WordPress Planet

November 04, 2026

Open Channels FM: Postgres Faces AI-Discovered Bugs, Ubuntu Critiqued for Patching and Ochaken, Why You Should Archive Websites

Postgres struggles with AI-found bugs, Ubuntu's patch speed is questioned, and a cherished web fan site disappears.

by Bob Dunn at November 04, 2026 03:00 PM

WPTavern: #240 – Martin Schmidt on Building Partnerships Between WordPress Product Makers and Hosting Companies

Transcript

[00:00:19] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, building partnerships between WordPress product makers and hosting companies.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today we have Martin Schmidt.

Martin has been deeply involved in the WordPress and hosting industries since 2005 when he created his first WordPress travel blog while living in New Zealand. Over the years, he’s developed websites for small businesses, spent 13 years with IONOS in various management and strategy roles, and built partnerships at Wix, and a German SaaS company.

Most recently, Martin has focused on connecting WordPress plugin companies with web hosts, helping both sides unlock growth through smarter partnerships.

Today, the conversation focused on the often overlooked world of partnerships between plugin developers and hosting companies. Martin shares insights from his two decades of experience on why hosting providers are the perfect allies for WordPress product makers looking to grow, given their established relationships and marketing channels to large customer bases.

We talk about the curious fact that many plugin builders put enormous effort into their products, but stumble when it comes to sales, marketing, and building the business relationships necessary for broader success.

Martin discusses what hosting companies are actually looking for in a partnership, the technical and marketing preparations plugin makers should have ready, and why empathy and preparation make all the difference when trying to connect with busy product managers.

If you’re a developer, freelancer, or agency owner interested in taking your WordPress product to the next level, or if you want a candid look at how partnerships really work in the open source ecosystem, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Martin Schmidt.

I am joined on the podcast by Martin Schmidt. Hello Martin.

[00:03:14] Martin Schmidt: Hi, Nathan. Great to be here.

[00:03:16] Nathan Wrigley: Yeah, thank you. Martin and I do not know one another, so this is our first call, but we were joined together, on maybe LinkedIn. I’m not entirely sure.

[00:03:23] Martin Schmidt: I was LinkedIn. Yeah. Yeah.

[00:03:25] Nathan Wrigley: Probably LinkedIn, by Nicole, so thank you to Nicole for doing that, really appreciate the linking together there. And we’re going to have a conversation today about, I suppose the word to describe it would be partnerships. How to partner with various different entities, possibly hosting companies are going to come up and things like that, so.

Before we begin that conversation, Martin are you able to just give us your little bio? Tell us a little bit about who you are and what you’ve done in the hosting partnership WordPress space, whatever you think fits best.

[00:03:55] Martin Schmidt: Yes, absolutely. I’m from Germany. I lived down south in Karlsruhe. Originally from the Cologne area. Started working with WordPress actually in I think 2005, something like that. When I was moving to New Zealand and started studying in New Zealand. That’s when I spun up my first WordPress site as a travel blog. And this was my first contact with WordPress. So I think, yeah, one of the, not one of the first users, but one of the very early.

[00:04:20] Nathan Wrigley: Fairly early, yeah, pretty early.

[00:04:22] Martin Schmidt: Very early. So that’s when you still had to like download WordPress and upload it via FTP, and there was no like auto update in the WordPress admin, and stuff like that. So one of the very early users and.

Yeah, around that time, that’s also how I got in touch with like the whole hosting industry. I was a web developer myself, started in high school developing websites for small businesses. Built them for people here in Germany and then also in New Zealand while I was studying over there.

And when I got back from New Zealand, I started applying for jobs. And one was with Google, the other one was with Ionos. And Ionos answered I think within a week, and I’m still waiting for the answer from Google till today. So, they never really got back to me, but yeah, it’s somewhere in the mail, yeah.

But luckily the guys from Ionos got back to me and I think a week later I had a phone interview. Another four days later an interview in Karlsruhe. And then I started, I think two weeks later. Already started there like end of October with my first job as a product manager at Ionos.

And then spent 13 years at Ionos in various roles, in product management and the last five years in strategy. And from there I got the chance to move on to Wix. Worked for Wix.com in Germany. There was, during the COVID pandemic, I moved employers and started to work for Wix, and spent two years there building partnerships in, Europe.

Actually also put them in touch with a company called Sevdesk, which is a German accounting company, similar to Zero or QuickBooks Online. And couple of months later the CEO asked me if I was interested in joining their side, after they had raised some money and built partnerships from their side. I kept him waiting a little bit, but then after a while I decided, that’s interesting to join a German SaaS company. Something different than hosting, and online presence.

So yeah, I spent the next two years building the ecosystem around the SaaS software, like all the software that integrates with the accounting product basically.

Then end of 24, I got a call from my former boss from Ionos, who had just moved to hosting.com and became the CRO, and they also wanted to do partnerships. So, yeah, had a chat with him and with the CEO and started there in February 2025, and started building partnerships for hosting.com.

And, the main focus was really on building partnerships with WordPress companies. Just after Cloudfest, we launched the partnership with WP Rocket. Started to build quite a few more partnerships, or that were in the making. And by the end of the year, which was interesting to me, I had a lot of those WordPress plugin companies that I reached out to telling me, look, this is super interesting. We want to work with hosting companies.

We’re really glad to be working with you. We would also love to work with a lot of more hosting companies, but honestly we don’t really know where to start, and how to do this. And they really got me thinking. And then over New Years, and you know when you like, get some time to maybe reflect on the year and stuff that’s happening, this was like, it, really hit me. It’s like, well there’s so much interest of companies wanting to partner with web hosts.

And I’ve sat on the other side for some 20 years, like people pitching to me, like explaining me why their product is going to be the next big thing for me in the hosting company. And you start to see patterns of like things that people do good, and maybe things that people don’t do as well when like trying to pitch to you as a hosting company.

And I saw all this demand from these WordPress plugin companies and I was like, hey, maybe this is finally the idea of starting my own business. Like something I wanted to do for the last five years, but I never really had the idea of like what to do? Or not the idea that was convincing enough for myself to give up my corporate job.

And, once you got a house and family, I mean, it becomes a bit more difficult to just jump into the cold water, right? I guess a lot of people can relate to that. But this time it was different. I felt like this could really be something. So I started reaching out to more people in my network, and ask them, hey, I’m thinking about doing like this sort of consulting advisory thing. Do you think this is interesting? And I got a lot of positive feedback, way more than I had anticipated.

So I thought, okay, if I’m not doing this now, I will never do it. I will never try and do it. So yeah, I decided to go independent and officially started in May. And that’s what I’m doing now, like helping tech companies who want to partner with web hosts to find a way to do it.

And I always tell people that are interested in, you can do it by yourself, right? You can find it all out yourself. It’s probably going to take you like three to four years to figure out the right model, and make all the connections. Build the trust with the hosting companies. Find out the right business model. The right support model, like the co-marketing activities, all the things you need to do. Or if you don’t want to wait for four years, you can work with me and I help you take a shortcut.

And the goal is by month six that you have someone in your organisation who can take care of partnerships, and just run this by yourself. But you don’t make all of those mistakes, and all of those extra investments that don’t turn into anything.

My pitch to my customers is like, I’m helping you cut down the time to market. I’m telling you what works and what doesn’t work, and what makes a good pitch.

[00:09:49] Nathan Wrigley: Yeah, this is genuinely really interesting to me, and we’ll get into that a little bit later. But I have a different angle to you, but probably we’ll end up at exactly the same place.

I’ve been podcasting in the WordPress space for a decade. So 2016, something like that, I started. And, if you do podcasting often enough, your voice is heard, and people have this sort of expectation, if you send an email to me with a product that you’ve just launched, I will somehow have a silver bullet for making you successful.

And first thing to say is, I basically don’t. You know, I can put you on a podcast episode, but that really is the limits of what I can do.

But also what’s quite fascinating, and I honestly genuinely, I probably get about 30 or 40 of these emails a week. And the bit that stands out for me is how unprepared, let’s go for that word, how poorly prepared the email that I receive is.

So in many cases over the last couple of years, it’s clearly been written by an AI. There hasn’t been a lot of due diligence about who I am, so it kind of feels like this really, really cold call. I somehow got on an email list somehow. And it comes, you know, with all of the usual caveats. The first paragraph is telling me what I do, and I already know what I do. So like there was an AI in there somewhere.

But also it feels like they’ve got a product. Quite often I’ll go and look at the product and I think to myself, boy, that’s so good. Look at what they’ve done. Like they’ve built a plugin and it’s fulfilling a real need.

Unfortunately, I can’t really help them except put them on a podcast, but it occurs to me if only they could connect with all the right people, have the right language, know how to pitch themselves, know how their website should look so that it speaks to people that drop into it.

What I’m basically trying to build up a picture is of is that there’s loads of people out there who are building things, but clearly the building of it is the part that they’ve been interested in. And as soon as it’s built, they then have this moment of, oh, now what do I do with it? You know? And they don’t have that marketing expertise, and so they’re kind of looking around trying podcasters and what have you. And it feels like you are trying to step into that gap a little bit.

But instead of it being a podcast, you are trying to hook them up to what are the big players in the WordPress space? The people with deep pockets. The people who have reliable income month over month. And that’s the hosting companies. Have I summarised that correctly? Is that your experience as well? You get people that have got a thing, but don’t really know how to move on from the I’ve built the thing, to now I need to sell the thing.

[00:12:37] Martin Schmidt: Yes. So I think you’re spot on. And I would add there’s probably, I would say two groups. There’s the one which is maybe the builder who doesn’t know marketing, right? And we had these people before AI that were building fantastic products. But they just don’t know marketing because they’re fantastic builders. They’re tech people, but they’re missing that marketing piece.

And the one thing they don’t hire a marketing person who does it for them. I think that’s always a shame. You see this fantastic product, someone like driving a product with their passion. They’re really solving a pain point, but they just don’t understand how to sell it. Because to them it’s all clear, it’s all obvious, but you do need to translate it to people in your target audience.

So I think this is one group, and I see that also a lot with WordPress plugin companies. It feels like, coming from the hosting space, where all of the big companies are so good at marketing. Looking at WordPress companies, I feel like this is really something that they are somewhat missing.

I think the most successful WordPress plugin companies, I think that’s probably the ones that have understood that next to building fantastic product, and also needs fantastic marketing. But I think this is really the one group.

And the other one is, I would call them like lazy salespeople. They’re just sending out like sales messages. And we had them way before AI, just sending out without doing any research at all. You get messages and you look at them or you look at the product, it’s like, there’s no fit at all. I’m selling to small businesses, and you pitching me a product for enterprise customers. Like, why? You are just wasting time, right?

If your goal is to work with a company to potentially sell to hundred, thousands, or millions of customers, and that’s going to be a deal worth hundred thousands or millions of dollars, you should invest maybe an hour, half an hour, of research and just see if there’s any fit at all right. And then if you take the time to go in a meeting with me and pitch your product, do a little bit of research to just make it fit. Just this tiny bit of research will make you stand out amongst the crowd like completely.

[00:14:41] Nathan Wrigley: It feels to me in the first case as if, timing’s not really the right word, but there’s a component of timing in here. And what I’m meaning by that is, what I’m feeling is that a lot of people have spent all of their time building the thing. So that might be time, but it might be money, whatever the thing that you’ve got going on in your business.

But at no point during the time from conception, idea to completed product have they said to themselves, okay, at some point we’re going to have to market this. We’re going to have to think about it.

So maybe, and I don’t know if this is part of the sort of wisdom that you have, but it feels like maybe halfway through that process of build to complete build, you need to put the brakes on and say, okay, now we’re halfway through, let’s work in two channels now. Let’s do the, finish the build, but also at the same time, let’s do the marketing.

