WordPress’s infinite possibilities, struggled to find your place in its community, or just want practical wisdom on making the path easier for beginners, this episode is for you.

Useful links

Why WordPress feels overwhelming for beginners – Priscilla’s presentation at WordCamp Europe 2026

Priscilla on WordPress.org

💾

Gutenberg Changelog #133 – Gutenberg 23.6 Release and WordPress 7.1

In episode 133 of the Gutenberg Changelog Podcast, Birgit Pauli-Haack hosts Faith Ruth Imokol, a Ugandan web developer and longtime Gutenberg advocate, to discuss the Gutenberg 23.6 release and the upcoming WordPress 7.1 update. The episode opens with insights into the WordPress community in Uganda, highlighting their active WordCamp scene and educational initiatives such as […]

💾

Gutenberg Changelog #133 – Gutenberg 23.6 Release and WordPress 7.1

In episode 133 of the Gutenberg Changelog Podcast, Birgit Pauli-Haack hosts Faith Ruth Imokol, a Ugandan web developer and longtime Gutenberg advocate, to discuss the Gutenberg 23.6 release and the upcoming WordPress 7.1 update. The episode opens with insights into the WordPress community in Uganda, highlighting their active WordCamp scene and educational initiatives such as the Campus Connect program, which introduces WordPress to students across the country.

Faith Imokol shares her experience on a recent WordCamp Kampala panel about AI in web development, noting divided perspectives: while some Ugandans are excited about AI’s possibilities, others are concerned about job security and adaptation. She describes her personal transition into using AI as a collaborative development tool, driven by the need for faster production due to heightened competition.

Discussion moves to WordPress 7.1, covering new features such as customizable viewports via theme.json, expanded notes and commenting capabilities, enhanced SVG icon registration, and improvements to blocks like playlists and tabs. Both speakers are enthusiastic about the collaborative features and the evolving editorial workflow, particularly the granular notes system for streamlined feedback.

The episode emphasizes community feedback’s role in shaping new releases and encourages listeners to help test upcoming WordPress versions to ensure quality and translatability. The episode closes with practical tips and excitement for ongoing educational outreach and future Gutenberg advancements.

Show Notes / Transcript

Show Notes

Special Guest: Faith Ruth Imokol

WordPress Events in Uganda

Upcoming Events

Past 2026 Events

WordPress 7.1

More Developer Notes for WordPress 7.1 

What’s new of Gutenberg 23.6

The post editor is going full iframe: what block developers need to know before WordPress 7.1

Video w/ Ryan Welcher: iframed post editor canvas

Stay in Touch

Transcript

Birgit Pauli-Haack: Welcome to our 133rd episode of the Gutenberg Changelog Podcast. In today’s episode, we will talk about Gutenberg 23.6 release and some WordPress 7.1. And that should be enough for today. I’m your host, Birgit Pauli Haag, curator at the Gutenberg Times and full-time core contributor to the WordPress Open Source Project sponsored by Automattic. And today I’m very excited that Faith Ruth Imokol joins me. She’s a web developer from Uganda, WordCamp organizer there and speaker, and a Gutenberg advocate since 2018, as long as the Gutenberg Times. And I’m glad she agreed to come on the show and talk through with this release and tell us more about the WordPress community in Uganda. Welcome to the show, Faith. How are you today?

Faith Imokol: Thank you very much, Birgit, for having me. I am okay. I’m very fine. Thank you, listeners, for having me as well. I’m excited.

Birgit Pauli-Haack: Me too. Me too. It’s such wonderful to have you on the show. So, WordCamp community in Uganda is really busy this year, and it probably was last year as well because there’s a lot of experience there in doing WordCamps. So you, you were in WordCamp Kampala this year.

Faith Imokol: Yes.

Birgit Pauli-Haack: And you were on a panel session titled AI and the Future of Web Development: The Good, the Bad, and the Ugly. So what were your takeaways? How are the people in Uganda kind of looking at AI and the future of the web?

Faith Imokol: Oh, well, the opinions on the future of AI in Uganda and how people view it are quite divided. Many are very hopeful, but some are also a little worried about what is going to become of them, especially when it comes to their jobs with AI. There’s a lot of talk on AI taking over. There’s a lot of talk on, okay, what do we need to do? Do we still need to continue with the way that we’ve been working or should we transition into full AI mode working with AIs? So there’s a lot of speculation around AI. And during the panel session, very many people had very many questions around that. They wanted reassurances on, especially when it comes to their jobs. Do we still have our jobs as developers? Can we still maintain the work that we are doing right now? Can we still continue using the tools that we are working with right now, or should we leave them and just take on AI and start working with AI. So it was a panel that was there to encourage people, to also highlight and offer corrections on some of the misinformation that was going, that has been spreading and going around in the community, especially in the WordPress community. Yeah.

Birgit Pauli-Haack: So how, you don’t have to go into details, but how are you approaching AI for your work?

Faith Imokol: Personally, I could say that I’ve been forced in some way to use AI ’cause I’m using it more as a pair working along with it in my development. And I’ve been forced to use it. Initially, I was a little hesitant. I like to do my own discoveries. I like to go through my own work and do my own troubleshooting. But with the AI coming in, it forced some of the teams that I was working in to have to increase the rate at which they produce and release applications. Why? Because the competition has now stiffened. If you’re not using AI to work faster, someone else is going to produce what you’re doing and they’re going to release it, and then you’re going to be left behind. So I kind of, at some extent, have had to take a back seat on doing my own personal investigations and leaving those to my own personal time. But when it comes to work, it’s something that I’ve fully incorporated into my day-to-day working. Yeah, still, I still apply my own knowledge as well. I don’t leave everything to AI to do it.

Birgit Pauli-Haack: That’s certainly quite prudent, yeah, to see how AI can really go wrong and you don’t know which tangent they go on. Yeah. And I have found, well, I’m using AI maybe a year now for a lot of different things and I have found that there’s no taste. Yeah. It has no feelings, of course. Yeah. And it has no empathy for anything. Yeah. So, human judgment is even more needed for anything that is released that was done by AI. And I think it becomes more and more clear the longer we practice with it. First, it’s a fantastic tool. Yeah, it kind of gets you to certain things faster, but it also is very verbose in code, in reviews, in analysis, and you really need to kind of slow it down and figure out what’s really important. And that it can’t do. It doesn’t know what’s important, what’s not important. Everything is the same.

Faith Imokol: I kind of think it’s like a very smart child who thinks they know everything, but they’ve not lived through the experience of what an adult knows.

Birgit Pauli-Haack: So they still need guidance. That’s a good analogy. Yeah. It’s like a young person who just graduated high school and knows everything.

Faith Imokol: Yeah.

Birgit Pauli-Haack: Yeah, I was that when I graduated from high school. I knew everything. But back to the Uganda community, the next WordCamp is in Jinja. Is that how you pronounce it? From the 19th to the 20th of September. It’s in the Civil Service College in Jinja. Just, just in case you dear listeners are in the region and you wanna go to a WordCamp in Uganda. But there’s also running from now to December several WordPress Campus Connect events with 25 schools, each one with at least 100 participants, 25 schools, colleges, or universities. And the program will bring practical, as it aims to, practical WordPress learning sessions to selected schools across Central and Eastern Uganda. And students will be introduced to the basics of WordPress, how websites are built, how to create and publish content and how they can use WordPress for school projects, personal portfolios, blogs, business ideas, and future technology careers. So these are the Campus Connect from the WordPress Education Program that started, I think, in the end of ’24 and has now run through ’25 and half of ’26. So, and Uganda is really taking to it and getting a lot of students involved with WordPress.

Faith Imokol: Yeah, we’re working hard to see that the future, the next generation that comes into the workforce is not too ill-equipped like the way we were. So these programs that we’re starting as the WordPress community are out to help the next, the coming, the young generations that are coming in, for them to know, to know the different skills that they can take on and to know that there are different tools that they can also learn that can help them. So it’s really a very amazing initiative that was started by Mr. Dumba and Moses.

Birgit Pauli-Haack: Yeah. Yeah. And they are still completely involved and totally immersed in that field. Yeah. Stephen Dumba also organized a website project competition for elementary schools, high schools, and colleges. And they had, I think, 20 teams in total there. And then each team had to create a website for a community project that is local and was very important to the community and how to communicate those problems and solutions. And that was also in June. Then there was WordCamp Osaka, Campus Connect in Osaka, and then Campus Connect in Kakumiro, if I pronounce all that right.

Faith Imokol: Yes. Yeah, you’re trying.

Birgit Pauli-Haack: I’m trying. Yeah, I’m not succeeding. Okay.

Faith Imokol: Your pronunciations are very good.

Birgit Pauli-Haack: Okay. Yeah. Yeah. So I’m really excited about what’s happening on the African continent in the various communities. Uganda is one. I think another very active one is Kenya. And there was one in Rwanda. I don’t know how active they are now. But yeah, I’m really excited about that. 

Announcements

So we have a few announcements. 7.1 is coming Today is July 30th. So in about 3 weeks, we will have a final release of 7.1. August 19th is the release date. And it will be released on the last day of WordCamp US. The Source of Truth, that’s the book about things, yeah, that is published on the Gutenberg Times. This time it’s about 39 minutes to read and 7,000 words. It’s really an ebook or something like that. The table of contents, it’s very detailed. So you can jump into the sections that you want. Okay. That you need. And the developer notes are coming out for those who need more technical details. And there was one from the client-side media processing, the text shadow support for global styles. 

The media library infinite scroll is coming back and is enabled by default, but there is a filter to disable it for those who need it disabled. And then there are now editable blocks inside custom HTML blocks. That’s a very interesting construction. So if you’re interested in that, we share, of course, the developer links in the show notes. There are some editor component updates that are interesting for those who are using those for development in admin as well as in block editor. And then a lot of people have been waiting for that part, registering and rendering SVG icons and icon collections. The developer note is out and it will come to 7.1. And then there’s also a mid-width block support and background gradient block support. So there are some things for the global styles that are only available through the theme.json. There is no UI yet for it because it just needs to simmer a bit and kind of brew a bit before developers are thinking about the UI. Is there anything that excites you from 7.1 from, from these developer notes yet?

Faith Imokol: Yeah, well, I really, really, really enjoy the new features that are coming in, especially the one thing that I’ve really been excited about is the collaboration tools. So I’m really looking forward to working more with those and seeing how they will help people collaborate on different WordPress projects.

Birgit Pauli-Haack: Yes. Yeah, yeah, yeah. Unfortunately, the real-time collaboration has been punted again. Or it was clear that it would not come to 7.1 because it has these underlying server technical approaches that depending on where the site is hosted, it needs to have a different approach. Or in enterprise, yeah, it’s a different approach and all that. And they haven’t narrowed down what the default value could be. But what I really like are the e-syncer. So it’s very rare that I’m sitting there and somebody else is sitting on their computer and we’re on the post or on the site at the same time. Mostly it’s because, yeah, I work remotely in Europe time zone with a lot of people in the United States that’s 6 hours behind. It’s more asynchronous. And I think the notes section is really getting some great love there that came in 6.9 and 7.0 and now has additional features. Yeah, I really like that.

Faith Imokol: Yeah. I see it growing. I see it growing into something much bigger. So I’m looking forward to whatever is coming ahead.

Birgit Pauli-Haack: Yeah, yeah, I could actually see that. But the current publishing flow at the official developer blog is that the writers do a draft in Google Docs, and then 2 reviewers come in and help edit that or streamline it or shorten it or whatever, comment on it. And then the writer has to make all the changes after those feedbacks and then take the whole Google Doc and put it into a blog. So with the notes feature, we can cut out the Google section part because we can now comment on the, on writing on the blocks. Yeah, we can mention people and we can resolve issues from the notes. So it’s coming really close to streamlining that, our process. All right. 

What’s Released -WordPress 7.1

What’s released? WordPress 7.1 Beta 4 came out. That’s the last release before the release candidate next week on August 5th. August 5th is also the deadline for the rest of the dev notes, the developer notes for that, and the Field Guide will come around that as well. And that’s also the time where string freeze happens. Release candidate is still 14 days away. The translators need to get into it. So string freeze means there are no new strings that come in that need to be translated. Because the WordPress ecosystem has a huge army of translators. And by the time the release comes out, it will be translated into about 70 languages, almost 100% from the new release. And that’s huge. But we need to give those translators a time on the polyglots teams to actually get it all in. And this is not a small release, although it wasn’t a long pipeline there. Yeah. 

And if you want to test it, this is now the time to go to the Make/Test team and follow the Help Test WordPress 7.1. It’s also linked from the release post from the news section because it gives you an opportunity to not only dive into the new features, but it also gives you instructions and a video and you learn quite a bit about it. And if you find things that are not right, you surface that. And that is not only surfaced for yourself, but it’s also surfaced for millions of other people who are going to get this new version. And if you are fast enough and the problems are small enough, they might get the fixes in before the final release. So if you wanna help and contribute quite impactful, help test WordPress 7.1. It’s my call for action for this show. Did you get a chance to dive into some of the features yet?

Faith Imokol: Yes, I did. I did try testing them as well locally. And yeah, it’s really impressive. The work that is being put into this is very, very impressive.

Gutenberg 23.6

Birgit Pauli-Haack: All right. So this brings us to the Gutenberg plugin release 23.6. And 23.6 is also the last feature release for 7.1. So everything that made it into the 23.6, almost all of it will come to 7.1. Everything that’s enhancements in the next release will not make it because we are past the beta site. But all the bug fixes that you find in your testing and you report them as issues or on the support forums have a chance to get in. Yeah. So let’s start with that. 

Features

The first item that I want to point out is that you can now set the viewport for tablet and mobile values in theme.json. What does that mean? So the Gutenberg plugin editor had hardcoded viewports for what’s considered desktop, what’s considered tablet, and what’s considered mobile. And everybody had to work around those if you had a different idea about those viewports.

Faith Imokol: Yeah.

Birgit Pauli-Haack: But now you can just set the setting in your theme.json for your theme and then everything will fall into place.

Faith Imokol: I think this gives us much more flexibility because initially with the default viewpoints that are set by WordPress, all sites end up having the same, could I say breakpoints?

Birgit Pauli-Haack: Yeah.

Faith Imokol: I think personally I prefer to, I refer to them as breakpoints. for different screens that is in mobile responsiveness. And this is going to allow us to be able to customize this to our own liking so that our themes can be uniform with, uh, can have settings that have been preset by us than having the default ones that WordPress has added. And I think as I was going through the changelog, I came through the discussion because the viewports allow you to set the tablet and the mobile view. And there was a discussion of what could happen if someone set the tab view to have a smaller, should I say, breakpoint than the mobile screen. What could happen by that? And it was quite interesting that at that point we reverted back to the defaults.

Birgit Pauli-Haack: Yeah.

Faith Imokol: Yeah. So it’s a good thing to have in the background, as I don’t think everyone will abide by the rules, but As you’re working with this and anyone who gets to work with this, I think you have to keep that in mind that you, you’re setting different breakpoints for different devices and tablets are larger than mobile devices.

Birgit Pauli-Haack: Yeah. Yeah. That’s the assumption that tablets are larger than mobile devices. So if someone puts a mobile breakpoint in that’s bigger than the tablet, that can probably just be a mistake or something like that. Yeah. So having a fallback to not ruin the whole site just because of a wrong value in the theme.json is probably a good measure, yes.

Faith Imokol: I’m thinking we now have these new Samsung phones that have come out, the flip phones. Does it become a tablet? I’m still trying to understand.

Birgit Pauli-Haack: Yeah, it’s a good question. So I saw a discussion, an issue that you can— that on Gutenberg to think through the consequences if you have more than 3 breakpoints. Yeah. Can we have multiple sizes? I mean, at one point it really becomes a usability issue. How would an editor or a user, keep in mind that, yes, I saw plugins that have 6 breakpoints and it’s really hard to control those because you never know where you have all the changes made. Yeah, and come back to it when you, when you start out, it’s probably easier to kind of think through it. But once you have a site and you need to make some changes, it’s very hard to figure out where all those changes have to be made. So it doesn’t become better with more breakpoints. I think that was a point why the Gutenberg developers started out with really honing in on the intrinsic designs, that there’s actually a seamless adaption to the screen sizes. And that’s where the Samsung folding phone probably will come in.

Faith Imokol: Yeah.

Birgit Pauli-Haack: That you’re not fixed on a breakpoint to just say, okay, yeah, it takes the space it has. Yeah. And rather do content queries rather than media queries. Yeah.

Faith Imokol: I hope we see how, what else will be added to this, cuz I think more is going to come up and shall have more settings being added to this.

Birgit Pauli-Haack: For sure. Yeah.

Faith Imokol: So, uh, notes, this is, features that I’m really excited about. It shows you how powerful Gutenberg has gotten. Being able to add notes. So the upcoming features, one of the features that we have will be auto-completing mentions. This is you’ll be able to tag an individual, a user, onto the post, and when you tag them, the prompt will be able to— will allow you to select from— it will pop up a list of the available users and you’ll be able to select the ones that you want to tag. And when they are tagged on the front end, you’ll be able to see that they are highlighted, that the tag name is— their display name is highlighted. So this is a feature that I’m really, really impressed by and hope to see how far it grows more because I’m seeing all the different possibilities that it can be used in, things like notifications. And I think this is one of the features that is being incorporated for the collaboration right. Later, even as we’re collaborating, because you can tag someone within the notes, but now you’re also doing inline, you know, you’re able to tag people within, within the context of the content that you’re creating. Yeah. So this is something that I’m really impressed by and looking forward to see how far that can be taken.

Birgit Pauli-Haack: Yeah. And now what a lot of people were waiting for, that you can actually highlight partial text and have those notes in the sidebar about a certain portion of a text and not just a whole paragraph block. And now you can also have multiple notes per block as well. So if you have here, the paragraph is, I don’t know, 10 lines long and you have something you want to note about the first line or the first 6 words or so, and then in the middle is something, and you could have notes for each one of them that then show up in the section. So it makes it much easier to streamline the conversation and to be really granular in what the notes are about or the comments are about. Yeah. And it now has a resolved divider. And so when you check a note that is resolved, it pushes it further down and has a little divider in the sidebar. So yeah, it really comes well together, this note section. Yeah. It really starts growing up.

Faith Imokol: Yeah, I’m seeing lots and lots of ways that this is going to, because I’m thinking with the resolver, adding the resolved divider, I’m seeing this going into something like project management and we’re able to add even more other statuses possibly besides just the resolved divider. Very impressive.

Birgit Pauli-Haack: I can see some plugin opportunities there to kind of collect all those and have a separate kind of setup for a whole editorial workflow where the main editor just kind of looks through what are the posts and what are the comments. And you can see, okay, or you come in as an editor and see, oh, I need to go through all the comments where I’m tagged. Yeah. So these kinds of things, I think that would be an interesting feature set to add to it. Not sure that core is actually gonna aim for it. So that might be plugin territory because, territory, because it’s a very finite use case for that.

Faith Imokol: Yes.

Birgit Pauli-Haack: The next item is by default, the admin bar is now shown for post and site editor as well. Once you’re logged in, you see a black bar on your website on top of it with some links where you can jump in different places, and that is coming to 7.1 as well. And now that admin bar has been streamlined and kind of combines the site editor navigation as well with the admin bar. And it’s really, it’s a nice feeling. It kind of feels now a little bit more consistent, and you can access the things that you could access before. Yeah, you have your site icon. You also have the big W, and that was in there before, but the header of the site editor is now smaller or the block editor. And it’s all coming together quite nicely.

Faith Imokol: Yes. Coming in version 7.1, we are having, I could say there’s a kind of more a mix of both dynamic and static content blocks, block content, where we are going to be able to have what WordPress offers. I don’t know if this is the right way to present this, but currently WordPress offers you a way of providing or creating content that is you’re either working with blocks or you’re working with your default static HTML. And this new feature of adding inner content is going to allow us to be able to add dynamic content within static content. So you’ll be able to work with your HTML and still add editable content within your static content. that is your normal HTML, but within it you have an editable, let me say, paragraph block within there. So the other content remains static, but within it you have your inner content. And we’ve been provided a new feature called inner content that we can use to set this up.

Birgit Pauli-Haack: Mm-hmm.

Faith Imokol: That is, if you’re working with if you’re creating your own code, you’ll be able to add this inner content feature and we’ll be able to allow you to create static content that has HTML blocks within it.

Birgit Pauli-Haack: Yeah. No, very well described. Yeah, I can see how that is really helpful, especially for patterns that you have editable sections and you say static, I say hardcoded. Yeah, don’t touch things as an editor. You’re right. This comes to 7.1 as well. And there are developer notes out. So it will be in the show notes so you can see the technical implementations for that in 7.1.

Faith Imokol: Yeah, it’s, it’s, it’s, it’s quite a powerful tool, I think, because it’s— I see it becoming also— it’s some— one of those features that I feel can be added onto in different ways because you’re now not just building something that is strict, but you can modify it to appeal to different scenarios and different use cases. As current cases, either you have one block that is doing one particular thing, but now here you’re able to work with blocks and also normal HTML. So it gives, as a developer, I feel it gives me some power. I’m not just leaving everything to the blocks to be doing everything, but it gives me some power to be able to add different content styles. Yes.

Birgit Pauli-Haack: Nice.

Faith Imokol: Yeah. Yeah.

Birgit Pauli-Haack: The next one is part of the Icons API. Now 23.6 Gutenberg plugin now has PHP methods To render inline SVG icons from the registry. So that can also be used in PHP-only blocks or in other templates and all that. So that also comes in 7.1, is a new API for registering icons in WordPress, SVG icons and icons collections that came in with 23.6.

Faith Imokol: I can take the next one.

Birgit Pauli-Haack: Mm-hmm.

Enhancements

Faith Imokol: Coming in 7.1. So we had some issues with the backgrounds in some of the blocks, that is the accordion, the post content block, the quotes block, the verse block. And in this, there were issues with the way the images were being handled, that is in the CSS, in the blocks, in the block CSS, which ended up blocking the gradient. It ended up breaking the gradient. So kind of could say that there was a conflict. In how the background images and the gradients were being handled. So it was causing a bug with our gradients. So this has been fixed in how the background images and the gradients are handled. And so you’ll not be able to see conflicts when you apply a gradient onto any of your blocks, especially the blocks that we have stated, that is the block quotes accordion, the pull quotes, the verses and post content blocks.

Birgit Pauli-Haack: Yeah. And actually, this fix also gives you a totally new feature. Now you can overlay the gradient onto the background image, and that gives a whole new way of designing things. And if you look at some of the PRs that are coming through and with a screen share there, it’s actually quite nice that the image kind of feels a little bit more lively when there’s a gradient on top of them. So it’s really good. 

Yeah, the latest post block received layout and block spacing support. The latest post block was historically just a re-rendering as a block from the widget section of WordPress prior to that, and hasn’t gotten a whole lot of love after that because the query block is kind of also a latest block kind of thing. But it now has layout and block spacing support so you can fit it in other places quite nicely. Speaking of the query block, it now has an option to exclude the current post from the query block, from the list of blocks, so to speak. So this gives a better feel for your single post template where you can say, okay, so this is the post with the post content, but then underneath you can add a list of blocks from either the same category or for the same taxonomy and exclude the current block. Up until now, it would always also render the current block if it had the same taxonomy. So I think that’s a feature that a lot of people actually were waiting for. It sounds so minuscule. Yeah, but it’s actually pretty powerful.

Faith Imokol: So we have a new feature that has been added to the cover block. And this will allow users to restrict the kind of videos that they want to be added to their cover blocks. Initially, currently what we have is that WordPress has a variety of different video providers that you can embed into your cover block, but this will allow you to restrict. So if you only want to display only YouTube videos, you can add a restriction that we only need YouTube videos being uploaded in our cover block. While you can switch this up to any that you want, as opposed to just allowing it to have any video embedded provider adding the videos. So this is one of those features. I think it gives us more control over what you want. Could I say, when it comes to different service providers, they provide a whole different interface and layout for how their videos play out, and this will allow something like uniformity. 

Birgit Pauli-Haack: Yeah.

Faith Imokol: Because I think it can be a little strange when you have your website on— some videos are playing like YouTube content and then it switches into another format and it’s maybe Vimeo and it all looks so different. I see this creating a better display, a better feel, but it also gives you more control on what kind of content is acceptable.

Birgit Pauli-Haack: Absolutely. So from the history, this comes after 7.0 allowed to actually use a video URL as a background for a cover. And after that was installed, there was quite some feedback from the community, especially the agency community and the enterprise level where they say, okay, I don’t want people just have video embeds from outside of, especially those that are in restricted industries, they’re regulated industries, they cannot just have willy-nilly URLs playing on their website. So they needed a way to restrict the video providers or even restrict that feature altogether. So this is a reaction of all the community feedback that came in to provide that.

Faith Imokol: Yeah.

Birgit Pauli-Haack: Speaking of video, the new client-side processing now also has a way to convert the GIF, an uploaded animated GIF. We know them from the ’90s, right? But some of the Screen recording features also do animated GIFs. And when they have one problem. It’s nice for smaller things, yeah, for 1 second or something like that. But if you have a longer GIF, you cannot control it. You cannot stop it. You cannot do anything. So some people want to convert that to a video. And now that feature is coming to 7.1, but it’s also made opt-in. So people have to say, okay, I wanna do this. And then it shows up in the block transform dropdown from a block toolbar. And then you can automatically have the GIFs converted to a video. It really depends on the video and the frame size and a lot of other things to get this right. But it’s a really nice feature.

Faith Imokol: Yeah, it’s a very nice feature in that I think now we have still, one has the ability to choose what they want, if they want to maintain the image GIF or to have it as a video. Whereby if it was a video, it could be lightweight and loads much faster than when it’s a normal GIF. GIFs tend to be quite heavy.

Birgit Pauli-Haack: Yes.

Faith Imokol: On websites. Yeah. Just a funny scenario. I went on a website that had— was literally littered with GIFs everywhere. And I’m just imagining having to work with that.

Birgit Pauli-Haack: Yeah.

Faith Imokol: How resource intensive that can be and how the performance of the website. So I think this resolves a problem that was there previously that they had tried to resolve previously. That is by allowing the conversion of the GIF into a video. So now one can choose, they can either maintain using the GIF or they can choose to go with the video.

Birgit Pauli-Haack: Yeah.

Faith Imokol: We had 2 blocks that were initially still, should I say, in production. That is the playlist block and the tab block. And these are coming out in version 7.1. The playlist block will allow you to add a playlist. If you’ve worked with any podcasting and different— if you’re doing any music playlists on your website, this block will allow you to be able to add a list of music that you want and you’re able to play it as well in one after the other. So it’s a very powerful block coming out in version 7.1. And I’m also talking about the tab— the tabs block. This will allow you to be able to organize content into tabs on your website. So it will allow you to group, literally to group different content onto your website. It’s also a very, very powerful block that I think will make a whole sense on how different content can be added onto our site. So maybe you can add on to that.

Birgit Pauli-Haack: Yeah, there were right from the beginning when Gutenberg came out, there were quite a few block collections that had tabs blocks in there. So finally it comes into core. I have a question for a developer. I don’t know how you feel about that, but doesn’t it seem that the details block, the accordion block, and the tabs block, they all kind of have the same metaphor kind of thing? Yeah, kind of. Yeah, you check something and something opens, and then you have a collection of check something and the tabs are there, or accordions kind of I mean, they behave a little bit differently, but aren’t they just a variation of the same idea?

Faith Imokol: I think it’s kind of a similar idea, especially when you see how accordions work. But they— I think it comes down to what kind of display is someone looking forward to. They may all be doing the same kind of similar thing, but someone wants their content to work differently. The tabs block, I think, gives us kind of more— I find it to be superior, should I say superior, to the accordion block in the sense that it allows you to actually group content that you’re displaying. 

So an accordion can be used for things— I could say the most common example that I’ve seen where they’re mostly applied is something like FAQs, right, where you group questions and answers. But now looking at a tab, imagine you have something like a WooCommerce site and you have all this different content that is in line with that product. You have the details, then you have the, uh, should I say specifications, then you have the pricing. So all these things can be grouped into different tabs and it can allow someone to navigate through them while providing more concrete details within them. You can do the same with accordions. But I find that this provides a better way of navigating, you know, of navigating through content. Accordions, if the content is quite a lot, they may become, I think, kind of very bulky and they create a lot. You have a lot within one thing while tabs allow you to break down that thing. And I think also, I don’t know right now, I don’t know how far this this feature is, but I think tabs can also allow you to also add different other blocks, should allow you to add different blocks within it. So you can do a lot more within, within it.

Birgit Pauli-Haack: So, and I feel it’s a little bit of a— the metaphor that tabs do is kind of more like in an office setting where you have files, folders, and then files in them that are kind of— you pull them out of the register and then you have the writers on top that are your tabs and then you can— that metaphor is kind of in a website now. And I think people can navigate that better than figuring out how an accordion works.

Faith Imokol: Yes.

Birgit Pauli-Haack: Yeah. I think you’re right there. Yeah. Well, that was actually kind of a tricky question because that question should go to the WC3 body that does the standards for HTML because that’s what these 3 blocks do, details, accordion, and tabs. They put the HTML that’s available into a block setting and then offer that as a tool to design pages and lay out the pages. So the question is actually for the WC3 standards body. Why did you come up with these different standards there and HTML tags for that? 

So I think, yeah, we have a few, 2 more updates on the visual revisions page. There is now a label for autosaves. Because the revisions historically only saved what you did, what was there when you hit the save button. And now it also adds the autosaves as separate line items to the revisions timeline. It might get a little crowded now, but you can collapse them quite a bit. And so when you leave a post that was autosaved and then come back to it again, you get a notification on top of the screen that says there is a newer version in autosave. And when you clicked on the link there, you were going back to the old revisions screen, and that has been solved too. So now this screen also goes to the new block-based visual revision screen.

Faith Imokol: I think this is one of the things— revisions is one of the things that I’m actually impressed by and excited about. I don’t know how many times I just could come back to my site trying to look through my content and going through the revisions, I’ll just give up and be like, you know, no need to go back. But I think this helps us to be able to track and actually know where in time we ended, what changed, and also being able to go through what the different revisions are. 

Birgit Pauli-Haack: Yeah.

Faith Imokol: And it’s quite also funny that the person who reported this was a first-time contributor.

Birgit Pauli-Haack: Yeah.

Faith Imokol: The person who caught this. Yes.

Birgit Pauli-Haack: Yeah.

Faith Imokol: So with the new settings that we have for the viewpoints, this is a buildup on what we had, we had talked about previously. That is being able to remember what we have, we now have a new feature that allows us to add our own custom viewpoints. in our theme that is in the theme.json.

Birgit Pauli-Haack: With the new states being for either the viewport states or the pseudo states, which is kind of hover and action on that and active, what didn’t work was that when you changed the color, you didn’t get a notification that your color choices didn’t adhere to the contrast for accessible websites. So, and normally when you change the color for the background and for the text, you get a little warning that this is not contrast-rich. You better check your color settings. This feature wasn’t working for the viewports for the mobile or tablet or for the pseudo-states. So when you change the styling for those states, you didn’t get the warning. So, and that has been rectified with 23.6 Gutenberg. And it is actually a nice, I would say bug fix, but it’s an enhancement because it was something that wasn’t there before. And I think the next one, we already talked about the inner blocks and the custom HTML block. I think we’re gonna skip through that.

Faith Imokol

This is just, I think, adding up to what we had previously.

Birgit Pauli-Haack: Right.

Faith Imokol: Because now you can add this as when you’re developing, writing your own blocks, you can add the inner blocks feature in your blocks as well.

Birgit Pauli-Haack: Yeah. Yeah. And feedback was for the block visibility. Now you actually have a setting in the theme.json to opt out so your editors wouldn’t be able to change the block visibility on any of your blocks. There’s a new theme.json property there. I think some people wanted to kind of look at that and have that available.

Faith Imokol: The next issue we have, enabling text alignment to be set by viewpoint state. So this will allow you in your, when you’re setting up your text and you’re aligning it, you can have different alignments based on different viewpoints. You can choose to, let me say, left align on the desktop and then right align on your mobile or on your tablet. So this new feature will allow you to be able to set up different alignments for different viewpoints.

Birgit Pauli-Haack: Yes, I really like that because sometimes you have a text that’s in— oh, I’m— that might be nice centered on a mobile, but it’s on this, on the big screen, you just can’t read it. Yeah. So you want it left aligned or something like that. The next one is an enhancement to the grid block. Sometimes we use the same terminology for different things. I just need to make sure that I’m looking at the same thing here, that it’s actually— it’s about the grid block. So there’s now an option to stretch the columns with an autofit for better layout flexibility. So it’s adapting to the screen.

If you wanted to, or you can say I have a fixed column width or fixed relationship to the other columns, but now there’s also that option to stretch the column with autofit.

Faith Imokol: So with the new icons feature, we now can group, should I say, we can group the different icons into different collections. WordPress is offering us a way of doing this and they’ve given us new tools, developers especially, to be able to create different groups for icons. So you can group your icons, maybe these are WordPress icons, these are Font Awesome icons, these are whatsoever different, uh, places where you’re picking your icons from. So you can group your icons. This is a very nice feature, I think, to be able to allow you to streamline so you can pick from one collection over the other. But this is one of the features that is coming in together with the updates that are being done to the icons.

Birgit Pauli-Haack: Exactly. Yeah. In the same vein now, developers are really happy about that, that they can now use digits and underscores in icon slugs. That was part of— it’s part of the registry API. And in 23.6, those things were added to the API for coming into 7.1.

Faith Imokol: Yes.

Birgit Pauli-Haack: So I think when I go through the rest of the changelog, I think we are through with that, what we talked about. But 23.6 again had about 400 PRs in there. And I’m really happy that the show is not more than an hour or so because we could kind of go on and on about a lot of things in there. 

For listeners, when we do the rundown, it has 38 pages and we’re kind of skipping over over 30 of those. So there’s a lot of work getting into WordPress 7.1, especially because the 3.6 release of Gutenberg was the last one. So everybody wanted to kind of get stuff in. That’s why it’s so exploded. But it’s mostly bug fixes from things that were in before. So we are not talking about those here. But make sure that you read the release notes that are on the Make blog and then, yeah, there’s a lot of information coming at you for 7.1. So carve out the time to study some of those that are really important for you. 