So I don’t know if there’s anything in there, like just put on the brakes before you finish, have some resources, have some ideas of contacts, have some marketing, have a website and all of that kind of stuff done. So that when you finish, it’s all ready to roll.

[00:15:43] Martin Schmidt: Yes. That’s definitely it. I don’t know if you have to put on the brakes, but I think it’s like, at least you as the CEO, you have to like work on two tracks. There’s the guys building the product, but then there’s also the marketing piece of it, right?

And you can have the most fantastic product if you’re not telling the story, if you’re not letting the world know. How are people going to find you, right? I think we see, I saw a stat on LinkedIn recently that there’s like a thousand plugins published on the repository every week. It’s going to be so crowded. You need to do something to stand out and to be found.

And I think that’s also with web hosts and every tech company, you can have the most amazing product, but if you’re not found, if the target audience doesn’t know about you, nobody will use your product. And you’re going to be the only user of your own product.

I think in the end, you need to master marketing to be successful with your business. And it’s not just about the best product. And, I think that’s the important message here. You don’t need to know marketing yourself. Just hire someone. There’s so many people specialise in marketing. Just get someone on board who knows marketing and who understands a little bit of tech to get why your product is so special, and who’s able to translate that into a customer pain point, and figure out how to sell it. that’s really it.

[00:16:58] Nathan Wrigley: So we’ve done podcast episodes on this podcast before where we’ve talked about partnerships in a different way. We’ve talked about partnerships in terms of plugin Company A joining with plugin Company B, because they’ve got similar enough products that they kind of overlap, and they can help each other out and mutually market and do marketing campaigns together and things like that.

But that’s not what we’re talking about here. We’re talking specifically about going to hosting companies. So I guess the first question is, why go to hosting companies? What is it that they bring? I suppose the obvious answer is they’ve got bajillions of customers. In many cases, you know, some of the big hosts, if you can forge some sort of relationship with them, goodness knows, you know, maybe they literally have millions of customers. But why have you made hosting companies the bit of the half of this jigsaw puzzle?

[00:17:45] Martin Schmidt: Yes. beside me coming from hosting and knowing hosting, which was kind of like, make it a bit easy to decide for hosters. But I think they also play an important role. In the end, if a small business wants to run a website, they need to host it somewhere. They decide for hosting company. They get their WordPress site spun up. And then, that’s where usually in the next step you would go with like certain plugins. Like for SEO, performance, backup, security, translations, whatever your use case is, right?

As you mentioned, the hosting company is the one that has all of the relationships with the customers. And unlike the WordPress companies, who are not allowed by the repository rules to directly market to their customers via email and things like that, they can only use popups inside the WordPress admin.

One thing that the host is free to do, they can call the customers, they can send text messages, they can send them emails. They can do all of the up and cross sell marketing to their customers. And I think that’s one advantage that the hoster has that they can bring to the table, beside all of these customer relationships, right? They can really do the full blown marketing to those free users, to push a premium version of the plugin.

[00:18:59] Nathan Wrigley: Okay. So it’s not just visibility within the platform of, I don’t know, you’re at the point of it installing a plugin because you’ve got a brand new WordPress website. And look, here’s a bunch of partners that we’ve got, you may be interested in those.

That’s one piece of it. But there’s also this sort of marketing side. Presumably just like every company on earth, web hosting companies are as keen to keep front of mind as any other company. So if they can come up with a good, and I’m doing air quotes, excuse to send out an email, they’ll do that. And why not send out an email because we’ve onboarded a new partner and, you know, have you thought about doing this with your website? It turns out we’ve got a partnership with this particular plugin company.

I’m guessing there that the ability to send out emails is something, you know, to keep front of mind is something that the web host would want to do. But what’s in it for the web host? Like if I was a plugin company coming to a web host, I would want to have in my mind, okay, these are the kind of things I know they’re looking for. What are they, what do the web hosts want in return?

[00:19:55] Martin Schmidt: Yeah. So a lot of web host will tell you, hey, I want new customers, and that’s what I usually tell the web hosts. This is something you can’t expect from the WordPress plugin company. Because they are like in the later stage of that decision process. So the customer decides for the plugin a lot later than they decide for the host. So it’s not fair to ask the plugin company to bring in new customers to the web host.

But what they can do and what the WordPress plugin company can help with is, A, make the product a lot more attractive. They’re web hosts that sell hosting bundled in with plugins like WP Rocket. So the product itself is more attractive from the get go.

And if you don’t bundle it in the start, you can also help solve certain customer pains that make the customer more happy, therefore more sticky, right? So you prevent churn. As a host, you reach like a hundred thousand, 200,000 customers. You really need to work hard that your new customer growth isn’t eaten up all by churn. Making your customers sticky and drive up the revenue per customer, that’s in the interest of the web host, right? And, with a certain size, increasing that revenue per customer also becomes very important and interesting for the web host.

So I think that’s where the plugin company can come in and help the web host. They won’t just partner with any plugin. The plugin needs to solve a certain pain point for the customer. So this could be performance, this could be SEO, this could be accessibility. So these are challenges that the customers of the web host are actually faced with. And the plugin is simply a solution to that pain point.

So the hoster has an answer to that question of their customer. They’re in the role of the trusted advisor to their customers. And if the customer says, look, I’m running a website on your servers. I need to now be in compliance with the accessibility requirements in my country, or I need to do certain things. Then there’s the answer. Let’s use WP Rocket for performance. Here’s a partnership that we have with them, right? And that’s where the plugin company can come in and help the host.

Beyond that, obviously joint co-marketing will also help the hoster. And obviously if you talk like Ionos, GoDaddy or Newfold, I mean they’re massive, like they have millions of customers. So probably what a plugin company can bring to help them in co-marketing is not going to make a huge impact. There’s hundreds of hosters with hundred thousands of customers. For them working with one of those plugin companies can still be very interesting in doing like joint co-marketing, and getting the word out.

[00:22:32] Nathan Wrigley: That’s interesting. In the back of my head, when we were talking until just now, for some reason I was thinking about all the big hosts. You know, the ones that you’ve all heard of with the millions of customers. But of course that’s not the case, is it? There are thousands of smaller hosts.

[00:22:47] Martin Schmidt: Yes.

[00:22:48] Nathan Wrigley: Who may be more amenable to this kind of thing because, well, Idon’t know, they just don’t have that sort of scale that they need to worry about. And, you know, they’re looking for opportunities because they themselves are looking to grow in different ways that perhaps the other big hosts don’t have to think about quite so much.

Okay. So that’s interesting. So, you know, if it doesn’t fit one hosting company and you get a silent wall from all the big ones, that doesn’t mean you’re out of the game. It may be that the smaller hosts with different staff, and a different approach, and different geography and things like that, they may be more amenable to that.

[00:23:21] Martin Schmidt: Yes, absolutely. And I will always tell my clients, I know that GoDaddy, Ionos and Newfold look very interesting because their publications, that they have millions of customers, but you don’t want to start with them. It’s going to take you three or four years to get a deal done if at all. If you start with them, I mean you’re going to give up frustrated halfway through probably.

So start with the smaller guys. They’re more approachable, right? They may be less busy. You mentioned that you get like 30 emails a week. That’s what the everyday of a product manager at an Ionos or GoDaddy looks like as well. They get pitches all the time. Getting some air time with them is nearly impossible.

Start with the smaller guys and they’re going to be a lot more open to discuss with you. And start some smaller partnerships. Work through the teething problems of partnerships with bigger companies, right? Build some track record. And once you’ve established a track record, you can work your way up, right? Every hoster has a competitor that’s bigger and one that’s smaller. Once the smaller competitor starts doing something, they will notice, and they will look like, why are these guys partnering with plugin company XYZ? Should we be doing the same? So you kind of like work your way up to the bigger guys and the bigger guys, right?

[00:24:34] Nathan Wrigley: Yeah.

[00:24:35] Martin Schmidt: Everyone is watching the other guys and watch what they do. So it’s, once you start working with some of them, the rest will start like, oh, this is interesting. If X, Y, Z worked with them, maybe we should too. That’s how you build the traction, but you need someone to start, right? And that’s probably not going to be the biggest guy.

[00:24:53] Nathan Wrigley: Yeah, and again, I hadn’t really thought about that, but yeah, the, sort of looking over your shoulder if you’re a hosting company, seeing with perhaps jealous eyes, oh look, they’re getting loads of attention out there on social media because they’ve formed this relationship. And their emails are going out, and people are making comments on their tweets and their blog posts and things like that. Oh, we should definitely get a bit of that. Okay. That’s, really interesting.

So if somebody approaches you, then let’s say they’ve got a plugin. Let’s just assume that it’s a plugin that is useful and that a hosting company would be interested in it, if they had everything wrapped up correctly. What would be some wisdom that you would drop in terms of how to wrap it up? Like, how prepared do you need to be? What are the kind of things that you expect plugin developers to have ready, so that on day one, when you do your first outreach to the first hosting company, you feel confident that, okay, I’ve got a good client here, we’ve got a good chance. What are the bits and pieces that you need to have them have done?

[00:25:50] Martin Schmidt: I think on the technical side, I mean they will need to have some sort of like provisioning enabled. The host would probably want to sell the plugin themselves within their billing engine, and their system. So they will need some sort of provisioning to your system to say look, someone bought a licence and this licence needs to be valid and stuff like that.

So, this integration and that usually, I mean, if you don’t have that, it probably takes you a few months to implement that. So that’s something like, I would really start first and built these kind of things.

The other stuff that I think the plugin company should have ready is, what’s your proposition to the web host? And what’s the proposition of your product to the web host customers? I always tell my clients like, don’t make the other guys think. Tell them. Show them that you thought about it. Coming back to our earlier point about people being unprepared, don’t be that unprepared person. Like once you get some air time with these guys, tell them what your product is. Tell them what your product, or your company can do for the web host. But also tell them how they should be using your product and marketed to their customers.

[00:26:56] Nathan Wrigley: Kind of spoonfeed them basically.

[00:26:58] Martin Schmidt: Yes.

[00:26:59] Nathan Wrigley: Have everything so that they can lift it and just walk off with it and, okay, we’ll do that then.

[00:27:03] Martin Schmidt: Yes. It might feel like spoonfeeding and like, why do I need to do your job? But I mean, in the end, put yourself in the shoes of that product manager, and tell them, look, if I was you, I would be selling my product this and this way.

Some of the worst product pitches I had. Companies came to me. Told me look, this is our product. You’re going to make millions with it. And then I was like, okay, that’s interesting. How do I sell it to my customer? And then the answer was like, I don’t know your customers. You need to know how to sell stuff to your customer. It’s like, that’s not how you land a deal, right?

And one thing I like to do when I was pitching products. I looked at the website of the company I was pitching to. I mocked up their website with my product, and I put that in my presentation, and I told them, look sorry guys, we already hacked your website. Our product is already on your website. This is what it’s going to looks like. This is what it’s sold for, right? It shows them that you put some thought into that. That’s going to make you stand out.

Understand the work life of that product manager. They get those 30 emails like you, do. They decide to go on that meeting with you. You spend 30 minute pitching your product, and then you leave them with this big question mark. Like okay, this sounds interesting, but how the heck do I sell this to my customers?

After your meeting then they have lunch, then there’s like an escalation, then there’s an all hands, then there’s the weekend. On the next Monday they will have almost forgotten about you. And if they think about you it’s, oh, I still have to figure out how to sell this. This is complicated. I don’t have time for this. I’m going to postpone it. And that’s not what you want to achieve.

You want them to go out of that meeting and thinking, well this is an amazing product, solves a problem for my customers. And these partners, they think about me. They think about how I should be selling it. And maybe it’s not a hundred percent right. It’s not about getting it a hundred percent right.

[00:28:51] Nathan Wrigley: Right. They can adapt.

[00:28:52] Martin Schmidt: Yes. But giving them something to adapt is like a lot more than just don’t give them anything, right. And adapting is always easier than coming up with it yourself.

[00:29:01] Nathan Wrigley: So, the email that I typically get is basically a description of a product. It tells me what it’s called and then what it does. And often it’s a fairly technical description of a product. And, I imagine that if you are a marketer, you’re four lines into that email and your eyes have glazed over, and it’s like, okay great.

But what you are describing is go the extra mile. Don’t just explain the product. Presumably, there’s a bit of that’s got to go on, but it’s also now explain to the person receiving that email how their company can use that. How they could market it. The way that could be marketed. The sort of mockup landing page that you described just there. Go the extra mile, sit in their seat for a minute. Try to imagine what their busy life is like, have a bit of empathy, and imagine that they’ve only got an attention span of a few moments. It’s more that, than the here’s a product description. Now that you know what it is, please come and contact us, because that’s just not going to happen.

[00:29:59] Martin Schmidt: No, it’s not. I think it’s the same for us in private life. If you get emails about products that. I mean you just know yourself. You’re busy with so many things in between. Your kids coming home from school, and someone calling, your parents calling and all of that. You, just look at the email and if it doesn’t click immediately, it goes to the trash bin.

And it’s the same with these guys as well. Convincing people just in email is probably going to be difficult. You need to at least get them into the meeting. And I think that’s the one step before that. But once you have them in a meeting, spend that time wisely. It’s difficult enough to get them into the meeting. But if you have them in a meeting, don’t waste it with generic presentations.

Invest this little bit of effort, and mocking up that websites or just taking a bit of a look at who they’re selling to and adapting your message to that. It doesn’t take a ton of work. And it didn’t take a tonne of work four or five years ago. And now with AI it’s even less, it’s even less work, right? But if you want me to trust you as my partner to go forward and sell to my customers, that’s going to blame me for everything. I want to see that you invest a little bit of effort too.

[00:31:04] Nathan Wrigley: I think that’s right. Yeah. I think that’s a very human characteristic, isn’t it? I would like to see that you made an effort, if I’m going to make an effort. That’s just how the game goes, right? That’s just how it is. You know, if I get the impression that you just want to rock up, make loads of money, and do nothing, that’s never going to work really.

[00:31:25] Martin Schmidt: No.

[00:31:26] Nathan Wrigley: I mean there’s the occasional person that manages to pull that off, but on the whole, that’s not how human relationships flourish and work.

[00:31:33] Martin Schmidt: In the end, it’s about you want to build a partnership, right? And that’s not, I come to you and you give me loads of money. I don’t have a lot of friends like that. And I don’t think anyone else has a lots of friends like that.

Usually it’s like you give and you receive, right? And sometimes one side invests a bit more, and the other side invests a bit more. But usually if only one side is giving and the other one is only taking, that’s a toxic relationship. And usually they tend to break. So why should business relationships work any differently?

But it’s a funny conception that a lot of companies have is oh, I want to do partnerships. I just go out there and then they’re going to sell my product and I’m going to make lots of money, and I don’t need to do anything. That’s honestly what a lot of companies think.

And that’s the difficulty that a lot of partner managers have, right? They’re being sent out to get those partners, and then they’re expected to bring in just all the revenue without any additional investment. And that’s just not happening. Honest truth, nobody is out there waiting for you and for your product.

[00:32:32] Nathan Wrigley: Yeah. That is the brutal truth isn’t it? Do you subscribe to doing things in person? You know, so WordPress has got a real panoply of events, Meetups and WordCamps and there’s obviously other things that you mentioned, you know, Cloudfest and things like that. Do you find that tends to short circuit things?

I guess there’s a bit of personality that comes into this as well. You know, some people are, seem to have all the characteristics for selling. They’re incredibly good at that kind of thing. Maybe they’re practised at it. Maybe they’re just, you know, born in that wonderful manner. Do you subscribe to that? Is that a part of this jigsaw puzzle as well? You know, show up, meet the people, shake the hands, go to the restaurants, do the schmoozing and all of that.

[00:33:12] Martin Schmidt: Absolutely. You could do all the Zoom calls that you want, but I’ve experienced it firsthand. Like during COVID, we were talking to people for six months via video conference. Like one in person meeting in Munich. It felt like this moved us further than just the six months of constant video calls.

You can meet people, and you can relate to them, and there can be some sympathy and stuff like that. And you might not have to meet ever, but it usually helps a lot to build that trust. To just meet the person face to face, shake a hand, maybe have a beer and have a laugh and stuff like that just helps a great deal.

And I’ve seen partnerships without any face-to-face meeting, but usually I would definitely advise to see people in person. And some people are just difficult to get hold of. And then catching them at the Colosseum Bar at Cloudfest 10 o’clock at night really helps to suddenly be in touch with that person.

[00:34:07] Nathan Wrigley: There is something ever so human about that isn’t there? And I think we all on some level enjoy that.

So you found yourself in this product market space. Like I said, I know that this is a thing. So I would imagine that given a fair wind, you’ll be doing this for years to come.

Where do you find yourself online? Do you have a website where you’ve packaged up these products and services, you know, these partnership liaison services that you do? Where can people find you? Where do they go online to discover more about you?

[00:34:37] Martin Schmidt: At the moment mostly active on LinkedIn. That’s where I meet a lot of the people. I also have a website, martinschmidt.co. And that’s where also people can reach out to me. The website has been a little bit neglected to be quite fair because I straight on, jumped into LinkedIn and started publishing on LinkedIn, because the audience is already there. And people are not searching for how do I build partnerships with web hosts? But they come to me via LinkedIn because they tend to read some of my posts, and that’s how I get to speak to people like yourself.

[00:35:07] Nathan Wrigley: Yeah. Well, that is exactly how it happened. It was LinkedIn and I think you’re right. I think having a website would be of great value, but at the same time, you know, given the proclivities of what you’re doing, LinkedIn seems to be very much the best place to do that.

What I’ll do is I will put your bits and pieces into the show notes. So if dear listener, you head to wptavern.com you search for the episode with Martin Schmidt, that’s S-C-H-M-I-D-T, you’ll be able to find the links there. So hopefully you’ll be able to contact Martin via LinkedIn and what have you.

Really interesting topic and Martin, thank you for chatting to me about it today.

[00:35:42] Martin Schmidt: Yes. Thanks for having me, Nathan. It was fantastic.

On the podcast today we have Martin Schmidt.

Martin has been deeply involved in the WordPress and hosting industries since 2005, when he created his first WordPress travel blog while living in New Zealand. Over the years, he’s developed websites for small businesses, spent 13 years with IONOS in various management and strategy roles, and built partnerships at Wix and a German SaaS company. Most recently, Martin has focused on connecting WordPress plugin companies with web hosts, helping both sides unlock growth through smarter partnerships.

Today the conversation focused on the often-overlooked world of partnerships between plugin developers and hosting companies. Martin shares insights from his two decades of experience on why hosting providers are the perfect allies for WordPress product makers looking to grow, given their established relationships and marketing channels to large customer bases.

We talk about the curious fact that many plugin builders put enormous effort into their products, but stumble when it comes to sales, marketing, and building the business relationships necessary for broader success.

Martin discusses what hosting companies are actually looking for in a partnership, the technical and marketing preparations plugin makers should have ready, and why empathy and preparation make all the difference when trying to connect with busy product managers.

If you’re a developer, freelancer, or agency owner interested in taking your WordPress product to the next level, or if you want a candid look at how partnerships really work in the open source ecosystem, this episode is for you.

Useful links

IONOS

Hosting.com

WP Rocket

Martin on LinkedIn

by Nathan Wrigley at November 04, 2026 01:00 PM

Open Channels FM: The Human Hurdle in Automated Cybersecurity

As artificial intelligence takes a more prominent role in cybersecurity, organizations face a growing challenge: the speed at which AI can discover vulnerabilities far outpaces human capacity to address them. Some news here on our podcast shines a light on how automation is transforming not just how vulnerabilities are identified, but how trust, autonomy, and […]

by Open Channels FM at November 04, 2026 10:34 AM

November 03, 2026

WordPress.org blog: WordPress 7.2 Beta 4

WordPress 7.2 Beta 4 is ready for download and testing!

This beta release is intended for testing and development only. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, use a test environment or local site to explore the new features.

Wait, what happened to 7.2 Beta 3???

WordPress 7.1.4 was released on October 28 which included WordPress 7.2 Beta 3.

How to Test WordPress 7.2 Beta 4

You can test WordPress 7.2 Beta 4 in any of the following ways:

WordPress Beta Tester PluginInstall and activate the WordPress Beta Tester plugin on a WordPress install. Select the “Bleeding edge” channel and “Beta/RC Only” stream.
Direct DownloadDownload the Beta 4 version (zip) and install it on a WordPress website.
Command Line (WP-CLI)Use this WP-CLI command:
wp core update --version=7.2-beta4
WordPress PlaygroundUse a 7.2 Beta 4 WordPress Playground instance to test the software directly in your browser. No setup required-just click and go!

The scheduled final release date for WordPress 7.2 is December 8, 2026. The full release schedule can be found here. Your help testing Beta and RC versions is vital to making this release as stable and powerful as possible. Thank you to everyone who contributes by testing!

What’s in WordPress 7.2 Beta 4?

For technical details on the issues addressed since Beta 2, see the following links:

Continued Improvements to WordPress 7.2

WordPress 7.2 Beta 4 continues refining the upcoming release with improvements to accessibility, editor reliability, and developer APIs, alongside additional bug fixes and compatibility updates.

Recent work includes improved keyboard focus visibility in Windows High Contrast mode, refinements to administration interfaces, and fixes for right-to-left block alignment and custom block spacing.

Developers will also benefit from continued improvements to the Abilities API, DataViews extensibility, and REST API behavior. Additional fixes strengthen revision handling, input validation, and compatibility across supported environments.

Learn more: Trac #45910, Trac #66382, Trac #66427, Trac #66383, Trac #66343, Trac #66329

Continued Improvements to Ipsum

The new default theme, Ipsum, continues to receive refinements ahead of WordPress 7.2’s final release. Recent updates improve accessibility with clearer keyboard focus indicators, more descriptive screen reader links, and better support for right-to-left languages. Additional improvements refine block patterns, touch target spacing, and color palette compatibility with other default themes.

Learn more: Trac #66352, GitHub #15113

Improved Translation Update Management

WordPress 7.2 makes managing translation updates easier by displaying individual available updates on the Updates screen. Administrators can now review and selectively install translation updates, bringing language management in line with the familiar plugin and theme update experience.

Learn more: Trac #42281, GitHub #11610

How important is your testing?

Testing for issues is a critical part of developing any software, and it’s a meaningful way for anyone to contribute – whether or not you have experience. Details on what to test in WordPress 7.2 are available here.

If you encounter an issue, please share it in the Alpha/Beta area of the support forums. If you are comfortable submitting a reproducible bug report, you can do so via WordPress Trac. You can also check your issue against this list of known bugs.

Curious about testing releases in general and how to get started? Follow along with the testing initiatives in Make Core and join the #core-test channel on Making WordPress Slack.

A Beta 4 haiku

Where did Beta Three go?
A surprise along the way
Four arrives on cue
.