Tools

One of them I wanted to highlight is on the Gutenberg Times. There is a blog post about how to approach the iframe editor for the post editor. So the iframe that every block editor is now going to be loaded in an iframe. That has the advantages that other designs and artifacts from the admin page do not creep into the editor. And that has been done in the site editor, template editor, and the pattern editor since 2021. Only the post editor, who was— that was the first one that was a block editor, was still loaded in an admin page. And now with 7.1, the post editor will also go into an iframe. But with the history of older blocks and older block collections, there might be some quirks there. 

The rule of thumb is if you load your block in the site editor in a template or something like that and it works, then it will also work in the post editor with no problem with the post editor iframe. If you see quirks, you probably— and the article is for developers and it goes through, okay, what were other people doing with the post editor that might not work with the iframe. And it goes through all the different scenarios and how to fix them or how to alleviate them. But there’s a lot of anxiety, but I have yet to see blocks that break in the iframe. But I only have a certain viewpoint there. I only use certain things. I’m gonna put the livestream YouTube video as well as the link to the article on the Gutenberg Times into the show notes so you can all follow up on it. 

All right, so you made it, Faith! Yay, congratulations!

Faith Imokol: Thank you.

Birgit Pauli-Haack: All right, dear listeners, as always, the show notes will be published on gutenbergtimes.com/podcast. This is the 133rd episode; 133 is the episode number. And if you have questions, suggestions, or news, just send them to us in the changelog@gutenbergtimes.com. That’s changelog@gutenbergtimes.com. And thank you, Faith, for joining me for the first time. You did an awesome job. Thank you so much. And I hope you come back. I didn’t scare you away.

Faith Imokol: Thank you too. Thank you too. Thank you for having me.

Birgit Pauli-Haack: Oh, absolutely.

Faith Imokol: Absolutely.

Birgit Pauli-Haack: We have fun. Yeah. Thank you for listening, dear listeners, and goodbye and to the next time. Bye-bye.

💾

WordPress 7.1 is afoot, Gutenberg 23.6, iframed post editor, Abilities API, Studio Code and more — Weekend Edition 371

Hi there,

This week I realized, I have been building websites for 30 years. from Notepad and hand-coded HTML to HomeSiteX over Coldfusion to WordPress, Nodejs and ReactJS to Python and Claude. It’s been a fantastic journey. It never gets old. I still learn new things every single day. I cherish most the friends I made along the way. I also found my notes about the WordCamps I attended, spoke at and organized. The first one was WordCamp Tampa in 2014. In 2026, I will probably attended my 30th WordCamp as well, Athens in December 2026. It’s a bit out, so let’s see if it works out.

Back to the here and now: It’s finally here the WordPress 7.1 Source of Truth with all the big and small changes coming to a WordPress instance near you. It’s again more like a book. Digest in small dosis.

Have a fabulous weekend!

Yours, 💕
Birgit

WordPress 7.1 updates


On the WPBuilds podcast series At the Core, Anne McCarthy and I talked with Nathan Wrigley about WordPress 7.1. We cover responsive styling, the persistent admin bar, and richer inline notes, plus why the new image crop modal and customisable viewports change your day-to-day editing. You’ll also hear how community feedback saved the Classic Block, where the collaborative editing outreach stands, and which developer changes to test now.

Birgit Pauli-Haack, Anne McCarthy and Nathan Wrigley recording the podcast episode.

Responsive styling finally lands in the block editor, and The WP Minute+ podcast has release lead Anne McCarthy demoing it with Eric Karkovack. You’ll also get the reasoning behind what didn’t make 7.1, including collaborative editing, plus how Classic Block deprecation is being paced. Anne talks about her first turn as release lead and points out hidden gems like the ‘On This Day’ widget and custom icon registration for the Icon block. The episode Why WordPress 7.1 Will Improve Your Workflow is also available as video.

More Devnotes:

There are still more to come and they will be published next week, together with the WordPress 7.1 Field Guide.

A list of all the dev notes can be reviewed from the Make Core blog


Anne McCarthy gives a candid account of the punted inherited styles indicator and its design dead ends. If you’ve ever watched someone style a template expecting it to apply site-wide, that’s the problem she’s chased since the FSE Outreach Program. Blue dots, diamonds, tooltips versus infotips, two competing reset paths — none settled, and summer holidays thinned the reviewer pool. She’s aiming at 7.2.

Gutenberg 23.6 released

Last week, Gutenberg 23.6 was already released. The WordPress 7.1 tech co-lead. Aki Hamano highlighted in his post What’s new in Gutenberg 23.6? (July 22, 2026)


This week on the Gutenberg Changelog podcast, my guest was Faith Imokol from Uganda. We began with the wonderful work of the WordPress community there, who have put together a series of events — WordCamps, Campus Connect, and a website competition — bringing WordPress to schools, colleges, and universities, and to thousands of students and users. Then we turned to the latest release and had a great time going through the details. As always, the episode drops in your favorite podcast app over the weekend.

Plugins, Themes, and Tools for #nocode site builders and owners

No PHP template, no shortcode, no custom block — Meta Box fields can now feed core blocks directly through block bindings for custom fields. Lua Nguyen shows the setup: select a Paragraph, Heading, Image, or Button, open Attributes in the sidebar, pick a Meta Box source, choose your field. Sources cover post, term, author, and settings-page fields, and an image field binds URL, alt, title, and caption separately. WordPress 6.5+, though the Attributes panel needs 6.9.

Theme Development for Full Site Editing and Blocks

Coming to the Site Editor from Elementor or Divi means learning new vocabulary, and Ollie’s ground-up guide to the WordPress Site Editor by Gina Lucia covers it: templates, template parts, patterns, global styles, navigation, the Font Library, and each toolbar button, starting at Appearance → Editor. A comparison table weighs both approaches on performance, flexibility, and portability. Ollie-specific tips sit alongside the core explanations, so you can read past them if you use another theme.


A typical Elementor page ships 200–400 KB of extra frontend assets, three to five times a native block build — the number behind Bikash Pun Magar‘s case for custom Gutenberg blocks over page builders on client sites. You get conditional per-block asset loading, HTML you control line by line, and content stored in native block grammar rather than a proprietary format. He’s fair about where Elementor still fits: prototypes and solo builders wanting pixel control without code.


The theme.json schema resolves to more than 40MB across hundreds of nested properties, which is why Sérgio Santos built a form-driven visual editor for theme.json as a VS Code extension. Fields come from the official schema rather than hand-written forms, and a weekly scan of core and Gutenberg adds experimental properties with honest badges. The feature Santos says changed his workflow: every preset shows the CSS variable name it will generate as you type the slug.

There’s also a companion WordPress plugin that mounts the same editor under Appearance. There will be dragons though: 🐲 Santos flags it as an experiment as it overwrites theme.json in place with no revisions or backups.

 “Keeping up with Gutenberg – Index 2026” 
A chronological list of the WordPress Make Blog posts from various teams involved in Gutenberg development: Design, Theme Review Team, Core Editor, Core JS, Core CSS, Test, and Meta team from Jan. 2024 on. Updated by yours truly. 

The previous years are also available:
2020 | 2021 | 2022 | 2023 | 2024 | 2025

Building Blocks and Tools for the Block editor.

If your custom blocks touch the global window or document, WordPress 7.1 will break them. Ryan Welcher walks through the forced iframed post editor canvas, landing August 19th with no flag to check and no opt-out. Five demos cover viewport detection, click-outside handlers, editor styles, admin body-class CSS, and unmaintained third-party libraries, with fixes using ownerDocument, defaultView, useRefEffect, editorStyle in block.json, and patch-package. His demo plugin ships broken and fixed versions of each.

Welcher also published a detailed tutorial: The post editor is going full iframe: what block developers need to know before WordPress 7.1

What’s new in Playground?

Some people still assumed every Playground was temporary. Persistence, multiple sites, Blueprints, file editing — all already there, just easy to miss, which is what the new WordPress Playground interface sets out to fix. A customizable Dock gathers those tools into one bottom toolbar: New, Playgrounds, Blueprint, Site Settings, Database, Files, Logs, Export. It’s navigation, not new capability. The design came out of the Playground table at WordCamp Europe Contributor Day, after Adam Zieliński used AI to explore 400+ variations.


Point a coding agent at WordPress Playground and it reads an instruction file first. The wp-playground agent skill now splits that file into a 52-line router plus focused references, so your agent loads the CLI details only for a local run and the sharing rules only for a share link — encoding, CORS, public hosting. Fellyph Cintra‘s four-scenario benchmark scored 24/24 against 22/24 for the old version, one run per prompt. All this is explain in more details in the post One Playground, three workflows: Consistent agent guidance across surfaces in the team’s Make Blog.


In a third post, Fellyph Cintra walks you through programmatic site management in WordPress Playground: from DevTools you can list, create, save, rename, and switch sites, change PHP or networking, and run PHP inside a site to check active plugins. Order matters — temporary sites must be saved before you can rename or reconfigure them.

One caveat worth knowing if it runs alongside the other Playground item: this API belongs to playground.wordpress.net only. It isn’t in the @wp-playground/client package, the CLI, or embedded Playgrounds via /remote.html — those need the JavaScript API instead.

AI and WordPress

Carlo Daniele‘s guide to the Abilities API for plugin developers stays on fundamentals: the input schema, output schema, callback, and permission check that together form an ability’s contract, and the WP-CLI commands that let you inspect one. A fresh install ships three — site info, user info, environment info. His example registers an audio-to-blocks process from an existing plugin and triggers it over the wp-abilities/v1 REST route.


Where Carlo Daniele registers a single ability, Jonathan Bossenger composes three into your first AI-powered WordPress plugin. Two call the AI Client, a third orchestrates them via wp_get_ability() and execute(), turning an image URL into a draft post. The same ability then answers over curl, from a React settings page, and from Claude Desktop through the MCP Adapter. Gotchas included: base64 data URIs for vision providers, stray markdown fences, and request timeouts.


One rule for this stream: no hand-written code. Ryan Welcher takes a full WordPress site build with Studio Code end to end for his son’s hockey team, and you watch a custom post type, a teams taxonomy, an Advanced Query Loop roster, and junior/intermediate/senior tabs come together by direction alone. The highlight is the agent reaching for block bindings unprompted. The lowlight: rogue PHP metaboxes, and a PHP-first answer where he wanted a SlotFill.

Need a plugin .zip from Gutenberg’s master branch?
Gutenberg Times provides daily build for testing and review.

Now also available via WordPress Playground. There is no need for a test site locally or on a server. Have you been using it? Email me with your experience.


Questions? Suggestions? Ideas?
Don’t hesitate to send them via email or
send me a message on WordPress Slack or Twitter @bph.


For questions to be answered on the Gutenberg Changelog,
send them to changelog@gutenbergtimes.com


Featured Image:


#227 – Maciek Palmowski on Testing Secure WordPress Hosting: Does the Marketing Match Reality?

Transcript

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, testing secure WordPress hosting, does the marketing match the reality?

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today we have Maciek Palmowski. Maciek is based in Poland and works at Patchstack, one of the companies in the WordPress ecosystem dedicated specifically to security. At Patchstack, Maciek collaborates with other security professionals on industry reports, bug bounty programmes, and solutions for agencies, product owners, and hosting companies aiming to secure their client sites.

I met up with Maciek at WordCamp Europe, and we discussed his presentation there. It examined the claims of secure hosting made by many WordPress hosting providers. He describes how Patchstack set out to test these claims with real world penetration testing, using 30 known plugin vulnerabilities across multiple hosts. Employing standardised methodologies and validating their results independently.

The findings are sobering. The majority of WordPress specific attacks still get through, and there’s a significant gap between the marketing hype and real protection.

The conversation starts with Maciek’s background, and how his journey in the WordPress security space led to a focus on the promises made by hosts.

From there, the discussion gets into the research approach, the selection of well-known vulnerabilities, consistent testing across different hosting environments, and the surprising result that even hosts with identical security tooling produce drastically different outcomes, showing it’s not just about the tools you use, but how you use them.

We talk about the Swiss cheese model of security, every layer will have holes, so you need multiple overlapping defences, and honest communication from hosts about their limitations.

We also explored whether an industry-wide standard, or badge, for secure hosting is feasible or even desirable, given how easy it is for strong marketing claims to outpace reality.

AI also enters the conversation, increasing both the speed and sophistication of attacks, and making patching, and processes, even more important, especially as the volume of vulnerabilities continues to rise and the time to exploitation drops.

If you’re interested in understanding what secure hosting really means, how to ask intelligent questions of providers, and the realities of WordPress security in 2026, this episode is for you.

If you’d like to find out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Maciek Palmowski.

[00:03:56] Maciek Palmowski: I am joined on the podcast by Maciek Palmowski. Hello Maciek.

Perfect. You did great.

[00:04:01] Nathan Wrigley: For some reason, your name has got into my head. A lot of the people that I interview, I struggle with their name, and I continue to struggle, but for some reason, I established many years ago that was how to say your name. And I think I’ve done it correctly ever since then.

[00:04:16] Maciek Palmowski: Yes you did. You’re almost having the typical Polish accent, so you’re doing great.

[00:04:21] Nathan Wrigley: So we are at WordCamp Europe, which is in Krakow, or Krakow, I don’t know how.

[00:04:26] Maciek Palmowski: Krakow.

[00:04:27] Nathan Wrigley: Thank you, that was good. And the reason Maciek is correcting my pronunciation is because Maciek is actually from Poland, which I suppose means that this is a bit of a, well, it’s like a home game to you.

[00:04:37] Maciek Palmowski: In a way so, but it’s also like a bit of a shame because I do like travelling when WordCamp Europe’s are happening. And, you know, just hopping on the train and going to Krakow, it was like a, I mean it’s cool because, yeah, the venue’s amazing, everything is great, but still I’m staying home, so yeah.

[00:04:53] Nathan Wrigley: Yeah, mixed feelings. So Maciek has done, or is going to do a presentation at WordCamp EU. Have you done it yet?

[00:05:02] Maciek Palmowski: I will do it tomorrow.

[00:05:04] Nathan Wrigley: Okay. And are you all set, are you one of these like really prepared people that has all the slides done, or are you last minute?

[00:05:11] Maciek Palmowski: Everything is ready. I already did one version of it at the Checkout Summit in Palermo, so.

[00:05:17] Nathan Wrigley: Oh I see. So you’ve had a sort of dry run of elsewhere.

[00:05:19] Maciek Palmowski: Of course.

[00:05:20] Nathan Wrigley: Excellent. So the presentation, which is going to be the focus of today’s conversation, is called Testing the promise, does secure hosting deliver? And I may as well read the blurb because it was a reasonably short one.

So it says, secure hosting, in quotes, is everywhere in WordPress. What does it actually protect against? We put this claim to the test with real penetration testing. 30 known vulnerabilities, multiple hosting providers, standardised methodology, validated by independent observers. The findings reveal a critical gap between marketing and reality. WordPress specific attacks succeed most of the time. That’s quite an alarming sentence. This talk shares the complete results and explains why generic security fails.

So, we’ll get into that in a moment. But as with all people, when I’m talking to them about security, I guess it’s good to establish who you are, and what your credentials are and what you’ve done, and how is it that you get to talk about security with authority. So over to you really, a little moment to give us your bio and tell us about you.

[00:06:20] Maciek Palmowski: Okay. So I work at Patchstack, and Patchstack is one of those few companies in WordPress space that are doing a lot in terms of security. We are constantly running this bug bounty for the whole ecosystem. We have quite a few solutions for both clients and hosting companies, and I work there right now. My role is, if I remember, the Growth Team Engineer, something like this.

But yeah, I do spend a lot of time working with other security people. So when we are working on all the reports, when we are checking the data, I’m also part of those teams that are working on it. So yeah, I think I know a thing or two about what is happening behind the scenes when it comes to WordPress security.

[00:07:02] Nathan Wrigley: Yeah, thank you. Always good to get that established though, right at the outset.

Patchstack is a company which is not a host though, I suppose that’s important to mention at the beginning. It’s a company which is in the security space, very much in the WordPress space, but perhaps more broad than WordPress, I’m not sure. But not a hosting company.

But obviously your presentation focuses its aim on hosting, I guess because that’s one of the places where the claim about security is most often made. You know, you’ll go to a, the landing page of hosting Company X, and you’ll see somewhere fairly near the top, secure hosting, or something along those lines. And you’ve decided to examine that in fine detail and look at these 30 vulnerabilities.

I guess really just tell us about this test and what it is that you decided to do and some of the items that came out of that.

[00:07:50] Maciek Palmowski: Okay, so maybe let’s start with how it even started, right? Because there was a trigger. At some point we published one report about the state of WordPress security. We tweeted about this. We got the response from none other than Matt Mullenweg, who kind of asked a very interesting question, but isn’t hosting companies taking care of this already?

And this was, kind of at this moment when we were, we thought that we know the answer that, no they aren’t. But to be honest, we didn’t have any broader proof about this.

We knew how it’s working at some hosting companies, but we could say that it was more of an anecdotal evidence that we had. So this was kind of the trigger that made us, okay, let’s check this. But not with one partner or two partners, but with more hosting companies.

So we did this research twice. First we just did kind of a beta run because we weren’t sure about the result and, is it even a good idea to go deeper inside of it? And during our first run, we were already very surprised because like the methodology was very simple. We just installed vulnerable plugins and we checked if we would be able to use the vulnerability. Because if the hosting is claiming that, we got your back, we are making your website secure, we have this and that, this means that they should protect against it. So it was as simple as that.

And when we were doing our first test, we were quite surprised because we saw, if I remember, that 80% of the attacks went through. 80% of the attacks. So our first reaction was, okay, we are doing something wrong. Okay, this was only few hosting companies, less plugins, but still the result were so surprising for us because we thought that, okay, that the problem exists, but it’s not that big of a problem. But it was.

So that’s why we did the second test. And this is about which the, my talk will be mostly when we tested more hosting companies, more plugins. And we saw that the problem still exists.

Of course it was, in some cases 70 few percent. So still, it’s a huge problem, especially if we are talking about some companies that are literally saying, you don’t have to install anything additional when it comes to security on your website. We got your back. They don’t. We found a lot of interesting things, but still the problem exists.

[00:10:21] Nathan Wrigley: So just deep diving into that a little bit, when tests like this are done, there’s obviously, the claim might be levelled, you know, obviously Patchstack would, this kind of maybe benefits Patchstack, if you know what I mean.

So let’s just sort of clear up what the test involved. So presumably the plugins that you chose are ones where it’s publicly known that there’s a vulnerability in this component or this particular file or what have you. So is that the case? This is stuff that, longstanding understanding that there’s a problem here.

[00:10:51] Maciek Palmowski: Yes. We only use the plugins that we had all the proof of concepts. So we know how have the vulnerability happened, what was the attack vector? They were all reported through our bug bounty programme, because that’s why we had the proof of concept. Yeah, and that’s it.

It was, like I said, it was as simple as that. We had a really broad mix of all the plugins. How many? It was 30 something of those plugins, if I remember. Different ones. Some were connected with WooCommerce. So, like a very broad selection of them. Different vulnerability types. So we try to mix it up as much as possible.

[00:11:27] Nathan Wrigley: Was the situation for each hosting company the same though? In other words, was the things that you did in one hosting environment the exact same as you did in another hosting environment? No. You mixed that up a bit as well.

[00:11:38] Maciek Palmowski: I mean we used all the same plugins, like the methodology was always the same. But we got totally different results. Even if, and this was one of the most interesting findings, because very often hostings will put a logo of some company that takes care of security. For example, say, Cloudflare. And despite using the same stack for security, they got different results.

[00:12:02] Nathan Wrigley: Interesting.

[00:12:03] Maciek Palmowski: So it turns out, in many cases, it’s not about the tools that you are using, it’s how you are using them, which was very interesting. And we did everything. We tried to enable every feature, every security features on those hosting, to kind of give them a chance to kind of make sure that they are defending the most as they can.

And the result in most cases was very simple. They were doing quite well with the generic ones like uploads, patch reversal, things like this, which are very generic in PHP. But with those WordPress specific attacks, they just failed miserably.

[00:12:44] Nathan Wrigley: That’s so interesting. The word secure hosting, which you’ll see all over the place, it feels a bit like using the word healthy on food. There’s no real definition of what healthy is. You know, a company selling chocolate could probably pretend that it’s healthy compared to something else.

[00:13:04] Maciek Palmowski: Like here, healthy chocolate is exactly, like in some cases secure hosting.

[00:13:07] Nathan Wrigley: Right. So what do you take from this then? I mean basically, is your survey saying that whenever you see the word secure hosting, be sceptical?

[00:13:16] Maciek Palmowski: Yes.

[00:13:16] Nathan Wrigley: Okay. As simple as that.

[00:13:18] Maciek Palmowski: It’s as simple as that. Because one of the things that we were always promoting, security is not a plugin, it’s not a one button thing. Security is a process. It’s layers.

And that’s kind of why we, especially after this report starting kind of using the term, Swiss cheese layer model. Because every layer will fail in some way. That’s also why you still need all the security solutions that hosting provides, because they do have a lot of interesting solutions against those generic attacks.

Because they’re doing really great when it comes to those generic ones. And that’s great because some of the attacks will be already dealt with. So whatever passes to the second layer, it has less work to do because a lot of it was already stopped at the first layer. The second layer should be something more WordPress specific that understand what is installed. And with this it can catch also a lot of it.

But still, you have to be prepared that, because again, this layer also isn’t perfect. Because there are zero days vulnerabilities, there are custom code, there are a lot of things that can happen, that your website will be hacked. I mean, weak password. Simple as that. That’s why you also need to have a layer, which will be more of what to do if everything else fails. Because you do need to know that you have to inform your clients, all the GDPR related things. How to kind of, I don’t know, use the backups.

In short you need to have procedures. You have to be prepared before the attack happens. Because let’s be honest, asking some lawyers about, what should we send to our clients? The moment when, well, the milk is already spilled. It’s like the worst moment to think about it. Especially that, hey, your website was just hacked. It’s not just a technical problem, it’s also a business problem. Again, with those GDPRs and everything.

So yeah, the more layers, the better. You still need to remember, every layer can fail in some place. That’s why the more, the better.

[00:15:29] Nathan Wrigley: Would you like to see a standard industry-wide definition of something like a badge or, I don’t know, let’s say for example, that you put the word secure hosting on your website, that has to actually stand for something.

Because obviously coming from the background that you do with a broad oversight on what that is, you have a vast amount of data at your disposal. You can see all of this kind of stuff. But every company can make the claim that our food is healthy, our hosting is secure. But I don’t know, in the model that we’ve got where any company can put anything they like on a website, I don’t really know how you do that, but some sort of accreditation or something. I don’t know.

[00:16:08] Maciek Palmowski: Honestly, it’s really difficult because as I said before, a lot of companies using the same tools were failing in different ways. So that’s a problem. On the other hand, like sometimes the, those stupid things like weak passwords. And it doesn’t matter that you had a, let’s call it a certified secure hosting, you still failed because your password was weak, you know? So, also certificates like this can backfire because some people might think I have a secure hosting, I don’t have to worry about things. And then you have 10 admin accounts for everyone.

[00:16:43] Nathan Wrigley: Is there is there something, some mark of that description that you, personally, that you go looking for though? Is there some credentialing system which you think actually does carry some weight? So for example, I don’t know, like the insurance space or the accountancy space or something like that. You have to have that accreditation in order to do business. Is there something like that? Is there a mark which hosting companies can apply for which you could have some confidence in it?

[00:17:13] Maciek Palmowski: Okay. So for sure one of those things would be, and I don’t want to say it as an advertisement, but it is a thing that you see that the hosting is thinking a bit better about security, kind of looking if they are a Patchstack partner. Because this kind of automatically means that they do have this WordPress, the security WordPress layer. So that’s already a good sign.

So yeah, I would start with this. I think that’s kind of one of the simplest ways, but again, Patchstack isn’t the only solution that does it. So looking for partners of such companies might be the best way to start because having those Patchstack aware security solutions built in, into the hosting is a really good sign.

[00:18:05] Nathan Wrigley: Yeah, okay. Now, the inevitable conversation in the year 2026 is AI. It doesn’t matter which area of WordPress you’re talking about. AI manages to get in somewhere. I am presuming that the landscape in terms of security only got more complicated because of AI. Because I’m imagining that attacks that needed to be conceived by a human can now be conceived in a fraction of the time by an AI agent. But not just one, maybe a dozen or a thousand or whatever it may be.

Let’s just talk about that for a moment. It feels almost as if AI and security are like, that’s a real systemic problem for the future of the entire industry. Because these things can happen so fast, a plugin vulnerability is discovered by an AI agent. It then discovers the attack surface, implements the attack all in a matter of seconds, possibly. What’s the position? Like, how do we stay calm basically in the year 2026?

[00:19:09] Maciek Palmowski: So the problem already existed around a year ago, because a year ago when we did our State of WordPress Security Report, we already saw that vulnerabilities are being used after around five hours after kind of being published. So five hours. That’s the first thing, because we still have a lot of people that say, yeah, just update your WordPress weekly and you’re good to go. No, you’re not. Looking at this number, you have five hours.

[00:19:39] Nathan Wrigley: Okay. Let’s just parse that at the moment. So the vulnerability is published. So there’s a whole thing there, like the vulnerability may well have been discovered prior to being published, so that’s a whole other thing.

[00:19:52] Maciek Palmowski: So first the vulnerability is discovered. Then at least how it works on, with our bug bounty. We inform the vendor they have, let’s say around a month to fix it. When they fix it, we publish everything and, yeah.

[00:20:09] Nathan Wrigley: Okay, so from the moment you publish, you can then detect that that is being leveraged within a space of five hours.

[00:20:17] Maciek Palmowski: Yes.

[00:20:17] Nathan Wrigley: Okay, that’s really interesting.

[00:20:19] Maciek Palmowski: But there is a problem. There is a really big problem. So if the vendor doesn’t respond, we still publish it.

[00:20:26] Nathan Wrigley: How long do you give them? Is it like.

[00:20:27] Maciek Palmowski: It is the one month.

[00:20:28] Nathan Wrigley: Okay, thirty days.

[00:20:30] Maciek Palmowski: Of course, if they reach out that there is some problem, they need like extra days. But in most cases, we’re talking about the vendors that just don’t respond at all. We publish it anyway.

But the problem is that, from all the vulnerabilities that were discovered last year, 50% weren’t patched at the moment of publishing about it. 50%.

[00:20:50] Nathan Wrigley: So half of the plugins where there was a known vulnerability, the vendor had been informed, they’d had this 30 day window. Half of them made no amendment to their code.

[00:21:01] Maciek Palmowski: Exactly.

[00:21:02] Nathan Wrigley: Okay. Wow, okay.

[00:21:03] Maciek Palmowski: Again, going back to this classical, yeah, just update your WordPress regularly. No.

[00:21:08] Nathan Wrigley: No, that’s a really different surface, isn’t it?

[00:21:11] Maciek Palmowski: It doesn’t work on so many levels. Because not only the problem is with the fact that, still the famous five hours, which also, it’s five hours now. It was much longer a few years ago. On the other hand, yeah, most of those, I mean around half of it aren’t patched, so the attacks will happen quicker than it get patched. So yeah, there is a lot of problems like this. And also the problem with security is that it’s really difficult to sell.

[00:21:39] Nathan Wrigley: It’s like insurance, isn’t it?

[00:21:40] Maciek Palmowski: Yeah. But insurance, okay, you see your car, your house, it’s real. It’s real, you kind of see it. The only category of websites that it’s much easier to kind of explain is e-commerce.

[00:21:54] Nathan Wrigley: Yes. You can feel the tightening on your wallet.

[00:21:56] Maciek Palmowski: They literally see the money. They can kind of really, okay, one hour of my website not working equals this and this Złotys or Euros or whatever. So that’s easier to explain. But for most people, yeah, security, meh.

[00:22:11] Nathan Wrigley: Yeah. That’s really interesting. So you mentioned, about this survey, you mentioned that fully 80% of your penetration testing resulted in something. What were the sort of, the high level items? Apart from that 80% figure. What were some of the other, because you said there were a few interesting things that dropped out of it. Can you mention anything else?

[00:22:31] Maciek Palmowski: So like I said, one of the things was that we learned that, despite using the same tools, we got different results. That was also a surprise for us.

[00:22:39] Nathan Wrigley: So let’s just figure that out. So at hosting company A, we’ve got a WordPress website with the same collection of plugins in. Hosting company B, exactly the same as far as you can make it the same, but things are different.

[00:22:52] Maciek Palmowski: No, no, they are, for example, they’re using for security the same tools.

[00:22:56] Nathan Wrigley: Right, okay.

[00:22:57] Maciek Palmowski: So in theory, if they’re using the same tools, we should have exactly the same results.

[00:23:03] Nathan Wrigley: So does that then point to a different set of configurations on the backend, or is it more curious than that? You just don’t quite know what’s going on.

[00:23:12] Maciek Palmowski: I mean because it’s not something that they will tell us. But yeah, in most cases, it’s all about configuration because the fact that you’re using a tool, it’s also important how you use a tool.

Also, with security is very often about, is something easy to use or is something secure? And kind of finding the balance. So some of the companies probably had a bit more aggressive configuration, which is better from the security point of view, but probably more often result in some annoying side effects for the user.

Also what, this was one of the most interesting things, but also what was very interesting because we contacted every company afterwards and we informed them that we did the test. Here are the results, what went through, what was blocked. And some of the companies did an amazing job of fixing whatever they could. On the other hand, we saw that some of the companies, because we did some extra tests later just to check what they did with our report, did nothing.

That’s one of the things about security in general, not about the hosting, about even having vulnerability in your plugin. That’s normal that we make mistakes. We’re humans, right? So that’s normal. What’s important is how we deal with them. If you have a problem and you fix it as quickly as possible, as good as possible, that’s great because you learn from your mistakes, you fix it, and you move on. Perfect. Good job. Now you are in a much better position than before. But if you get this, you look at it and you say, ah, this is fine, that’s the worst behaviour from the security point of view that you can have.

[00:24:57] Nathan Wrigley: I’m going to ask you not to name names here, but were some of the companies familiar to us?

[00:25:05] Maciek Palmowski: For sure, because we did test the biggest ones. But there is a reason why we didn’t want to name them, and it wasn’t about that we were afraid that I know someone will get mad or whatever. It was more about this weird side effect that could happen.

Some users would think, my hosting isn’t on this list, so probably I’m secure. Probably you’re not, you just weren’t in the test. Because we also did some site checks and everything. And we saw that a lot of those problems happen at most of the hosting companies. And like I said, the more important part was how did they reacted after getting the report. Like I said, it was a more common problem that we even thought.

[00:25:43] Nathan Wrigley: Do you, obviously, you know, caveat all of this with the fact that you work for Patchstack and what have you, do you see it even as the role of a hosting company to have any position on security publicly? Or would you prefer them not to make grand claims about things that you believe they can’t necessarily substantiate?

I don’t really know where I’m going with that question, but I’m just wondering if there’s just a sense that the language that’s being used is too strong. You know, secure hosting implies we’ve got all the padlocks, and the padlocks are there and you’ve got nothing to worry about. You’ve found a different picture. So I’m just wondering whether or not you would just prefer that the hosting companies stop talking about this altogether.

[00:26:27] Maciek Palmowski: I do think that’s, one of the biggest problem here is about the claims, the bold claims, the whole marketing around it. Sometimes even you can find documentation of some of them that, yeah, you don’t need to install any third party tool because we got you covered. We checked it, no they didn’t. So that’s kind of the problem.

It’s really more about the, how they market it. If they would say, okay, so we have a really performant hosting that does this, this and this. When it comes to security, kind of do it yourself. I mean we are providing this layer, but the rest is up to you. And that’s okay. That’s an honest claim. We are not doing everything for you. We are doing this part, but this is up to you. This would be much better.

I know that from the marketing point of view, it doesn’t sound as good as, we got all the security that you can imagine, don’t have to worry about this. Because that’s kind of the thing that very often managed hosts trying to sell, that you don’t have to worry about things. You just have to focus on whatever you have, writing content, selling stuff. If you have a e-commerce, whatever, that’s it. That’s kind of the only thing you should think of. Not about performance, because we got your back. Not about security, again, we got your back. And if you are paying for a managed hosting and suddenly they would start having like this different way of messaging to, it’s not that obvious that we have your back in everything. That would be very difficult for them.

So now it’s kind of the problem that, because everyone is kind of using this messaging, everyone else also has to. And also if we think about how a lot of those algorithms, look like that algorithms love bold claims. They want something white or black, not grey. And the truth is, most of the things we are talking about, it doesn’t matter, security, SEO performance, it’s everything in the grey zone. That’s why a lot of developers can end their talk with, yeah, it depends. There is no right or wrong. It depends because there are so many things you have to think about.

I could say that, and this is my kind of thing that, most of the websites that people have should be static. They don’t need even WordPress at all. This is a horrible claim if you’re a manager of a WordPress hosting, right? So that’s the thing. But it all depends on so many things, but yeah, the messaging is important.

[00:29:08] Nathan Wrigley: Yeah, if you were, on a personal level, if you were going out there looking and let’s say, if you can somehow put your job hat to one side, what would be the kind of things that you would be looking for? What questions would you be asking related to security if you were to be going to these companies?

From everything that you said, obviously it’s not black, it’s not white, it’s definitely grey. So every setup has some way of being vulnerable. But what are the kind of intelligent questions that you would be bringing to hosts to get some reassurance that at least they appear to know what they’re doing, even if they can’t make the claim that they’re a hundred percent cast iron, water tight? What might be some intelligent questions to start asking?

[00:29:49] Maciek Palmowski: One of the best questions you can ask is just, is there any solution in your security stack that is WordPress aware? Not the general one. Because if they only start talking about some web firewall, things like this, it’s already kind of a red flag. Because this is, overall, if we’re talking about firewalls, that’s not the correct layer about which, this is the generic one.

So this is the main question. How do you take care of WordPress specific attacks? Simple question. And if they will start responding, yeah, that we have this web application firewall that, in most cases this will be a sign that, no, we are not talking about the correct layer. That’s not it. It’s probably not aware about what is happening in WordPress.

[00:30:40] Nathan Wrigley: Okay. So given that this is a WordPress podcast, and we are at a WordPress event, that would be the beginning of your questioning is demonstrate that something in your stack is specific to WordPress.

[00:30:52] Maciek Palmowski: Exactly.

[00:30:53] Nathan Wrigley: Okay. And beyond that, is there any questions that, so let’s imagine that they come back with, yes, we have something specific, it’s WordPress. What would be sort of sensible follow up questions?

[00:31:00] Maciek Palmowski: I mean you can kind of start off about, okay, what exactly you are using? Because there is a limited amount of tools that are really WordPress aware. So if they will answer with kind of a product name, that’s kind of the easy way that then you can check it on your own. But that’s kind of the thing. Is it WordPress aware?