Props to @audrasjb, @courane01, @huzaifaalmesbah for pre-publish review.

by David Baumwald at November 03, 2026 03:45 PM

Open Channels FM: Drupal Commerce Exploits, Synology Ransomware, DeepSeek Coding Tools, and France’s Tax on Data

Security issues challenge Drupal and Synology users as a French tax proposal threatens the VLC nonprofit’s sustainability.

by Bob Dunn at November 03, 2026 03:00 PM

Open Channels FM: Trusting the Machines Is the New Team Skill

Building trust with AI agents and automation in software teams, focusing on code reviews, verification, and balancing innovation with reliability.

by Bob Dunn at November 03, 2026 12:11 PM

November 02, 2026

Open Channels FM: The Core Principles of the Open Web, Simplified

The open web is defined by five principles: open standards, permissionless publishing, linking, interoperability, and decentralization, ensuring freedom, flexibility, and user control in online information sharing.

by Open Channels FM at November 02, 2026 12:28 PM

November 01, 2026

WordCamp Central: WordCamp Sylhet 2026: No Swag, All Heart

What happens when you take the swag out of a WordCamp? You get more of what WordCamps were always about: people, ideas, and real conversations.

On October 2 and 3, 2026, the WordPress community gathered at the Central Auditorium of Shahjalal University of Science and Technology (SUST) for WordCamp Sylhet 2026. This year the organizers made a bold call: no swag from the organizers and no swag from the sponsors. I was there for both days as an organizer, and it turned out to be one of the best WordCamp experiences I’ve had.

Third Time in the Tea Capital

WordCamp Sylhet first came to the city in May 2023 and returned in 2024. The 2026 edition was its third, back at the same SUST auditorium where it all started.

This time the organizing team chose a clear theme: back to basics. Their message from the very first announcement was “less show, more substance.” As WordCamps grow, the focus can drift toward production, merchandise, and presentation. Sylhet wanted to bring the spotlight back to knowledge, genuine conversations, and community connections.

What a Swag-Free WordCamp Feels Like

I’ll admit I was curious. Swag is part of the WordCamp ritual: the T-shirts, stickers, notebooks, and the queue at every booth. How would an event feel without it?

The answer: lighter, warmer, and more focused. Nobody was rushing from table to table collecting goodies. Instead, people stopped and talked. Hallway chats ran longer. Lunch tables turned into mini-meetups. Questions after sessions were sharper because people came for the content.

Swag bags get forgotten in a drawer. A five-minute conversation with the right person can turn into a client, a job, or a friendship. WordCamp Sylhet 2026 proved that the community itself is the best takeaway.

Day One: Contributor Day

October 2 was Contributor Day, and around 150 people sat down at the contributor tables to give back to WordPress. The work ranged from bug fixes in Core to new designs for the Patterns Team.

What I love about Contributor Day is that you don’t need to be a senior developer to take part. Whether you code, write, design, translate, or test, there is a table for you. For many first-timers, it was the day they made their first contribution to one of the world’s largest open-source projects, shoulder to shoulder with the people who build it.

Day Two: Conference Day and the Rise of AI

October 3 was Conference Day, packed with talks and panel discussions from morning to evening. With the swag gone, the sessions really were the heart of the event.

If one topic ran through the whole schedule, it was AI. A few sessions that stood out:

  • Panel: How AI Is Reshaping Modern Workflows. M Asif Rahman, MD Ershadur Rahman Talukder, and Shahjahan Jewel shared practical lessons on how AI is changing the way WordPress teams plan, build, and ship.
  • From Plugins to Agents. Nazmul Hasan Rupok explored how WordPress architecture is shifting as AI agents arrive, including using the WordPress Abilities API so any MCP client can use a plugin’s features.
  • Customer Support, Reimagined. Khan Rafin Ahmed showed how AI agents and the Model Context Protocol (MCP) help support teams do more.
  • Find It, Fix It, Prove It. Niluthpal Purkayastha talked about using AI to find and fix security holes in WordPress plugins.

The common message: AI isn’t replacing the WordPress community. It’s giving builders new tools, and Bangladesh’s developers are already putting them to work.

Sponsors Without Swag: Real Conversations at the Booths

No swag didn’t mean no sponsors. Companies still had booths in the expo area, and they still had a great chance to show what they’re building. The difference was the quality of the conversations.

Instead of handing out freebies, sponsor teams explained their products, heard feedback from users and met new people who were genuinely interested. Some booths ran friendly challenges and contests that broke the ice and started long chats.

For businesses, that’s arguably worth more than a thousand tote bags. And it matters for the community too: WordCamps are nonprofit and volunteer-run, and sponsorship keeps tickets affordable for students, freelancers and first-timers.

The Energy: A Community That Showed Up

The most crucial part of WordCamp Sylhet 2026 wasn’t on the schedule. It was the energy.

From the first Contributor Day table to the final session, the auditorium stayed full of enthusiasm. Students, developers, designers, freelancers, agency owners, and product teams came from across Bangladesh. Everyone was eager to learn, share, and connect, and you could feel it in every room and every hallway.

The green SUST campus, a short ride from Sylhet’s famous tea gardens, gave the whole event a calm and welcoming feel. It’s hard to imagine a better home for a community gathering.

Thank you, Sylhet.

Organizing a two-day event for a community this size is never easy, and no event runs perfectly. What stays with you is the effort and heart behind it, and there was plenty of both.

A huge thank you to the organizers and volunteers who made it happen, the speakers who shared their knowledge, the sponsors who supported the event and showed up for real conversations, and every attendee who brought their energy.

WordCamp Sylhet 2026 showed that you don’t need freebies to make an event memorable. You need people who care. Back to basics turned out to be exactly what we needed.

🙏 A big thank you to the sponsors of WordCamp Sylhet 2026!

WordCamp Sylhet 2026 brought together WordPress enthusiasts, developers, designers, and community members at Shahjalal University of Science and Technology. It was possible because these organizations believed in our community and supported open source in Bangladesh.

💎 Platinum Sponsors
Automattic • Bluehost • FluentCart • FlyWP • Hostinger • Kirki • OneSuite • WooCommerce • xCloud

🥈 Silver Sponsors
Bit CRM • bPlugins

🥉 Bronze Sponsors
PaymentForm.io • SubscriptionPro • Timetics AI • WebAppick

Thanks also to our micro sponsors and to every organizer, volunteer, speaker, and attendee who helped make it happen. ❤

See you at the next WordCamp!

by Nazmul Hosen at November 01, 2026 03:04 PM

October 30, 2026

WordCamp Central: WordPress Campus Connect at Presidency University: Building Skills, Exploring Careers, and Inspiring the Next Generation

We’re excited to share that WordPress Campus Connect at Presidency University, Dhaka, has successfully concluded! 🎉

Held on 25–26 October 2026, this two-day initiative brought students closer to WordPress, practical website development, career opportunities, and the growing role of open-source education.

Want to see more photos from WordPress Campus Connect at Presidency University?

📸 Explore all the event photos here: Official Event Photos 📸

Day 1: From Ideas to Websites

On 25 October, we hosted a hands-on workshop where students explored WordPress by building their own websites. Together, we created 50 websites and WordPress.org profiles, giving students a starting point to continue learning, experimenting, and engaging with the global WordPress community.

The goal was not just to introduce a tool, but to help students take their first practical steps toward building something of their own.

Few websites created by our students:

  1. https://noyonhossain.blog/
  2. https://hurayra.art/
  3. https://www.golammonayem.com/
  4. https://tayenhossainshuvo.blog/
  5. https://ifatkhalilfahim.blog/
  6. https://r-if-a.blog/
  7. https://rafid.blog/
  8. https://sanjidaaktersuborna.blog/
  9. https://byapon.art/
  10. https://golammonayem.blog/
  11. https://belalhosenbadon.blog/

Day 2: Exploring Careers and WordPress Education

On 26 October, we shifted our focus to career guidance and educational opportunities. We discussed how students can develop practical skills, build a portfolio, contribute to open source, and explore career pathways in the WordPress ecosystem.

Through these conversations, we encouraged students to look beyond traditional academic learning and explore how real-world projects, community participation, and continuous learning can help them prepare for their future careers.

Exploring WordPress Credits: Connecting Education with Real-World Experience

An important part of the discussion was the WordPress Credits program, which offers universities an opportunity to connect academic learning with practical contributions to the WordPress open-source project.

We introduced the program as a potential pathway for students to go beyond learning WordPress and start contributing to a global project used by millions of people. Through structured learning, mentorship, and practical contribution opportunities, students can develop technical and collaborative skills while gaining experience in an international open-source community.

We were delighted by the university’s interest in this opportunity. Presidency University has already applied to join the WordPress Credits program, marking an encouraging step toward bringing WordPress education and contribution-based learning into its academic environment.

This is an exciting opportunity to explore how students can apply their classroom knowledge to real-world projects, collaborate with the global WordPress community, and build a stronger foundation for their professional journeys.

We hope this initial engagement will lead to further collaboration between the university and the WordPress community, creating more opportunities for students to learn, contribute, and grow.

Supported by the Global WordPress Community

This initiative was made possible with support from the global WordPress community and its sponsors, who continue to invest in education and the next generation of talent.

A special thank you to Kirki for joining as our Gold Sponsor and supporting this educational initiative. Your support helps create meaningful opportunities for students to learn, build, and explore their future in the digital world.

We’re also grateful to the university, our speakers, volunteers, and everyone who contributed their time and energy to make these two days meaningful.

Organisers and Speakers

The success of WordPress Campus Connect at Presidency University was made possible by the dedication and collaboration of our organizing team: Mostofa Kamal Sagor, Muhibul Haque, Nasim Miah, and Rashed Hossain.

Our speakers Nasim Miah, Nazmul Asif, Pranto Dev, Mostofa Kamal Sagor and Muhibul Haque shared valuable insights on WordPress, web design, career opportunities, NLP, and prompt engineering. Through practical guidance and engaging discussions, they helped students explore new skills, understand the evolving tech industry, and discover opportunities in the WordPress and AI era. A big thank you to all our speakers for sharing their knowledge and inspiring the next generation!

The journey continues. Let’s keep building opportunities for the next generation through WordPress education! 🚀

by Muhibul Haque at October 30, 2026 02:42 PM

Open Channels FM: Who Controls Our Software, Open Channels News Week in Review

This week's Open Channels News highlights tensions over AI in open source, new tools like GridCraft, corporate shifts towards open infrastructure, and the need for sustainable, user-driven technology.

by Open Channels FM at October 30, 2026 12:31 PM

Open Channels FM: Look at What Was Waiting Down Your List

An update on our feed.

by Bob Dunn at October 30, 2026 08:31 AM

October 29, 2026

Open Channels FM: Mistral LeChonk, Open-Source Windows Tools, and Rethinking the Internet’s Platforms

LeChonk’s debut, open-source Windows projects, and Wired’s take on digital control shape today’s tech news and business decisions.

by Bob Dunn at October 29, 2026 02:00 PM

Open Channels FM: Post Formats, Bring Back the Fun and Flexibility in Blogging

Bob Dunn and Derek Hanson reflect on blogging, personal writing, and using post formats to shape digital presence beyond social media.

by Bob Dunn at October 29, 2026 10:33 AM

October 28, 2026

WordPress.org blog: WordPress 7.1.4

This security release features fixes for multiple issues.

Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 7.1.4 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.
WordPress 7.1.4 is a short-cycle release. The next major release will be version 7.2, currently planned for December 8th.

For more information, please visit the WordPress 7.1.4 HelpHub site.

Security updates included in this release

The security team would like to thank the following people and organizations for responsibly reporting vulnerabilities, and allowing them to be fixed in this release:

  • A weakness in the WordPress upgrade process which can lead to remote code execution during the upgrade window, reported by Umut Bayram.
  • A stored XSS with specially crafted block markup, reported by Rafie Muhammad (Awesome Motive, Inc.).
  • Privacy Data Removal Requests can be created in a way that leads to stored XSS, reported by Anthropic.
  • Multiple stored XSS issues in the Interactivity API independently discovered by AnC and DatNLQ from VietSunshine Cyber Security, rekter0 and Anas cherni, Marcel Karlsson (whoismarcel), and Weston Ruter, Jon Surrell, Alex Concha, and Luis Herranz of the WordPress Security Team.
  • A stored denial of service issue in the Interactivity API, reported by Jon Surrell of the WordPress Security Team.
  • A stored XSS in Customizer selective refresh, reported by Rafie Muhammad (Awesome Motive, Inc.).
  • A Stored XSS in the Categories block reported by Ben Bidner of the WordPress Security Team.
  • Specially crafted User Logins can lead to a stored XSS reported by Anthropic.
  • Unpublished customizer changesets can be discovered by unauthenticated users, reported by Antonio Lorensius Silaban.
  • A Stored XSS in Playlist and image blocks, reported by Ben Bidner of the WordPress Security Team.
  • Stored XSS in core/comments-pagination-next and core/comments-pagination-previous blocks, reported by Alex Concha of the WordPress Security Team.
  • Notes can be read by privileged users that lack access to edit the post the note is attached to, reported by Ramon of the WordPress Security Team.
  • An update to the bundled root certificates due to the eMudhra revocation.

Thank you to these WordPress contributors

This release was led by Aaron Jorbin and Nik Tsekouras. WordPress 7.1.4 would not have been possible without the contributions of the following people:

Aaron Jorbin, Adam Silverstein, Alex Concha, Andrew Duthie, Andrew Serong, David Arenas, Dennis Snell, Ella Van Durpe, George Mamadashvili, Isabel Brison, Jake Spurlock, Jb Audras, Jeremy Felt, John Blackbourn, Jon Surrell, Jonathan Desrosiers, Kira Song,Lance Willett, luisherranz, Marco Ciampini, marcs0h, Marin Atanasov, Mario Santos, Miguel Fonseca, Nik Tsekouras, Peter Wilson, ramonopoly, Rudy Faile, Sergey Biryukov, umut3806, Weston Ruter

Backports

As a courtesy, the security fixes were backported to all branches eligible to receive security fixes (currently through 4.7). As a reminder, only the most recent version of WordPress is actively supported. The backports are in progress and will ship as they become ready.

WordPress 7.2 Beta 3 has also been released, containing all applicable fixes.

by Aaron Jorbin at October 28, 2026 05:13 PM

WPTavern: #239 – Remkus de Vries on How Scanfully 2.0 Is Making WordPress Security and Performance Monitoring Simpler

Transcript

[00:00:19] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case how Scanfully 2.0 is making WordPress security and performance monitoring simpler.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today we have Remkus de Vries. Remkus has been active in the WordPress space for over 20 years, starting out with his own agency focused on high performance, scalable WordPress websites. Over time he has diversified into education and community building with projects like WithinWP, and a new initiative, The Guild, which is a paid community aimed at helping people build smarter, more performance, sites through a first principles approach.

Our conversation centres on Scanfully, a site health and monitoring SaaS Remkus co-founded, which recently hit version 2.0. Scanfully’s focus is giving users meaningful, actionable, insights into WordPress site, health, security performance, email, deliverability, DNS, and more. Packing all this data into an easy to understand dashboard.

We talk about Remkus’ motivation for diving deep into the complexities of WordPress monitoring, and why many users struggle to keep on top of the technical side of their websites. Remkus argues that too many site owners are stuck in a reactive mode, only investigating issues once something breaks. And Scanfully aims to change that mindset by making ongoing health checks accessible and easy to parse, even for the spreadsheet averse.

Remkus walks us through the products evolution, including the 2.0 update that aimed to reimagine their dashboard experience, added public APIs, and introduced tools like MCP AI integration, empowering users to query their sites health conversationally.

We also get into recent and upcoming features such as WooCommerce checkout monitoring, activity logs, and future add-ons designed to cover forms and other business critical flows.

If you manage multiple WordPress sites, run an agency or are simply interested in building more robust futureproof WordPress projects, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you can find all the other episodes as well.

And so without further delay, I bring you Remkus de Vries.

I’m joined on the podcast by Remkus de Vries. Hello, Remkus.

[00:03:29] Remkus: Hello, Nathan.

[00:03:30] Nathan Wrigley: It’s been a while. Remkus and I have been on many calls in the last few days and weeks. We’re going to have today about a project that Remkus has been actively involved in for a number of years. It’s called Scanfully. We’ve reached version, I’m going to say 2.0, let’s go with that.

[00:03:46] Remkus: Yeah. Yeah. Yeah.

[00:03:47] Nathan Wrigley: But over the last few days it’s actually advanced a little beyond that. So that’s going to be the main focus.

I would probably urge listeners to this podcast. If you want to understand what the product is and how it works, maybe press pause. Go to Scanfully.com, so scanfully.com, and then come back and you’ll understand fully what the product is.

Before we get stuck into updates and product and what it all does. Very briefly, Remkus, do you want to just tell us a little bit about you, your backstory, WordPress space, that kind of thing?

[00:04:17] Remkus: Yeah, sure. Been in the WordPress space, active, 20 plus years now. Started with an agency, very quickly moved into complex performance scaling, more complicated type of sites.

Ran a niche agency like that for a very long time. In the last couple of years I’ve been doing some diversification. I have withinwp, which is a WordPress, how do I explain this? Because this is also in transit, but it’s a podcast, it’s a newsletter. One that’s being cited by This Week in WordPress a lot, I should say.

And part of it is the educational side, which is the part that I’m building out currently. And what I mean with educational side, that I’m preparing a community, a paid community, that has the sole goal to help you better understand WordPress and build better sites, smarter sites, more performance sites, that sort of stuff. Basic first principles type approach.

And that is roughly how I look at WordPress. And Scanfully is something I started with my co-founder Barry, let’s call it three years ago. And from a similar angle, we want to solve, essentially site health and performance monitoring tool of your WordPress site in the broadest sense of the word. Meaning the word Scanfully is literal. We scan fully and what we’re not scanning fully currently, we will be.

[00:05:32] Nathan Wrigley: Okay. Thank you. Can I ask a question? May touch on your personality, I guess. All those years ago, 20 plus years when you came into WordPress. How can you explain why you delved into this bit? Because there were so many ways that you could have gone, but you’ve really made scanning, and site health, and monitoring and performance, that is your thing. Is there a bit of that which, speaks to you on some level? Do you find yourself drawn in that direction, no matter where you look on the internet?

[00:05:58] Remkus: Yeah.

[00:05:59] Nathan Wrigley: Do you enjoy data analytics, spreadsheets, numbers, all of that?

[00:06:03] Remkus: I wouldn’t call it enjoy, but, I’ve always been good at it. I always found it fun to some degree. But in general, I get bored quite easily. If I’m to stick with a topic, it needs to be the complicated version of a topic. To me, in web development, that quickly revolves around all the things that make a WordPress site more tricky to scale, or more tricky to make fast, or more tricky to fill in the blank. There’s tonnes of different subtopics to that.

[00:06:25] Nathan Wrigley: Yeah.

[00:06:26] Remkus: And that then gives you a different view of what is important. And Scanfully is one of the answers to that. we. See that there’s, I think the whole industry is levelling up in a way. I don’t think it’s happening fast enough, but part of it forces you to start thinking about things in a more professional way, like more preemptively understanding what is something that’s going on. What is a trend on your site? What do you see happening? And I think we’re still too much on the reactive side of things. So if my side is down, or if somebody complains it’s slow, then I’ll have a look. And we want to change that awareness and make it one of your first thoughts instead of an afterthought.

[00:07:02] Nathan Wrigley: It’s a curious thing then that the complexity which you enjoy, in a sense, you require other people to not enjoy it as much as you, in order for you to have a product. And I am one of those people. If you present me with a, I don’t know, a Google Analytics dashboard, or a spreadsheet which goes beyond about four rows, then I quickly lose interest. I genuinely can’t maintain my effort over there. I glaze over and don’t enjoy it.

And so part of the problem with dealing with WordPress is getting over that hump. Maintaining the interest in an area that I feel ill-equipped, not just ill-equipped, completely out of my depth.

And so having tooling, the likes of which you’ve built with Scanfully enables people like me to actually stand back and go, okay, that complicated thing is made more easy. I can actually start to understand it in real terms, with data and charts that are less overwhelming. And I guess that’s the point.

[00:07:53] Remkus: That is the point, and that is essentially also the driver, why we went from dashboard version 1.x to now, 2.x. Because it’s very easy when you’re on the more technical side of things and you kind of understand what the signal is and what it’s implying to forget what the person who doesn’t understand the extra layers and the assumptions that go underneath. Like what does that actually mean?

The 2.0 rebrand. Because it’s not a rebrand in terms of what we do, but it’s a rebrand and how we interpret every single version of the monitoring metrics that we collect, how we present it, and what we allow you to do with it. Everything has been rethought. It’s been a, I think in total, we’ve had about four or five months of just working with a redesign. And we call it a redesign because it is, because it visually looks different.

We’ve got all this feedback of how people are using it. And a common theme was, we’re missing this, we’re missing that. Could you make that easier? So we were like, okay, that’s a lot of stuff pointing in the same direction. Why don’t we start rethinking how we’re going about helping you figure this out?

And I’ll give you a very concrete example. So if a site goes down, because we have an uptime monitoring, you get a notification. But if it’s the server that goes down and you have 25 sites on that server, it doesn’t make a lot of sense for you to receive 25 emails.

[00:09:05] Nathan Wrigley: No.

[00:09:06] Remkus: So gathering information per monitoring alert is something we’re doing now. And, the same goes for if there’s, I don’t know, if the latest plugin you’re using on all of your sites has something that needs to be fixed, or something that is already fixed. So let’s assume there’s a security release for it. You don’t need to know that 25 emails. You need to know there’s one email, and these are the sites that are affected. But you also want to know, is this a high risk? Is this a medium risk? Is this a low risk?

Because there’s plenty of security stuff that is so close to impossible to replicate that, do I need to act right now? Maybe, but we give you the insight that you can act upon it. Like it’s not, we’re not forcing you to pay all the attention all the time.

And it’s things like that. So we had the data already, but the question then becomes, how do we make this digestible? How does this become a signal, versus the noise that it’s also is? So that’s a lot of rethinking. That’s a lot of rethinking in what is valuable to share, and how is it valuable to share and what are the things you would like to do with certain things?

So, an example, related to that is what if there is an update available for a plugin that you’re using in a few places? But there’s no fix yet. Do we need to send you every single day that there is a security update? Or there’s a security issue? Probably not. So why don’t we allow you to snooze a particular alert? It’s simple things like that. And I say simple. It’s not simple to implement, but.

[00:10:27] Nathan Wrigley: Simple on the front end.

[00:10:28] Remkus: Yeah. Simple for you as an end user. So that was a lot of thinking and figuring out how do we make this more pleasurable, for as pleasurable as the topic itself is.

[00:10:39] Nathan Wrigley: I’m going to circle back to the product in a moment, but I’m going to ask you a curious question.

[00:10:43] Remkus: Yep.

[00:10:43] Nathan Wrigley: You may balk at this question and think, okay, that’s unusual and a bit weird. Is the WordPress space for you quite an exasperating thing. And what I mean by that is, you are obviously steeped in this knowledge, about how things can go wrong, and how a poor implementation of something over here can have catastrophic effects over there. Given enough time, and the stars aligning in a certain way.