[00:31:19] Nathan Wrigley: Does it worry you in some way that there’s this perception out there that WordPress is insecure? You know, if you ask a thousand people, you’d maybe get 800 saying, oh WordPress, you know, we’re not touching that with a barge pole.

Do you worry that content like this, that you are putting out, that that might fuel that fire? Does it concern you in any way that it might lean into the argument that, I don’t know, somebody can link to that blog post from a rival CMS, or a SaaS platform, which does something similar to WordPress? Where do you sit on that?

[00:31:51] Maciek Palmowski: That’s a really difficult question. And this is one of the questions that when I talk on non WordPress events, I love to ask people. Is WordPress secure? And in most cases, I see that most of the room is, yes, it’s unsecure for sure. And I’m like, no, that’s not true. WordPress is secure. Every year there is just a few minor vulnerabilities in Core. That’s it. The problem is, of course, that WordPress on its own lacks some functionality. That’s why we install plugins.

And here we enter another problem because, okay, every year we have like thousands of those vulnerabilities in general in plugins. On the other hand, we have thousands of plugins. So kind of statistics will always look bad. But that’s why every time when you want to select a new plugin, you need to do some research. Yeah, I know it’s boring and everything but, hey, now we have AI, you can do it much quicker. It can help you a lot.

But looking at all those databases, for example, we have one database, WPScan has. There are those databases of WordPress vulnerabilities that occur to every plugin. And you can see, is the plugin you’re interested in had a lot of vulnerabilities? On the other hand, how it kind of looked historically. It’s not just about the number of them. In general, it requires some research.

And yeah, if we are just like looking at this, and this kind of vibe that right now we have that we are just about really bold opinions stated quickly that will fit one TikTok, yeah, WordPress is in a horrible position because, let’s be honest, it’s like, if you have, I’m not sure how many seconds does a TikTok movie has?

[00:33:39] Nathan Wrigley: I think 30.

[00:33:40] Maciek Palmowski: Okay, let’s say 30. So it will sound much better that you will say, yeah, WordPress is unsecure, which is not entirely true because it depends again. One of the most boring, especially again for those algorithms and everything, it’s a grey zone.

Because we are collaborating with a lot of companies that are making plugins, and we see how their security flow looks like. How they are dealing with vulnerabilies that are discovered. And honestly, I’m amazed how well some of those companies are doing it. They are very serious about it. They understand how important it is. For them it’s something very important.

[00:34:22] Nathan Wrigley: I suppose WordPress is a victim of its own success in that sense. And it would be a bit like, I guess a good analogy might be if you’ve got a car manufacturer and they produce a thousand cars a year and you compare them to Ford who make, let’s say, I don’t know, 20 million a year. And the question is, well, whose cars break down more often?

[00:34:41] Maciek Palmowski: Yeah. Do we look at the percentage of the number?

[00:34:44] Nathan Wrigley: Right. And if you say, well, 400,000 Fords broke down last year, and one of these other manufacturer, you can immediately see why there’s a problem there. And that I think is the landscape in which WordPress is often painted. The reason there’s lots of publications like yours bringing out WordPress information is because it’s the most popular thing. It makes sense to write about the most popular thing and to try to find the vulnerabilities and disclose them in a sensible way. So I don’t know what we do with that. It is just the way it is.

[00:35:15] Maciek Palmowski: I would also say there is one more interesting aspect because WordPress is considered unsecure because of the plugins. But what’s funny, for example, Elementor is also considered unsecure because there are plugins for Elementor. This is a very weird moment when the thing that brought WordPress to its bigger success, security wise, is its biggest problem right now.

Because WordPress did a lot of, I mean it was always great to, being as it’s kind of, let’s call it entry level CMS. For many people, it was also the way how they began the adventure with PHP development because it was so easy. Now we kind of have the, all the consequences of being that easy.

[00:36:06] Nathan Wrigley: Yeah, in a sense, this is going to sound ridiculous, we should be glad that there’s people talking about WordPress vulnerabilities, because it means the project is successful. And it also means that it’s, there’s an industry of WordPress security solutions, and there are people who take this very seriously and dedicate their lives to it. And you may not find that in some of these other ones, you know, some of the smaller CMSs and things like that.

I think we’ve probably hit about the sweet spot for the amount of time. But Maciek, I don’t know if there was anything in that report that you have got lined up in your presentation that I never got to. If there was a particular thread that you wanted to pull. If there is, go for it.

[00:36:46] Maciek Palmowski: No, I think we covered all the important things. And as you kind of said, this AI aspect, this will change so many things.

[00:36:55] Nathan Wrigley: Yeah, we’ll come back in two years and this conversation will be a very different thing.

[00:36:57] Maciek Palmowski: Oh, I think even in few months which will be very interesting. Yeah, so this aspect, it’s really very surprising. And I think that everyone who is right now kind of giving somewhere a talk about AI and security is in a very difficult spot because.

[00:37:14] Nathan Wrigley: Yeah, your content is going to look stale quickly.

[00:37:16] Maciek Palmowski: Yeah because you know it’s like, but a week ago everything changed. Yeah, I have to rewrite everything.

[00:37:20] Nathan Wrigley: Speaking of which, by the time that this goes out, hopefully you have managed to give out your presentation at WordCamp Europe. I will link to it and anything else that we’ve mentioned today in the WP Tavern post. So go and check that out. But I will specifically link to the wordpress.tv version of your presentation, which no doubt will have been created by then. So Maciek, thank you for chatting to me today. Good luck. I hope presentation goes well.

[00:37:43] Maciek Palmowski: Thank you. Thank you so much. Yes. I might need a bit because, you know, it’s WordCamp Europe. It’s a big conference.

[00:37:49] Nathan Wrigley: It is, yeah. Good luck. I hope that you manage to stay calm.

[00:37:52] Maciek Palmowski: Thank you.

On the podcast today we have Maciek Palmowski.

Maciek is based in Poland and works at Patchstack, one of the companies in the WordPress ecosystem dedicated specifically to security. At Patchstack, Maciek collaborates with other security professionals on industry reports, bug bounty programs, and solutions for agencies, product owners, and hosting companies aiming to secure their client sites.

I met up with Maciek at WordCamp Europe in Kraków, and we discussed his presentation there. It examined the claims of “secure hosting” made by many WordPress hosting providers. He describes how Patchstack set out to test these claims with real-world penetration testing, using 30 known plugin vulnerabilities across multiple hosts, employing standardised methodologies, and validating their results independently. The findings are sobering. The majority of WordPress-specific attacks still get through, and there’s a significant gap between the marketing hype and real protection.

The conversation starts with Maciek’s background and how his journey in the WordPress security space led to a focus on the promises made by hosts. From there, the discussion gets into the research approach: the selection of well-known vulnerabilities, consistent testing across different hosting environments, and the surprising result that even hosts with identical security tooling produced drastically different outcomes, showing it’s not just about what tools you use, but how you use them.

We talk about the “Swiss cheese” model of security, every layer will have holes, so you need multiple, overlapping defenses, and honest communication from hosts about their limitations. We also explored whether an industry-wide standard or badge for “secure hosting” is feasible or even desirable, given how easy it is for strong marketing claims to outpace reality.

AI also enters the conversation, increasing both the speed and sophistication of attacks, and making patching and processes even more important, especially as the volume of vulnerabilities continues to rise and the time to exploitation drops.

If you’re interested in understanding what “secure hosting” really means, how to ask intelligent questions of providers, and the realities of WordPress security in 2026, this episode is for you.

Useful links

Patchstack

 Checkout Summit

Testing the promise: does secure hosting deliver? – Maciek’s presentation at WordCamp Europe 2026. It includes the video of the presentation.

 State of WordPress Security in 2026 Report

WPScan

💾

WordPress 7.1 Beta 3, AI in Action at #WCUS, Playground UI testing and more — Weekend Edition 370

Hi,

After a few month dealing with a bad knee and a bad back, I enjoy moving again. As long as the weather is nice, I will be biking, swimming and walking the city with all the tourists that populate downtown Munich.

From an SEO veteran’s surprisingly upbeat take on WordPress market share to a one-file answer to “what makes a block theme,” this week’s finds dig a little deeper than the usual headlines. There’s also plenty of hands-on material, whether you want to test 7.1 Beta 3, try the new Playground UI, or get your store ready for agentic commerce.

Enjoy your weekend!

Yours, 💕
Birgit

WCUS 2026 has a dedicated AI track

The AI in Action sessions are built around the questions site builders are actually sitting with right now. How do you set guardrails for AI-assisted development without losing client trust? How do you build sites that serve AI agents as visitors, not just humans? What are the legal and ethical boundaries when you put AI tools in front of clients?

They’re practical sessions for developers navigating a workspace that changed faster than anyone planned for. The full schedule is live. If you’re figuring out how AI changes your pricing, your workflow, or your service model, this is a rare room to be in.

August 16–19, Phoenix Convention Center. $100 includes four days, all sessions, lunch, and the community social.
🎟 us.wordcamp.org/2026/tickets

WordCamp US 2026

Developing Gutenberg and WordPress

WordPress 7.1 Beta 3 is now available for testing.

Rae Morey, The Repository, has the news WordPress 7.1 Beta 3 Now Available, Punts Unicode Email Support Over Security Concerns

Contribute by Help Test WordPress 7.1 and learn deeply how the new features and blocks work. It’s a very impactful way to contribute to the open-source project that powers hundreds of millions of websites.

Quite a few Dev notes made it out of the publishing queue this week:

Plugins, Themes, and Tools for #nocode site builders and owners

On the WordPress.com blog, Joe Fylan explains what agentic commerce means for your store. AI assistants that discover, compare, and buy products on a shopper’s behalf. You’ll get an overview of where the big AI tools stand on in-chat checkout, plus reassurance that small stores can win with verifiable facts. Fylan’s checklist for getting ready: clear product descriptions, structured data, and making sure your robots.txt isn’t blocking the agents you want.


Dave Smith, core committer and Gutenberg contributor, thinks WordPress has a homepage problem — and he built a better version to prove it. In his video, he walks you through why setting a static homepage trips up so many beginners, then demos a prototype exploring a simpler, clearer approach. You can try the live demo yourself in the browser. Smith wants to know if the direction resonates, so drop your homepage struggles in the video’s comments.

Theme Development for Full Site Editing and Blocks

In episode 226 of the WP Tavern Jukebox podcast, Nathan Wrigley talks with Jessica Lyschik about why accessibility in WordPress themes is easier than you think. Fresh from her WordCamp Europe 2026 talk, Lyschik walks you through the recently updated accessibility-ready requirements, quick wins like correct HTML tags, alt text, and skip links, and why block themes make much of this effortless because Core handles it. The insight: AI agents navigate your site like screen readers do.


Ryan Welcher digs into how WordPress decides a theme is a “block theme” — and the answer might surprise you. It all comes down to one file: templates/index.html exists, or it doesn’t. Neither theme.json nor patterns flip the switch, which is why Astra, Kadence, and Blocksy all still test classic.

 “Keeping up with Gutenberg – Index 2026” 
A chronological list of the WordPress Make Blog posts from various teams involved in Gutenberg development: Design, Theme Review Team, Core Editor, Core JS, Core CSS, Test, and Meta team from Jan. 2024 on. Updated by yours truly. 

The previous years are also available:
2020 | 2021 | 2022 | 2023 | 2024 | 2025

Building Blocks and Tools for the Block editor

In episode 477 of the WP Builds podcast, Nathan Wrigley talks with Olly Campion and Tommy Rockett about lessons from their WordPress plugin business and their block-based plugin Slidey Panel, which slides customizable side panels into any site. You’ll hear how years of client work revealed a gap in both classic themes and the block editor, the philosophy behind their “page as panel” approach, and their candid take on AI, market share shifts, and the future of bespoke agency work.


Ryan Welcher walks you through What’s New for WordPress Developers for July 2026 in his monthly video roundup. You’ll learn why WordPress 7.0.2 is a must-install security release, how to test React 19 via a runtime flag in Gutenberg 23.4, and what the now-enforced iframed editor means for your themes. He also covers responsive styling, Block Bindings for list items, and MCP support in Playground. Prefer reading? There’s a companion post on the Developer Blog.

What’s new with Playground

The Playground team wants your help testing the new WordPress Playground UI before it officially launches. Fellyph Cintra shares four testing modules you can pick from: creating and managing Playgrounds, the Blueprint experience, developer tools like Files and Logs, and import/export workflows. Five minutes on desktop or mobile is enough, and the post walks you through each step. Feedback on text clarity, mechanics, and design goes into the GitHub issue #4092.


Elliott Richmond shares how he uses WordPress Playground and Blueprints to train clients on block themes, inspired by WordCamp Europe. For a client migrating from a classic theme, he trimmed a gigabyte-plus database to a 50MB export, then built a Blueprint that loads their actual theme, plugin, and content into a disposable in-browser site. You send one link, the client can safely break things, and a refresh resets everything — no hosting or credentials needed.

WordPress and AI

On the Kinsta blog, Carlo Daniele takes a deep dive into the WordPress AI integration architecture that arrived with WordPress 7.0. You’ll learn how the three layers — Connectors, AI Client, and Providers — replace bundled SDKs and provider-specific code with the unified wp_ai_client_prompt() function. Daniele then walks you through building a real plugin, available on GitHub, that transcribes an audio note and converts it into structured Gutenberg blocks via two AI passes.


An interesting take: On the MemberPress blog, SEO veteran Curt Noble argues that WordPress lost market share and got stronger. Drawing on twenty years in SEO, including his own private blog network (PBN) days, Noble contends the dip mostly reflects Google demolishing the spam economy that ran on WordPress. Meanwhile, search interest hit a five-year high, WordPress dominates the top 10,000 sites, and the vibe-coding security hangover is sending founders back to proven platforms. Noble’s bigger point: with the AI Client, Abilities API, and MCP Adapter, WordPress became the platform AI agents can natively and safely operate.


Jeff Paul announced what’s new in AI 1.2.0, the latest release of the canonical AI plugin. You’ll find a new Suggest Reply experiment that drafts contextual comment responses for moderators to review, bulk Content Summary generation for existing content libraries, and two read-only Abilities: core/read-content and core/read-users. The settings screen got simpler, too, with advanced controls now tucked behind an opt-in Developer Tools option. Content Translations and C2PA (Coalition for Content Provenance and Authenticity) tracking are on the 1.3.0 roadmap.

Need a plugin .zip from Gutenberg’s master branch?
Gutenberg Times provides daily build for testing and review.

Now also available via WordPress Playground. There is no need for a test site locally or on a server. Have you been using it? Email me with your experience.


Questions? Suggestions? Ideas?
Don’t hesitate to send them via email or
send me a message on WordPress Slack or Twitter @bph.


For questions to be answered on the Gutenberg Changelog,
send them to changelog@gutenbergtimes.com


Featured Image:


#226 – Jessica Lyschik on Why Accessibility in WordPress Themes Is Easier Than You Think

Transcript

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, why accessibility in WordPress themes is easier than you think.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Jessica Lyschik. Jessica is a longtime member of the WordPress community who’s been working in the ecosystem since 2015. She’s spent years learning and advocating for web accessibility, both as a developer and as an active community participant, joining agencies, working on theme reviews, and helping improve standards.

Many theme creators assume that making themes accessible is an intimidating task, but Jessica’s here to show you that achieving an accessibility ready WordPress theme is more straightforward than you might imagine.

Her WordCamp Europe 2026 presentation, accessibility in themes, easier than you think, aimed to demystify the requirements for accessible themes. Explaining what the WordPress guidelines mean in practise, where the low hanging fruit is, and how both block and classic themes can reach accessibility ready status with manageable efforts.

We talk about the personal and moral journey that brings developers to accessibility. The technical hurdles and documentation challenges, and the ways in which things like AI agents are putting accessibility in the spotlight for everyone.

Jessica talks about practical steps that quickly improve accessibility, like using correct HTML tags, adding alternative text to images, and configuring skip to content links, and shares why building accessibility in from the start saves time and effort down the road.

We also explore the differences, and possible advantages, of block themes when it comes to accessibility, and why theme guidelines work the way they do, and the importance of interdisciplinary awareness across SEO, design, and content teams.

Jessica mentions helpful resources, influential leaders in accessibility, and the ongoing need for documentation improvements to help everyone level up.

If you’ve ever felt overwhelmed by accessibility requirements, or wonder why they matter, and how you can build better WordPress sites that work for everyone, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Jessica Lyschik.

I am joined on the podcast by Jessica Lyschik. Hello, Jessica.

[00:03:39] Jessica Lyschik: Hi Nathan.

[00:03:41] Nathan Wrigley: Nice to have you with us. This is my second interview at WordCamp Europe 2026. We’re in a beautiful, big media room. I’ve got to say, this is one of the nicest spaces I’ve ever had for these kind of interviews, so that’s really nice.

Jessica has already done, I want to say presentation but maybe it was a workshop. I’m not sure.

[00:03:57] Jessica Lyschik: No, it was a regular talk actually, yeah.

[00:03:59] Nathan Wrigley: Okay. And how did it go?

[00:04:00] Jessica Lyschik: It went super well, except for my slides went missing in between. That wasn’t so great. But the audience was very respectful of that, and I made a bit fun of it, so they laughed for a second and I tried, the media guys tried to fix that. We got it fixed in the end. I would’ve winged it anyway because I, like I knew what was coming up. But it’s always good to have your slides. It’s like seeing them, because for me it’s also visual reminder. It’s like, I need to see what I’m talking about, so I’m not losing track of it. But yeah, this was just a little technical hiccup. But overall I got very great feedback so far on my talk, and I’m very glad.

There were also quite a lot of people. I did not expect this many. And that makes me just super happy that people are actually interested in this topic, although it is sort of scary for some of them if they even like try to touch this topic. We can probably get into the details later. Yeah, just overall like, what does it do? Why do I need that? These unanswered questions that they have that they were like, ah, no, I’m not really interested into that.

[00:05:01] Nathan Wrigley: Oh, that’s nice a big reception.

[00:05:03] Jessica Lyschik: Yeah. And that’s just great to see because I think just as we all grow older, and I even noticed that, and I’ve said that in my talk, like I kind of get to appreciate when a website is accessible. I mean I’m still have a long time to go, hopefully in my life, but I start to appreciate the small things that make just browsing websites easier, to be honest.

[00:05:23] Nathan Wrigley: So I guess we should introduce the subject and then give you a chance to introduce yourself because it feels like in this context, the subject at hand, it’s important to know that you know what you are doing. It’s not, well, I suppose it’s a general skill in that it should be something most people know an awful lot about. But I fear that that’s not the case.

So the presentation that you’ve just given was called accessibility in themes, easier than you think. That’s nicely phrased. Let’s get them through the door.

And then the blurb that went with that, I’ll just read that into the record then everybody knows what we’re talking about. So it says, many theme developers assume accessibility ready requirements are hard to meet, but that’s rarely true. This session shares practical insights for real theme reviews, and shows how both block and classic themes can reach accessibility ready status with manageable effort.

So that’s the context of what we’re going to talk about today. However, as I just alluded to, could you just tell us a bit about you, how long you’ve been using WordPress, and then I guess if you want to focus a bit on your accessibility credentials and what you’ve been doing in that space.

[00:06:23] Jessica Lyschik: Yeah, of course. So yeah, I’ve been using WordPress, I think I started around 2005 or 6 already. So like dipped my toes into it, played with it around, just got a feel for it. But actually professionally, I started out in 2015 in the WordPress ecosystem.

Before that, I already joined the community. So I was working at another place that did not use WordPress before. And then in 2015 I joined a WordPress agency. Today they’re called Syde, for anyone who’s wondering. And ever since I’ve been into WordPress that long.

And accessibility in that case I have, I think it was a gradual process more of. It was not just like, I’m now doing accessibility. That just didn’t happen. It was, I learned it over time. And when I started learning about how to create a website accessibility was absolutely not a thing. No one cared about it. And it just became more and more aware for people, for developers, especially in the past couple years. I think we still have some way to go but like, as I said earlier, there were so many people interested in my talk. So I think we’re now at a pace where things get really interesting for many more people.

And yeah, I learned a lot along the way. Made a lot of mistakes along the way. But I’m glad I’m learning this. I’m still learning. So it’s always something that you continuously learn, because I think the hardest part to grasp for people is that, if you are abled, it’s like you can see, you can hear, you can navigate a device with your own hands, all stuff like that, you take it for granted.

And if you suddenly see or people tell you the perspective of like a blind person, a person who’s deaf, a person who may not be able to use a device like you do, maybe have a hand injury, or no hands anymore, that’s also happening. Then you start to wonder, okay, how do these people actually like use websites or use their phones or computers? And there are many different ways to do that. And I think if you have the chance to learn about this, it is absolutely eye-opening.

You can also then, there was a talk at WordCamp Leipzig this year, but also last year, I attended last year, by a blind person. And her brother was also blind. He was a developer. And they shared like how bad some websites are, and how they struggle to like get the information out of the website, and what crazy, crazy stuff people are doing to their websites that do not make it accessible for these people.

And then you are sitting there and wondering, oh my God. And sometimes I have to say, I even did this in the past and I didn’t know, but I’m glad today that I learned about this and make a better web essentially. Yeah, that’s why I’m here sharing my knowledge.

[00:09:11] Nathan Wrigley: It kind of sounds for me, so when I talk about accessibility, there’s always two strands to it. There’s like this legal bit where the governments are increasingly talking about things that will happen to you as a company that builds websites if you don’t follow guidelines. So that’s one side.

But there’s also this moral side. There’s the side of, we ought to do this despite what the law says. You know, it’s just a necessary thing. And it feels to me as if your journey in this was a moral one.

[00:09:38] Jessica Lyschik: More of, yes.

[00:09:39] Nathan Wrigley: Yeah, there was a definite need here. You know, in the real world when you see somebody, let’s say somebody who’s sitting in a wheelchair and they’re trying to get into a post office and there’s a step that they can’t get over, there’s no bit of you which doesn’t see that as unjust. Every bit of you says that character can’t get over that step. That’s wrong.

And yet, the bit of the world which is becoming increasingly the way that we interact, you know, we book flights, we file our taxes, we do our banking, we, all of these things, they’re completely invisible.

Most of the time we’re doing the internet by ourselves. You know, we might be sitting on a train, but nevertheless it’s a solitary activity, or we’re in our own home or whatever. And these pitfalls, the equivalent of the step in front of the post office is totally invisible.

And it also seems that the voice of the people whose lives are made more difficult is just drowned out. Somehow that anger that they must feel never seems to rise to the top quite enough that we all take the necessary steps.

I don’t know if any of that landed, and there was definitely no question there, but I’ll hand it back to you if any of that resonates.

[00:10:49] Jessica Lyschik: No, I think you, you’ve put it absolutely right. And the invisibility is the thing, because a step for us is visually, like we see it I mean. If you’re blind, you’re not seeing it. But let’s put it away for a second. But in the web, the invisibility is like the key thing. And I just talked to Anne-Mieke Bovelett about, who’s doing another accessibility talk this afternoon. She told me about like a company where they put effort into their website, making it more accessible. And their sales actually increased. So it can definitely help. This is just one example.

But there’s also a new player in the field that will probably even increase the interest in accessibility, and that is AI agents. Because AI agents, they do not see a website as we do visually. They rely on that the website is technically built correctly. Google actually just last month announced that they will focus on this. They will focus on the accessibility for the AI agent. I have put a link in my slides to that document. This is basically, I think something that will be easier to grasp for people for some weird reason. But it’s made more visible to them because if an AI agent cannot read your website, and I know we are probably still at the very beginning of this AI agent stuff, but I think this will increase over the next couple months or even years.

[00:12:14] Nathan Wrigley: That’s really interesting because when an individual, let’s go back 10 years, when an individual is creating a website, every single bit that you have to achieve is a minute of work or another minute or 20 minutes or an hour or what have you. And so there was this whole thing of just building the website, especially when page builders and things like that came along, just building the website to see what it looks like. And that whole accessibility layer just basically gets ignored.

However, that’s what you’ve just said is curious because the AI agent building the website, to the AI agent, that’s kind of no extra work to get it right, if you know what I mean? If it’s configured to do all of the bits correctly, I’m using air quotes around the word correctly, then in theory it should be quite a good custodian of accessibility when it’s building things. I guess only time will tell whether that actually happens.

[00:13:08] Jessica Lyschik: Yeah, but it’s also for like, not the agents itself building, but also the agents visiting your website. Especially if you do like, I think shopping will be the one thing that if you say, hey, I don’t know what the best coffee or what, this is like a good topic. Yeah, okay, here are three options. And then, okay, buy me option one, a kilo of these beans or whatever. The AI agent, if the shop is accessible, the AI agent could do the shopping for you. This is where things are going and progressing towards, that you are not actively anymore the person who actually goes to the online shop, puts it in the cart, goes to the checkout and does all that stuff for you. But if the agent knows all that, it can do it for you.

[00:13:50] Nathan Wrigley: Can I ask a question then? Because I may have, I think I’ve understood what you were just saying and curiously, I’ve never had that thought, the one that you’ve just expressed. I want to know if I’ve got it right. Are you saying that in a world in which we increasingly ask AI to achieve things on the web for us, if it’s built with accessibility in mind, it’s more likely to be able to achieve the result of, let’s say, buy me a kilo of coffee.

[00:14:14] Jessica Lyschik: Yep.

[00:14:15] Nathan Wrigley: That’s so interesting.

[00:14:16] Jessica Lyschik: Yeah because like, Anne-Mieke, whom I just talked about, shared a long document with me recently and I was just reading through it and was like, yeah, of course. Of course, if we technically do things right, we use the right elements, we do the right descriptions for everything that a computer, because AI agent is just a computer. Like assistive technology, like a screen reader who needs to read the right structure out of it and to fit the right content. But also is able to interact with stuff, like click on that button, put that in the cart, go to the checkout and so on. It’s basically the same. An AI agent is a screen reader.

[00:14:53] Nathan Wrigley: Yeah, that’s really interesting. I’m thinking of a map where I’m trying to get to a destination, but the map has no directions. Imagine a scenario where we set off from one place and our destination is here. What you are saying is all the instructions in between to get from the start to the end can be read if the HTML and all of the bits and pieces wrapped up in that are correct. I had never had that thought before. That’s so interesting.

[00:15:17] Jessica Lyschik: Yeah, that’s very interesting. And I did not focus too much on this topic in my talk, but I wanted to put it in there at least in one slide to give like the food for thought that people can actually think about it because this is like what’s hyped right now. I have not tried out this whole agent thing yet, but like from a developer perspective, I can totally see that this is something that will increasingly help AI agents to achieve stuff.

[00:15:41] Nathan Wrigley: Yeah. And presumably make it so that a whole tranche of people who struggle with the web as it is currently might be able to interact with their voice or whatever other technique they use. We’ve completely gone off the rails, but that was such an interesting aside, thank you.

[00:15:58] Jessica Lyschik: Yeah, I think this is something interesting to share. And as I said, I wanted to focus more on the technical details in my talk, so I left it kind of out. But I think it’s a great opportunity to share it here with you.

[00:16:08] Nathan Wrigley: Yeah. That was lovely. Thank you.

So let’s go back to the WordPress bits and pieces then, and I’ll just do the title again because hopefully that’ll refresh it in listeners’ minds. Accessibility in themes, easier than you think. Dear listener, if you’ve been using WordPress for any length of time, you’ll know that the themes still plays a giant part in the structure of your website and the way that people experience it.

So where are we at then in the year 2026? Does the theme still represent a huge part of accessibility? In your experience, is it easier than most people think to get an accessible website in the year 2026? We’ll get into block based themes and classic themes and all that in a minute. But essentially what I’m asking is, is it an easier thing to get right than most people imagine?

[00:16:51] Jessica Lyschik: Yes, because I think what scares people off from my own experience, there are requirements to get the accessibility ready tag in the wordpress.org theme repository. And these requirements, if you first read them, they’ll sound a bit cryptic and you do not really understand what they actually mean.

In my talk, I was trying to combine this, what the requirement says with what is actually meant by that. Because right now, and this is something I would like to improve for the future, I’ve already talked to people about this, and I will have another chat with Rian Rietveld about it later, or tomorrow. Let’s see when we can make that happen.

Because right now the requirements read like, okay, this must be achieved. This is what the website should do. Then there are some testing instructions, but you’re not told how to achieve it. What do you technically need to do in order to do that?

I noticed this while I was reworking. I found out about the requirements also just a month ago because the requirements got updated. I have a theme in the wordpress.org repository and I tried to apply these new rules and have another fresh look at it. I got the accessibility ready tag for this already when I first got the theme into the repository. But like it was a good refresher to like go over all the requirements because they have slightly changed a bit, they added new ones.

When I was there, I was like, okay, like I understand this now because I have learned about accessibility over the past couple years. For someone who is fresh to this topic and doesn’t know too much about it, it’s hard to understand. Because there are some descriptions of things like, basically what it means is that you need to use, for example, the right HTML tags, header, footer, the main tag. We have section and aside, which are available in HTML 5. But the requirements does not say this explicitly.

And I think this is where probably most people have gotten stuck in the past, because they did not understand like, what is actually required from me technically? Because the texts are not so much focused on that. And this is something I would like to contribute as well, to give back and to enhance. So it’s not there yet, but hopefully sooner than later we can add all this information so it gets even easier for people.

Because if you’ve done a website and you know about the HTML, you know about maybe a little bit of CSS, you know how to achieve this. You just need to connect the dots to what is relevant for accessibility and how do you do this in your HTML essentially.

[00:19:20] Nathan Wrigley: Yeah, I guess that’s a bit of a shame really, isn’t it? Is that the documentation is difficult to follow because I feel that accessibility is one of those things where if something is difficult it can get dropped basically.

[00:19:33] Jessica Lyschik: Yeah, people won’t do it.

[00:19:34] Nathan Wrigley: Yeah, because the majority of people browsing the internet can browse the internet despite your accessibility efforts, that will be the standard that they’re aiming for in most cases. So if it’s difficult to achieve these things and the documentation’s not really straightforward, every time somebody comes across a question and thinks, I don’t really know the answer to that, probably the quickest thing to do is just to, ah, push it to one side and not press through. But you obviously have and made it a bit of a goal.

So is there a particular accessibility requirement that developers in your estimation kind of overestimate the difficulty of? What I’m asking here really is about some low hanging fruit that you know about. In the scenario that we’ve just described where it’s easy to get put off and to sort of say to yourself, okay, I can’t do this. I’m wondering there are some sort of quick wins that you could describe that people could maybe achieve within the next half an hour, once they sat down at their machines?

[00:20:27] Jessica Lyschik: Yeah, I think there are definitely some. There is like underlining text in your main content, just underline the text. It’s one line of CSS, text declaration underline. For links, obviously, not for the entire text.

And there is like, as I said, the HTML tags. With block themes, it’s super easy. For example, you just need to configure that correctly in the editor, or use the correct template part and it’s basically done for you. Core does that. This is one advantage of block themes, but we can dive into this deeper later. Or the skip to content links also in block themes.

As an example, in block themes it is just like putting the content block in a group and assigning the main HTML tag to that group. And WordPress does the rest for you. It’s just like assigning this one little setting correctly and then you get automatically a skip a content link for block themes.

[00:21:18] Nathan Wrigley: Yeah, but curiously, if you didn’t know that small fact, that WordPress would handle that for you, if you don’t know, you don’t know. And you’d presumably go around the houses trying to figure that out for yourself and implement some custom version of that thing. Whereas in fact, what, three clicks, four seconds and you’re done.

[00:21:33] Jessica Lyschik: It’s super easy, yep.

[00:21:33] Nathan Wrigley: Yeah. Any more before we move on?

[00:21:35] Jessica Lyschik: I think these are like the most, absolutely the low hanging fruit is also if you use any images to add an alternative text. I think this is probably the most common one people already know. It is so easy. And even WordPress, even if you use classic themes, it’s already in the media library, the alternative text field. For block themes you have it directly at the image so it’s already in front of you. You just need to use it.

[00:21:57] Nathan Wrigley: Yeah, you just not ignore it basically. Yeah, that’s true.

So has this become kind of a habit for you then, over the last period of time since you’ve taken more and more interest in this? Have you got to the point now where this is just how it works? You know, in the same way that I drive a car and I use the gears and that’s all just second nature. Is it like that for you when you are building your themes? Because it’s now locked away in your head. Every time you do a thing that previously you would’ve omitted. You are now just in the habit. Has that been a difficult journey or fairly straightforward?

[00:22:28] Jessica Lyschik: I think it’s, like starting out with this, it would feel like a bumpy road. But for me it was, it’s a gradual process. But right now it’s really like, yeah, I just know that when I use a button in a context that is not like sending off a form to add an aria label to it, it’s like, it is baked into my brain essentially already because I know.

And I just had a very interesting example this week at work where there was a client reaching out saying, hey, we did an accessibility test on our website and it marked like two buttons that did not say what they’re doing. These were essentially missing the aria label because they had only icons on the buttons, not real text.

So if there’s just an icon, the screen reader cannot read, what is this button for, essentially, with just an icon? The win here was just to add the aria labels, because the fields were already there. This was also part of the Greyd.Suite, so from our product so I knew how to put it in there. And then it was like, oh no, like I have to do this 12 times, my colleague said. And I was like, yeah, okay, then you have to do it twice, 12 times. So 24 times. But be happy it’s not 200 times you have to do it.

So, and I said, do not take this personally. This is a great example of why putting accessibility at the very beginning of when you’re creating this makes life so much easier than rather when you just build a website and then you figure out you have to change 300 buttons. This is probably a crazy number, but just to give you an example, to change all the buttons manually again, going through every single page or whatever you have when you just could have taken the extra step, added the aria label, and then just be done with it.

[00:24:09] Nathan Wrigley: Right. That’s an interesting thought. And also the exasperation of your colleague there kind of perfectly sums up the problem. In that you see it as a problem. Does that mean I’ve got to do something 24 times? And there’s this sense of, ugh, I’ve got to do this work. And it feels like a chore. But then I suppose if you step back and look at what you’ll actually enable by doing those 24 things.

And I know that in the workday that’s hard to do. It’s hard to sort of step back and say, okay, if I do this thing 24 times, this will be the result, and lots more people will be able to, in this case, view the image.