I don’t know how to describe this. Does that mean that everywhere you look, you just see catastrophe and problems. And you open up a WordPress website, you’ve got a new client or somebody’s onboarded you with the plugin. You look inside and you sort of face plant, head slap. Okay. All the stuff that I know, which is second nature to me. Why don’t they all know this? There’s no question there, but can you see what I’m trying to.

[00:11:27] Remkus: Yeah. Yeah, I can. You’re not recording the video. The people listening didn’t see me nod along the way of what you were saying, but yes. If you understand things. So there’s a principle called first principles. Which means everything we approach, we should approach from the first principles. Like what is the base layer of where to solve problems. And, this is not even just WordPress, this is life, I guess.

But there’s a big tendency for people to look at a problem and then have the idea of how they want to fix the problem, but they don’t actually look at the layer, it should be fixed. They just want to fix the outing. That’s not really a fix, right. You fix things at the bottom layer. You can identify where the problem lives.

And when that is your view on life slash work. Yeah, there’s moments where you go, how do you, not look into this? This is your work, this is your job, this is your, competency. Why do you not dive into this? But I also understand that’s not for everybody to be in that layer of how I look at things. And it’s not me wanting to force other people, my model of the world, but it is something where I go, you don’t need to do my model of the world, but there’s some stuff that you actually should be quite skilled on because it’s part of your job. Because it touches your job. It touches the clients you serve and all of that sort of stuff. Long-winded answer, but yes, I have those moments.

[00:12:39] Nathan Wrigley: Yeah, I guess it must be the same no matter which bit of WordPress you’re in. So for example, I don’t know if you’re a front end designer and you see catastrophic use of fonts and spacing and typography, and it would make the head plant moment occur. But also accessibility. And there’s these tendrils isn’t there? And we can’t become expert at all of them, but many of the things are inconveniences. Where if something goes wrong, it’s annoying, but that’s probably where it ends.

Whereas the stuff that you are dealing with, there’s a potential for catastrophe to occur. The website gets defaced or taken down, or the server gets compromised and is used in some crazy way that we can’t imagine. That makes your part I suppose a little bit more essential. But then, as as you said, we can’t all be experts, and relying on the expertise that you have and the tools that you’ve built. I suppose that’s why you occupy the space that you do.

[00:13:33] Remkus: Yeah.

[00:13:33] Nathan Wrigley: Because not everybody can spend the time becoming as knowledgeable as, as you have become.

[00:13:37] Remkus: And I, for the record, I don’t acclaim to have all the knowledge. I just happen to specialise on a few things I find highly interesting.

[00:13:44] Nathan Wrigley: Yeah.

[00:13:44] Remkus: My goal for the Within WordPress community that I want to build, which is called The Guild, is exactly to behave like a guild. We’re all there to elevate each other up. That is what a guild is supposed to do. And, back in the day, you had guilds that were that you went there, you were part of it, and all that had as a goal was to help you elevate your craft.

And we need to start thinking about what we do as a craft. And how do you do your craft? Well there’s tonnes of different ways to do the craft that’s putting bread on the table. But if you’re not actively developing yourself to become better at your craft, then what are you doing? You’re, essentially behind in the first week you start working. And you’re only playing catch up. And most people have forgotten that they’re just in the game of playing catch up. Which I think is a shame.

[00:14:26] Nathan Wrigley: You’ve alluded from various bits and pieces that you said. You’ve suggested what Scanfully does. So we have an idea that there’s charts, and graphs, and information about things that could be going wrong with your website in the background. But we haven’t really explained what the tool does at its core.

So putting the update to one side, if we just examine why you built the tool in the first place, what does it broadly do? And then we can get into what it most recently does and how it’s been adapted for the 2.x version.

[00:14:55] Remkus: So Scanfully is about giving you the information so you know what broke on your site, and what changed and what things you need to pay attention to. Anywhere from critical stuff. So vulnerabilities, downtime, to also adjacent critically, are my emails being sent from the site? Does that still work? So we do email monitoring. We do DNS checking.

We do all kinds of site health, like actual site health menu inside of WordPress. We pull in that data so you can see and you can filter for which of my sites are in PHP seven point, whatever still? You can figure that out.

If you need to do all kinds of filtering on data that is living in all of your WordPress sites. That’s a pain in the ass to have to click through every single site to figure out what’s what. And maybe your control panel on your server tells you something, but Scanfully will tell you everything.

We will tell you how large the uploads folder is. We will tell you, is your certificate about to be renewed, yes or no? Did anything go wrong when that happened? Things like that.

So anything and everything that goes into the bucket of what is site health, what is a healthy site mean? We are monitoring, or we will be monitoring. We still have a very long list of stuff we’re going to add. But yeah, the goal for Scanfully is to have you be in control of what’s going on with your site.

[00:16:19] Nathan Wrigley: Ok thank you. I have some follow up questions just to that, so the first one is. Who has been, or who potentially is your ideal customer? So I’m going to broadly bucket that as, I don’t know the person who’s got just one WordPress, or a handful of WordPress websites and they manage that themselves. Are they the kind of people that you are trying to get? And then I’m going to go into different buckets of enterprise perhaps. Agency level customers. I’m imagining there’s some perfect fit there.

[00:16:42] Remkus: Yep.

[00:16:43] Nathan Wrigley: And then also I’m wondering if hosting companies also might be a customer of yours in terms of adding this in, to a deployed website on their platform.

[00:16:53] Remkus: They are now. One of the features we added, we kind of already had it, but we added publicly now, with Scanfully 2.0 is a public API. Which means if there’s a public API, anybody can hook into whatever data we have, and display that in their dashboard or website, or wherever they would choose to do so.

So yes, we cast a broad net, But the goal is for any client that needs to be in control of what’s going on with their site. But the reality is this is from freelancers to agencies and indeed, hosting type of adjacent companies. Yeah.

[00:17:25] Nathan Wrigley: Right. So there’s a fit across all of those three things that I just mentioned?

[00:17:29] Remkus: Yeah.

[00:17:29] Nathan Wrigley: And do you have pricing that reflects that? So in other words, can you buy a single licence, and a multiple licence and a, I don’t know, an unlimited licence?

[00:17:37] Remkus: It’s a flat structure. It’s 299 a month per site. Simple.

[00:17:41] Nathan Wrigley: And, in terms of the level of depth of technical understanding that you have to have in order to get the tool working, is this more a case of upload the plugin, activate the plugin, and then there are some sensible defaults? Or do we have to do a tonne of background research to understand what’s going on? And maybe that’ll lead us into the 2.0 stuff in a minute.

[00:17:59] Remkus: There’s nothing more than installing and activating.

[00:18:03] Nathan Wrigley: Okay.

[00:18:03] Remkus: And even the activating we have made as frictionless as possible. The only thing you need to do is once the plugin is activated, you click that button that says connect to your Scanfully dashboard, and assuming you’re already logged in there, clicking that button is all you need to do. There’s no copying pasting of keys and other weird stuff.

[00:18:18] Nathan Wrigley: So I presume from what you said earlier, the 2.x, the article that I’m going to link to in the show notes on the WP Tavern website is about 2.0, but I understand time has passed and probably by the time this episode will be on two point something.

[00:18:32] Remkus: 2.3.

[00:18:33] Nathan Wrigley: It would appear that you obviously took a stab at what you thought people would like to see in their dashboards. That’s one of the things that’s been updated. How did you adapt that over time then? Because, like we said earlier, getting complicated data to be easy to understand, that is a proper art form. I don’t think you’ll probably ever end this journey.

[00:18:52] Remkus: No. No.

[00:18:54] Nathan Wrigley: You’ll just be iterating forever.

[00:18:54] Remkus: Yeah.

[00:18:54] Nathan Wrigley: But is that one of the things that you got feedback on? Okay, it’s good, but we’re still confused. Make it simpler to understand. Just describe that side of things.

[00:19:02] Remkus: Yeah. So that’s the part where you go, how do I go from showing noise? Because there’s a tonne of data that you actually need to be in control of. But how do I make that, easy, digestible?

So one of the solutions we came up with, and that seems to have gone down really well, people like it, is essentially every view on top has the most important things. So we’ll tell you if there’s stuff that you need to be updating. We’ll tell you if email is not being delivered. We’ll tell you if the percentage of up and down times you’re having is odd, or requires more investigation. Essentially we’re helping you figure out the important things per monitor, per view. And then from there, you can deep dive into the data that we collect and figure out things.

[00:19:46] Nathan Wrigley: You’re moving away from graphs and data first, into more of a human readable summation in a couple of sentences?

[00:19:53] Remkus: Yep.

[00:19:53] Nathan Wrigley: Okay. So you can finally parse what’s going on. Okay. That’s good to know. And you said that’s been well received?

[00:19:59] Remkus: Yeah, people like it.

[00:20:00] Nathan Wrigley: Okay.

[00:20:00] Remkus: It’s more straightforward in terms of quickly understanding what’s going on. That was a big part, and we also wanted to make that information available more easily as well. And what I mean with that is that inside the API you can query this now.

But more conveniently, we have an MCP server available as well. So you can connect us to your favourite LLM, your favourite AI and just ask the questions. Like let’s say you have a bunch of sites for different clients in there, but one client has a specific question. You’ve labelled them accordingly inside of Scanfully. You can do that now. And then your LLM, you can ask, either ask it to label it, you say these are the domains, labelled them with this client. And then tell me do I have any vulnerabilities? Is email being sent out correctly? Are there any weird DNS changes? What does my uptime look like? And we’ll tell you.

[00:20:46] Nathan Wrigley: So the API enables you to, I don’t know, if you’re an agency owner, you could build a dashboard, for example, for your clients or something like that. So you could put charts and information in a place where your client can go and see it in a way that makes sense for them.

[00:20:58] Remkus: Correct.

[00:20:59] Nathan Wrigley: But the MCP enables you to kind of have a conversation with the security and the current state of your WordPress website. That’s so intriguing.

[00:21:07] Remkus: Yep.

[00:21:08] Nathan Wrigley: Have you discovered some interesting, quirky things in there? You know, you you ask it a particular thing and a surprising thing came back?

[00:21:13] Remkus: I got for one of the sites that I have in my account, I got some intermittent email is not being delivered. And I go, why does it turn on and off all the time? What’s going on here? So I ask it to investigate, look at any commonalities. Look at anything that stands out. And it sure enough came up with something that goes along the lines of there’s conflicting DNS records. So if there’s multiple validation records, I was using a transactional email service for that. But their validation system allows you to have old validation DNS records in there as well. And apparently their system picked up both intermittently. How do you figure that out?

[00:21:48] Nathan Wrigley: With an MCP, it turns out. Yeah. That’s really interesting.

[00:21:50] Remkus: Yeah. So it told me, double check the DNS records here, because it looks like, and then I go, okay, let me check that. And I go in, I dive deeper into the dashboard for my transactional email provider. And I go, hold on. This is, okay. I get it now. So let me delete those. I deleted them, and the problem solved.

[00:22:07] Nathan Wrigley: Does your MCP enable bi-directional things to happen? Or is it basically read only?

[00:22:12] Remkus: It is read only on the data. It’s write on, like I said, if you want to create labels and other things like that.

[00:22:18] Nathan Wrigley: Unharmful stuff is right.

[00:22:20] Remkus: Correct.

[00:22:21] Nathan Wrigley: Because you are dealing with quite a lot of powerful stuff here, and writing in the wrong direction in a silly way, which let’s be honest, MCPs enable us to be very silly very quickly.

[00:22:30] Remkus: Yeah. Yeah. Yeah.

[00:22:31] Nathan Wrigley: Okay, that’s good to know. It’s basically read only.

Okay. We’ve got the dashboard updates with more human readable data. We’ve got the API. We’ve got the MCP. Anything else in Scanfully 2.x?

[00:22:43] Remkus: If we include 2.x, the release we did yesterday is 2.3. And in that we have much smarter user activity tracking. Content changes. Not only who did the change, but what is the change, that sort of stuff.

We pull everything out of WordPress into our dashboard. So for instance, we have a full WordPress activity log and in that log, we collect all the things. Whatever happens on your WordPress site, so that’s a plugin installed, updated, all those things. So now user activity is in there as well.

And it’s also the things happening to your user. So elevated admin rights given to a user. Was that supposed to happen? An email address change to a administrator is something you would want to know. On a multi-site, if a user gets to have super admin, you’ll want to have that logged. So things like that.

So the 2.0 essentially, which is a week and a half ago, it allowed us to have a whole bunch of other refinements we had essentially lined up. We have a much better foundation to build these things on top of what we now have. So we can move forward much faster.

[00:23:42] Nathan Wrigley: We’ve already agreed pre hitting the record button that there’s a whole load of stuff which you know is going to occur, but we are not quite ready for public disclosure at the moment.

One thing that we didn’t touch on, which I suspect people will be listening to this thinking, okay, hang on a minute. How does it all work in terms of, is there a scanfully.com/whatever login? In other words, do you have a SaaS sort of admin section?

[00:24:06] Remkus: Yes.

[00:24:06] Nathan Wrigley: So the plugin kind of binds to that, because I miss that at the beginning.

[00:24:11] Remkus: Yeah, correct.

[00:24:11] Nathan Wrigley: We probably should have explained that. So the plugin binds to the SaaS. The SaaS holds the data. And in that way, for example, an agency could have an overview of all the sites that they’re managing and that kind of thing?

[00:24:23] Remkus: And everything that happens on that site that is worthy of tracking and monitoring for. So again, the activity log is a good example. A WordPress activity log should not live inside the WordPress site, period. From a performance standpoint, it makes no sense. Most databases for most hosting companies have issues when you track and sort a, let’s call it a busy website.

So what we do is we asynchronously pull all of that into our dashboard. So if your site goes down for whatever reason, we have a track record of what the last things that were happening on your site.

[00:24:53] Nathan Wrigley: Oh yeah, of course.

[00:24:55] Remkus: There’s just an easier way of being in check.

[00:24:58] Nathan Wrigley: So you’d log into the SaaS, everything’s there. So if your site does have some catastrophic failure, then at least you can begin to understand what’s going on.

[00:25:06] Remkus: Yep.

[00:25:07] Nathan Wrigley: And work backwards from there?

[00:25:08] Remkus: Yep.

[00:25:08] Nathan Wrigley: I think that’s probably all the questions that I’ve got. Is there anything that we didn’t touch on that you wanted to mention?

[00:25:14] Remkus: I think what’s fun to mention is that this whole rewrite allowed us to start building add-ons as well.

So the base monitor service as we have it currently is what Scanfully is. So that’s Scanfully monitor. But we’re, and probably by the time this podcast is being aired, I think we will have, the beta available for WooCommerce checkout monitoring.

This is essentially an add-on to the base service. And what it does, we fully check everything that goes into, from is the product available in your WooCommerce, website? Can I add it to cart? Can I then go to cart? Can I then start the checkout? Can I fill out the checkout? Can I start the processing of the actual payment. So we don’t go into the payment itself? So they’re test orders, so to say.

[00:25:59] Nathan Wrigley: But the moment right before?

[00:26:01] Remkus: Yep to the moment, right before. So we’ll tell you if we can’t reach the payments provider. We’ll tell you that, but we can’t, at this moment in time, do the step beyond that.

[00:26:09] Nathan Wrigley: So how does that work then? Does it literally do that as if it’s a human being, you know?

[00:26:13] Remkus: It does.

[00:26:14] Nathan Wrigley: Is some part of your SaaS kind of opening up a browser somewhere in effect and doing that journey. Finding a product, putting it in the cart, checking the cart, and so on.

[00:26:21] Remkus: And the fun thing is you get to define what that journey looks like. So if you have a custom WooCommerce checkout, or any of the other solutions. We account for that. And you can tell us if it’s any different from what their default is, or the WooCommerce default.

And from there you get to essentially define the journey. And then the journey is stored as the thing we’re checking. And we’re doing this from the external, obviously. So it doesn’t touch any monetary things. Nothing gets charged, nothing gets booked. And the plugin that is providing the connection to our dashboard, that plugin cleans up whatever test orders were made in that process.

[00:26:56] Nathan Wrigley: Right, okay. So it’s not 3000 carts.

[00:26:58] Remkus: Yeah, we don’t, want to do that.

[00:27:00] Nathan Wrigley: Do you enable that in other ways as well? for example, I’m thinking maybe a contact form is incredibly important to somebody’s business.

[00:27:07] Remkus: Yep, that’ll be next.

[00:27:08] Nathan Wrigley: Is it possible to, outside of WordPress, visit a contact page, fill out the form fields, and then even, I don’t know, maybe even check on the other side to see if an email landed or something like that?

[00:27:17] Remkus: A part of it we’ve already solved with the email monitoring, or I should say email deliverability monitoring.

[00:27:23] Nathan Wrigley: Of course you’re on the inside there, so you can see whether that got sent.

[00:27:27] Remkus: Yes. But once we’re fully done with releasing the WooCommerce checkout monitoring, we are going to move to forms next. Because you’re right, if you have a landing pages, or a critical contact form or whatever, you need to know that that still is working as intended.

[00:27:41] Nathan Wrigley: So that’s a roadmap item. To be able to build these custom journeys, starting with WooCommerce, but more or less anything at some point. We want to see if people are going from A to B to C as we’d hoped.

[00:27:52] Remkus: Yeah, it’ll be a separate thing in the sense that WooCommerce will do a lot more than just checking the validity of the form, because that’s essentially on the WooCommerce side of things, that’s the checkout form. You fill out the form. And that’s the most similar to a general form. But yeah, we will build a separate feature inside of Scanfully that allows you to do all the types of monitoring you could possibly imagine you would need to make sure your forms are working the way you design them.

[00:28:16] Nathan Wrigley: Random question just before we end. How exciting do you find this? When you embark on the journey of building a product like this, you know, oh we’re going to do this thing, me and my friend. We’re going to do this thing, it’s going to be brilliant. And then the reality sets in, you know, it’s difficult, you’ve got to manage customers and all that kind of stuff. Do you still wake up excited by this?

[00:28:32] Remkus: Oh yeah.

[00:28:33] Nathan Wrigley: Obviously you’re not going to say the opposite. I’m just wondering if that curiosity still remains and whether or not.

[00:28:38] Remkus: It does, because there’s just so much more we can still do. And the feedback that we’re getting is very positive. And especially with this new imagination of how this should be solved with the 2.x reboot I guess is probably the best word. It just excites me on the potentials that we have.

The WooCommerce checkout monitoring is a good example, but there’s tonnes of other add-ons we have in mind where it just makes sense for you to have the Scanfully monitor as base. But there’s stuff that we can do more. We’re already gathering it in one way or another, and just to be super complete with what we’re presenting. Yeah, that excites me, yeah.

[00:29:11] Nathan Wrigley: Okay, thank you for chatting to me today. Scanfully.com. Go and check it out. Remkus, where are you apart from there? If people want to contact you, are you available on a particular platform, I don’t know, social media or email or what?

[00:29:26] Remkus: remk.us

[00:29:28] Nathan Wrigley: Nice. Of course you have that domain. Yeah. That’s lovely. In which case Remkus I will speak to you soon and thank you for chatting to us about Scanfully.

[00:29:38] Remkus: Thank you for having me.

On the podcast today we have Remkus de Vries.

Remkus has been active in the WordPress space for over twenty years, starting out with his own agency focused on high-performance, scalable WordPress websites. Over time, he has diversified into education and community-building with projects like WithinWP and a new initiative, The Guild, which is a paid community aimed at helping people build smarter, more performant sites through a first principles approach.

Our conversation centers on Scanfully, a site health and monitoring SaaS Remkus co-founded, which recently hit version 2.0. Scanfully’s focus is giving users meaningful, actionable insights into WordPress site health, security, performance, email deliverability, DNS, and more, packing all this data into an easy to understand dashboard.

We talk about Remkus’ motivation for diving deep into the complexities of WordPress monitoring, and why many users struggle to keep on top of the technical side of their websites. Remkus argues that too many site owners are stuck in reactive mode, only investigating issues once something breaks, and Scanfully aims to change that mindset by making ongoing health checks accessible and easy to parse, even for the spreadsheet-averse.

Remkus walks us through the product’s evolution, including the 2.0 update that aimed to reimagine their dashboard experience, added public APIs, and introduced tools like MCP AI integration, empowering users to query their site’s health conversationally.

We also get into recent and upcoming features such as WooCommerce checkout monitoring, activity logs, and future add-ons designed to cover forms and other business-critical flows.

If you manage multiple WordPress sites, run an agency, or are simply interested in building more robust, future-proof WordPress projects, this episode is for you.

Useful links

Scanfully

Scanfully 2.0 release post

Within WordPress

The Guild

Remkus’ personal website

Remkus on X

by Nathan Wrigley at October 28, 2026 02:00 PM

Open Channels FM: Linux Foundation on AI, Denmark’s Open Source Test, and Ben Thompson’s Take on the Internet

AI quickens open source coding, Denmark tests Collabora beyond Microsoft Office, and Ben Thompson reflects on the changing internet

by Bob Dunn at October 28, 2026 01:55 PM

Open Channels FM: When AI Mistakes Have Real-World Costs: Rethinking Delegated Control

Advances in AI have opened an entirely new chapter in how we interact with technology. We are moving rapidly from asking questions of digital assistants to handing them the authority to take actions in the real world. This shift brings efficiency and convenience but also introduces a new kind of risk: errors that cost more […]

by Open Channels FM at October 28, 2026 09:44 AM

October 27, 2026

bbPress: bbPress 2.6.21 is out!

bbPress 2.6.21 is a security and maintenance release. Everyone running bbPress should update. 🔒

This release strengthens access control across forum feeds, search results, BuddyPress activity, group forums, attachment requests, topic moves, and old topic and reply redirects. Inherited forum passwords now apply consistently when WordPress renders topic and reply content, and Akismet moderation requests now require HTTPS.

Maintenance fixes improve forum freshness and child-count queries, preserve metadata when database lookups fail, tighten route and user-profile handling, retain original dates and revision content during moderation and editing, and correct the administration reply destination controls. This release also repairs straightforward orphaned list items on WordPress 6.9 and newer, keeps generated bbPress excerpts available without duplicating content, adds the ugc relationship to topic and reply links, and refreshes administration icons for WordPress 7.2 and newer.

bbPress 2.6.21 still requires WordPress 6.0 or newer and PHP 7.2 or newer, and is tested through WordPress 7.2. The database version remains 264, so no database upgrade is required. The 2.6.21 upgrade notes cover compatibility details.

These changes are also in the 2.7 development branch, which remains 2.7.0-alpha-4. Thank you to antaloaalonso, arielmeadow, bor0, Clorith, dd32, deborah86, diddledani, lmstearn, netweb, noruzzaman, Otto42, Pebbleontheshore, r-a-y, rollybueno, sbask, shadow043, SirLouen, softglaze, terresquall, tharsheblows, and ton-ha for reports, patches, testing, and review.