[00:24:42] Jessica Lyschik: I mean this was like they started already working on. If you fix it now, you do not have to do it for the coming pages. So if you multiply that with how many pages more you need to do, once you get this one fixed, and ideally you need to change the aria label of the text changes obviously, but this was, I think for a header, in a header, where there was like, I think one sort of popover or popup. Fully accessible by the way, so don’t worry about that. And also a button to, I think for the phone numbers, like just a phone icon. And they could click on it and it would be something like that, along the lines. I don’t exactly remember what it was. But it was just like two icons in the header. And if you take that header, use it on, I don’t know, another 250 sites, you don’t need to do the work anymore.

[00:25:29] Nathan Wrigley: Okay. So you are painting a picture in which, get it right at the beginning, follow the guidelines, do the hard work once, then almost the career from then, from this moment forward, your life will be immeasurably easier if you build it into the theme or.

[00:25:45] Jessica Lyschik: And accessibility will not be taken as, ugh, and I now have to do this all. Because when you do it from the start, you have to make sure at the end of course that it still works. You may have to run into issues and redo stuff. That can happen. But I think you just have saved yourself so much work in the end if that requirement for some reason pops up later or so.

[00:26:10] Nathan Wrigley: I’m wondering, depending on the kind of nature of where you work, and how you do this. You know, if you’re a freelance, then this is on you. If you’re in an agency, then it may be that there’s somebody, you know, maybe there’s an SEO person, there’s a design person, maybe there’s an accessibility person. But it does feel like the moral argument states everybody should have some insight. Maybe you’re not right in the weeds of it, but you should have some knowledge of what the low hanging fruit is, at least.

[00:26:38] Jessica Lyschik: Yeah it’s, what’s the right word for it? Interdisciplinary. It is like not just the developer who needs to think of accessibility. It’s like, okay, we need to because like we provide a technical structure for it. But it also needs to be for the content people who write the blog posts, the pages, whatever, for SEO people to understand that.

And I think accessibility, if you want the entire website to be accessibility, everyone who works on a website needs to know about it. That an SEO person needs to know how to create a skip link, probably not. Or how to use, maybe to use the right text. But for them, the text would be just the, using the right heading structure, for example. This is also a requirement, that you do not use an H3 and then an H6 heading in your content, but you structure it correctly that you have the H1 on the top, and then every next level is H H2, and then every level under that is H3. So this way. They should know about this. But they do not need to know too much about the technical side. Because in the end, it all comes together and creates an accessible website.

[00:27:42] Nathan Wrigley: In your commentary a few minutes ago, you mentioned that there were some guidelines in order to put a theme on wordpress.org. Is that the nature of it? Is it a guideline, or are there some hard and fast rules, which will prevent a theme getting into the repo based upon a lack of accessibility? What I’m asking is, are there some things that you must do as of now, or is it very much, okay, if you do this, great, but if you don’t, we’ll let your theme pass anyway?

[00:28:09] Jessica Lyschik: Yeah. Let me explain this. So there’s this accessibility ready tag. So you have different tags for the themes in the repository. And in order to get the accessibility ready tag, you need to follow the requirements, the accessibility ready requirements, I think it’s completely called.

And these are as of now 18 requirements. I went through them all in my talk. We’ve already touched on some of these. Some are really low hanging fruit, some are, one of the newer ones are, a theme should not recommend or require a plugin that is not accessible. This is something else that the team came up with, which is an interesting one. There’s, I guess a lot of room for discussion.

But also another one is to have an accessibility.txt file in your theme. Which basically, it’s not a standard yet, but like close to a standard sort of, has information about what has been done in terms of accessibility. Are there any classes that you can, CSS classes that you can use to make use of texts for screen readers? So basically hide them visually, or hide these texts or items visually, but still have them read out by screen readers. So they’re not like discipline none where you just remove that basically from the accessibility tree, but make it still readable for screen readers. And just some more information about that.

Yeah, you need to meet all these requirements with your theme if you want this tag. But you can still like do not care about accessibility and still get your theme in the repo if you want.

[00:29:40] Nathan Wrigley: Would you like that to be flipped? Would you like that to be, because I mean we’re a very open ecosystem, aren’t we? And would you like to see though a day where you don’t meet these 18 guidelines, you don’t get the tag, you don’t get to play, you’re not allowed in the repo? Or is that a touch too far?

[00:29:56] Jessica Lyschik: Let me share some numbers, I think. So there are like 14,700 plus themes in the repository right now. All themes. At least that’s the number I can access. I don’t know if there’s maybe a bit more, I don’t know. But this is the public number you can access. And out of these themes, I think if I saw the correct number, it’s like just 270 have the accessibility ready tag. So then that is like 1.5% of all themes who have that tag.

So I think it will be extremely hard to force sort of, if you want to flip that, force that onto people. And I think we need to do a more gradual way. And that’s what I’m sharing my knowledge because I think it is not that hard. If you can improve the documentation for it, it will be even easier for people. And I think this is the way to go instead of forcing like, because we do not like to be forced to things we do not understand.

[00:30:50] Nathan Wrigley: That’s right. Yeah, that’s interesting. I wonder if there’s a future in which that slowly gets ramped up.

[00:30:56] Jessica Lyschik: I think with the AI agents, we will have an acceleration on this, I guess. So maybe not in WordPress themes, in the repository directly, but I think the attention will be put there and then like, oh, maybe we should make it more accessible. Let’s read into this. And I think these guidelines are also very interesting, maybe not just for WordPress themes. I mean, of course they’re for the repository, but you of course can apply them to your own custom theme, definitely. You do not have an absolute check like the team will do for you. But nothing stops you from using them even on a non WordPress site.

[00:31:30] Nathan Wrigley: Do the guidelines, do they feel like they’re kind of firmly fixed or is it always a movable feast?

[00:31:35] Jessica Lyschik: They’re relatively fixed.

[00:31:37] Nathan Wrigley: Okay, so if you were to swat up, for want of a better word, on what there is right now, there’s a good chance that the rug will not be pulled out from under you in six months, a year, two years time.

[00:31:46] Jessica Lyschik: No, I think the last time the requirements got updated was in 2012, 14. I would need to ask, Joe Dolson did the initial, or was working on the initial thing. And so it has been a while since this got updated and they just got updated last month. So I don’t think that they will be changing anything.

The one I talked about, not requiring or recommending plugins is the one, this is something, it kind of creates a grey area sort of. And I think this will be put to discussion. It’s like, I don’t mind, but I can see many people like really, not raging against it, but like raising questions about it. If this is something that should be a requirement.

But I think for like the actual technical stuff, I don’t think that there’s much that should change, because like they’re based on the WCAG requirements. These are like the standard requirements that also have, I’m not sure if they’re used on governmental things, like on the European Accessibility Act, but I think they’re a sort of base for that. And it’s not like completely this. So the theme requirements are not like the WCAG requirements 100%, but like a subset of it, sort of.

[00:32:57] Nathan Wrigley: Yeah, it’s a fairly slow moving ship in other words. If you acquire the knowledge today, you’ve got a good chance that in a year, two years, maybe even five years, the knowledge that you’ve got will need amending. But most of it will broadly work several years from now.

[00:33:11] Jessica Lyschik: It’s with like development in general. So like you always need to be constantly learning. And I think if you learn about accessibility today, I think you’re in a very good spot. Because like of course we have European Accessibility Act and governmental requirements, at least in Europe we do have them. But I think there’s already so much information out there, that it should be relatively easy to onboard you. And I think this is just beneficial if you learn, it’s basically about learning about how to use things correctly. And if you’ve got that, then you’re absolutely good to go.

[00:33:45] Nathan Wrigley: So not that long ago I suppose, we had block themes coming around, which is an entirely different way of creating themes in WordPress. So you’ve got classic themes, which is the way it always used to be. And now we’ve got block themes. Is there a striking fundamental difference in the way that you might approach accessibility if you were used to doing block themes? Is there a whole lot more to learn? Maybe it’s more straightforward if you’re using block themes. Just tell us about how those two things differ.

[00:34:08] Jessica Lyschik: Yeah. It is more straightforward actually. Core is handling stuff for you. So accessibility just got a tad bit easier if you use block themes actually. In classic themes, you have to do a lot of things manually. You have to make sure that the elements are right, that the skip link is there, for example, things that we touched on already. And in block themes, if you use the correct blocks on the correct structure, Core handles stuff for you.

For example, there’s a requirement labelled form fields. So when you use a form or the form fields should have a label to it. In themes you don’t really have that because usually you should not put like, something like a form in there. There are two forms that by default come with a theme that are the comments form, but that’s completely handled by Core. And there’s the search form on the search results page.

But in block themes, both of them are handled by Core. Both of them are accessible because Core handles it all for you. You just need to place them and actually not do anything to them. It is that straightforward.

And same for like template parts. If you want to use header and footer, just use the template parts and use them. You can assign them a header template part as header of course, and one as footer. And then the HTML text will be automatically added correctly for you. So there’s not too much that you need to do manually anymore, just get that right.

And as I say, I really love block themes for the much easier accessibility, or the way you can make a block theme accessible. This is so much easier than with a classic theme.

[00:35:38] Nathan Wrigley: So presumably though, it sounds like there’s meta knowledge, if you know what I mean. You’ve got to know which block to put in which spot, and which block wraps this other block, and the parents and the children. But if you learn that, and if you make that, we were talking about habits earlier, if you make that your habit, and then save that habit and save the theme and what have you, you are painting a picture where it’s significantly more straightforward because you don’t have to think about it in many cases. Well, that’s the wrong way of phrasing it. You don’t have to do that hard work.

[00:36:07] Jessica Lyschik: Exactly. If you have like a, sorry to interrupt you here, but if you have a theme that already gives you the correct examples, you can build off from that theme. For example, if you’re creating a new template, you can use an existing template and then just adjust it to what you need. If you need to change like colours or something but you have the structure already correct. You do not need to think about doing the structure again and maybe just have a check that it’s actually the right one. But if you just copy what’s already there, that is part of the theme, that’s actually super easy.

[00:36:38] Nathan Wrigley: I’m going to link to your presentation, which I know by the time that this goes out will be probably on wordpress.tv, I would’ve thought by that point. But I’ll link to your presentation and all of the different bits and pieces.

But I’m curious, who in the WordPress space, and maybe not the WordPress space, maybe outside of that, who do you follow or try to get guidance from? Maybe that’s a YouTube channel or a blog, or a, I don’t know, government based website. Maybe it’s just wordpress.org, I don’t know. Where do you go to swat up on all of this?

[00:37:06] Jessica Lyschik: Ooh, there are some very good resources out there. So I do follow like people within the WordPress community. I mentioned a few names already, like Joe Dolson, Rian Rietveld, Amber Hinds from Equalize Digital. They do a lot of stuff in that area. And then I also follow Sara Soueidan, she’s a developer from, I think Lebanon, if I remember correctly. She does great stuff on accessibility. There is a few more names. There are some good resources out there. I can probably research that for you because I cannot remember the names right now.

[00:37:39] Nathan Wrigley: I’m putting you on the spot. I’m sorry.

[00:37:40] Jessica Lyschik: Put me on the spot. That’s okay. I’ll share some links with you that you can then put in with the podcast information. There are some great resources both within the WordPress community but also outside of it that can give you a very good overview. And I think it’s just interesting to follow people who like can build the bridge between, okay, this is a requirement, this is how you technically do it, and this is why you do it.

[00:38:05] Nathan Wrigley: I have a friend who’s recently been on the journey of trying to go from zero to really quite proficient in this space. He’s found a bunch of YouTube channels and several of the names that you mentioned there, particularly the Lebanese lady that you mentioned.

And I think followed a course that they put together and found that structure profoundly helpful. The dry documentation, I think was the way it was described on the WCAG website can sometimes I think be a, you know, it’s hard to get into that in some way.

You know, if this all sounds like a lot of work, there’s definitely resources out there, which, fun is perhaps the wrong word, but make it more engaging. There’s videos to watch, and channels to follow and blogs to read and all of this. And so it turns this, I’m doing air quotes, dry subject into something a little bit more manageable and easy to take in.

[00:38:52] Jessica Lyschik: Yes. Yes, because like the WCAG requirements, like they’re hard to read. It’s like reading, the HTML 5 spec. This is also super hard to read.

[00:39:01] Nathan Wrigley: Yeah, it’s the cure for insomnia.

[00:39:03] Jessica Lyschik: Yeah, sort of. And it’s, yeah, I think if we have, not more content, but the right content available to people in the right spot, I think this will be beneficial for everyone.

[00:39:14] Nathan Wrigley: Yeah. I think unless there’s something else you want to cover off, I think, Jessica, I’ve asked everything I wish to. Is there anything you think we’ve omitted or are you happy to call it a day there?

[00:39:24] Jessica Lyschik: I think we’re, I mean we could go on probably for days. But I think for now it’s, we’ve covered every topic.

[00:39:32] Nathan Wrigley: Well in which case, what I’ll do, dear listener, if you go to the WP Tavern website and search for Jessica’s post, I’m not sure what number it will be as we’re recording it, go there and anything that we discussed, and any names that we discussed and those kind of things, I’ll put a link and obviously if Jessica supplies any other things she mentioned, we’ll add those in as well.

So Jessica, thank you so much for chatting to me today. And now that your presentation is done, you can relax and enjoy the rest of the spectacle.

[00:39:55] Jessica Lyschik: Yes. Thank you so much, and thanks for having me.

[00:39:57] Nathan Wrigley: You’re welcome.

On the podcast today we have Jessica Lyschik.

Jessica is a longtime member of the WordPress community who has been working in the ecosystem since 2015. She has spent years learning and advocating for web accessibility, both as a developer and as an active community participant, joining agencies, working on theme reviews, and helping to improve standards.

Many theme creators assume that making themes accessible is an intimidating task, but Jessica’s here to show you that achieving an accessibility-ready WordPress theme is more straightforward than you might imagine. Her WordCamp Europe 2026 presentation, “Accessibility in themes: easier than you think,” aimed to demystify the requirements for accessible themes, explaining what the WordPress guidelines mean in practice, where the low-hanging fruit is, and how both block and classic themes can reach accessibility-ready status with manageable effort.

We talk about the personal and moral journey that brings developers to accessibility, the technical hurdles and documentation challenges, and the ways in which things like AI agents are putting accessibility in the spotlight for everyone. Jessica talks about practical steps that quickly improve accessibility, like using correct HTML tags, adding alternative text to images, and configuring skip-to-content links, and shares why building accessibility in from the start saves time and effort down the road.

We also explore the differences, and possible advantages, of block themes when it comes to accessibility, why theme guidelines work the way they do, and the importance of interdisciplinary awareness across SEO, design, and content teams. Jessica mentions helpful resources, influential leaders in accessibility, and the ongoing need for documentation improvements to help everyone level up.

If you’ve ever felt overwhelmed by accessibility requirements, or wonder why they matter, and how you can build better WordPress sites that work for everyone, this episode is for you.

Useful links

Accessibility in themes: easier than you think – Jessica’s presentation at WordCamp Europe 2026

Syde

WordCamp Leipzig 2026

 Greyd.Suite

Accessibility Handbook – Theme section

WCAG 2 Overview

European Accessibility Act (EAA)

 Joe Dolson

Rian Rietveld

Amber Hinds

 Sara Soueidan

💾

How WordPress decides a theme is a “block theme”

The term “block theme” is used a lot in WordPress but it was never really clear to me what that meant exactly from a code point of view.

While researching The post editor is going full iframe: what block developers need to know before WordPress 7.1, I learned that the outcome of testing WordPress 7.1 Beta 1 may soften the plan: instead of forcing the iframe for everyone, core might force it only for block themes, while classic themes using blocks with apiVersion 2 or lower keep the current 7.0 behavior. (The linked article covers the 7.0 state of things in full.)

If that’s the split, then the exact definition of “block theme” suddenly matters a great deal. So what does core actually check?

The public API is wp_is_block_theme(), which just asks the active theme:

PHP
// wp-includes/theme.php (guard clause trimmed)
function wp_is_block_theme() {
	return wp_get_theme()->is_block_theme();
}

And WP_Theme::is_block_theme() is, in its entirety, a file-existence check:

PHP
// wp-includes/class-wp-theme.php (caching trimmed)
public function is_block_theme() {
	$paths_to_index_block_template = array(
		$this->get_file_path( '/templates/index.html' ),
		$this->get_file_path( '/block-templates/index.html' ),
	);

	foreach ( $paths_to_index_block_template as $path ) {
		if ( is_file( $path ) && is_readable( $path ) ) {
			return true;
		}
	}

	return false;
}

A theme is a “block theme” if it ships an index.html block template, either in templates/, or in block-templates/, the pre-5.9 legacy location. Nothing else is consulted. That has a few consequences that may surprise people:

theme.json doesn’t make you a block theme. Neither do patterns, block template parts, or add_theme_support( 'block-templates' ). A theme can adopt every one of those “hybrid” features and still land on the classic side of this check, because the test only looks for a top-level index.html template.

Child themes inherit the answer. get_file_path() looks in the child theme first and falls back to the parent, so a child theme of a block theme is a block theme even if the child ships no templates of its own.

It’s a filesystem check, not a declaration. There’s no header in style.css that opts you in or out. Drop a templates/index.html into a theme and, as far as WordPress is concerned, it is a block theme.

The minimum files required for block and classic themes

This is the entire minimum viable block theme — two files:

Markdown
my-block-theme/
├── style.css          ← standard theme header
└── templates/
    └── index.html     ← this file IS the decider

(WordPress considers a theme valid if it has style.css plus either index.php or templates/index.html, which means for a block theme, index.php, functions.php, and even theme.json are all optional.)

And this is a theme that is guaranteed to stay classic:

Markdown
my-classic-theme/
├── style.css
└── index.php          ← the classic fallback template

Staying on the classic side of the check comes down to two conditions:

  1. No templates/index.html and no legacy block-templates/index.html. Other block templates don’t matter: a theme with `templates/single.html` but no `templates/index.html` still tests as classic. (In practice, though, if you’re shipping block templates, ship the index and be a block theme on purpose.)
  2. No block-theme parent. The check falls back to the parent theme, so a child of Twenty Twenty-Five is a block theme no matter what the child contains. To be classic, the whole chain has to be.

Everything else is fair game. theme.json, patterns, add_theme_support( 'block-template-parts' )` custom templates registered from plugins — none of them flip the switch., patterns, add_theme_support( 'block-template-parts' ), custom templates registered from plugins: none of them flip the switch.

Where real themes land

Running that check against some current releases from the theme directory

Tests classicTests block
Twenty Twenty-One and every earlier defaultTwenty Twenty-Two and every later default
Astra, Kadence, Blocksy, Botiga, Sydney, Hello Elementor — all ship theme.json
GeneratePress, Neve, OceanWP, Storefront

Six of the themes in the first column ship theme.json, the marquee “block” feature, and still test classic, because the check never looks at theme.json

Twenty Twenty and OceanWP are another good gotcha: both ship a templates/ directory and are still classic, because it’s full of PHP page templates (template-cover.php, landing.php). The check wants templates/index.html specifically, so “does it have a templates folder” is not the indicator you might assume.

How the editor reads it

On the JavaScript side, the block-theme flag surfaces in two different places, which is worth knowing if you go source-diving.

As an editor setting:

PHP
// wp-includes/block-editor.php, get_block_editor_settings()
$editor_settings['__unstableIsBlockBasedTheme'] = wp_is_block_theme();

and on the REST themes endpoint, which is where @wordpress/core-data picks it up:

PHP
// wp-includes/rest-api/endpoints/class-wp-rest-themes-controller.php
$data['is_block_theme'] = $theme->is_block_theme();

The one-file switch


For all the weight the term carries, “block theme” boils down to a single file: templates/index.html exists, or it doesn’t. Not theme.json, not patterns, not any amount of hybrid adoption. Just one index template, checked up the parent chain.

That’s worth keeping in mind if 7.1 does end up drawing the iframe line at wp_is_block_theme(). A hybrid theme that has adopted everything except block templates would keep the classic editor behavior, while adding a single templates/index.html (even accidentally, even in a parent theme you don’t control) would flip a site to the forced iframe. If your theme or your users’ sites sit anywhere near that line, now is a good time to check which side of it you’re actually on: it’s one is_file() call away.

#WCUS Schedule, iframed Post Editor, WooCommerce 11.0 and so much more — Weekend Edition 369

Hi there!

What a week! WordPress 7.1 Beta 1 (and Beta 2) arrived with a huge array of updates. We’ll unpack them together over the next four weeks, right up to the final release on August 19, 2026.

One thing shouldn’t wait, though: the security release WordPress 7.0.2. Go update your production sites now — this newsletter will still be here when you’re back. 😉

In this edition, you’ll also find the first speaker lineup for WordCamp US, a fourth page-builder migration story, WooCommerce 11.0 on the horizon, and plenty of block development goodness: from iframed editors to on-brand maintenance pages.

Grab your favorite Saturday beverage and dig in.

Yours, 💕
Birgit


WordCamp US 2026: Four Tracks, Three Workshops, 33 Speakers

First speaker spotlight WordCamp US>

The first wave of WCUS 2026 speakers is live — and it reads like a who’s-who of WordPress in practice.

WordCamp US just published its opening lineup for August 16–19 in Phoenix: 34 confirmed speakers so far, including K Adam White, Brian Coords, Jamie Marsland, Kathy Zant, Miriam Schwab, and Robert Abela, all experienced developers, educators, security specialists, community builders.

The program runs four tracks.

  • AI in Action leads with sessions on agentic workflows, AI search, and guardrails for AI-assisted development.
  • Honing Your Skills covers the practical side: maintenance, privacy compliance, creator commerce, security.
  • Technical WordPress digs into block migrations at scale, WP-CLI automation, and plugin pipelines.
  • Beginning WP101 is the on-ramp for newcomers — or for clients you’re bringing along.
  • Three hands-on workshops round out the program, where you build something real in the room and leave with it.

The full session schedule isn’t out yet, but the speaker list alone is a useful signal. If someone on that page is a voice you follow, a tool you depend on, or a corner of WordPress you’re actively navigating, you now have a specific reason to be in the room.

🎟 us.wordcamp.org/2026/tickets — $100 General Admission · $750 Micro-Sponsor (includes listing on the sponsors page) 👥 Full speaker list →

Developing Gutenberg and WordPress

WordPress 7.1 Beta 1 was release on July 15, 2026. is now available for testing. The release post offers instructions how to sent up a test side and shows an extensive list of new features.

The security team released WordPress 7.0.2 with the urgent appeal to update right away. The security fixes were also backported in 6.9.5 and 6.8.6.

The security fix was also included in WordPress 7.1 Beta 2, so testing sites are also protected during this release cycle.

Huzaifa Al Mesbah, from the Core Test team, published the accompanying Help Test WordPress 7.1 post.

A few WordPress 7.1 Dev Notes are already available:

Plugins, Themes, and Tools for #nocode site builders and owners

In about 10 days, WooCommerce 11.0 release is schedule. Brain Coords has the skinny for you in what’s coming for developers in WooCommerce. Performance leads the release with 28 PRs — product object caching becomes the default for new stores, speeding up variable products by 9–12%. You’ll also find email verification connecting guest orders to accounts, new phone validation hooks, video embeds in the block email editor, and the final removal of the Product Editor beta. The beta is ready for your testing now.


Jamie Marsland followed his instincts and build Jamie’s Front-End Editor for Content Teams, a plugin that lets your editors click any paragraph or heading on the live page and start typing — no block editor required. With the latest updates, you can now edit text, links, buttons and images right on the live page. No wp-admin, no block editor, just click and change it in place.

Built on the Interactivity API with no build step, it preserves block markup on save, records edits as native block notes for an audit trail, and lets you restrict chosen roles to front-end-only editing. Let Marsland what you think.


Last week, I shared three migration stories from page builders to the Core block editor and block themes. Here’s a fourth perspective: The team at WP Expert, an Ottawa agency founded by Frederic Sune, put together a comprehensive post on migrating agency sites from page builders to Gutenberg, should you go on that journey, too. You’ll find the strategic arguments (better Core Web Vitals, smaller attack surface, less technical debt) alongside a practical playbook covering backups, staging, block theme selection, pattern development, and SEO safeguards. The post also explores what block-based architectures mean for an agency’s business model, from premium modernization packages to fewer layout-related support tickets. An FAQ rounds it out.

Theme Development for Full Site Editing and Blocks

Brian Coords tackles a common WooCommerce pain point: custom product templates for block themes. He combines two core WordPress features — the plugin template registration API from 6.7 and the venerable single_template_hierarchy filter — to serve custom templates for product collections, like all products in a category. His example plugin falls back to your Single Product template unless you override it. Clone the repo and give it a try; custom Product fields are next on his list.


On the WordPress Developer Blog, Troy Chaplin shows you how to build an on-brand maintenance mode for block themes. You add one small hook to your theme’s functions.php once, then design and manage the maintenance page entirely in the Site Editor with full access to your Global Styles. Renaming or deleting the template toggles maintenance mode on and off, no code needed. An SEO-friendly variant adds 503 headers so crawlers know the downtime is temporary.

 “Keeping up with Gutenberg – Index 2026” 
A chronological list of the WordPress Make Blog posts from various teams involved in Gutenberg development: Design, Theme Review Team, Core Editor, Core JS, Core CSS, Test, and Meta team from Jan. 2024 on. Updated by yours truly. 

The previous years are also available:
2020 | 2021 | 2022 | 2023 | 2024 | 2025

Building Blocks and Tools

On WP Mayor, Jean Galea untangles when to reach for WP-CLI, the REST API, or the Abilities API. His mental model: they’re layers, not rivals. WP-CLI lives on the server for bulk work, REST serves off-server callers like headless front ends, and the Abilities API tells AI agents what they’re allowed to do, complete with schemas and permission checks. Galea also shares how his own sites lean on all three at once.


Get up to speed how to make your custom blocks plugin work in the iframed post editor, if you haven’t yet. After five years of ruminating and communicating the switch is coming to WordPress 7.1. In his post, Ryan Welcher explains why the post editor is going full iframe in WordPress 7.1 and what that means for your custom blocks. You’ll find the fixes for the most common breakage — global window and document references, editor styles enqueued into the wrong document, stale admin-scoped CSS, and third-party libraries — plus a companion demo plugin with broken/fixed block pairs, Playground blueprints for testing both states, and a handy pre-flight checklist.


The video volunteers at WordCamp Portugal uploaded all recordings to WordPressTV and two of the talks caught my eye:

Imran Sayed walks you through the fastest way to build Gutenberg blocks with modern tools, scripts, and AI. If custom block development has felt complex or time-consuming, you’ll appreciate his focus on practical, real-world workflows you can adopt immediately — moving fast without over-engineering. The recording is available on WordPress.tv, and the presentation slides are linked below the video for easy reference.

Jorge Costa shows you how to use the AI building blocks already shipped in WordPress core (the WP AI Client, the Abilities API, and the MCP adapter) to bring AI-powered features into your own plugins, themes, and sites. He also tackles the bigger question: when agents can spin up entire projects on any stack, why is WordPress still the right bet? Slides are linked alongside the recording.


Check out the not so new any more Talk Devy to Me series on Ryan Welchers YouTube Channel! In the latest epsiode, Antonio Sejas demos Studio Code, the agentic AI assistant built into WordPress Studio’s desktop app and CLI. You can spin up sites, run performance audits, add content, and install plugins and themes through natural language conversation — all locally, so nothing you break goes public. Sejas explains how it works under the hood before building something live with the host. Studio Code is free while in beta, so now’s a good time to experiment.


If you rather want to read about the updates in WordPress Studio, Fredrik Rombach Ekelund shares three big updates to WordPress Studio: a new default Native PHP runtime makes your local sites load 30–50% faster while using a third of the memory, the Studio CLI now installs with one dependency-free command — no Node.js or npm required — and Claude Sonnet 5 is the new default model in Studio Code, improving multi-step work like tracing bugs across files. A Sandbox runtime remains available for testing untrusted code.


Need a plugin .zip from Gutenberg’s master branch?
Gutenberg Times provides daily build for testing and review.

Now also available via WordPress Playground. There is no need for a test site locally or on a server. Have you been using it? Email me with your experience.


Questions? Suggestions? Ideas?
Don’t hesitate to send them via email or
send me a message on WordPress Slack or Twitter @bph.


For questions to be answered on the Gutenberg Changelog,
send them to changelog@gutenbergtimes.com


Featured Image:


The post editor is going full iframe: what block developers need to know before WordPress 7.1

For years, the post editor has lived a double life. The Site Editor renders your blocks inside an iframe. The post editor — where most people actually spend their time — renders them directly in the admin page. That split ends with WordPress 7.1: the post editor canvas will always be an iframe, on every theme, no matter what apiVersion your blocks declare. The Gutenberg plugin has been enforcing exactly this for months. If you ship blocks, assume the iframe.

If your block never touches the global document or window, you can probably stop reading after you’ve changed "apiVersion": 2 to "apiVersion": 3 in block.json. For everyone else — and especially anyone shipping blocks that wrap third-party libraries — the iframe changes where your code runs versus where your markup lives. That gap is where things break.

Quick reference guide: Are your blocks ready?

An infographic showing the checks and fixes for readying custom blocks for the WordPress 7.1 iframed editor

The timeline, in one table

ReleaseWhat happens
June 21, 2021The iframed editor was announced on make.wordpress.org
WordPress 6.9 (Dec 2025)Console warning (with SCRIPT_DEBUG) when a block registers with apiVersion 2 or lower. The block.json schema now only validates apiVersion: 3.
WordPress 7.0 (Apr 2026)The iframe decision now looks at blocks actually inserted in the post, not every registered block. All inserted blocks on v3+ → canvas is iframed. Insert a single v1/v2 block → the iframe is removed on the fly. Nothing is enforced yet.
Gutenberg 22.6+The iframe is enforced regardless of theme — this is the feedback-gathering phase.
WordPress 7.1 (Aug 19, 2026)The iframe is enforced on every theme, regardless of apiVersion. The conditions are gone, not tightened.

The WordPress 7.0 change is subtle but important: before 7.0, one apiVersion: 2 block registered by any active plugin — even one never used in the post — kept the entire editor out of the iframe for everyone. Now only inserted blocks count. Your v3 block gets the iframe until the user inserts a legacy one, at which point the editor quietly reloads the canvas without the iframe. The companion plugin ships a legacy-api-v2 block so you can watch this happen — insert it into an otherwise-v3 post and the iframe disappears. In 7.1, that escape hatch closes.

Worth knowing, as an aside: the “every theme” decision landed in WordPress 7.1 Beta 1, and it’s deliberately being tested in public. Gutenberg merged “Post editor: always iframe” (#74042) on July 10, 2026, deleting the theme and apiVersion conditions outright. The 7.1 release lead signed off on that merge on the condition that the team could “move to the softer approach” if Beta 1 feedback surfaced real problems — the softer approach being enforcement on block themes only, with everything else staying on the 7.0 rules. No specific mechanism is committed to; the plan is to respond to what the beta actually turns up.

Which is a reason to test harder, not to wait and see. If that rollback happens, the iframed and non-iframed editors both stay in the wild longer — and your block has to work in both regardless of which way it goes.

It’s also worth noting that blocks that will break with the 7.1 changes are most likely already breaking in the Site Editor.

Why the iframe is a good thing

This isn’t change for change sake. Rendering the canvas in an iframe gives the editor a real document boundary:

  • Admin CSS stops leaking into your content. No more #wpadminbar-adjacent style resets, no more admin styles subtly changing how blocks render in the editor versus the front end.
  • Viewport units and media queries finally work. vw, vh, and @media rules resolve against the canvas, not the admin page — so tablet/mobile previews and zoomed-out views actually behave like the front end.
  • What you see is much closer to what you get. The canvas document is built from your theme’s styles, not the admin’s.

The issue this raises for block developers? Your editor JavaScript runs in the admin page, but your block’s DOM lives in a different document. Every assumption baked into document.querySelector(...) and window.addEventListener(...) just became wrong.

What actually breaks (and how to fix it)

Everything below is demonstrable with the companion plugin — each pattern ships as a broken/fixed pair of blocks: iframe-editor-examples on GitHub.

1. Global window and document references

The classic: a block that reads the viewport or listens for resize.

JavaScript
// ❌ Broken in the iframed editor
useEffect( () => {
	const update = () => setWidth( window.innerWidth );
	update();
	window.addEventListener( 'resize', update );
	return () => window.removeEventListener( 'resize', update );
}, [] );

Editor scripts load in the admin page, so window is the admin window. In the iframed editor this reports the wrong width and never reacts to the canvas resizing — switch to the Tablet preview and the number doesn’t move.

The fix is to derive the document and window from your block’s own DOM element:

JavaScript
// ✅ Fixed — works iframed or not
import { useRefEffect } from '@wordpress/compose';

const ref = useRefEffect( ( element ) => {
	const { defaultView } = element.ownerDocument;
	const update = () => setWidth( defaultView.innerWidth );
	update();
	defaultView.addEventListener( 'resize', update );
	return () => defaultView.removeEventListener( 'resize', update );
}, [] );

const blockProps = useBlockProps( { ref } );

Two things to notice:

  • element.ownerDocument is whatever document the block is rendered into — the iframe’s document when iframed, the admin document when not. ownerDocument.defaultView is that document’s window. Code written this way is context-agnostic: it doesn’t care whether the iframe exists.
  • useRefEffect (from @wordpress/compose) instead of useRef + useEffect: it re-runs the callback when the ref changes, so if the block ever moves between documents, your listeners re-attach to the right window.

2. “Close on outside click” and other document-level events

This one is my favorite because it fails weirdly. A dropdown that closes when you click outside, implemented the way every React tutorial teaches it:

JavaScript
// ❌ Broken in the iframed editor
useEffect( () => {
	const closeOnOutsideClick = ( event ) => {
		if ( ! containerRef.current.contains( event.target ) ) {
			setIsOpen( false );
		}
	};
	document.addEventListener( 'click', closeOnOutsideClick );
	return () => document.removeEventListener( 'click', closeOnOutsideClick );
}, [] );

In the iframed editor, clicks inside the canvas happen in the iframe’s document. They never bubble to the admin document, so the listener never fires. The result: click another block in the canvas and the dropdown stays open — but click the admin sidebar and it closes. Same code, same block, works perfectly in the non-iframed editor. This is the kind of bug report you’ll get from users that “can’t be reproduced” — because whoever tested it happened to have a v2 block sitting in their post, which quietly dropped the iframe and made everything work.

Fix: same principle, attach to element.ownerDocument instead of document (see the plugin for the full useRefEffect version).

3. Editor styles enqueued into the wrong document

If you’re styling your block’s editor experience with enqueue_block_editor_assets, those styles load in the admin page — outside the iframe. They silently stop applying the moment the canvas is iframed:

PHP
// ❌ Loads in the admin page — never reaches the iframed canvas.
function myplugin_enqueue_editor_styles() {
	wp_enqueue_style( 'myplugin-editor', plugins_url( 'editor.css', __FILE__ ) );
}
add_action( 'enqueue_block_editor_assets', 'myplugin_enqueue_editor_styles' );

The fix is to register editor styles through block.json, which WordPress injects into the canvas document, iframed or not:

JSON
{
	"editorStyle": "file:./index.css"
}

(add_editor_style() also gets copied into the iframe, if you need theme-level editor styles.)

The demo plugin makes this visual: the same block carries a green banner from editorStyle and a red banner from enqueue_block_editor_assets. Count the banners — two means no iframe, one means you’re iframed.

4. Stale CSS written for the leaky editor

The section above is about CSS loading into the wrong document. This one is the sneakier inverse: the stylesheet loads into the right document — injected straight into the canvas, exactly as intended — and still gets it wrong, because of what it was written to describe. These are the rules that quietly stop matching, or start over-matching, once the canvas becomes its own document. It’s the code that’s been sitting in themes and plugins for years, “working,” right up until the iframe is enforced.

Selectors keyed on admin body classes

The most common one, and it fails exactly like the “close on outside click” bug — silently.

CSS
/* ❌ The canvas body no longer carries these classes */
.wp-admin .my-block { padding: 2rem; }
body.block-editor-page .my-block__title { font-size: 2rem; }

Inside the iframe, the canvas <body> is a clean document — no wp-admin, no block-editor-page. The selector matches nothing and your editor styling just evaporates. Same block, same stylesheet, works perfectly in the non-iframed editor.

CSS
/* ✅ Scope to the block, not the admin chrome */
.my-block { padding: 2rem; }
.my-block__title { font-size: 2rem; }

.editor-styles-wrapper does still wrap the canvas content inside the iframe, so .editor-styles-wrapper .my-block keeps working if you need genuinely editor-only styling — but the admin ancestor was almost never necessary in the first place.

Offsets that compensate for admin chrome

CSS
/* ❌ Subtracting the admin sidebar and adminbar from the viewport */
.my-fullwidth { width: calc( 100vw - 160px ); } /* 160px = admin menu */
.my-toolbar   { position: fixed; top: 32px; }   /* 32px = #wpadminbar */

This is the flip side of the win from earlier: now that 100vw resolves against the canvas instead of the admin page, there’s no sidebar to subtract — so the calc() overshoots, and top: 32px pushes your toolbar below an admin bar that doesn’t exist in this document.

CSS
/* ✅ The canvas is the viewport now — no compensation needed */
.my-fullwidth { width: 100vw; }
.my-toolbar   { position: fixed; top: 0; }

Specificity walls built to fight leakage

CSS
/* ❌ Cranked up to beat leaking admin styles */
.editor-styles-wrapper .my-block p {
	font-family: Georgia, serif !important;
	line-height: 1.6 !important;
	box-sizing: border-box !important;
}

The iframe already stops admin CSS from leaking in — that’s one of the reasons it’s a good thing. These !importants and resets have no admin styles left to override, but they do now override the theme styles the iframe loads into the canvas. The result: your editor preview drifts away from the front end — the exact opposite of what the iframe is for.

CSS
/* ✅ Let theme styles through; set only what your block truly owns */
.my-block p { font-family: Georgia, serif; }

Two things to notice:

  • The pattern is the same as the JavaScript fixes: stop describing the admin, start describing your block. A selector that names .wp-admin, #wpadminbar, or .block-editor-page is reaching for chrome that isn’t in the canvas document anymore.
  • Most of these were workarounds for problems the iframe solves. Deleting them is usually the fix.

5. Third-party libraries that assume one global context

The biggest real-world hazard. Masonry layouts, sliders, lightboxes, maps — a generation of libraries was written assuming there is exactly one document:

JavaScript
// Inside some-legacy-lib.js
const targets = document.querySelectorAll( selector ); // finds nothing in the iframe

Your block calls the library, the library queries the admin document, finds zero matches, and silently does nothing. No error, no warning — the block just stops being enhanced.

Your options, in order of preference:

  • Pass elements, not selectors. If the library accepts an element (lib.init( element )), hand it the block’s element from useRefEffect and you’re usually fine.
  • Patch the library. For unmaintained dependencies, patch-package is the pragmatic answer: edit the module in node_modules to resolve document/window from the element (node.ownerDocument), run npx patch-package <pkg>, commit the patch, add a postinstall script. The official migration guide walks through a real patch for @panzoom/panzoom.
  • Guard and bail. If the library is loaded inside the iframe (front-end scripts are), check for it on defaultView before using it: if ( ! defaultView.jQuery ) return;

So what does apiVersion: 3 actually do?

Less than you might think — and that’s the point. Declaring "apiVersion": 3 in block.json doesn’t change how your block renders; it’s a signal that your block is iframe-ready. All core blocks have been on v3 since WordPress 6.3. For most blocks the migration is literally a one-line change… followed by the actual work: testing that nothing in your edit component (or the libraries it pulls in) touches the global document/window.

And to be clear about 7.1: the iframe will be enforced there regardless of apiVersion. Staying on v2 doesn’t opt you out anymore — it just means you get the console warning and the breakage.

How to test today

You don’t need to wait for 7.1. What you’re testing is that your block works in both states — iframed and not — because both will exist in the wild for a while yet.

Iframed: install the Gutenberg plugin 22.6+. It enforces the iframe regardless of theme, so this is the fastest way to live in the future. 7.1 Beta 1 does the same — I’ve confirmed it forces the iframe on a classic theme, which is the merged behavior shipping in August.

Not iframed: run WordPress 7.0 without the plugin and insert a v1/v2 block alongside yours — the canvas drops the iframe on the fly. The companion plugin’s legacy-api-v2 block exists for exactly this. Any theme will do: core 7.0 has no theme check in the iframe decision at all, so you don’t need to hunt down a classic theme to reproduce this.

Confirm which state you’re in: element.ownerDocument !== document, or look for iframe[name="editor-canvas"] in devtools.

The Site Editor has been iframed for years — if your block already behaves there, you’re most of the way home.

The companion plugin ships a wp-env setup, an example override file that adds Gutenberg for enforced mode (copy it to .wp-env.override.json), and two Playground blueprints — one per state, so you can flip between iframed and not in two tabs without installing anything.

The block author’s checklist

  1. Set "apiVersion": 3 in every block.json.
  2. Check your editor code for window. and document. — every hit is a suspect. Replace with element.ownerDocument / .defaultView via useRefEffect.
  3. Check for enqueue_block_editor_assets — move canvas-affecting styles to editorStyle in block.json.
  4. Check your editor CSS for .wp-admin, #wpadminbar, and .block-editor-page , admin chrome offsets and !important
  5. Audit third-party libraries: pass elements not selectors, patch what you must.
  6. Test both states, not both themes: iframed (Gutenberg 22.6+ active) and not iframed (no plugin, v1/v2 block inserted).
  7. Watch the console with SCRIPT_DEBUG on — the deprecation warnings tell you which registered blocks are still on v1/v2.

Note What’s not on that list: checking whether the active theme is a block theme. Core exposes that answer twice — as __unstableIsBlockBasedTheme in the editor settings and as is_block_theme on the REST themes endpoint — and there’s a shelved PR and a live debate behind it. Your block never needs to ask. element.ownerDocument !== document answers the only version of the question that affects you. If you’re curious what that theme check does under the hood, that’s its own story: How WordPress decides a Theme is a “Block theme”.

Resources

#225 – Milan Petrović on the Risks of Legacy PHP in WordPress and Why Upgrading Matters for Security

Transcript

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, the risks of legacy PHP in WordPress and why upgrading matters for security.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players. If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you or your idea featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Milan Petrović. Milan has been deeply immersed in the WordPress ecosystem since 2007, developing an array of plugins, especially for expanding bbPress forums, and running his own company, creating plugins before joining the Freemius team as a full stack developer. With nearly two decades of hand-on experience, Milan has witnessed firsthand the evolution of both the WordPress and PHP landscapes.

Many WordPress users may be only partially aware of PHP. Perhaps they’ve noticed version numbers in their hosting panel, but few of the millions of WordPress users understand the real impact that PHP versions have on the security and performance of their websites. Milan is here to shine a light on why embracing newer versions like PHP eight isn’t just good practise, but a crucial step for security and efficiency.

Milan begins by recounting his journey through WordPress development. The conversation gets into the heart of his recent WordCamp Europe presentation, which tackles how legacy PHP code exposes sites to thousands of open bugs and vulnerabilities. And why relying on old versions is, as he describes, an active invitation for automated exploitation.

The discussion explores the contrast between running legacy code, and using the native shields of modern PHP, and highlights how PHP 8 not only closes security holes, but also delivers major performance boosts, reducing memory usage, and accelerating speed.

If you’re wondering why you should care about the PHP version your site is running on, or you’re a developer interested in practical ways to harden your code, Milan unpacks both the existential risks of outdated PHP, and the step-by-step benefits for hosts, agencies, and plug-in developers alike.

He introduces his Vulnerability Lab plugin, designed for developers to see firsthand how code exploits play out differently across PHP versions, and makes the case that modernising can happen gradually, one update, one plugin at a time.

If you’ve ever questioned how your hosting choice, or plugin stack, could affect your site’s future. Or you’re ready to take the first steps towards building more secure and future proof WordPress products, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Milan Petrović.

I am joined on the podcast by Milan Petrović. Hello Milan.

[00:03:58] Milan Petrović: Hello Nathan. Thank you for having me here.

[00:04:00] Nathan Wrigley: You are very welcome. We’re in a beautiful, beautiful media room at WordCamp Europe. And I know that you have already done your presentation because we just had a little chat about the fact that you’ve done it and it went well and all of that.

Do you want to tell us a little bit about you and your background working with code and developing and security and all of that kind of stuff? And then we’ll talk about your actual presentation and how it went.

[00:04:25] Milan Petrović: So I started with WordPress almost 20 years ago, so way back in 2007. And I created a lot of plugins for WordPress, and I especially have a lot of plugins for bbPress for expanding forums. Yeah, people still use forums these days. So that was, I really like bbPress and all the stuff I did with that.

I have been working as a freelancer for a lot of years. I have my own company that was doing plugins, it’s called Dev4Press. But in 2024, I joined the amazing team at Freemius. So for almost two years I am a full stack developer at Freemius. And that was a really nice change of pace for me and the work I usually do before that. So yeah, that’s a short of it.

[00:05:13] Nathan Wrigley: Yeah. That’s great. Thank you. And so the presentation that you did that is now over, goes like this. I’m going to read the entire blurb because it’s short enough to read, and it says, secure by design, hardening plugins with PHP 8.x. In the WordPress ecosystem, we’re often forced to choose between supporting the lowest common denominator of hosting and implementing modern security. But in 2026, writing legacy PHP 7 code isn’t just a bad habit, it’s an active invitation for automated exploitation. It’s time to stop playing whack-a-mole with sanitisation, and start building products that are secure by design. This talk isn’t just another slide deck on security tips. Through comparisons of a Vulnerability Lab plugin, you will see how common exploits like authentication bypass, and server side request forgery succeed on legacy code, only to be neutralised by the native shields of the latest PHP. You learn how to leverage the modern PHP patterns to ensure your plugins are resilient to a wide range of exploits.

Now into the show notes I will put Milan’s wordpress.tv presentation so that you can go and watch the entirety of it. I guess basically if at any point you get confused, that would be a good idea, pause this podcast and go and check that out. But, how did it go? How well received was it?

[00:06:33] Milan Petrović: For me personally, I’m very satisfied with how how it went. I don’t know, it’s a bit overwhelming to be honest, but I am very satisfied and I got a lot of questions after the talk. I met a lot of people that liked what I had to say. And I think it’s good feedback to have, for something that is more technical like this was.

[00:06:52] Nathan Wrigley: Well touching on the fact that it’s more technical, I have to confess that I think you are going to have to shepherd me through this, because a lot of the content that you I think probably got stuck into is beyond my pay grade. But hopefully we’ll get through it.

Now at WordCamp Europe, where we are now, I don’t know what the ratio is, but I’m guessing that a significant proportion of the people out there are not developers. They kind of know that PHP is a thing. They realise that WordPress is built on that, but they don’t really have an understanding.

They’ve probably heard of PHP 7. They’ve probably heard of PHP 8, because somewhere in a control panel that was shown to them. But maybe there’s not much of an understanding of the fact that it gets better over time. It gets secure over time. I think there’s probably a notion of, well, my website works. Why do I need to change anything?

So let’s get into that. What were you talking about in your presentation? What’s changed in the landscape of PHP more recently that you brought to the fore that you shared with your audience?

[00:07:51] Milan Petrović: Yeah, I think that PHP 8 was a big milestone for a lot of things. And I’m not sure, but I don’t think that the wider communities are kind of aware about the impact of the PHP, or the server environment in general, on how the websites work and how secure they are. Maybe the WordPress in itself needs to spread more awareness about that.

Because right now we get a notice in the dashboard that maybe the PHP needs to be updated. But for a lot of website users, that can be too much and too little information at the same time, because they may be not aware of how to do things on their hosting site.

We need to spread more awareness about how important the changes in the code are when it comes to the newer PHP versions, and what they can do to improve the security. And how developers should be starting to use more of those new features and the new things that PHP provides on a language level nowadays.

[00:08:49] Nathan Wrigley: WordPress has got this real legacy, I suppose is the right word, of supporting legacy code. So WordPress itself is supported way, way, way back. You can keep using versions of WordPress, which are many, many, many years old. And I wonder what your stance is in terms of PHP, whether or not WordPress runs versions of PHP which are far too old, in your opinion.

So in other words, should WordPress have a policy of, I don’t know, 8.x only? Or is 7 okay. And I don’t know what other CMS platforms, you know, Drupal, Joomla as was. I don’t know what they do, I don’t know what their posture is.

[00:09:32] Milan Petrović: I think that one of the most important decisions that, it was done with WordPress early on, is that backwards compatibility, because it opened the doors for a wider adoption. Because you don’t need to change server every year, or you don’t need to upgrade your software that often. And that helped a lot of hosting companies to provide WordPress hosting very cheaply, because they didn’t have to have the latest PHP, they didn’t have to invest much more money into all that. So WordPress got a lot of adoption from backwards compatibility policies.

But in the same time, that also proved a bit of a problem. Because even the WordPress Core code is kind of stuck because of that policy of backwards compatibility. And it’s not only compatibility with old versions of WordPress, but the old versions of PHP. And we are running now maybe six years behind end of life PHP versions. Because PHP 7.4 end of life was four and a half years ago. And we still support it in the Core.

[00:10:33] Nathan Wrigley: Yeah, I guess it’s a nice thing to support it. And it, as you described, it was a great way of onboarding the millions of people that came along. But things have moved on.

What would be some of the top level items? And I’m inviting you to open the scary book and sort of give out the worst case scenarios basically of running legacy code. So really, go to town, frighten us all. What are some of the horrors that await if you’re quite willing to, as a hosting company, support seven point whatever or beyond, six or five, or dare I say it, four, who knows? What are some of the terrible things that await us?

[00:11:08] Milan Petrović: To be honest, when I was researching some of the statistics and things like that, I was kind of scared when I saw that there are 3 or 4,000 open bug reports for PHP 7 and PHP 5, which are still in use today, and there are WordPress websites running on both of them in the millions. And there are 3 or 4,000 open and confirmed bags that are never going to be fixed. Never. So PHP 7 has thousands of bugs, and I’m sure that not everything security related, but a big chunk of those bags are related to security.

And there are open exploits that run on the PHP level. They don’t care really about if you are using WordPress or using something else. It’s more like a exploit on the level of a, on a server side that can be quite scary because you, even the technical people are not really sure what are all those bugs. Who is going to go through 3,000 or 4,000 bug reports?

[00:12:05] Nathan Wrigley: Yeah, so just to sort of describe that, the fact that there is no more updates to the 7 branch of PHP means that all of those bugs which are publicly available, anybody can go and read great detail about what they are. Well that then means that any hacker can do that, and probably did like a dozen years ago. And so really you are painting a picture there of you are asking for trouble.

[00:12:30] Milan Petrović: There are hosting companies that maybe do things a bit differently because you don’t need to run PHP as it was created. You can build your own version of PHP. You can patch bugs on your own. And a lot of hosting companies are doing that. But in the same time, that also poses a problem. You are going to run WordPress in your own plugins on a platform that is not actually officially PHP supported. It can have some different quirks that make your code run a bit differently.

A while ago we had the Facebook running their own PHP build, that was quite different from the public PHP. But they used it, and other people started using it. So I don’t know. Still I think that the official PHP is the one you should be on because you never know what other issues. Even when hosting company patches the PHP they’re using, maybe they’re opening doors to something else that is not quite documented on that level.

I think that the best policies, I don’t expect for WordPress to adopt the latest PHP or only supported PHP versions, but to kind of move quicker on the adoption of the newest version. So maybe we should be quicker to adopt PHP 8.0 or 8.1 is a next minimal required version for WordPress.

[00:13:50] Nathan Wrigley: When you say you don’t expect WordPress to do it, is that simply because it doesn’t have a history of doing it? Is there a technical reason why WordPress could not keep up with the latest version? I know we’ve got this plugin architecture where there’s thousands and thousands of developers who are all doing their own thing, and there’s all of that. Is there any technical reason why WordPress couldn’t be on the cutting edge, most up-to-date, latest version?

[00:14:15] Milan Petrović: There are two factors in all that. First one is you can declare, PHP 8 is the minimal version we support. We don’t support PHP 7.4 anymore. And that means that you don’t need to make any changes in WordPress at that point. You can declare it because WordPress is compatible with all PHP versions. It works on 8.0 and 8.5. That’s no problem. But say that branch 7 is no longer supported, you’re kind of pushing other developers and hosting companies to improve their support for newer versions.

And you don’t need to make immediate changes to WordPress. But at that point, you are open to modernise the code because now you can have more stricter typing across the board. There are some strict typing things in older PHP versions, but with 8.0, you can do all of that. And it doesn’t have to be a process that is done immediately. It can be done gradually. You can update parts of the WordPress Core over time. And it’ll take a few years, to get up to date, but at least you are closing doors to some older versions of PHP, and you are pushing developers as well for plugins to have that policy.

Right now, each developer can have their own plugins supporting any version of PHP you want. For my plugins, I have policy of 8.0 as a minimal version since this year. And, I’m updating the code as I go along. I don’t do it, it’s impossible to do it all at once. And for WordPress, it’s going to be even worse to make it all up to date. But declaring PHP 8 is a minimal required version, would be a great step in the right direction for wider adoption.

[00:15:51] Nathan Wrigley: Yeah, I think the problem is simply one of the user base, isn’t it? There’s just millions of people, thousands of developers all doing their own thing. And casting 8.x, 8.0 and above as the new minimum, there’s going to be a moment where some things do go wrong.

So that calendar plugin that you’ve been using for ages, which just works. And sure, you’ve never really received any updates from the developer, but it just works. Everybody’s booking on my calendar and we are all good. And then suddenly PHP 8 is required and it turns out the calendar plugin now no longer works.

You can imagine those kind of stories a million times over coming to the fore. But equally, we got to move on. There’s no way of, you know, because we can’t in 10 years still have sites on 7.4.

[00:16:43] Milan Petrović: We have sites on five point something. I recently checked the official WordPress tracking. 7.4 is on 20% even now. So we are far away from WordPress ditching the 7 branch. And I think there are still few percent of PHP 5 in all that so.

[00:17:01] Nathan Wrigley: Yes, I regularly look at the, it’s like a little donut chart, isn’t it? That is often produced and you gradually see the eight point x whatever section of the pie getting bigger as they produce the next survey. But you’re right, it’s still a significant chunk that’s on 7 and below.

And whilst when I look at that chart, it doesn’t really bring any alarm bells to the fore, I just think, oh, that’s a shame. But now that you are presenting this talk, and giving me this information, I realise that that attack surface is worse.

When you gave that talk, who is your target audience? Were you directly sort of aiming at the hosting companies who presumably can do a lot of work very quickly? You know, they could take a million people onto 8 with a little bit of development work and on the back end of their platform. Or are you really encouraging the general WordPress user, like me, to take a bit more interest and make sure that I am going into the cPanel or whatever it is and updating myself? Or is it a bit of both?

[00:17:59] Milan Petrović: For everyone actually. It’s for developers to be more aware of what they can gain with the new PHP versions. It’s for hosting companies. Because it’s not only about security when it comes to the newer PHP. The PHP is faster and faster. So each new version gets you 5 or 10% more performance without doing anything. So PHP 8.5 is more than 50% faster than PHP 7.4. So that’s a significant update.

And I have even, one slide was showing how much less memory PHP 8.5 used to run exactly the same piece of code. So it’s pretty wild to see that hosting companies are maybe the biggest factor in all this. They will gain a lot more because they’re going to free a lot of resources to run more websites because PHP is going to use less memory and it’s going to be faster.

So I understand they need to invest a lot of money to do all that. But, I don’t know, I think that gains from that are very significant, on that level alone.

[00:18:57] Nathan Wrigley: Yeah, so you described there are really compelling scenario. You know, it’s quicker, it uses less memory, you’ll save money. I mean what else do you need? You’ve just presented the entire argument.

However, it hasn’t happened. So technically speaking, why do you think it hasn’t happened? Is there an acquisition of new knowledge that is difficult to take in? Is it that simply you would have to, I don’t know, retrain your staff? How do you understand that it hasn’t happened? What are the reasons people are digging their heels in and not making these updates?

[00:19:25] Milan Petrović: I kind of make the group of two or three types of hosting companies. One, and that’s usually more expensive managed hosting solutions. They are forcing the updates. They’re not maybe on the latest version, but they are forcing their users to use at least three or four versions of PHP back. So maybe 8.2 or 8.3, which is a great step in the right direction.

There is also a problem of support. If something starts breaking, they’re going to be the first one to be asked about that, because they made the change to the server. So why now website that was working yesterday is no longer working today because of some change made on a hosting level. So there are a lot of factors to play into that adoption.

But on the other hand, there are a lot of developers that have moved on with supporting PHP 8. A lot of plugins are very much updated and, especially popular plugins. They invested a lot of time to do the update. It’s getting easier to support it. But on the other hand, you have very old websites that are simply cannot move without proper testing, without updating the plugins. And there are cases when you cannot simply update one plugin because something else may break, or you made some changes that will make some other thing break. So it’s a big puzzle that is definitely not easy to solve, but maybe we should start some work on that as a community to do it, and to move people along.

I don’t want to say force the change, but make people aware of the benefits. Make people aware of the risks if they continue to run the old and outdated software. And the same goes for not updating plugins, not updating WordPress. No matter how much work is done in that regard, there are still most likely some exploits on a WordPress level for very old versions that at some point someone is going to find out about and exploit.

[00:21:16] Nathan Wrigley: I mean I guess the motto of WordPress was democratised publishing, which means basically make it available to everybody. No matter your level of expertise, make it available to everybody. And I’m sure that if you were to grab the CEO of any hosting company and say, I can save you money, I can save you resources, and all of those things that you outlined earlier, they would, yeah, we know, we know. But we’ve got thousands of non-technical people using WordPress.

I kind of have this analogy in my head, and it goes a bit like this. Several years ago, I bought a bike. And it sits in my garage and there is my bike. And I expect my bike to work tomorrow in the same way that it did four years ago. And in 10 years, I expect my bike to work. I don’t expect there to be an update to wheels or gears or the saddle. It doesn’t need an update. It’s just a bike. And I need my bike to be a bike and nothing more.

And I get the impression that many people treat their WordPress website as the same thing. This sort of static commodity that, sure enough, they pay a monthly fee for it, but it’s this website. It’s a thing, and it doesn’t need changing. And so what I’m trying to say is, I’m fairly sure that the hosting companies are met with that an awful lot. The customers who just, it’s a bike, it’s a website. Do you know what I mean?

[00:22:37] Milan Petrović: Yeah, but you need to maintain your bike. If you don’t do it, it’s going to, your belt is going to rust, your wheels are going to be deflated or whatever. A lot of things can happen with it if you don’t maintain it. So, we don’t need to upgrade everything all at once, but we can start from someplace. We can do it gradually. But still, WordPress needs to be the platform that leads the charging that, because it’s going to force other developers to do it. It’s going to force hosting companies to start doing it. And it’s not a big jump on moving just that one version, but it’s going to help to move things along faster. Let’s see how it goes in the next few years. But I really don’t expect for WordPress to drop 7.4 for at least a year or two, maybe even more.

[00:23:24] Nathan Wrigley: I loved your rebuttal of my bike analogy there. That was perfect. That’s exactly right. The bike will rust, the wheels will be deflated and all of that, yeah. So we need to drag the WordPress users along.

Now, in your presentation, you mentioned something that I have never used, the Vulnerability Lab plugin, which you used to demonstrate the attack. Can you just tell us a little bit about that? Because I’d be curious to follow that up, and maybe some people listening to this would too.

[00:23:47] Milan Petrović: I started it for, created for this talk specifically to add few examples and to run the code that is going to show those things if you run the plugin on the old version and the new version of PHP. And I do plan to expand on it because there are a lot more PHP security elements that can be demonstrated in that way.

So it can show you, you have like a, in many cases the same code, but if you run it on one platform, you’re going to get one result. And if you run it on the newer one, you will get something different. So it’s useful to show, and some of those changes are quite small, those attributes that you can add to the code are very, very small, but they can really help you to improve security of your plugin.

And there are more complex security measures that can be implemented, but the format of the talk wasn’t really suitable to mention everything. But this was like something to get you started on the path of discovering what else PHP 8 can offer, when it comes to improving the security of the plugins and what possible exploits and vulnerabilities are there.

I try to use some obvious things that are very easy to spot. And I’m sure I did made some of those errors myself in the past. So some of those examples are something that I dealt with when I was upgrading my code. So I’m sure that a lot of people can see similar problems in their own code, and similar kind of solutions that can help them to overcome those and to make them much more resilient in the future.

[00:25:17] Nathan Wrigley: So is your plugin designed primarily, would you say for developers in mind, or is it something that just a typical end user may get some mileage out of?

[00:25:26] Milan Petrović: No, it’s more for developers that they can see, they can run that code and see how it behaves on the old version and the new version to demonstrate some of those things. And I will definitely expand it to include more examples in the future. Even for myself to like a document, what can happen if you run something in the old version, and the new version?

I had some suggestions coming to me like, maybe like a pattern library that is going to show what is the pattern that we use with old PHP and how to improve it with a new one, and document which version of PHP is going to support it, and how it’s going to improve the code.

[00:26:01] Nathan Wrigley: So is the idea then that you would instal it on various different, let’s say that you’ve got a live site and you’ve got, I don’t know, a development site and another development site, is that you would put it on each of those, different PHP versions, and just sort of compare and contrast what.

[00:26:16] Milan Petrović: Yeah, that can be used.

[00:26:17] Nathan Wrigley: Yeah, in that way. And what’s the reporting that you get? Is it kind of error logs, you know, that only a developer would be able to understand, or is it in plain language that somebody like me could understand?

[00:26:26] Milan Petrović: Right now it’s a bit technical because if you run a certain part of the code, some of those elements do have a visual component in the admin section. You will see, one of the examples, if it’s run on PHP 7.4, it’s going to result in a fatal error for sure, depending on the server settings. And if you run it on the new version, you will get a full code running and executing as expected.

So it’s a bit of a development thing that developers can use themselves to show maybe to potential clients or to website owners what is going to happen if they continue to run the outdated versions of the PHP. So it’s not just, yeah, the PHP 7.4 is bad, but here it is, why it is bad actually.

[00:27:12] Nathan Wrigley: Okay, that’s a really interesting use case, isn’t it? So if I’m an agency owner and I’ve got, I don’t know, a client over here who is absolutely wedded to this plugin, this calendar plugin say, and we know that the development of that plugin has ended years ago, then trying to persuade that client to find something new, or have something new built is difficult.

But with the capabilities of the plugin that you’ve created, you’ll be able to show in a sort of readable human way, okay, right. That’s all very well, but we’ve got to get onto PHP 8.0. And when we do that, this is going to happen.

So that’s actually quite a useful tool for agencies to be able to dangle things in front of the noses of their clients. Potentially, I don’t know, get some new work out of it as well, because there’s this extra work that needs to be done to bring it up to the modern standards.

[00:28:01] Milan Petrović: Yes. And one example especially demonstrates not only security, it demonstrates the performance. It shows you how much memory that piece of code is using on old version. Almost half the memory is going to be used less with a new version. So that’s very on the nose demonstration on security, and the performance in the same time. So things like that can help. And I will definitely try to invest more time in showing more examples and anyone can contribute.

It’s a plugin available on GitHub, so any contributions in that regard are welcome. And we can maybe all work to create like a list of patterns that are something that a lot of people can use, and show different people how the PHP can help them move along.

And again, I don’t want to sound like we don’t need whatever WordPress is doing. We still need to use all the security enhancements that WordPress has built in the Core. Escaping, sanitisation. All that is still very important because you cannot solve everything by upgrading PHP and upgrading your code to use some of the PHP features. There are still a lot of security elements in WordPress itself that are very important and should not be replaced, or removed, from the code. There are patterns that are crucial to ensuring the security is on a top level. So combination of what WordPress already has, plus everything we get with the newer PHP is something that we should strive in the future, and to make things better.

And it’s not that complicated to start with the process. You can start upgrading small things. You can start with stricter typing. You can start with very small changes, and then gradually you can add those new attributes. You can replace some of the functions that you may be used with old version of PHP, but there is something better in the new version. So that’s something that everyone can do. Do a bit at a time so not everything at once. Spend time and make some gradual upgrades, and that’s going to help moving along.

[00:29:57] Nathan Wrigley: You are obviously here to talk about where PHP meets WordPress, but presumably you, yourself are gaining intel from the PHP community. Is there a resource, like a central PHP resource that you would direct people to, or would you rather steer them towards kind of WordPress resources? The things that people are doing in the WordPress space and the hosting space. There’s not really a question there, but it’s more where do you find your information? Where’s the most reliable place?

[00:30:25] Milan Petrović: You need to check everything. PHP website is a really good resource to find the information about what’s coming in the next version of PHP, because the preparations take up to a year to release a new version of PHP. So they’re now on a cycle that every December we get a new feature version. So in December this year, there is going to be PHP 8.6. And you already know most of the things that are coming to that version. You have the detailed list of changes for every PHP version. And that’s something that any developer should look at, and to see maybe something that will drive them to upgrade.

In the current usage of third party libraries, there are a lot of libraries used in PHP that have moved on beyond 7.4. There are a lot of libraries that now require 8.1 or 8.2. If you depend on some library for, I don’t know, parsing URLs, or doing something else, something for security, something for whatever. You may face the problem that if you want to use the latest version of that library, you will need to have the newer PHP version. So you are kind of forced to upgrade your plugin requirements to meet with the requirements of the third party libraries.

And outside of WordPress ecosystem, those libraries will move much faster with the adoption of newer PHPs versions than WordPress itself, because they don’t deal with millions and millions of websites that are affected. They are creating the library the best way they can. And they want to ensure that their library is secure, that their library has access to the latest features. So they are going to bump requirements for those libraries on their own. And if you are depending on it, you need to do it yourself for your plugin. So it’s kind of, those libraries are kind of forcing the hand of some developers to upgrade, even if they maybe are not ready at this point to do it.

[00:32:15] Nathan Wrigley: Yeah, it certainly sounds like there’s no lack of information out there. If you make your business to find the information, then it’s all there. You’ve just got to make the effort to go and find it.

I’ve kind of run the gamut of everything I wish to ask. However, I’m very conscious, as I said at the beginning, that this conversation is a little bit above my pay grade. Is there anything that I missed that you wished you had been asked that you wanted to get across?

[00:32:38] Milan Petrović: No, I think we covered a lot of stuff in that.

[00:32:42] Nathan Wrigley: Well I’m glad to hear it. That’s great. Yeah, thank you.

In which case, I’m assuming, given that you’ve come to an event like this and you’ve put a plugin on GitHub, you are sort of semi available, or very available, to have conversations with people around this. And if that’s the case, where’s the best place to find you online? A website or an email address or a Twitter handle or whatever.

[00:33:00] Milan Petrović: We included the slide with the contact information. So even the email, if someone wants to get more information, they can do it on various social networks as well. So any input about all that is welcome. And I’d be happy to help if someone needs, some pointers or additional information to get started with all this.

[00:33:21] Nathan Wrigley: Well, thank you. That’s very much appreciated. As always, if you go to the show notes on the WP Tavern website and click on the episode involving Milan, you’ll be able to find, buried probably towards the bottom, all the different bits and pieces, the wordpress.tv video that will go with his presentation and various other links that have been discussed during the course of this episode.

So with that said, Milan, thank you so much for chatting to me today. I really appreciate it.

[00:33:47] Milan Petrović: Thank you. It was really great, and I appreciate your invitation for the interview.

[00:33:52] Nathan Wrigley: You are so welcome. Thank you.

[00:33:53] Milan Petrović: Thank you.

On the podcast today we have Milan Petrović.

Milan has been deeply immersed in the WordPress ecosystem since 2007, developing an array of plugins, especially for expanding bbPress forums, and running his own company creating plugins before joining the Freemius team as a full stack developer. With nearly two decades of hands-on experience, Milan has witnessed firsthand the evolution of both the WordPress and PHP landscapes.

Many WordPress users may be only partially aware of PHP, perhaps they’ve noticed version numbers in their hosting panels, but few of the millions of WordPress users understand the real impact that PHP versions have on the security and performance of their websites. Milan is here to shine a light on why embracing newer versions, like PHP 8.x, isn’t just good practice but a crucial step for security and efficiency.

Milan begins by recounting his journey through WordPress development. The conversation gets into the heart of his recent WordCamp Europe presentation, which tackles how legacy PHP code exposes sites to thousands of open bugs and vulnerabilities, and why relying on old versions is, as he describes, “an active invitation for automated exploitation.” The discussion explores the contrast between running legacy code and using the “native shields” of modern PHP, and highlights how PHP 8.x not only closes security holes but also delivers major performance boosts, reducing memory usage and accelerating speed.

If you’re wondering why you should care about the PHP version your site is running on, or you’re a developer interested in practical ways to harden your code, Milan unpacks both the existential risks of outdated PHP and the step-by-step benefits for hosts, agencies, and plugin developers alike.

He introduces his Vulnerability Lab plugin, designed for developers to see first-hand how code exploits play out differently across PHP versions, and makes the case that modernising can happen gradually, one update, one plugin at a time.

If you’ve ever questioned how your hosting choice or plugin stack could affect your site’s future, or you’re ready to take the first steps towards building more secure and future-proof WordPress products, this episode is for you.

Useful links

Secure-by-design: hardening plugins with PHP 8.x – Milan’s presentation at WordCamp Europe 2026

bbPress

Dev4Press

Freemius

 Vulnerability Lab plugin on GitHub

💾

Gutenberg Changelog #132 – Proposals for Core, Calls for Testing, WordPress 7.1 and Gutenberg 23.4 and 23.5

In episode 132 of the Gutenberg Changelog podcast, host Birgit Pauli-Haack and guest Ellen Bauer explore the latest updates within the WordPress ecosystem. The conversation centers on the releases of Gutenberg 23.4 and 23.5, the recent WordPress 7.0.1 maintenance update, and the strategic roadmap for the upcoming WordPress 7.1.A significant portion of the episode is dedicated to […]

💾

Gutenberg Changelog #132 – Proposals for Core, Calls for Testing, WordPress 7.1 and Gutenberg 23.4 and 23.5

In episode 132 of the Gutenberg Changelog podcast, host Birgit Pauli-Haack and guest Ellen Bauer explore the latest updates within the WordPress ecosystem. The conversation centers on the releases of Gutenberg 23.4 and 23.5, the recent WordPress 7.0.1 maintenance update, and the strategic roadmap for the upcoming WordPress 7.1.A significant portion of the episode is dedicated to major merge proposals destined for WordPress 7.1 that aim to evolve the core software.

These include “Core Abilities” for AI agent integration, the new “Knowledge” post type for managing site standards and guidelines, and “Design System Theming” to enhance consistency and accessibility via CSS custom properties. The hosts also discuss the shift toward mandatory iframing for the post editor in block-based themes, a critical architectural change designed to improve content rendering.Beyond core architecture, the episode highlights user-focused improvements such as enhanced responsive editing controls, which now allow for granular canvas resizing without preset limits. They also touch on media-related updates, including aspect ratio controls in the media editor, and improvements to the Icon block.

With WordPress 7.1’s Beta 1 approaching, Birgit and Ellen emphasize the importance of community involvement, encouraging developers and site owners to participate in ongoing “Call for Testing” efforts. Whether discussing React 19 status or new grid layout properties, the episode serves as a comprehensive briefing for anyone looking to stay current with the rapidly changing landscape of the block editor and WordPress core development.

Show Notes / Transcript

Show Notes

Special Guest: Ellen Bauer

Announcements

Community Contributions

What’s released

Post Editor iframed

Punted from 7.1

Gutenberg releases

Stay in Touch

Transcript

Birgit Pauli-Haack: Welcome to our 132nd episode of the Gutenberg Changelog podcast. In today’s episode, we will talk about proposals for core, calls for testing Gutenberg 23.4, Gutenberg 23.5, and whatever side ideas we have about 7.1, which is in the works. I’m your host, Birgit Pauli-Haack, curator at the Gutenberg Times and a full time core contributor for the WordPress open source project sponsored by Automattic. With me today on the show, and I’m very delighted to tell you that is Ellen Bauer, product manager at WordPress.com and early adopter of block themes. Thank you for joining me, Ellen. How are you today?

Ellen Bauer: Thank you very much. Always happy to be here. I’m great. I just landed back in Bangkok this week where we are. I’m staying here a little bit longer with my family this year from Germany, visiting family and attending a meetup. And yeah, it’s good to kind of do that travel because it always inspires me to get out of a routine. And yeah, I’m really glad I’m here now and motivated.

Birgit Pauli-Haack: Yeah.

Ellen Bauer: To get back into working, improving WordPress.

Birgit Pauli-Haack: That’s a great time to spend in Germany. And I hope you had luck with the weather.

Ellen Bauer: Well, there was this heat wave in the second week. It completely knocked me out, to be honest.

Birgit Pauli-Haack: Yeah, that was really hard. And a lot of people say that.

Ellen Bauer: It was great and went on the last day I went to Legoland for the first time, which was also an experience and exhausting, but great.

Birgit Pauli-Haack: That’s here between Munich and Augsburg.

Ellen Bauer: Yeah, I think it’s close. Yeah.

Birgit Pauli-Haack: Yeah, between my first time. Oh, nice. Yeah, maybe I should go there too. But it is fun.

Ellen Bauer: It is fun. Maybe not. I don’t recommend to go in the summer on a Sunday, which we did, but. Oh yeah, that’s actually really fun.

Birgit Pauli-Haack: Family day. Yeah. So you mentioned you attended the meetup in Porto. What was your takeaway from the meetup with digital?

Ellen Bauer: So it was actually the main reason I came to Europe for it was the first time all products meetup from Automattic in beautiful Portugal for me, also the first time I’ve been to Portugal, which shouldn’t happen to not visit before. But it was really cool. I love Portugal. Really lovely people, beautiful vibe, nice weather. Yeah, it was really relaxing, really a treat. And then very inspiring and motivating to be in the product group for the first time all together in a nice setting and we had amazing conversations. For me, I also got to know my team a little bit better because I just sort of recently switched into dot com, so that was helpful. But yeah, also a lot of meaningful, deep conversations and I’m really, really motivated after that meetup.

Birgit Pauli-Haack: Oh yeah. So when you said meetup, I’m still in the community brain, so I thought it might have been a WordPress meetup because I spent some time. And that’s probably also the reason why my brain went there instead of the internal. Because I spent some time with meetups, local WordPress meetups in Salzburg and in Erfurt and also in Munich. I restarted the meetup here in Munich with a few of the original founders and some other people and. And it’s a totally different vibe than a WordPress conference.

Ellen Bauer: That is true. I love meetups.

Birgit Pauli-Haack: You meet 15 maximum 20 people and then you learn more about how they use WordPress, what they really move a normal user. So it kind of grounds you much better than kind of always being in the contributor section, kind of.

Ellen Bauer: So that is true. Well, there was WordCamp Europe, which I didn’t attend because it was just so much. I attended WordCamp Asia, which I also loved this year. That was such an amazing experience and very motivating. And I talked to a lot of people who are meetup organizers in India and I really now want to visit one of their meetups. It sounds fun. I also visited the meetup here in Bangkok before and I love the people there, the really tight community. And I’m also. I have been thinking for many years now that I should actually start a meetup in our town in New Zealand. I haven’t committed, but I’m always coming back thinking about it. So maybe I should just commit and do that because it would be cool to have like a local.

Birgit Pauli-Haack: Yeah.

Ellen Bauer: In New Zealand. There aren’t many around, but it would be cool.

Birgit Pauli-Haack: Well, the first thing that you need is a co-organizer. So don’t start until you have a second person to do that because we travel a lot. Well, I travel a lot and I cannot be at every meetup, so I need somebody else to do that. So that was kind of back of mind.

Ellen Bauer: That’s a good advice.

Birgit Pauli-Haack: Yeah. And the meetups in India, they’re really big. They’re 40, 50 people.

Ellen Bauer: I talked to someone and. And they have 200 people every month on Surat. I was like, I want to come. Yeah, it’s amazing. Like, I want to visit.

Birgit Pauli-Haack: It’s a small word camp for an evening kind of thing.

Ellen Bauer: That is so true.

Calls for Testing

Birgit Pauli-Haack: All right. Yeah. So work for 7.1 is progressing and there are calls for testing out, and this is the first time that there are so many out there. There are five of them. And if you want to learn what’s really in 7.1, there’s no better way to take a deep dive and heed the call for testing. 

So there’s a call for testing for the responsive styling and yes, it’s coming to WordPress now. And then there’s a call for testing for the new modal media editor that opens up when you click on the crop icon in the toolbar of an image block or a cover block. And then there is the call for testing for the client media processing. That’s a feature that comes to 7.1 where the client, the browser is actually doing a lot of work in uploading the upload side of the image uploads and the resizing and then dumps it into the WordPress media library. 

There’s also a real time collaboration outreach effort that is also a call for testing. And then there’s a call for testing for getting Unicode into email addresses. And that’s kind of fun too. So the testing has done an amazing job putting those calls for testing together because you get instructions on how to use it and videos to show you how to use it and then the instructions also for the testing. So your mental work on how do I test this is already done. You’re just going to follow the script and, and then have room in your mental room to observe your feelings for whatever you’re doing and kind of try to, to verbalize them and share your feedback. So it’s really interesting and I hope you dear listeners are going to heed those calls. One or two of them. You don’t have to do all of them. Yeah, I don’t grade you, but there will be a test. Yeah. 

Community Contributions

Then there are also two. Well, I said two, but there are actually three merge proposals from the contributors. There’s new things coming to WordPress Core. One is expanding the WordPress Core abilities. It’s a merge proposal to add three read-only abilities to cover the settings, content and users for AI. And it gives AI clients real tools to call so the agents can understand what your site’s configuration, post and people are doing. There’s a discussion should this be in core, should this be a plugin and all that you can read up on the post. And the second one is also for AI is the guidelines to build knowledge on your website. Yeah, what’s your tone about what’s the tone of voice, the expression, what the topic is about and what the members are, what the standards are and all the notes for revision and capabilities. So an AI agent could follow those instructions as well.

And for people who manage multiple sites with one AI they can actually it’s different for every site. So it’s really important to have that on the site to give that that’s a new content type and new settings pages for these things. So you can even use your AI to update those guidelines. There’s one thing and then of course the last one is the bigger one and that’s a merge proposal for the design systems theming Andrew Duthie published a merge proposal bringing design tokens and new theme components to WordPress built by the Gutenberg Components team. But it turns the hard coded admin styles into CSS custom properties so your plugins and screens stay consistent and accessible. 

Then a color ramp tool generates harmonious accessible scales from just two seed colors and the user color scheme reaches the site editor which will come into I think 7.1. So with a dark mode on the horizon. So it’s a good time to get involved in the discussion now, dear listeners, and to make your point of view listen to and converse with others on the impact for you and your business and for your clients because that’s where the decisions are made. Some of them are already made but they are loosely held, so to speak. 

There’s a whole aspect of WordPress is we have strong opinions but they’re loosely held. If you have a good argument and you have a good use case or a different point of view, you are listened to. Of course if aired respectfully and even if it’s not respectful it should be because we all want to do the same thing. So the links to all the merge proposals and calls for testing will be in the show notes. You get to pick what you are interested in and so that’s a whole thing that happened in the last three weeks when we didn’t have a Gutenberg change log. So I wanted to catch you up. Any thoughts on that Ellen, that you want to share with our listeners?

Ellen Bauer: I think on the merge proposals but I think for the calls for testing the responsive styling of course sticks out to me because we have been calling for that for so long and the user the feedback was always there like what is that without responsive styling? So now here it is. So yeah go ahead and test it and I will do the same and kind of contribute to make it better or improve what. What we can. But here we go. We finally have. I think the number one ask always this is missing in Gutenberg.

Birgit Pauli-Haack: Yeah. I think the number one ask is not the responsive design because Gutenberg is responsive in certain areas. It’s a viewpoint. It’s a media kind of thing. Yeah. So what is a tablet? What is a mobile. And to change things for those screen sizes. And there was a big hesitation and there’s. On the developer blog, there’s an article about intrinsic design that’s built into Gutenberg. And I think the thinking was, okay, intrinsic design is what comes after media queries. Comes after. So because we need to also talk to what is component in the container queries in CSS and all that. And at the start of Gutenberg people wanted to push the envelope of intrinsic design and then see what’s missing. And. And now we know where it all goes and how to. To change it. And there is a. Yeah, we talk about it a little later when we come to that. Yeah, but so that’s kind of. That part why it took so long, I think was the reason why I kind of went on the drain there.

Ellen Bauer: That is true. I’m glad that we didn’t do like earlier versions of it. It seems late, but yeah, there’s. There’s a reason.

Birgit Pauli-Haack: But I think, yeah, a lot of plugin companies actually filled that gap quite nicely. I also saw a few implementations where you didn’t have three viewports or breakpoints, you had six, so. And I kind of couldn’t imagine that a normal user can keep in their head six different sizes to control the styling and when something needs to be changed to find it again where that actually was changed. I get the hesitation. So yeah, yeah..

Ellen Bauer: You quickly go a little overboard with that. And I’m also glad that we didn’t do that on the core level.

What’s Released – WordPress 7.0.1

Birgit Pauli-Haack: Yeah. So that brings us to what’s released and it’s release week kind of thing. So on Wednesday and we’re recording this on Friday, July 10, Thursday, July 9, WordPress 7.0.1 was released with bug fixes from the major release. And the release candidate announcement has a list of all the fixes in track and from the Gutenberg repo, 

I’m preparing an article for the Gutenberg Times. I will probably put in the show notes about what the fixes actually did is the WPKSS or however say that CSS corruption on some of the admin design glitches and some more. So you can have a summary of that. Yeah. 

On Wednesday, just the day before 7.0.1, a user ask in the core channel, what is. I see all the communication. Yeah. What is the latest version actually, and at that time it was still 7.0, but we say but tomorrow it’s going to be 7.0.1. 7.0.1. Yes. Yeah, yeah. 

So 7.1 last month Anne McCarthy posted the roadmap 7.1. It was aspirational and also very concise with an outline and links to the tracking issue for the many features contributors have been working towards. Beta 1 of 7.1 is scheduled for next week. That’s July 15th. And by then we will know the full picture of what made it and didn’t make it into the release features from the Gutenberg plugin releases 22.6 through 23.6 will come to 7.1 unless they’re behind an experiment flag or plugin or plugin only as guardrail 23.6 release candidate. And that’s what’s getting into the beta version is on July 14, so one day before the beta version, because that’s where all the NPM packages are created and all the things get into the branches. Right feature branch. 

The final release of 23.6 is moved to July 22nd. That was kind of decided by the release tech leads to get it all just in time for beta and organize that. So the deadline for enhancement into the plugin on 7.1 is July 14, the day before beta. So if you’re a contributor and you want to get the feature that you were working on in this weekend is probably crucial because it also needs to be reviewed and approved. So give people time to get in there. 

So yeah, what should be on your radar for 7.1 is the mandatory iframe of the post editor. We mentioned it before. It actually has also a lead time to come to this point is the post editor runs inside or the block editor should run inside an iframe because it isolates the content from your admin styles and makes the viewport units and media queries work correctly against the editing canvas rather than the browser window. And in 7.1, iframing becomes more enforced for block based themes or for all themes because it ensures that canvas behaves predictably and the blocks render accurately for both the post editor and the site editor, template editor and pattern editor and plugin developers. 

So plugin developers who have not updated their Block collections from version 2Block JSON version 2 to 3 should actually upgrade to make this all work. If you want to catch up on the newest discussion, there’s a Gutenberg PR that’s called Always the post editor for book theme. And that’s the 79819. And if you put that in your playground, you can actually add some of the plugins or your staging site, or add it to the staging site, then you can test your things. I think the biggest problems are sites that are maintained by people that do not read the make blog or do not listen to podcasts or read blog posts about their site or the software. And those are sites that haven’t been maintained for a while, otherwise they would have already upgraded things. Yeah.

Ellen Bauer: So block themes need to do anything too. They haven’t. No. Right.

Ellen Bauer: I haven’t looked into that.

Birgit Pauli-Haack: It’s a problem for blocks. Yeah.

Ellen Bauer: That are in the block plugin collections.

Birgit Pauli-Haack: Yeah. That only. They were only meant for post editor and have never been used inside editor or something like that. Because those would have broken already. Because the site editor since 2020 kind of uses an iframe version. So if you use the block in a template or use the pages thing from the site editor, the pages administration from the site editor, you will know when the block breaks. And in the post editor, if you go into the console, you see the notification that it’s going to be deprecated. But if you’re only in the post editor and never look at anything else and those blocks might break if they’re not updated.

Ellen Bauer: What should they do if this happened to them?

Birgit Pauli-Haack: There are some guardrails in place and there were two PRs. That one is the hard kind of, okay, we do all the iframe insight and that’s going to be in beta. And in beta, listening to the feedback will decide if there will be a switch to the other less hard choice there in terms of saying, okay, if it’s a block theme, it’s going to be an iframe post editor. But if it’s not a block theme and. Or if there are blocks on the page that are on the old version, like the version 2, then it will not be iframed, but that is subject to change. It’s kind of. There’s a trial and error kind of process here to figure out what is the best way move forward. Because the first post blog post about that was actually published in June ‘21, so five years. And then there was another one in November 2025, and there was another one in February ‘26. So there is a lot of leeway or runway for agency developers and plugin developers to kind of update, but sooner or later there will be a push to make it final and then deal with the consequences. Yeah. 

Anne McCarthy’s roadmap included two updates that we already know have been already punted. So that’s the update to React 19 and the deprecation of the classic block. Those things have been punted. And there are blog posts on the make blog for the reasons and next steps for that. It’s pretty much the classic blog where there was a lot of communication around it that said, okay, maybe it’s not a good time yet. And for the RAC 19 there were too many backwards compatibility issues, but it’s going to come. So it just needs a little bit more runway to get final to that point. All right. Any thoughts about that?

Ellen Bauer: Not really. I’m excited for 7.1. I think we haven’t mentioned the release time. Is that still planned for WordCamp US and like August 19th.

Birgit Pauli-Haack: Yes, the planning is July 15th being beta and then August 5th being release candidate and August 19th final release on the last day of WordCamp US.

Ellen Bauer: Okay, cool. I’m excited.

Birgit Pauli-Haack: Yeah, I’m excited too. There are nice features in there and there are nice updates to the site editor there and I’m very excited about that. 

Gutenberg 23.4

And now that brings us to Gutenberg 23.4. Let’s go and talk about things.

Ellen Bauer: So that was released June 17th. We’re also going to talk about the next release 23.5 right after. So let’s start with this one first. 

So I think the most exciting things in there are related to media. And the first thing that is pretty exciting is if you load media into the post editor, you now get like a little notification snack bar that kind of tells you the progress of your uploads. Like if you load dump, just dump in like 20 images you’re going to see. And you also I think timed first image, second image, third image. We are used to it, I don’t know from apps and stuff. So I think that is really, really helpful to see the progress of the loading there.

Birgit Pauli-Haack: Yeah. And Adam Silverstein did an amazing job to get this all done. There’s a second one that also that the upload process is now enabled. So when it’s interrupted because you’re offline or something, it also resumes automatically the upload on the when the connection returns. So this would save quite a few hurry up and wait kind of thing. When you’re maybe on a train or in a country where you don’t have stable Internet connections to upload your media. 

Right now, I only highlighted that because it’s in the same thing that the client side media processing is now geared towards 7.1. So the plugin’s only guardrail has been removed and it can be merged into WordPress.

Enhancements

The next one is the playlist block. It now has a visualization style selector so it has the playlist lock. When you try and test it, you’ll see there is a visualization kind of where the music builds some animation on top of the track and you can select the styles now for that. And also it now has a track length setting so you can set up the settings for that as well.

Ellen Bauer: Another thing I kind of liked because I’ve built that before is if you have, I don’t know, on a WooCommerce theme or something, if you want to have the log out log in or for any other kind of purpose, you can now get that into an inner block of the navigation submenu. The lockout lock in. That wasn’t possible before. It’s a small thing but very helpful for whenever you want to have that in a drop down or sub menu.

Birgit Pauli-Haack: Yeah. If you have a membership site or subscribers only content and you. You offer them a nice accessible way to log in and log out. There’s a very minimal change, but you might need. You will notice it. It’s the time to read icon has been renamed to time. So it’s not. Might be getting rid of redundancy, but I’m not sure it’s even clearer. It’s clear enough. So yeah, that’s the change.

Ellen Bauer: Yeah, I think that’s mainly kind of to reuse it, to be able to reuse it for more things. Right.

Birgit Pauli-Haack: Yeah.

Ellen Bauer: Another thing that I think is a little bit bigger and quite helpful is that now it’s possible that columns and gallery blocks can be transformed into grid variations for layout styling. I think that’s kind of cool. I think I wanted to do that many, many times.

Birgit Pauli-Haack: Yeah, me too. Because I forgot that I have a grid block and I tried to do things with the columns block.

Ellen Bauer: Yeah, yeah. So often you kind of start out in a column and then you realize no, that should be a grid.

Birgit Pauli-Haack: And then again for the media. But this time it’s out of the block editor. The media editing modal has changed and it has some new features, better features, new libraries. And we talked about it before on this podcast. But now you can reorder the details field has been reordered and then now you have aspect ratio controls for the mobile toolbar and they refactored a little bit the modal layout in total. But this is a great, great tool. So these are all just the usability issues. The main feature was already in 23.2 or 3 and there are editable attachment fields. And the mobile tool. The mobile toolbar has been updated to include the aspect ratio controls. Also uses the zoom uses now plus and minus buttons. Yeah. Instead of the spyglass.

Ellen Bauer: Oh yeah. That is actually very helpful an update on the dashboard. And you maybe have to help me out if I’m not 100% sure if I understand that correctly. So we always had the grid columns and now they are opinionated. So pre designed responsive. Is that correct if I say that like in your dashboard, like the two columns, I think it’s maximum four columns. It doesn’t go more than four and then it reduces like it nicely responsive by default, right?

Birgit Pauli-Haack: Yeah. It goes from 960 desktop width, so four columns to two columns between a tablet kind of size, between if it’s smaller than 960 to 600 and if, if it’s smaller than 600 or 600 and smaller, it’s going to one column and has a mobile kind of view there. So it’s definitely responsive. But that’s the dashboard. It’s about the admin dashboard. It’s not in the block editor. So that grid has nothing to do with a grid block in the block editor. So we have a little issue there with using the same words for different things. But that’s because it’s all grid based. But it’s a good thing. 

And contributors have an experiment on redesigning the dashboard and also let blocks going in there and all that. So it’s. It’s quite interesting to see that there are more additional features in there like this day before. Right. So if you’re in a block, you can. They’re figuring out how to put the previous day and previous years. So if you have a blog for 30 years or 10 years, you. You get. Or even five years. Yeah. You get a notification, what you published about this time of year, last year or something like that.

Ellen Bauer: Yeah, I like that.

Birgit Pauli-Haack: And that was actually kind of nice.

Ellen Bauer: It kind of embraces your blogging history.

Birgit Pauli-Haack: Yeah, exactly.

Ellen Bauer: One actually kind of cool little change that I really like is in the site editor now. The admin color scheme, if you select another one, get translated into the site editor. So I know a lot of people always say, oh, you go into the site editor and it’s this black different looking user interface. And yeah it’s. Why is it so dark? So now it kind of adopts the color scheme you have selected. And I think this like part of bigger work going into kind of making the interfaces more be like one thing instead of.

Birgit Pauli-Haack: Yeah. The unification of the admin interface is also a long time coming and I think that’s a, that’s a fantastic step. Yeah. To kind of just make it sure that if you have a green sidebar that it’s also green in the site editor.

Ellen Bauer: Yeah. Because why, why wouldn’t it be?

Birgit Pauli-Haack: Yeah. So on the client media side again, the ultra HDR JPEGs that are detected by upload and then the originals are kept unmodified and the sizes subsizes. They preserve their ICO standards. So you have a better quality of the Ultra HD but it also handles the bigger sizes. So it’s a nice addition to the media upload feature that we talked about before.

APIs

Ellen Bauer: And then we also have an update on APIs. Oh, God. You have to help me with this one. I read it, but now I’m kind of like what was that about again? The future it will help.

Birgit Pauli-Haack: So it tracks per entity, the view configuration for pages. And then so it’s about the pages of pages, posts, patterns, template parts, templates and have their default layout in the grids being the, the layout grid in the admin. So when you’re in the site editor you have a choice when you look at templates, what kind of layout. You have a grid layout, a list layout and these kinds of things. And now there is actually an API that you can extract that view configuration for several other things. If you’re plugin developers, you can then replicate what the, what the priority is or what the preference is for your user. And you see that in the rest API when you pull out the information and display it again, that you get the configuration with it. I don’t know.

Ellen Bauer: So you can practically kind of unlock whatever the configuration was in default and then use that in a plugin or something, right?

Birgit Pauli-Haack: Exactly. Yeah.

Ellen Bauer: The same screen.

Birgit Pauli-Haack: So when you. One use case could be if you are using WordPress as your content container, but have another application that displays things as a headless or in another. In another admin content management system that only talks to WordPress with all and pulls out the things that are in WordPress and measures it up with other data that’s also in the system, then you are able to display the same what the user sees in the WordPress admin, you can display that also in your system at the same time. So that kind of would be one of the use cases that I just made up.

Ellen Bauer: Yeah, that makes sense and very good to explain in that way. What else do we have next?

Experiments

Birgit Pauli-Haack: So the dashboard we talked about that now has also an events widget that can be filled. 

Documentation

I wanted to point out one documentation thing that is really a big deal that Juan Margarido has taken on in April or May and push that through a merge now with 23.4 and that is the auto generation of the per block API reference from the block JSON files. 

So, until now it was really hard to figure out, okay, what’s the block markup and are there all the supports in there? Because the documentation was handmade. So if somebody updated a block’s configuration and block JSON and added support to it for other things, it would not show in the documentation until someone touches the documentation page. And for 90 blocks or so that are in core right now, that’s a moving target and fast moving target. So he proposed to go in and auto generate that documentation page for humans and AI to map multiple things. 

So one is the parent relationship with other blocks like think accordion block and the sub blocks there, the attributions in the table, in a table that what the block supports and with links to explain those features. So if you don’t know what the alignment or support of a block is, you can look it up right from there and then what block styles come with core so you don’t have to figure that out from the interface. So like the button comes with two styles, one is the default, the other one is the outline style. Then which CSS selectors are automatically created and then an example of the block markup. And last but not least, also the links to the source of the information and the packages. So you have a full 36-degree view on the block. And because the documentation is auto updated, it comes right there when the new features are kind of added to the block and it will be shown in the documentation. 

This not only helps the developers and theme developers to have a better handle on or one lookup page or section in the documentation, it also helps AI agents to form a comprehensive space to learn about WordPress blocks. Because I have found that AI sometimes just does a custom HTML block and puts it all there instead of using a column block or cover block or something like that. 

So this is a very big deal because that’s something where AI elevates human capabilities because he used AI to run the code that parses the block JSON and puts it into the documentation page and then also has that documentation page from the GitHub repo into the developers.wordpress.org document block editor documentation automatically merged there. So this is a big deal. And kudos to Juan Margarido. He also spent some time getting some community input from the documentation team from the Gutenberg leadership. We had a hallway hangout with a Q and A and it finally was merged now. So kudos.

Ellen Bauer: Yeah, that’s pretty cool. 

Gutenberg 23.5

I think now we’re moving to the latest release, 23.5, released July 1. 

Enhancements

I think the first thing we wanted to highlight was that the design system token defaults now with out a runtime which practically, as far as I understand it correctly, helps that all the styling from the design system is just there by default. There’s nothing that got missed. Is that correct? Yeah, because it happened before that some design elements were in style.

Birgit Pauli-Haack: Exactly. Yeah. It’s now available as public export. That’s pretty much so you can use it in your own apps that you put into apps. I say it’s also called plugin, so you can use it without having to import it into your plugin via NPM and these kinds of things via the build process. So you can just import it into your app here. 

But I also want to point out again the match proposal for the design system. Everything there is kind of in a holistic way explained and also what it’s supposed to come to. And these are all plenty of the component work that’s done for 23.5 and released or merged is actually in support of the design system and the UI revamp of the components.

Ellen Bauer: I think about the block library. And we have a few other updates in the release. The first one is that the viewport states and the controls are now support for they supporting aspect ratio and all the related controls with that.

Birgit Pauli-Haack: So I think yeah, it’s part of the styling system. Yeah.

Ellen Bauer: For image blocks featured image block media library also no, no background images. A background cover image and cover block, yeah.

Birgit Pauli-Haack: Also yeah, okay, that’s the viewport states is the name that they give the responsive editing screens. So those controls are now also available. 

There’s also a line item in the block library section of the changelog about the classic block to hide it from the inserter that has been reverted. That’s part of the blog post that I mentioned earlier that was published after the release of 23.4, so I wanted to point that out. 

The next one is that the media editor modal is now available also for the cover block that comes with that. I think I mentioned that already. But now when you have a cover block with an image, you can also use the media editor modal to crop it, to rotate it, to tilt it and all that kind of things.

Ellen Bauer: That’s a nice add on small but also visually really nice to have is that the icon block now has controls for flip and rotate the icons, which is very nice to have like a. One of the things you like kind of expect to be able to do and then it’s super difficult. So now you can do that. And then it also. What is the second one about?

Birgit Pauli-Haack: Oh, it just adds a default placeholder instead of to the blockchain.

Yeah. So there was also a big push to have text alignment support for some of the text blocks. And now the block quote. I think there were seven or eight blocks that have that again. This time there was missing text align support and that has been rectified. So now you have also text align support for the block quote. 

Yeah, that was one thing that threw me quite a bit and quite often I always went back to the quotes block. But a quote block and a pull quote have different use cases and a pull plot is an excerpt from the article and you couldn’t make it not centered. It was kind of odd that you couldn’t left align it. Which is my favorite. Yeah. Centered when you have more than one word in the center, you hardly can read it. Or more than one line. Yeah. So I always wanted to be left aligned and I can’t quote just a sentence. Yeah. So I’m really great that they have a text aligned support now that makes sense.

Ellen Bauer: It’s these little things that kind of throw you, throw you off if you don’t have them and you’re like, why can’t I then? I think one of the biggest things in this release is that the resizable editor now it’s like fully resizable. You can drag it along. It’s not just mobile, tablet, desktop, you can get your own size and preview it. I think this is one of the biggest releases in this. In this update 23.5. So can you do anything else? You can resize it.

Birgit Pauli-Haack: Yeah, yeah. It has a handle though. You can resize it. So you have a handle to make it smaller but not as small as mobile. So you can see if. If somebody uses a tablet whatever and odd width you can kind of test it if, if your settings actually work there or your. If the. The layout is there. But you cannot change the viewports themselves. Yeah. They are not customizable. It’s just so you can see the preview there. Yeah.

Ellen Bauer: Which is very helpful like visually.

Birgit Pauli-Haack: Yeah. Especially when you get a call and you don’t have that device on hand. Yeah. That a client sees or a client has a complaint from their clients that something is wrong on the view. You can just kind of tested in the block editor without having the device on hand. 

But there is a long standing request to be able to change the viewport numbers and because right now they are hard coded to I think 768 is the desktop and then 467. Yeah. 468 is the tablet and or between there is tablet and then below is the mobile. But there is good news. There is coming with 23.6. It’s already merged is in PR where you can change that via the theme JSON. So theme developers are now able to change viewport numbers for their sites. There is no UI yet for it. But that’s typical. That theme JSON is first. So theme developers can test it out and can actually use it. But for the UI you need a little bit more information how things are going and how users would work with it.

Ellen Bauer: And there’s also been a smaller change on. If you add a note that just. It’s simplified how the show more or less collapse works. If you have a long note you want to collapse it and show more or less. I think that just has been reworked or simplified.

Birgit Pauli-Haack: Right.

Ellen Bauer: I don’t think it’s anything we see on the user side. Right. It’s more in the background. Yeah.

Birgit Pauli-Haack: It’s just faster. Yeah. It’s kind of that. Okay. Mostly performance issue. Yeah. You’ll see a slight change there. 

There is the experiment of the omnipresent toolbar which is pretty much the admin bar. In the editors you see the admin bar, the black admin bar on top of the screen when you’re logged in and you look at your website from that perspective and you also in the post editor you see the black toolbar but you couldn’t in the site editor or in the other editors. So now the experiment is to show it but then also unify the interface because the design view or the site editor has its own W to go back to the other admin. And when it’s in the admin bar you just click where you normally click to get to the site. So it’s all unification of the interface pretty much. And now you can see the site icon instead of the dash icon if you select it as well in the toolbar. So there has been an ongoing effort and some of it might come to 7.1. It’s on the roadmap for the admin bar everywhere, so to speak.

Ellen Bauer: I think one thing that I remember I struggled with quite a lot is the flex behavior of children. So now there has been.

Birgit Pauli-Haack: You mean your child? Well, it’s not the flexibility of toddlers.

Ellen Bauer: The Flex elements. I love flexbox CSS always have. But I think we always had a problem that they weren’t behaving like exactly like CSS. Flexbox should behave. So now one of the changes has been that so flex children that had a fixed width, this is now like truly fixed. I think it was squishable before. Can you say that? Is that correct? And now it’s like a truly fixed width to zero. So I think that’s one of the things visually that helps a lot. And then the other one was grid layouts now have fill available space, toggle. Is that correct? I think it’s just a toggle in the settings. Right. That you can toggle on and off and then you have auto fill and auto fit behavior. Okay. And this behaves exactly like CSS grid behavior.

Birgit Pauli-Haack: Yeah, you would expect. Yeah, that’s pretty nice. There was some. Some quirkiness to the grid block and the grid layouts and I’m glad that Isabella is working on that constantly to improve it and to get back to it.

Ellen Bauer: Yeah, she’s doing great work. I met her live at WordCamp Asia this year and it was really pleasant because I love flexbox Grid. I always love these blocks and CSS settings and they never quite worked. How I or like went into that depth, I wish they had. And yeah, she’s. I think, like, she has the same opinions, so it was a good chat. 

Another thing that is kind of cool and fun to have is that now global styles allow text shadow settings. So, yeah, there’s these options of text shadow, if you ever want to use that in like a cool, fun design or. So now you can set it in global styles, which is really cool. That wasn’t possible before at all, I believe. Right?

Birgit Pauli-Haack: Yeah.

Ellen Bauer: Right.

Birgit Pauli-Haack: It’s a new style support.

Ellen Bauer: I really like that.

Birgit Pauli-Haack: Yeah, I tested it and it’s really nice. There are some presets in there that come from core, and I still need to figure out or find out how you can switch off some of the styles and how you can add your own styles like you can do with the shadow box. The shadow box has a feature that you can switch out the core styles with your own styles or just switch them off, but you definitely would need that for the texture as well.

Ellen Bauer: Maybe we will add that.

Birgit Pauli-Haack: Yeah, it’s not there. It’s the first version and the first version is pretty much a minimal viable kind of setup. Yeah. 

The next thing is again Media Editor modal. It now has some error states. You can magnify the crop to fill the canvas and the current post always includes the initial options. There are also minor fixes, but that is because it gets ready for 7.1 release. So every aspect of it is actually and comes from feedback from the call for testing. The call for testing was actually already issued in I think in May. So it’s already a month in or two months in. So there is already some feedback coming back. 

The data layer has a feature for the real time collaboration or many features, but one of them stands out is that you can disable collaboration per post. So if you have maybe a recipe or a book post type and you don’t want anybody to collaborate with you on that, you can switch that off. It’s probably best for very visual post types or it’s also necessary for template parts or for navigation. Those are also post types. You can control that now. 

So there was a for a while in the text controls there was a prop to have the next 40px default size and there was underscore. Underscore was an experimental property and that now has been made the default. So if you had a 36 before or 32 on the default size for the text box, then if you wanted to be in the same realm as WordPress itself, you had to use the underscore next 40px default size prop to have the same sizes of the controls and now those are default now. So you don’t have to do this experimental prop to use but it will change how things work. So you might want to, as a theme developer or a plugin developer, you probably want to check your plugins, your text control components, how they change behavior or at least the default layout. So that’s why I’m calling that out here in the episode. 

And also a similar thing is known that 23.6 Gutenberg 23.5 bumps. The minimum required version to install the Gutenberg plugin is now 6.94 versions 23.5 and newer. So if you are on 6.7 or 6.8, you are not getting the newest version of the Gutenberg plugin. So I think. Oh, there’s one more. Did I overlook something?

Performance

Ellen Bauer: No, I think on performance you highlighted that blocks migrate markdown converter from showdown to marked. And what does that do?

Birgit Pauli-Haack: It actually is just performed faster. Yeah.

Ellen Bauer: Oh, yeah. Okay.

Birgit Pauli-Haack: And it also has a different parser, so it might have a say. It’s G. What’s it called? GTM. There is a standard for markdown that comes from GitHub and it now adheres to that standard. Yeah. So that’s updated. It’s a minimum change most people wouldn’t even need to do. But if you copy paste something from GitHub or from other Markdown editors or from your AI agent, it’s a different parsing process.

Ellen Bauer: I just researched that and it said that the previous one was like from 2018 or so and this is just like a faster newer version that we updated to. Okay, that makes sense. 

Experiments

And then there was one last highlighted thing on the block library unwrapping. Classic block migration notice experiment.

Birgit Pauli-Haack: Yeah, that’s part of the effort to the classic logic. But that has also been reverted so it will not announce that this is deprecated. So it’s important to know that that line item in the change log has been overwritten already with a newer version that comes to 23.6 on July 22.

Various

Ellen Bauer: And there was another small update on icons to self declare icons color on the icons block.

Birgit Pauli-Haack: Oh, nice. Yeah, I overlooked that. I got lost in the changelog already. So.

Ellen Bauer: I mean there were a lot of these smaller things.

Birgit Pauli-Haack: Oh yeah. So if you have an icon, it can say I’m. I’m only in blue or something like that. What does it mean, the current color?

Birgit Pauli-Haack: Oh, current color. Yeah, of course. Duh. Yeah. I was still stuck on tab sync finally second the tab sync because it’s the. For stabilizing it to come into 7.1. The tabs block is still under active development until July 14, so don’t start building on it yet because there’s API cleanup and refactoring going on where the contributors try to nail down the final version before it gets into core. Yeah, that’s the end of it.

Ellen Bauer: Wow.

Birgit Pauli-Haack: Yeah, we still had a lot to talk about, Ellen. Yeah. So apart from the responsive styling, are you excited about some things that come to 7.1 in the near future?

Ellen Bauer: I think for me, being like a Visual X thing builder or and working on blocks, I think responsiveness is a big one and I’m excited to see how. Yeah. How we just kind of improve things. Also, I like that we are looking more into the dashboard and finding ways to unify the experience. I think this is one of the things that always come up that it looks kind of like two different versions, partly outdated. And I think we need to move along and kind of come to maybe not make everyone happy, of course, but come to a compromise that we can all live with and then move forward. I think this would really help WordPress to kind of shine in a way that it doesn’t look outdated or not like one product. I think if we can come together and do that and push for that change, that would be really, really helpful for all of us and for everyone and for WordPress. So I’m excited to contribute and help to make this happen.

Birgit Pauli-Haack: Awesome. Awesome. Yeah. Yeah. I like the new blocks that are coming. Of course. I have been a fan of blocks since the beginning of the block editor, so I like that the playlist block and the TAMS block. And finally. The table of content. There is an effort to actually have the table of content come to WordPress. Right now. It’s only available for years in the Gutenberg plugin.

Ellen Bauer: I didn’t even know. I thought it would be in.

Birgit Pauli-Haack: Yeah.

Ellen Bauer: Even small things like rotating icons and stuff like that or having them be the current color and all these grid and Flexbox things. They. We need these things. I think it’s still very, very important to have professional settings like that available.

Birgit Pauli-Haack: Yeah. And this is a visual person. You’re probably also happy that you now can have in the group block. Background gradients. Gradients. We all love gradients. I love gradients. I love gradients. Yeah. And there’s these kinds of things.

Ellen Bauer: They’re like, why aren’t they there? And so responsiveness. And I think just of kind of growing up Gutenberg and the editing experience.

Birgit Pauli-Haack: Yeah.

Ellen Bauer: Seems. And even like with AI helping on a lot of things and being able to patch CSS and stuff on onto things to make things better that we don’t have. I think it’s still important that we aim for a really high quality experience in manual editing so people find what they’re looking for and are not frustrated or get lost. I think that’s just the quality we want to stand for and have in WordPress no matter what.

Birgit Pauli-Haack: Yeah.

Ellen Bauer: I think the standard should like, should be. We aim. Should aim for that as being just there for people, for users.

Birgit Pauli-Haack: I think we. We develop, as I say. Yeah. Are kind of really immersed in this AI grace and hype and also the possibilities and the usefulness of AI in our work. There is a danger that we forget that WordPress users that are writers or publishers actually are not using AI to do their work on WordPress. So we definitely need a delightful interface and all these small changes, quality of life changes and the big changes like the responsive editing and the dynamic galleries and whatever is going to come. The modal editor, the media editor needs to be delightful and useful for humans that are kind of having fun and producing more content for the Internet that is kind of. Yeah. Eating it whole, so to speak, with AI.

Ellen Bauer: Yeah, yeah, I love that too. Delightful is a beautiful word to use. Yeah. We want to delight people using WordPress and this should be our aim. AI or not, like in whatever. We have to meet users wherever they are, however they want to use the tool. It shouldn’t be, oh, we can leave this stuff now because everyone uses AI. I think if we have a user interface, it would be delightful. If it’s not yet delightful, we have to make it delightful. And AI can only help us to do that because we can contribute faster, we can move things faster. So let’s use AI for that, to delight users to meet them wherever they are for everything we offer, and we do offer a user interface. So here we are with some work to do.

Birgit Pauli-Haack: I think that’s a good end of the show today. Thank you so much, Ellen, to be on the show and walk with me through those changes that are coming and if people want to reach you, how is a good way to reach out to you.

Ellen Bauer: So I am in the community Slack WordPress community Slack. I’m also on social media, not that active to be fair, but reachable anytime. I think for WordPress community, the community Slack is the best place to reach me. But if you look at my name, Ellen Bauer, you can find me online on all kinds of platforms and I’m oh, I’m actually revamping my Manu and my Little Elmo Studio blog. So there’s going to be a new design and I’m really excited to get blogging again. Also doing a lot more like a few more YouTube videos. I have some ideas for that over the summer month now. So, so wonderful. Yeah, I will share if I have some news on that. Look out for Ellen or Elmer Studio and just reach out anywhere.

Birgit Pauli-Haack: Excellent.

Ellen Bauer: Yes, I’m always excited to hear from you.

Birgit Pauli-Haack: Wonderful. Thank you so much, Ellen.

Ellen Bauer: Thank you for having me. Birget, you’re welcome to be on the show.

Birgit Pauli-Haack: It’s delightful to have you to overuse that word. 

Now, dear listeners, the show notes will be published on GutenbergTimes.com podcast this is number 132, 132. And if you have questions and suggestions or news you want us to include, send them to changelog@gutenbergtimes.com that’s changelog@gutenbergtimes.com thank you all for listening. And until the next time, goodbye.

Ellen Bauer: Bye.

💾

Roadmap 7.1, Gutenberg 23.5, Responsive Styling, Migration to Block themes — Weekend Edition #368

Hi there,

After a four-week break — courtesy of a sciatic nerve with strong opinions — I’m happy to be back in by office chair and in your inbox. There is plenty to catch up on.

Beyond the updates on the new WordPress and Gutenberg versions, you’ll find stories below from WordPress veterans on migrating to and working with block themes on client sites and dive into more complex theme solutions or

Don’t let me keep you from your light summer reading.

Have a splendid weekend ahead!

Yours, 💕
Birgit

Developing Gutenberg and WordPress

The team around release lead Aaron Jorbin pushed WordPress 7.0.1 Maintenance release out the door to update millions of WordPress sites. The update covers 17 Trac tickets and 14 Gutenberg PRs. The full list is available in the RC 1 announcement post from last week.

In WordPress 7.0.1 Fixes Registration Spam, wp_kses() CSS Corruption, and 7.0 Admin Design Glitches, I cover the most important fixes for end users and developers of this release. You’ll learn how the registration-spam loophole got closed, which admin design glitches were sanded off, and why developers can finally remove their wp_kses() CSS workarounds. Update your sites soon if auto-updates aren’t enabled.


Ryan Welcher compiled What’s new for developers (July 2026), and it’s all about the 7.1 cycle getting real: Beta 1 lands July 15, final release August 19 at WordCamp US. You’ll want to test responsive styling, the React 19 runtime flag, and Unicode email addresses now. Also on your radar: merge proposals for Core Abilities and Guidelines, the 40px component default, icons inheriting color, and Playground’s MCP support.


Berislav “Bero” Grgičak announced what’s new in Gutenberg 23.5, released July 1. The headliner: you can now drag the editor canvas to any width, with the device preview dropdown and resize handles working together for responsive editing. The experimental Media editor gains a magnified crop canvas, pixel-snapping handles, and Cover block support. Also notable: text shadows in Global Styles, flip and rotate controls for the Icon block, and a minimum WordPress version bump to 6.9.


For the next episode of the Gutenberg Changelog, I sat down with Ellen Bauer to chat about what’s coming next for WordPress. We dug into the latest Gutenberg plugin releases (23.4 and 23.5) and the recent WordPress 7.1 update. Plus, we walked through some big merge proposal, like the Design System Theming. our excitement around responsive styling coming to WordPress. It’s a packed episode full of news you won’t want to miss! The episode will land in your favorite podcast app over the weekend.


WordPress 7.1 roadmap and more calls for testing

Anne McCarthy published Roadmap to WordPress 7.1., scheduled for August 19, 2026. Longstanding styling gaps are being tackled: responsive styling and interactive-state styling let you adjust blocks per viewport or on hover — no custom CSS required. You’ll also find new Playlist, Table of Contents, and Tabs blocks, a smarter command palette, a Design → Identity screen, the admin bar inside the editors, a media editor modal, and expanded Unicode support for email addresses.

Also mentioned Real-time collaboration, Knowledge Guidelines, React 19 upgrade, Classic block deprecation have been punted since the posts came out. Beta 1 arrives July 15 and will settle which of the other Roadmap features are in and which will be punted to a future release.


The latest Weekend Edition listed three calls for testing. Meanwhile, two more came online:

Nikunj Hatkar, this year’s team rep of the Core Test team, posted a call for testing responsive styling. You’ll be able to style blocks differently for tablet and mobile right in the editor — no custom CSS or media queries needed. The underlying PR unifies the resizable canvas with the device-preview switcher. Fire up the linked WordPress Playground instance, walk through the four test scenarios, and share what feels intuitive or broken. Plugin and theme developers should test their canvas integrations, too.

Dennis Snell published a call for testing Unicode email addresses. With initial support merged, is_email() and sanitize_email() now accepting non-ASCII addresses like grå@grå.org, and validation aligns with the Web Hypertext Application Technology Working Group (WHATWG) spec. You’ll want to check your plugins and themes: the new WP_Email_Address class gives you structured access to local and domain parts, and a snippet lets you disable Unicode support until third-party integrations catch up.

Three Merge Proposals

Core contributors put together three merge proposal for new features to be added to Core for public comment.

Jorge Costa published a merge proposal to expand WordPress Core Abilities in WordPress, adding three read-only abilities covering settings, content, and users. Building on the Abilities API from 6.9, they give the AI Client real tools to call, so agents can understand your site’s configuration, posts, and people. Settings and post types opt in through a dedicated flag, and management abilities are planned for a later WordPress version. 


Greg Ziółkowski published a merge proposal for Guidelines built on Knowledge, a new custom post type headed for WordPress 7.1. Knowledge gives your site one shared home for standards, memories, and notes — with revisions, capabilities, and REST access built in. Guidelines is the first feature on top, letting you capture voice, tone, and per-block rules right where writing happens. Although, originally aimed at WordPress 7.1, in their latest comment, Anne McCarthy indicated that it needs to simmer some more before it’s considered for inclusion in WordPress Core.


Andrew Duthie published a merge proposal for Design System Theming, bringing design tokens and a new theme component to WordPress. Built by the Gutenberg Components Team, it turns hard-coded admin styles into CSS custom properties, so your plugins and screens stay consistent and accessible. A color ramp tool generates harmonious, accessible scales from just two seed colors, and the user color scheme reaches the Site Editor — with dark mode on the horizon. 

Plugins, Themes, and Tools for #nocode site builders and owners

Anne Katzeff published a tutorial exploring the WordPress Cover Block for parallax scrolls. You’ll learn how the Fixed Background setting turns a Cover block into a layered parallax effect — background, middle ground, and foreground text moving at different speeds. The post steps through nesting a second Cover block, switching which layer scrolls, and improving text readability with grouped backgrounds. A video tutorial rounds it out. She also demos her process in this YouTube video.


Carrie Dils shared a case study, One Header, Two Themes, on phasing a legacy Elementor site toward Full Site Editing without a rebuild or content freeze. Using ThemeSwitcher Pro to run two themes side-by-side, she built one shared header in a plugin that both themes render. You’ll learn from five real-world snags — WooCommerce’s hooked blocks, cascade conflicts, routing gaps, query-string bypasses — and why shipping the shared layer first de-risks everything after.


Gina Lucia compared WordPress block themes vs page builders on the Ollie blog. You’ll get a clear-eyed walkthrough of what classic themes, page builders, and block themes each handle — scope, design control, performance, lock-in, and maintenance — with side-by-side tables. Her conclusion: block themes combine sitewide design control with visual editing natively, so you rarely need a page builder anymore, though migration costs and team habits can justify keeping one.


Elliott Richmond explained why he spent 16 months turning 400+ holiday cottages into WordPress blocks. The kate & tom’s site moved from ACF flexible content to a native block theme, freeing the marketing team from waiting on custom widgets. You’ll appreciate his candor: 10,590 widgets migrated via a purpose-built plugin, re-run against fresh production snapshots, with flaky conversions fixed by hand. Even untuned, PageSpeed jumped from 22 to 67.


Wes Theron published a video tutorial, How to Create and Edit Navigation Menus in WordPress, for anyone getting comfortable with block themes. In under ten minutes, you’ll learn how to edit your menu with the Navigation block, add pages, posts, categories, and custom links, and build dropdown menus. Timestamps let you jump straight to the part you need — handy if dropdowns are the only thing standing between you and a finished header.

Theme Development for Full Site Editing and Blocks

Henrique Iamarino shared how the Automattic Design team built a WordPress theme without ever opening Figma. You’ll follow the making of Crafted, a production-ready theme created almost entirely in the WordPress Editor: Global Styles for typography and spacing, Create Block Theme to save edits to theme files, WordPress Studio for local review, and an AI assistant for finishing-touch hover CSS. His takeaway: the Editor is now a professional design surface.


Justin Tadlock explained how to dynamically load template parts in block themes on the Developer Blog. Instead of maintaining a pile of near-identical templates, you can hook into the render_block_data filter and swap a template part’s slug on the fly — say, a different sidebar per post category. His walkthrough covers early returns, fallback behavior, and file setup, and the technique works for headers, footers, and banners, too.


 “Keeping up with Gutenberg – Index 2026” 
A chronological list of the WordPress Make Blog posts from various teams involved in Gutenberg development: Design, Theme Review Team, Core Editor, Core JS, Core CSS, Test, and Meta team from Jan. 2024 on. Updated by yours truly. 

The previous years are also available:
2020 | 2021 | 2022 | 2023 | 2024 | 2025

AI and WordPress

Jeff Paul announced what’s new in AI 1.1.0, the latest release of the canonical AI plugin. Two experiments headline, type-ahead text suggests inline ghost text as you write in the block editor, and key encryption secures your AI Connector API keys in the database. You’ll also find smarter content readiness checks with locale-aware counting, more control over guest comment moderation, a new core/read-settings Ability, and a peek at 1.2.0 plans.

Need a plugin .zip from Gutenberg’s master branch?
Gutenberg Times provides daily build for testing and review.

Now also available via WordPress Playground. There is no need for a test site locally or on a server. Have you been using it? Email me with your experience.


Questions? Suggestions? Ideas?
Don’t hesitate to send them via email or
send me a message on WordPress Slack or Twitter @bph.


For questions to be answered on the Gutenberg Changelog,
send them to changelog@gutenbergtimes.com


Featured Image:


WordPress 7.0.1 Fixes Registration Spam, wp_kses() CSS Corruption, and 7.0 Admin Design Glitches

WordPress 7.0.1 is now available. As the first maintenance release of the 7.0 cycle, it’s strictly a bug-fix release: every included ticket addresses either a regression introduced during 7.0 development or an issue intentionally deferred at the end of the cycle.

The release ships fixes for 17 core Trac tickets and 14 Gutenberg PRs. Because this is a maintenance release, sites with automatic background updates enabled will update to 7.0.1 automatically — everyone else should update as soon as possible. Here’s what stands out for each audience.

Kudos to release lead Aaron Jorbin and his team for pushing this release over the finish line and getting it into hands of WordPress users quickly.

The most important fixes for end users

Registration page spam is shut down (#63085). The account registration page could be abused to send “Login details” spam emails from your site. This is arguably the most impactful fix in the release for anyone running a site with open registration — it protects both your users’ inboxes and your domain’s email reputation.

The 7.0 admin reskin gets its rough edges sanded off. WordPress 7.0’s refreshed admin design shipped with a handful of visual glitches that this release cleans up:

  • Form elements are now standardized in the mobile viewport (#64999)
  • The image editor’s scale and crop inputs no longer mismatch in size, and the info icon uses the new color scheme (#64937, #65428)
  • The publish settings panel no longer crowds its primary action buttons together (#65286)
  • The Media Library’s loading spinner is properly aligned in the modal filter toolbar, and the search bar no longer jumps position after a search (#65275, #65296)
  • A “black flash” that briefly appeared on wp-admin pages before the interface finished loading is gone (Gutenberg #78493)

Emoji behave correctly again. Two related fixes: the emoji detection script is once more printed in the admin (#65310), and certain characters are no longer incorrectly replaced by Twemoji images (#64318).

Accessibility improvements to the new revisions experience. The Visual History / Revisions feature introduced in 7.0 receives several accessibility fixes: focus now moves to the revisions slider when entering revisions mode, and changed blocks are marked with a CSS outline as a secondary, non-color indicator — important for users with low vision or color blindness (#65122, Gutenberg #77530, #78393, #79691).

The most important fixes for developers

wp_kses() no longer corrupts valid CSS (#65270). Since 7.0 RC4, wp_kses() could mangle legitimate background-image: url(…) declarations into a broken style=")" attribute. If your theme or plugin outputs inline background images through KSES-filtered content, 7.0.1 restores expected behavior — any workarounds you shipped can now be removed.

global-styles-inline-css can be dequeued again (#65336). Since 7.0, developers were unable to remove the global styles inline stylesheet. If your build pipeline or performance optimization strips this and re-serves it another way, that control is back.

PHP 8.5 compatibility fix in wp_get_attachment_image_src() (#64742). An incorrect array access triggered issues under PHP 8.5. If you’re testing sites on newer PHP versions, this removes one blocker.

A removed Navigation function returns as a deprecated shim (Gutenberg #78484). block_core_navigation_submenu_render_submenu_icon() was removed in 7.0, breaking themes and plugins that called it directly. It’s restored as a deprecated shim — but treat this as your migration notice, not a reprieve. Update any code that references it.

Editor state management fixes reduce false “unsaved changes” warnings. Two Gutenberg fixes matter here:

  • controlled/mode block changes are now marked non-persistent (#79350), and
  • related navigation entities are no longer dirtied during passive renders (#79000).

Together these should mean fewer spurious dirty states and a cleaner undo history — a quality-of-life improvement if you build with template parts and navigation blocks.

Block Visibility: “hide everywhere” keeps working after a block opts out of visibility support (#65389). If you register blocks that disable visibility support, previously hidden instances now stay hidden as expected.

How to update

You can update directly from Dashboard → Updates in your site’s admin, run wp core update with WP-CLI, or download WordPress 7.0.1 from WordPress.org and install it manually. Sites that support automatic background updates for minor releases will begin updating on their own shortly.

The full ticket list is available in the release candidate announcement, Trac report 4, and the 7.0.x editor tasks board on GitHub.

What’s next: WordPress 7.1

With 7.0.1 out the door, attention turns to the next major release: WordPress 7.1 is scheduled for August 19, 2026. To see what’s planned for the release, check out the Roadmap to 7.1 on the Make WordPress Core blog.

#224 – David Snead on Building Trust and Collaboration in the Hosting Industry With the Secure Hosting Alliance

Transcript

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, building trust and collaboration in the hosting industry with the Secure Hosting Alliance.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you, and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today, we have David Snead. David has been involved in the hosting industry since 1999, starting out as legal counsel for one of the earliest shared hosting companies, and going on to work with over 50 others. He helped found the i2Coalition, serve as in-house counsel for cPanel and WebPros, and now leads the Secure Hosting Alliance.

If you’re listening to this podcast, I’m sure that many of you will have worked closely with hosting companies. Perhaps you run an agency, or business, that depends on the reliability, ethics, and security of hosting providers. David is here to talk about cross-industry collaboration in the hosting world, specifically around improving security, professionalism, and communication between hosts.

The conversation focused on why, and how, the Internet Infrastructure Forum, or IIF, is building a framework for real-time intelligence sharing and abuse reporting, aiming to help the entire ecosystem detect and prevent attacks faster than adversaries can adapt.

David talks about the challenges hosting companies face, especially smaller ones, in keeping up with security, and how this evolving project hopes to ease this by sharing actionable, non-proprietary abuse information across registrars, hosting providers, DNS services, and more.

He discusses the growth of both the Secure Hosting Alliance and the IIF, the business case for collaboration, and the nuances of legal and technical information sharing across borders.

If you’re in hosting, run a web agency, or just want to know how the backbone of the web is working to stay more secure and connected, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so, without further delay, I bring you David Snead.

I am joined on the podcast by David Snead. Hello David.

[00:03:20] David Snead: Hello.

[00:03:21] Nathan Wrigley: Very nice to have you with us. David’s got a really interesting background, and a really interesting, I’m going to use the word project. I don’t know if that’s the right word. It feels like it’s got more solidity and it’s got a lot more history than that. It’s something which is, I think going, but we’ll find out a little bit more about it. It’s all about the hosting industry and trying to get hosts to, I guess communicate with each other in ways going forwards.

[00:03:44] David Snead: That is a part of it. There are really two goals and one is to level up the ethics and professionalism in the hosting industry. And the second is to facilitate more comradery and interaction among hosts. Something that folks felt occurred in the early 2000s, and with all the consolidation that occurred went away. And so that’s something that we’re also trying to facilitate.

[00:04:16] Nathan Wrigley: Okay. So given that we’re going to be talking about hosting, I guess it’s a good idea to paint your credentials and find out a little bit more about you. So a short opportunity to just tell us a little about you and your background in WordPress and hosting specifically, I suppose.

[00:04:29] David Snead: Sure. So I have been working in the hosting industry since 1999. As I often say, I was working in the hosting industry when hosting was cool. It is not so cool anymore. In fact most people don’t really pay attention to it.

You know, and I started as a lawyer for a hosting company, and I was in-house counsel for a company that actually owned a hosting company and was one of the earliest hosting companies that specialised in shared hosting. And so I was their general counsel. And for some reason it stuck, and I’ve just kind of turned it into a career.

So after that I had a private practise as a lawyer and I worked with probably 50 different hosting companies, mostly writing policies that nobody ever reads, which makes me super fun at parties.

And then from there, my friend Christian Dawson and I formed the i2Coalition as a response to some legislation in the US that would’ve been kind of the death nail for internet providers. So we started the i2Coalition. I then went in-house for cPanel and worked at cPanel and WebPros for 10 years, and then started the Secure Hosting Alliance.

[00:05:52] Nathan Wrigley: Okay. So you’ve got all all the history. That’s pretty good. You know, if we’re going to talk about hosting.

[00:05:57] David Snead: All the hosting history in one person. That’s kind of a very scary idea, no?

[00:06:02] Nathan Wrigley: But that’s excellent. So do you still offer counsel? Is that still, so you haven’t sort of sidestepped and do half of the week on a sort of more technical basis? It’s still the legal side that you’re involved in.

[00:06:13] David Snead: I do. Right now I’m doing mostly M&A work for, it’s weird. So I don’t know if anybody has ever said this to you before, but web hosting is kind of like the Hotel California. It’s like, once you start in the web hosting industry, you never leave. And so I have all these clients from 15 years ago who are now running like little baby hosts, and they’re talking to bigger hosts and they want to get acquired. So I’m doing some of that now. I am not writing any of the policies that nobody ever reads because that was just, I did that for too long.

[00:06:51] Nathan Wrigley: There were too many moments parties.

[00:06:53] David Snead: Yes, exactly. Yeah.

[00:06:55] Nathan Wrigley: Okay, so I’m going to read into the record the title and the blurb that went with the presentation that you are doing or done.

[00:07:02] David Snead: I did it yesterday.

[00:07:03] Nathan Wrigley: Okay, we’ll get into that in a moment. So the title is coordinating the fight, cross industry collaboration, and the blurb goes as follows. WordPress hosting threats cross company lines. When one provider falls victim, the entire ecosystem suffers. This session explores how the Internet Infrastructure Forum, or IFF, enables hosting providers, registrars and registries to coordinate abuse response through real time intelligence sharing. Learn how operational collaboration helps responsible operators detect and stop attacks faster than adversaries can adapt. And why working together produces results no single provider could achieve alone.

When I read that, immediately was, yeah, that’s a really sensible idea. Why are we separately, as hosting companies, I say we, I mean the hosting companies. Why are they all trying to do the same work over and over again, separately? When presumably this aspect of the work, the security bit is something they all have in common.

[00:08:05] David Snead: Right? So that’s the fundamental question, right? So the IIF is a voluntary organisation that is made up of everyone in the infrastructure stack. So from registrars, registries, DNS providers, hosting providers, cloud providers, everyone in the stack. So it is facilitated by the Internet and Jurisdiction Foundation. They’re based in Paris, and they’re the actually the secretariat for it.

And what it’s designed to do is create a common way for everyone who’s in the infrastructure stack to share information about abuse and abuse issues. And it’s one of the fundamental problems that you referred to is everybody is operating in a silo, right? And that’s mostly because that’s the way the internet is architected, right?

So the internet is architected, so it’s distributed, right? Registrars and registries basically do their own thing with domain names. They might have a small hosting component or maybe a cloud component, but by and large, all they do is domain names.

Hosting providers probably resell domain names, but they’re not part of that industry. And so how do they all coordinate? And that’s what the IIF is trying to facilitate, is more information sharing among the participants.

[00:09:39] Nathan Wrigley: Well I imagine some of the hosting companies are probably fairly good. You know, they’ve got a giant customer base. Let’s imagine hosting company X over there, they’ve got millions of customers. They’ve got a huge budget that they can put over to, let’s say, security things. Well that’s all well and good, brilliant. But then there are other companies who are much scrappier. You know, they maybe have only a few thousand customers. And so their budget for the exact same work is going to be reduced.

How will this work? Is it going to be like a subscription service basically? Will you have a membership, which is in some way equal to the number of clients that you’ve got? Will there be some expectation that, okay, we’ll look at your revenue, your membership will be equivalent to a percentage of your revenue? How will that all work?

[00:10:20] David Snead: We don’t know. This is a very early stage project. Right now we are in a prototype phase where we have just figured out what information folks should submit to the secretariat.

So the way it works is, you submit the information that you collect for a particular abuse issue to the secretariat, who then enriches it with all the other information that’s been submitted and sends it to the right person.

So a great example is, let’s say a registrar reported a phishing domain. They turn off the phishing domain and they have maybe a timestamp, an IP address where it was submitted from. They submit that to the secretariat, who then finds the hosting company who is providing the services for the hosting and says, this came in about this particular site. Can you take action on that? So that’s the way it works.

Right now it’s very early stage. It’s in the first phase of a test, and we’re going to look at whether the way we’ve architected it, or the way the group has architected it, actually makes sense.

[00:11:39] Nathan Wrigley: Is this going to be then a sort of slow on ramp whereby you bring a few companies in at the beginning, hopefully. And then one or two more and iron out the wrinkles, and then some more and some more? Because I imagine, if you just threw the switch, everybody’s in, a lot could go wrong at that point. And I’m guessing there’s going to be more of a slow on ramp.

[00:12:00] David Snead: So you’ve pointed out my particular frustration with the IIF, and the reason that the secretariat is moving slowly, right? So fortunately, or unfortunately, based on my cultural background, I’m just sitting here going, this needs to move faster. We need to have everybody involved, we need to have all the hosts involved, we need to have all the registrars and registries. And other folks who are a little bit more skilled in this type of work say, no, we need to figure out what we’re doing and that requires a small number of people.

The phase that we’re in right now is looking for more folks who are interested in sitting at the table and being part of the discussion. Particularly in the hosting industry and in the web design and marketing industry. Those are folks who don’t generally participate in these kind of industry led collaboration exercises. And that’s the reason that I’m at WordCamp, is to talk to web designers, marketing agencies about why they should participate in something like this.

[00:13:13] Nathan Wrigley: So this really isn’t bound in any way to WordPress, is it? It just so happens that WordPress has a significant chunk of the internet, so this is a good place to start. But if you happen to be a, I don’t know, Drupal user, or you’re just into writing PHP code or whatever it may be, this is still applicable. There’s no real WordPress layer to this. This is just a good place for you to come because, well, there’s probably, what, 30 hosts, 100 yards away from us out there.

[00:13:37] David Snead: I know. And I haven’t seen all of them yet.

[00:13:39] Nathan Wrigley: Yeah, there’s work to do. But agnostic to any platform, basically.

[00:13:42] David Snead: It is completely platform agnostic, yeah.

[00:13:43] Nathan Wrigley: Okay. Okay, that’s interesting. But WordPress is a, is certainly a good place to start.

Now, I’m imagining, if I was a hosting company and I was the chief executive, I definitely have some questions for you in terms of, okay, we’re going to share our valuable intel with you, what are you going to do with that? How can we trust you? How do we know that the sharing is going to be done effectively and what have you?

So I guess really what I’m getting to is, what is the assurances or checks and balances that you, in the end, will hope to offer the host? That you can assure them that, look, if you hand us this body of work, you don’t need to think about it again. You can trust us to do it honourably, effectively, collaboratively. You get where going.

[00:14:26] David Snead: Yeah, yeah. And I suspect that you wanted to be a lawyer at some time, because that’s one of the issues that we’re facing. Information that can be shared freely, as an example, in the United States, might not be capable of being shared so freely in the European Union, or in Brazil, or in India or someplace like that.

So one of the things that’s being done, not by me, but by another group, another working group that’s part of this, is analysing the legal issues around information sharing.

The information that’s being shared, to answer the proprietary and confidentiality question, is not proprietary or confidential information. So it’s things like timestamps, domain names, IP addresses for the initial abuse submission. Things like that that really don’t indicate some sort of company confidential information. And it’s further abstracted into xarf, which is a language that’s used for abuse reporting, that we all can share. And so I think that the only thing that would be of concern is whether that information is personal information that’s subject to jurisdictional restrictions around the world.

[00:15:48] Nathan Wrigley: Would the idea be that this organisation would do the remedial work? So is there any notion that, let’s say for example, some sort of security problem was discovered by hosting company A over there, and they share that intel with you. Maybe the question is kind of asking, will you then appoint people to figure out what the patch is for that? Or is your idea just to, oh, red flag, we’ve got this problem, now you all know about it. Is it just information sharing as opposed to fixes?

[00:16:17] David Snead: Yeah, it’s the latter. So the thing that we’re solving for right now, so there’s just one issue that, one abuse issue, that we’re testing out and it’s issues related to fake shops. And so the fake shop issue is the test abuse issue for the project, and where folks are sharing information. It’s a particular problem right now with credentials harvesting. And so that’s what we’re trying to look at.

[00:16:43] Nathan Wrigley: And how has the conversations that you’ve had thus far, how have they gone? Has this been warmly received or are you facing a little bit of pushback?

[00:16:50] David Snead: So, look, I’ll be very direct with you. If something isn’t just an immediate threat to them, it’s very difficult to conceptualise why you should participate. And I am pretty used to answering that question simply based on the political work that I do with the i2Coalition. But once you talk about, so let’s use fake shops as an example. Fake shops, and you’re providing services to fake shops, actually has an impact on your bottom line.

So if you are providing, let’s say, payment processing to an entity that is running a fake shop, it very easily can make your credit card processing charges higher. It ends up eating bandwidth. It will tax your abuse resources.

One of the things that you referred to initially is, you know, larger hosts have a lot of money. I wouldn’t say they have a lot of money, but they have more bandwidth to handle a vast fire hose of abuse issues. Most smaller hosting companies might only get five or six abuse issues in a month. But if you have a fake shop, that’s going to generate a huge amount of abuse, and it’s taking away resources that you can use to actually grow your business. So that argument actually is relatively persuasive in getting folks to pay attention.

I find that the business argument around abuse is a much more compelling discussion than kind of moral persuasion. I don’t think moral persuasion works in the context of a community that is trying very hard just to keep their heads above water.

[00:18:42] Nathan Wrigley: It feels to me from what you’ve just said, and I could be reading too much between the lines, but it feels to me as if a good target audience would be smaller hosts to begin with, simply because they’re probably going to be more receptive because they have less bandwidth themselves. And so would welcome anything that can make the burden of sharing this information easier. So 10 of the small hosts combined is, well, it’s much bigger than each of them individually would be, whereas I suppose you’ll have to get a critical mass of them on board until maybe some of the bigger hosts start to look at you with favourable eyes, let’s say that.

[00:19:15] David Snead: Well, so we have some pretty large hosting companies who are participating. So as an example, both GoDaddy and Newfold are participating. But we also have smaller hosts. But I agree with you, the information that’s being provided, particularly since it is actionable, realistic information that can be adapted for bespoke systems, is invaluable, right?

So if you only get five or six abuse complaints and you get an abuse complaint, and you can go to the secretariat and say, we got a complaint about this domain, and the secretariat says, here’s what the registrar did. Here’s what Cloudflare did. Here’s the information they provided us. And you can use that to make a decision on how to address that problem. It saved you hours and hours and hours of research time.

[00:20:09] Nathan Wrigley: Technically speaking, what would the conduit of information both toward you and away from you look like? So if I’m hosting company X, how are you imagining that I will supply you with that information? But also, if I’m just looking for information from you on a daily, weekly basis, whatever it may be, how do I receive that? Is this like a, I don’t know, a website or an API or?

[00:20:33] David Snead: It’s an API. So it’s a file. It’s just a general file download.

[00:20:37] Nathan Wrigley: Right, okay. So it’s readily available 24/7?

[00:20:40] David Snead: Right. That’s the goal. Right now it’s not, but the goal is to kind of figure out a way to make something like that possible.

[00:20:47] Nathan Wrigley: Yeah, okay. I also suppose that the hosting companies, whilst this is good for their business if they can minimise costs and hand a lot of this work over to you, there’s a part of them which would also probably like to put some sort of badge on their website to say, this is what we’re doing. We’re part of this alliance, for want of a better word. Is that something that you are looking to develop as well, you know, some sort of credentialing system to demonstrate that you’re in this?

[00:21:12] David Snead: So that’s not something that the IIF is working on. It’s something that the Secure Hosting Alliance does. The Secure Hosting Alliance has a trust seal that we give to hosts who fulfil our Trust Seal Certification provisions. But that’s not something that the IIF does.

Talking about like why, other than business reasons, folks should participate in this, one of the things that is going on that I would suggest that most hosts know about, is there’s a little bit of a moral panic going on in the world about what contents you have. And regulation is actually a very real thing for the hosting industry, who has not ever been regulated. This is the time where you can say, hey, this is what we’re doing, right? We’re dealing with issues. This way a trust seal is the same thing, right? It’s something that you can say, we are actually taking steps to make the internet a better place.

[00:22:18] Nathan Wrigley: I think if you are a general agency owner or, I don’t know, just a freelancer, hosting is one of those things that you, once you’ve done it once, you’re in it for the long haul until something goes wrong. But you’re also browsing around for any tiny indication of why is this host slightly different? You know, what is it that they’re doing that, I don’t know, is faster? What is it that they’re doing that’s more secure? So it feels to me if you had a credentialing system and I began to hear about it and see it pop up again and again, it would be one of the metrics which I would weigh up when looking at hosting.

[00:22:51] David Snead: I would think so. One of the things that a trust seal does is it indicates that there’s been some vetting of the host. That someone has determined the things that are important to the hosting industry and are important to the web design industry. The agency industry are also important to the host.

Great example of that is one of the provisions of the Secure Hosting Alliances’ Trust Seal Certification is that a contract is presented to the customer before they sign up, which is super customer friendly.

One of the things as a lawyer that you hear about all the time when people are dissatisfied with their services is, yeah, well, I never saw that contract. Or it was just a hyperlink in an email that I got. That’s one of the differentiators for a Trust Seal certified host is that the contract is actually presented to them, to the customer beforehand.

[00:23:57] Nathan Wrigley: So in terms of the WordPress crowd, is this a thing that you are pitching only to hosts? Like when you step out of here, are you trying to have conversations only with hosts? Or is there some bit of the WordPress community, the freelance, the agency owners? Are you trying to communicate with them just to scope out what they need?

[00:24:15] David Snead: So for both the Secure Hosting Alliance and for the IIF, it is that. I really enjoy talking to agencies and developers about whether this is important to them, or why it might be important to them.

[00:24:31] Nathan Wrigley: In terms of how long this project’s been going, I’ve only heard of it because of your participation here, but I don’t know if you’ve been banging this gong for a decade or, I mean you’ve been in the industry for long enough to have been banging it for decades. Is this a new initiative or is this something which has a long and storied history?

[00:24:49] David Snead: So the Secure Hosting Alliance has only been active for a year, a little bit over a year. I’ve been talking about abuse for a long time, but the Secure Hosting Alliance has only been around for a year.

[00:25:01] Nathan Wrigley: And have you, in that year, got any intuitions that you’ll be here for another year? Is it basically going in the right direction?

[00:25:09] David Snead: It is going in the right direction. So we started out with two or three charter members. We now have 25 hosting members. We have three security vendors who are members as well. We have, I think, 17 Trust Seal Certified members, and we’re launching in 2027 a trust seal for security vendors who provide services to hosting companies.

[00:25:40] Nathan Wrigley: I know that several owners of hosting companies listen to this podcast. They may very well be the people that you’ve spoken to already, but if they are not, and they are people who would like to investigate this further, I suppose the thing that’s going to be in their head is, okay, Nathan and David, you’ve explained what I’ll get out of it, what do I need to put into it? So is this an annual financial commitment? How does it all work from that point of view?

[00:26:02] David Snead: Yeah, so you become a member of the i2Coalition. And so the Secure Hosting Alliance is a working group of the i2Coalition. So you would be a general member and you would participate in the Secure Hosting Alliances’ working groups. You also have the ability to participate in the i2Coalition as a whole, which is a much larger trade association that represents almost everyone in the internet infrastructure vertical. Mostly doing policy work, primarily in the US and the EU. Although there’s, we’re doing some work in India right now as well.

[00:26:40] Nathan Wrigley: And does membership allow you to steer the future of the project? I know that lots of chefs in the kitchen results in terrible food, but that, I fear, is something that could happen. You’ve got 87 members, 260 members. And then the 260 members all start to bicker and, you know, we want this, no. You see how it goes.

[00:26:59] David Snead: I do.

[00:26:59] Nathan Wrigley: What’s the position there? You know, is there sort of gated levels of membership? How are you organising all of that?

[00:27:04] David Snead: There are not. The membership is based on self-reported revenue. The membership is not horrifically expensive from my perspective. And I think that that, most of our members would say that it is, it’s actually relatively affordable, particularly for the small to medium sized hosts. And registrars or design agencies, anyone who’s participating.

The question about, who’s running the show, comes up quite a bit. We haven’t really faced that issue, particularly in the Secure Hosting Alliance. Folks seem to get along. But the organisation runs on the idea of rough consensus. And so decisions end up not being controlled by one member or not. Some of the i2Coalition has some very large companies who everybody knows about, who get along with startups, and folks against whom they compete directly. And policies still get made. The organisation still moves forward.

[00:28:11] Nathan Wrigley: Yeah, I guess you’re in a space where, obviously all of these hosting companies commercially are vying for everybody else’s business. But in this particular situation, that is not the case. Nobody’s vying for their websites to be less secure. They all want the same level of security. So at least in that sense, you would hope that consensus could be maintained even if, commercially, the two companies that are in the room, the 10 companies that are in the room might be commercially at loggerheads with each other. At least on this they could agree. That would be the hope, I suppose, anyway.

[00:28:47] David Snead: It seems to be, not only the hope, but the actual way that things work. You ask about how compromise is reached. What comes to mind is I have a much different concept of privacy than, particularly when I was at WebPros, than other folks in the i2Coalition had. And another company just called me up and we worked through our disagreements about how privacy should be handled within the i2Coalition and were able to move forward.

The industry I’ve found to be hugely collaborative, particularly the hosting industry. Everybody knows what their competitor is doing. But when it comes to addressing an issue like, how are we going to deal with abuse as a community? Folks come together. CEOs of hosting companies while they compete tend to be relatively good friends.

As I said at the very beginning, it really is like the Hotel California, right? You come in as a CEO of a hosting company, you grow it and you sell it to another company. All of a sudden you’re at the bottom again with a server in your grandma’s basement, you know, trying to start again.

[00:30:08] Nathan Wrigley: It’s a really curious effort. I suppose really at the bottom of this entire podcast is your endeavour to be heard and to reach out and get some conversations going. So with that in mind, where do people find the information about this? So maybe there’s a website that we could mention. But also, is there a specific place where you hang out? Is there a place where you would like to be contacted most?

[00:30:33] David Snead: Sure. So our website is hostingsecurity.net. I’m not too afraid of getting too much spam. So folks can email me at snead@i2coalition.com And the two is the numeral two. So it’s snead@i2coalition.com. And I’m happy to answer questions.

In terms of hanging out, I am at most industry conferences in the hosting industry. In the WordPress industry, I’ll be at WordCamp US. We also participate very heavily in ICANN. So there is an i2Coalition member at every single ICANN meeting.

[00:31:12] Nathan Wrigley: So if you go to wptavern.com and you search for the episode with David Snead, S-N-E-A-D, you’ll be able to find those details. I’ll put everything into the show notes. So anything that I missed? Was there a particular focus that we didn’t touch?

[00:31:26] David Snead: No, this is actually one of the most thorough podcasts I’ve been on recently.

[00:31:31] Nathan Wrigley: That’s love to hear it. Well, David Snead, thank you very much for joining me today.

[00:31:35] David Snead: Glad to be here. Thanks for having me.

On the podcast today we have David Snead.

David has been involved in the hosting industry since 1999, starting out as legal counsel for one of the earliest shared hosting companies and going on to work with over 50 others. He helped found the i2Coalition, serve as in-house counsel for cPanel and WebPros, and now leads the Secure Hosting Alliance.

If you’re listening to this podcast, I’m sure that many of you will have worked closely with hosting companies. Perhaps you run an agency or business that depends on the reliability, ethics, and security of hosting providers. David is here to talk about cross-industry collaboration in the hosting world, specifically around improving security, professionalism, and communication between hosts.

The conversation focused on why and how the Internet Infrastructure Forum (IIF) is building a framework for real-time intelligence sharing and abuse reporting, aiming to help the entire ecosystem detect and prevent attacks faster than adversaries can adapt.

David talks about the challenges hosting companies face, especially smaller ones, in keeping up with security, and how this evolving project hopes to ease this by sharing actionable, non-proprietary abuse information across registrars, hosting providers, DNS services, and more. He discusses the growth of both the Secure Hosting Alliance and the IIF, the business case for collaboration, and the nuances of legal and technical information sharing across borders.

If you’re in hosting, run a web agency, or just want to know how the backbone of the web is working to stay more secure and connected, this episode is for you.

Useful links

i2coalition website

Secure Hosting Alliance website

💾

#223 – Ivana Ćirković on How WordPress Credits Bridges Education and Industry in the WordPress Ecosystem

Transcript

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case how WordPress Credits bridges education and industry in the WordPress ecosystem.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Ivana Ćirković. Ivana is a digital marketer with 18 years of experience working both in and out of the tech industry, and currently leads marketing at WPBakery. She’s an active participant in WordPress events, having attended, and spoken at, numerous local and international word camps over the years.

In this episode, our focus is on the WordPress Credits initiative. We learn how this program, launched by the WordPress Foundation, connects students with real world opportunities to contribute to the WordPress ecosystem, earn certifications, and increase their competitiveness in the job market.

Ivana discusses her own experience as a WP Credits mentor, working with students as they learn about digital marketing, remote work, and other open source contributions. We explore, how universities can modernise their curriculums, and real world value for students by participating in the initiative, and how businesses can get involved, not just to support the community, but to help shape and discover future talent.

The program’s evolving structure also gets attention, and we learn how students are guided through hands-on activities such as translation or documentation, and how their progress is tracked publicly via profiles on wordpress.org. Ivana shares the opportunities and challenges for both educators and businesses with thoughts on accountability, mentorship, and the need to bring new faces into the WordPress community.

If you’re interested in the future of WordPress, education, or bridging the gap between academia and industry, this episode is for you.

If you’d like to find out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Ivana Ćirković.

I am joined on the podcast by Ivana Ćirković. Did I get that right?

[00:03:14] Ivana Ćirković: Yes. Excellent.

[00:03:16] Nathan Wrigley: Thank you. This is my first interview at WordCamp Europe 2026. I’m guessing because we’re on the first day of the event and it’s quite early in the morning, it’s 10 in the morning, I’m guessing you cannot have done your presentation yet?

[00:03:30] Ivana Ćirković: Not yet. Tomorrow.

[00:03:32] Nathan Wrigley: Do you get nervous with these kind of things?

[00:03:34] Ivana Ćirković: I get nervous all the time. I’ve been doing this for 12 years, it never gets easier. It is what it is.

[00:03:39] Nathan Wrigley: Well, the presentation that you are doing is going to be the focus of what we’re talking about today. So do you just want to tell us a little bit about the topic that you’re talking about, but also just give us a bit of a general bio about who you are and what you do. So just tell us about you and about your presentation basically.

[00:03:56] Ivana Ćirković: Okay. First thing first, I would like to introduce my presentation, or the talk, that is build up around WordPress Credits initiative, which is something that WordPress has rolled out late last year in December. And I applied to be a mentor to support students into their entering into WordPress. Got accepted, did my courses, passed them and started working with students on their, first entering the WordPress society, how everything works, contributing.

And out of all of this, I came up with the idea of sharing the story about WordPress Credits. What it is, why it is important, not just for the WordPress community, but also for universities all around the world for businesses to support, because there is an angle and huge opportunity for them too. And hopefully inspire people to join and become part of it more.

As far as I’m concerned, my name is  Ivana Ćirković and I am a digital marketer for 18 years. I’ve been working inside tech organisations, tech industry, but also outside of it. So I’m the multiverse. And lately, for past couple of years, I’ve been working in WPBakery, in marketing their product, and talking to people, sharing knowledge of what we do, how we do it, and so on. In the meantime I am attending many, many WordCamps, local and international ones, giving lectures, giving talks about digital marketing and all things related.

[00:05:39] Nathan Wrigley: So are you here at this event, not just to give your presentation, are you also here on behalf of WPBakery to represent them and the products that they have as well?

[00:05:47] Ivana Ćirković: Yes, we are sponsors. I am speaker, I was table lead for marketing on Contributors Day. So we are wide into the ecosystem.

[00:05:56] Nathan Wrigley: I have to say, having only been in this event space for about an hour, I’m actually deeply impressed by this particular event. It really is a gigantic venue. It’s so pleasurable as well to see the WordPress community in such large numbers here. And so we’re looking forward to a really good event.

Okay, let’s kick off with the topic at hand then. So it occurs to me that many people listening, whilst they’re using WordPress and they’re kind of, I don’t know, they’re building websites for people, and they’ve got products and plugins and they’re just general users. It may be that the community piece, and the educational piece, is nothing that they’ve heard of before. So would you just tell us a little bit about what WP Credits is as far as you’re concerned, just to give us that broad background of what it is?

[00:06:40] Ivana Ćirković: Okay. So WP Credits program is initially made to bring new young people into the WordPress, to broaden the ecosystem with the new fresh blood, new contributors. And to do so, WordPress Foundation initiated this program to connect with universities all across the world. To connect students to some programs, to learn about WordPress through contribution. For that, they will get graded and get certification, which in the end will help them be more marketable, and have more modern knowledge of what is needed in today’s job market, and to be more competitive and more appealing to potential employers.

So by doing so, WordPress Credits aims to broaden the ecosystem, to strengthen the WordPress community, and WordPress itself. But also to put new generations in more marketable place, and to help them get more profitable jobs.

[00:07:45] Nathan Wrigley: Thank you. That was a really nice summary. In terms of your personal commitment to it and what have you, how did you fall into it as a thing that you were doing? And is this something that you get sponsored for from WPBakery, or is it personal and simply a sort of philanthropic thing that you are doing on the side?

[00:08:01] Ivana Ćirković: Yeah, so basically, I’ve been doing education my whole professional life. So it’s something that comes natural to me. In my local country, in Serbia, I do informal education for high schoolers and primary school’s children about digital marketing, digital literacy. This is like very natural to me. I’m being sponsored by WPBakery to do so.

And the program works like, initiative needs people, needs more mentors to get involved. More than it needs like product and businesses to support with their products. So if there are businesses who are maybe interested in support through their product, know that you need to put your people first to actually get involved and contribute, and then you can offer products as the side piece, so to say.

[00:08:52] Nathan Wrigley: So yeah, it seems that you’ve got a lifelong interest in education as well. Okay, that gives me some sort of hook there.

Okay, if I was to say WP Credits to the people outside, the people who already knew about it, I think would probably peg it as entirely educational in nature, just an education initiative. But curiously, your presentation, the notes that went with that and the blurb that went on the WordCamp Europe website, you kind of make the point that it’s much bigger than that, and you get into businesses and the students themselves and universities.

So the students in universities bit, well, that’s the education piece. But the business bit, what’s going on there? Because I definitely hadn’t drawn that intuition. I thought education from top to bottom. But business, okay, where does that fit in?

[00:09:37] Ivana Ćirković: I will get the hot insights from the talk. So basically, there is more than what meets the eye, so to speak. Businesses have unique opportunity to shape people they want to employ by getting involved as mentors. They also get the chance to see firsthand how those young minds work in real environments, in real contribution. And they get the chance to pick and choose who they want to employ by seeing them work on some real things. Whether it’s documentation, whether it’s translation or programming, developing something, AI.

We need more people who know what they do, although they are young. By having students in this program, they are working on not fictional things, but actual things that really contribute to community and businesses as a whole. By supporting this initiative, businesses then in relations to that can get more insights into who they want to employ. So on top of that, they are building the better market for themselves as well.

[00:10:42] Nathan Wrigley: I guess the student university piece is fairly obvious. You know, WP Credits and the people working on that project communicate with universities, they’re probably easy to find. You know, if you go to a phone directory for example, they’ll all be there. And it’s an easy thing to do. You phone up the university and see if there’s interest. And I know that some universities have taken up the WP Credits program. And it seems to be, as far as I can work out, it seems to be working very successfully.

How are you going to make the connection with businesses? Because that seems like a much more scattered, I don’t know if you’re going to be working with big businesses, you know, huge companies or if it’s going to be kind of more the businesses on the street, the smaller businesses, that kind of thing. So, I’ll just sort of hand it over at that point.

[00:11:23] Ivana Ćirković: So basically, web agencies, businesses around WordPress, we know they have an issue with new employees onboarding last, let’s say three to six months. That cost time and money and other people who are teaching them what needs to be done and how.

Then we have WordPress Credit students who are already doing that junior type of work within contribution. They’re already onboarded through using Slack, knowing how to do remote work, what needs to be done. So businesses supporting WordPress Credits initiative can choose those students and spend less time and money and energy in onboarding them because they already went through that by doing WordPress Credits program.

[00:12:10] Nathan Wrigley: Yeah, I guess if you are a small web agency, it’s highly likely that you won’t necessarily have an induction program finely tuned, so that the young people that are coming through have this sort of specialised system where they can get some accreditation. It’s probably more, okay, I’m going to assign you to John this week and then next week you’re going to go over to Susan and follow what they’re doing.

So is there a sort of structured program that, let’s say a web agency based in London could drop into and receive documentation about? Where are we at with that whole process for the busineses?

[00:12:44] Ivana Ćirković: Yeah, so since this initiative is still fairly new and we already have just one generation of students that are passed the program, this is something in development. So at the moment, we still don’t have like a specific structure that is based just for agencies and businesses in general, but it is something that we are considering and working towards too. So definitely.

On the other hand, the upper management organisational team might not be aware to the fullest what am I about to talk. So it might come as a surprise to them, but also it is something in the works as well. So give us some time and we will come up with something.

[00:13:26] Nathan Wrigley: Yeah, it feels like that would be something really credible. Because if you’re a small business owner, the last thing you want to be doing is kind of wasting time. And onboarding somebody might be something that you’d have to divert weeks into, you know, syphoning employees off, writing documentation, SOPs, those kind of things. And if you could just pick something up off the shelf that was tried and tested over many years, that would actually be really handy. So good luck. I hope that that initiative comes off.

In terms of students, if you were a student, let’s say you are at a university, or you are looking for work, what would you say would be some of the top line items that you would mention as to why WP Credits is worth looking at? Because, you know, if I’m at a university, there’s probably a thousand different things that I could be doing. WP Credits would be in competition with all of those. Why do you think it’s something that young people should be taking care of to look at?

[00:14:17] Ivana Ćirković: Yeah, I would think differently, in that sense. Universities curriculums are outdated comparing to the industry that we are living and working in. So WordPress Credits gives something that is in trend. That is happening now that people are using and working now. So students who choose to go to this program are gaining the most efficient and not outdated curriculum, and things that are being worked on in this moment.

And this is bigger than WordPress. It is initially for WordPress, but the knowledge students get, nobody can take that away. They learn to be outspoken. They learn to use all the necessary remote work tools that is applicable in all the industry.

So we are really encouraging them to be very marketable employees and people who have portfolios, whether they choose that category that brings them portfolio. That is very transparent throughout whatever they do. Because on wordpress.org, every contribution is noted. So they’re building their own business brand by doing WordPress Credits. And in that way they are more marketable and can get more business opportunities.

[00:15:42] Nathan Wrigley: I didn’t realise that the wordpress.org profile, is it the profile that you mean?

[00:15:47] Ivana Ćirković: Yes.

[00:15:47] Nathan Wrigley: Each time you participate in one of these credit programs, that will be a badge, for want of a better word, that you can display and it will be freely available for the public. And presumably that will be difficult to acquire. That’s the wrong word. What I mean is, it won’t be simple to acquire. You will genuinely have had to.

[00:16:07] Ivana Ćirković: Yes, you need to do the work. Let’s say students are interested in translation. So they go to Polyglots team and they get assigned to a mentor who is on weekly basis working with them on onboarding, helping them how to navigate through wordpress.org website, translation, what needs to be done. And basically, for that student, they need to translate to have approved translation, 150 strings approved.

So that doesn’t mean, okay, I will translate 150 words. No, no. You might need to translate 500 words out of which 150 is approved. And this is the bare minimum you need to do in order to get that badge that you contributed. Because that contribution, each contribution needs to be something very specific and tailored to help other people. That is very open and helpful.

[00:17:00] Nathan Wrigley: So you mentioned translations there, which obviously is just one of multiple things that you could do, and we could list them all out, but we won’t. How is that curriculum, I’m doing air quotes, how is that curriculum decided upon? In other words, how do you decide, okay, I’m going to do a bit of translation, I’m going to do a bit of work on Core, I’m going to work for the Plugin Review Team? How is that decided? And, how is it decided by the institution, I guess that that’s going to equal something which our university will stamp as part of your degree, let’s say?

[00:17:33] Ivana Ćirković: Yeah. So basically, that is all arranged between the foundation and universities. You won’t get IT students doing marketing if that’s not their preferable choice. So students opt in. They’re given the whole like curriculum, categories of things they can contribute to. And the one they choose, this is the one they stick to throughout all the programs.

So you cannot switch in between like translation and documentation, or plugins, or WP-CLI whatever. The whole program stick to one chosen category. And that is all aligned with the, let’s say, topic of university. So IT is preferable for IT related contributions. Communications are also more favourable towards translation community, marketing. So it’s aligned that way.

[00:18:23] Nathan Wrigley: So flipping that round, so we’ve been talking about it from the point of view of the students. Now let’s just flip it around to the point of view of the university. I guess the same thing applies. They would have to communicate with the Foundation and say, okay, these are the kind of things that we wish our students to do. These particular strands, we will, you know, if they do 500 translation strings, that will count as something. I guess there’s got to be some interface between the Foundation and each university to establish what a credit equals.

[00:18:50] Ivana Ćirković: Yeah, common ground as to how WordPress Credits adds to the official curriculum of the university. And the thing that university get out of it, they are in position to offer modern, in trend, teachings, and that makes them more appealing to next generation of students. Because the more their existing students who are in the WordPress Credits program are succeeding, the more desirable the university gets to newer generations because they don’t teach outdated curriculums. They’re aligning to what is now efficient and needed in the job market.

[00:19:30] Nathan Wrigley: I suppose also as well, when I was at university, there was a choice of about, I don’t know, four things to do each year. Something like that. You could do this or this or this. And you had to pick one of them and that was your pathway. This feels much more wide open because knowing the WordPress ecosystem, I know that there’s dozens, maybe multiple dozens of different things that you could be involved in.

So that’s quite appealing as well, isn’t it? You know, you can just take a little nibble of this one thing, and another nibble of this. And so there’s potentially multiple dozens of different pathways that you could pick. And whilst you say that, once you’ve decided you’ve got to stick to that, well, that’s fair enough, but the fact that you’ve got so many different ways that you could choose. That to me as a university student would’ve been really appealing. The fact that there’s so many different things that you could do.

[00:20:15] Ivana Ćirković: Yeah. And once they got in, the overall input that we get from students that, first they don’t know that something like this exists. And once they go deep and start work, it’s like, wow. The whole mind just shifts, and they are amazed by all the possibilities that they can do within WordPress that isn’t talked about.

[00:20:36] Nathan Wrigley: Yeah. And I presume they get to do it in the way that the WordPress community works, which is remotely distributed and when you wish to do it. So long as I, you make the end of the university period of whatever a semester is or something, so long as you make the deadline, you can do it at night or in the early morning or.

[00:20:57] Ivana Ćirković: Exactly. So they are training to be like workers as we all are today, that are not restrained with some deadlines or by official university rules. They’re accountable for the final output. How will they come to that output? It’s entirely up to them because, yes, they are young but they’re not so young that they cannot be held accountable for their actions. So they need to do the work. We got weekly mentorships and assessments. So it’s a fun ride.

[00:21:31] Nathan Wrigley: So just touching on that, the sort of ongoing support that every student needs, because with the best rule in the world, there’s a proportion of students who will leave everything to the last minute. I’m looking at myself in the mirror when I say that. So that ongoing support, it’s a weekly sort of huddle. And is that like a one-to-one thing or is it a one to many thing?

[00:21:50] Ivana Ćirković: Yeah, so depending on the number of students, if a mentor has a one or two students, it can be one-to-one. If there are more like five or six, it’s better to have a group meeting on a weekly basis, and then Slack chats in between if anything is more needed than that.

So basically we go through what they did last week, are there any setbacks or they need additional help, or do they need information from other parts of the team? Are they interested in something else? So we are really trying to get them involved in a way that matters to them.

One of the things that each student needs to do, no matter section they chose, is to create a blog and to have weekly blog posts. So we discuss about that. What interests them. Whether they want to be something personal like, or professional like. So it’s very interesting to see how they think and how they express themself and how they build their online persona.

[00:22:55] Nathan Wrigley: Do those huddles take place on a, let’s say university by university basis? So for example, when you join and you mentor students, are they from the entire WP Campus project, or are you doing it from the university of this town and the university of that town?

[00:23:13] Ivana Ćirković: No, it’s mixed and matched.

[00:23:14] Nathan Wrigley: So, okay, well that’s a real strength as well it feels, because presumably then you’re on a call with people potentially from all over the world. Certainly people that you may not have encountered before. And those sort of serendipitous chance encounters can sometimes be some of the more meaningful ones. You know, work comes out of those things, and meetups come out of those things, and unexpected things come out of those things. So that must be really nice as well, watching those kind of things happen.

[00:23:42] Ivana Ćirković: Yeah, it’s like nothing I experienced before. And just to have the privilege to talk and work with those people, you never know what can come up out of them, and out of our connections. And I get inspired every time we have chats and they make me want to be a better educator.

[00:24:03] Nathan Wrigley: Oh, that’s interesting.

[00:24:04] Ivana Ćirković: So, yeah, that’s my take out of all this.

[00:24:06] Nathan Wrigley: Yeah. Okay, so there’s actually some psychological benefit for you as well. You get a real nice feeling of it. Okay, that’s really good.

So with the best will in the world, a university, every year there’s a cohort of children, young adults, whatever it may be, whichever institution it is, and a proportion of them will work diligently and hard and they will succeed. And some others maybe not so much.

How does that work? How do you ensure that everybody gets through it? And I don’t know if there’s enough data to answer this question. Again, I’m doing air quotes, how is the pass rate? Do most people that embark on this get through the necessary things? Or is there a fair bit of, I don’t know, discipline, for want of a better word, that needs to be applied and cajoling people to get through it?

[00:24:46] Ivana Ćirković: Yeah, so I touched base on the accountability. So we have not strict rules, but recommendations. Weekly mentor chats, async communication through Slack. They all have weekly tasks that needed to be done. So if a student don’t answer the message or come to weekly mentor call three times, they are no longer WordPress Credit students. And that is the accountability.

You need to show yourself that you are willing to do the work. So if you don’t care, we won’t force you to do that if you don’t want to. We will set reminders, we will call back, we will reach out. But if you are no show, no tell anything for three times, then evidently you are not for that. You don’t wish to be there, and we won’t force you to be there.

[00:25:40] Nathan Wrigley: And then in some way, are you required then to report that back to the institution and sort of say, okay, we’ve reached the end of the road here, and then it’s for them to figure out how that impacts. And presumably the students can.

[00:25:53] Ivana Ćirković: Their grades, yeah.

[00:25:53] Nathan Wrigley: Yeah, their grades what have you, okay. Touching back on the sort of business side, because we’ve dwelled a lot with students and universities and we’re going to stay with students, because that’s really the underpinning of the whole thing. How has the business side of things, is it taking off? You were describing that it’s kind of like a new thing. Have you got any sort of success stories or anecdotal evidence that people do in fact want this?

[00:26:15] Ivana Ćirković: Yeah, so it’s still fairly new, so we don’t have those anecdotes yet. One of the reasons why I’m here at the WordCamp Europe is to find out and to get new perspective from businesses to like reach out to them to see what they think about the program. Would they want to be evolved. And how to give tips, maybe how we can improve. So stay tuned for more.

[00:26:38] Nathan Wrigley: Yeah. And it is interesting, when you walk around an event like this, I don’t have the exact numbers, but the demographic is definitely skewing older. There’s not so many 18 year olds. And if this community wishes to carry on, at some point the age demographic will get to retirement age.

[00:26:57] Ivana Ćirković: Yeah. Just last night we were talking. I’ve been in the community for 11 years. And for 11 years all the same faces are here. And we really need new faces. But to get new faces, WordPress Credits is one part of the solution. But then again, we need to meet young people where they are. And they are not on the conferences, they are not on websites, they don’t use websites, they don’t care about websites. They are on very specific social media channels. And if we want to get fresh, new, young blood, we need to go there and to present what we do in a way that matters to those kids.

[00:27:35] Nathan Wrigley: In terms of success, if you were to, I don’t know, let’s imagine that we could cast our minds forwards five years, let’s go for that. What would you like to have happened with WP Credits? Would you like, for example, to see a bunch of 20 somethings wandering around in an event like this? Does it matter that they’re involved in the community and doing WordPress events and contributing to Core and those kind of things? Or is success just more broadly, people are using WordPress? You know, it’s still a project. What’s your take on, what does success look like in five years?

[00:28:08] Ivana Ćirković: For me, I would like to see more young people involved. Yes, we will always have users because in its core, WordPress is a very useful tool. And I’m happy to stumble upon that tool many, many years ago to use it both personally and professionally. But I really want to see young people involved in a way that we were involved 10, 15 years ago, and to see what can happen with WordPress.

I strongly believe it’ll be transformed, not with AI or all other flashy trends. WordPress has always been about people. And we need new people, we need young people to get it where it needs to be.

We are getting older and don’t have strengths or stamina to do so for how many long years. By having new kids, fresh perspectives, I’m really excited to see what they can come up with next.

[00:29:08] Nathan Wrigley: Yeah, it’s kind of handing over the baton in a way, isn’t it? Seeing what the future holds. Yeah, I definitely have concerns that the age demographic is skewing. And no matter what has happened in the past, I don’t see it being backfilled with younger people moment.

But I think that’s largely because we just assumed that that age demographic would fill itself, because we were excited about it, so the younger generation will be excited about it. Well it turns out the world moved on. And TikTok came along, and YouTube became a massive thing and mobile phones and all the different platforms became a thing. And so the attention was put elsewhere by many young people.

And so I suppose we needed to come up with a system where we are, in a sense, just putting it in front of their face and saying, look, it’s here. You know, you’re a university student, you are somebody looking for work in a small business. Here’s a credible way of getting involved in something which potentially could change your life. That seems like the most credible way of doing it at the moment. And I guess we’ll just have to see what the next five years brings.

In which case, is there anything that you felt you wanted to touch on that you wanted to get out of this chat before we finished?

[00:30:15] Ivana Ćirković: No, I think you did it masterfully. And we touched base on everything that needed to be said.

[00:30:20] Nathan Wrigley: Perfect. In that case, I will say Ivana, thank you for chatting to me today. Fingers crossed that your presentation goes well tomorrow, and that you pack the place out, and that by this time next week, you are extremely busy with the WP Credits program. Thanks for chatting to me.

[00:30:34] Ivana Ćirković: Thank you. Thank you for inviting me.

So on the podcast today we have Ivana Ćirković.

Ivana is a digital marketer with 18 years of experience working both in and out of the tech industry, and currently leads marketing at WPBakery. She’s an active participant in WordPress events, having attended and spoken at numerous local and international WordCamps over the years.

In this episode, our focus is on the WordPress Credits initiative. We learn how this program, launched by the WordPress Foundation, connects students with real-world opportunities to contribute to the WordPress ecosystem, earn certifications, and increase their competitiveness on the job market.

Ivana discusses her own experience as a WP Credits mentor, working with students as they learn about digital marketing, remote work, and open source contributions. We explore how universities can modernise their curriculums and add real-world value for students by participating in the initiative, and how businesses can get involved, not just to support the community, but to help shape and discover future talent.

The program’s evolving structure also gets attention, and we learn how students are guided through hands-on activities such as translation or documentation, and how their progress is tracked publicly via profiles on WordPress.org. Ivana shares the opportunities and challenges for both educators and businesses, with thoughts on accountability, mentorship, and the need to bring new faces into the WordPress community.

If you’re interested in the future of WordPress, education, or bridging the gap between academia and industry, this episode is for you.

Useful links

WordPress Credits

WPBakery

What it (really) means to be a part of the WP Credits program?

💾

❌