Download bbPress 2.6.21 from WordPress.org, or update from your WordPress dashboard.

by John James Jacoby at October 27, 2026 10:33 PM

WordPress.org blog: WordPress 7.2 Beta 2

WordPress 7.2 Beta 2 is ready for download and testing! 

This beta release is intended for testing and development only. Please do not install, run, or test this version of WordPress on production or mission-critical websites. Instead, use a test environment or local site to explore the new features.

How to Test WordPress 7.2 Beta 2

You can test WordPress 7.2 Beta 2 in any of the following ways:

WordPress Beta Tester PluginInstall and activate the WordPress Beta Tester plugin on a WordPress install. Select the “Bleeding edge” channel and “Beta/RC Only” stream.
Direct DownloadDownload the Beta 2 version (zip) and install it on a WordPress website.
Command Line (WP-CLI)Use this WP-CLI command:
wp core update --version=7.2-beta2
WordPress PlaygroundUse a 7.2 Beta 2 WordPress Playground instance to test the software directly in your browser. No setup required-just click and go!

The scheduled final release date for WordPress 7.2 is December 8, 2026. The full release schedule can be found here. Your help testing Beta and RC versions is vital to making this release as stable and powerful as possible. Thank you to everyone who contributes by testing!

What’s in WordPress 7.2 Beta 2?

For technical details on the issues addressed since Beta 1, see the following links:

Continued Improvements to WordPress 7.2

WordPress 7.2 Beta 2 builds on the first beta with additional enhancements, bug fixes, and refinements across the administration experience and developer APIs.

Development continues on the Abilities API, including content querying, capability requirements, and improvements to schema handling and permissions. New server-side registration capabilities for DataViews and DataForm also provide developers with more ways to extend WordPress interfaces.

Additional work includes improvements to REST API flexibility, admin asset loading, and the transition to modern SVG icons throughout WordPress administration.

Learn more: Trac #66268, Trac #66325, Trac #66229, Trac #66343, Trac #57548, Trac #65089

How important is your testing?

Testing for issues is a critical part of developing any software, and it’s a meaningful way for anyone to contribute – whether or not you have experience. Details on what to test in WordPress 7.2 are available here.

If you encounter an issue, please share it in the Alpha/Beta area of the support forums. If you are comfortable submitting a reproducible bug report, you can do so via WordPress Trac. You can also check your issue against this list of known bugs.

Curious about testing releases in general and how to get started? Follow along with the testing initiatives in Make Core and join the #core-test channel on Making WordPress Slack.

A Beta 2 haiku

Second beta takes shape
New abilities take root
WordPress grows stronger

Props to @mamaduka for pre-publish review.

by David Baumwald at October 27, 2026 03:49 PM

Open Channels FM: Open Source Debates AI, GridCraft Challenges Excel, Tesco Eyes Proxmox

Reddit’s open source rules, a new Excel alternative, and Tesco considers open virtualization for retail edge infrastructure.

by Bob Dunn at October 27, 2026 03:15 PM

Open Channels FM: Adapting to Local Client Needs in a Remote Work World

A look at building business trust and reputation by combining local presence with digital communication.

by Bob Dunn at October 27, 2026 12:58 PM

October 26, 2026

Akismet: Akismet turns 21. Spam isn’t invited.

On October 25, Akismet turns 21. We’re celebrating with a few new guests: an official Drupal module, a PHP SDK, and another year of improvements to our WordPress plugin. Spam still isn’t on the list.

Akismet launched in October 2005 to help people spend less time dealing with comment spam and more time enjoying their blogs. The web has changed a lot since then. People build communities, collect inquiries, accept donations, and create applications on all kinds of platforms. Each of those places gives people a way to contribute. It also gives spammers somewhere to try their luck.

Since then, Akismet has blocked over 570 billion pieces of spam. Every one is something a site owner didn’t have to spend time sorting through. Our birthday wish is to keep making more room for the real people.

Welcome, Drupal

This year, we released the official Akismet Drupal module, built by the team behind Akismet. It brings our spam protection to Drupal comments, contact forms, webforms, and user registrations, with tools for moderators to review submissions and send corrections back to Akismet.

We’ve continued building on that welcome. The latest release supports Drupal 12 and passes richer bot-detection signals into spam scoring. On Drupal 12, comments and registrations are supported now; contact forms, webforms, and the Key module will follow as those modules become ready for Drupal 12.

For people using the older community module, we also built an upgrade path to the official module that carries their API key and protection settings across. The migration guide explains the requirements and which settings need attention.

Welcome, PHP developers

Akismet’s API has long made it possible to protect sites beyond WordPress. This year’s official PHP SDK gives developers a first-party client for bringing that protection into their own PHP applications, including projects built with Laravel or Symfony.

The SDK handles the Akismet API integration so developers can focus on their application. It supports checking submissions, reporting spam and legitimate content, and retrieving usage and account information. The official Drupal module uses it too.

If you’re building a place where people can post, sign up, or send a message, there’s a new tool to help you keep the spam out.

A familiar guest, with a few improvements

WordPress has been with us from the beginning. This year, we kept improving that experience: clearer setup and error messages, accessibility improvements, better detection of automated submissions, and compatibility fixes. You can find the details in the WordPress plugin release log.

Version 5.7 also added support for Abilities and Connectors, helping Akismet fit into WordPress’s evolving tools for integrating external services.

More room for real people

A comment worth replying to. A message from a future customer. A donation to a cause someone cares about. Those are the things we want coming through.

Thank you to everyone who uses Akismet, builds an integration, reports a problem, or helps us improve. You’ve been part of these 21 years, and you’re very much invited to the celebration.

Whether your site runs on WordPress, Drupal, or something you’re building yourself with the PHP SDK, there’s room at the table.

Just no room for spam.

Try out the Drupal module today!

by Peter Westwood at October 26, 2026 03:16 PM

Open Channels FM: AI in Cybersecurity: Balancing Speed and Human Oversight

As AI revolutionizes cybersecurity, organizations struggle with rapid vulnerability detection versus slow human remediation. Balancing efficiency and accountability is crucial, as maintaining human oversight prevents potentially catastrophic errors.

by Open Channels FM at October 26, 2026 11:35 AM

October 24, 2026

Gutenberg Times: A critical PHP fix, WordPress 7.2 Beta 1, Notes in the margin, and more—Weekend Edition 378

Howdy,

Before anything else: check which version of PHP your sites run. On October 21, the PHP project released fixes for two critical vulnerabilities, and they affect any server running a PHP application, not only WordPress. You’ll find your version under Tools → Site Health → Info → Server in your WordPress admin. If you manage your own server and are still on a version older than 8.2, I highly recommend updating. While many hosts have patched older PHP versions that are end of life, it’s best to stay on versions that PHP officially supports.

On a happier note, I’m back. I was sick for a stretch earlier this month, which is why there was no edition on October 10. Rather than try to cram four weeks into one post, this edition sticks to the last two. Much of what happened in the gap is covered in my October roundup for developers, linked below.

With that, let’s get down to the latest news.

Your friendly neighborhood developer advocate, 🎃
Justin Tadlock


Developing Gutenberg and WordPress

The final major release of the year has entered testing. David Baumwald announced that WordPress 7.2 Beta 1 is ready for download and testing, with the final release set for December 8. Notes move into a margin beside the canvas and pick up emoji reactions. Text shadows and form element styling arrive in the design tools, a new Secrets API gives plugins a standard place to store API keys, and client-side media processing extends to the Media Library. There’s even an On This Day dashboard widget. Not everything made it, though: The Repository reports that Notes suggestion mode was punted to 7.3.

The quickest way to try it is the 7.2 Beta 1 Playground instance, or wp core update --version=7.2-beta1 on a test site. Not on production.


Not sure where to start? Noruzzaman’s Help Test WordPress 7.2 breaks the release down by area: security, collaboration, admin, blocks and APIs, design, media. It also walks through the different ways to run a beta, from Playground to a staging site on your host, and points you to where feedback goes. The Beta 1 post is clear that testing counts as contributing, whether or not you’ve done it before.


Your first contribution to WordPress shouldn’t start with installing Git, Node.js, npm, and Docker. That’s the friction the WordPress Contributor Toolkit removes, and Ryan Welcher announced Contributor Toolkit 2.0, a redesigned app in your language. It’s rebuilt on the WordPress Design System, ships in ten languages, and adds a settings dialog. After you apply a patch, you can revert a single file without losing the patch itself. It’s also about 350 MB smaller, which helps when a whole Contributor Day room downloads it at once.


Jorge Costa shared what’s new in Gutenberg 24.2, and the Notes feature is the big headline. Notes now float in a margin the editor reserves next to the canvas, so you no longer have to choose between reading feedback and keeping the Settings sidebar open.

Screenshot of the WordPress post editor with notes shown in the margin to the right.

The Navigation block’s link search now looks through pages, posts, categories, and tags at once. Gallery can sort hand-picked images and tint all of them with a single duotone. And the design tools push continues with about 80 more PRs. Minimum width and height controls, for example, went from five blocks to 40.

For developers, React 19 is now on by default. Test your plugins and themes, and if something breaks, you can switch it off under Gutenberg → Experiments. Gutenberg 24.3 RC1 is already out, too, with rich text formatting across blocks, so expect that next week.


On the Developer Blog, I put together What’s new for developers? (October 2026), and I tried something different this month. Instead of walking through every aspect of the project, it focuses on the changes I think matter most if you build on WordPress: custom blocks building their own responsive controls, wp_kses() being rebuilt on the HTML API, stroke-based Core icons, and the automated security review for plugin releases. Everything else is linked at the end.


Readers may remember Chris Zarate’s post on moving collaboration to the server from the last edition. Alec Geatches follows it up with a guide to the sync engines for real-time collaboration, comparing yjs-server, DE-RTC, and intent-log on their strengths and weaknesses. In every engine, each change goes through WordPress, which confirms who sent it, checks their permissions, and validates it before merging. You can try all three in the experimental Gutenberg Sync Engines plugin. It needs WordPress 7.0+ and the Presence API plugin, and it bundles its own copy of Gutenberg, so deactivate the Gutenberg plugin first.


Feature Notifications has been quiet since version 0.2.0 shipped in April 2023. Jonathan Bossenger is reviving it with a status update and plan for 0.3.0, aiming to ship it with WordPress. That would be the project’s first working MVP: a notifications system that creates, stores, displays, and dismisses notifications. His honest assessment is that the foundations are solid but nothing is wired up end to end yet. He’s posting weekly updates if you want to follow along or help.


Benjamin Zekavica published the recap of the WordPress 7.1 “Mary Lou” retrospective, summarizing what contributors would keep, add, and change for future release squads. If you answered the survey, this is where your feedback landed.

Plugins, Themes, and Tools for #nocode site builders and owners

Sticky headers are one of those things you end up fixing on nearly every block theme site. Jamie Marsland turned his fix into a free plugin, Jamie’s Header Effects.

The standout is Chameleon mode: as visitors scroll, the header picks up the background color of the section beneath it and flips its text between light and dark to stay readable. There are also frosted-glass, solid, hide-on-scroll, and transparent overlay styles. It finds your header template part on its own, respects prefers-reduced-motion, and lives under Appearance → Header Effects.


Meta Box’s custom models no longer have to sit in isolation. A few weeks after moving model creation into the builder, Lua Nguyen announced the new Custom Model field, which lets you pick one or more items from a custom model the same way the Post field picks posts. MB Relationships also gains a Model object type, so you can connect models to posts, terms, users, or other models in either direction. Think hotel rooms as a post type with bookings attached from a custom model—no IDs stored by hand.


On WordPress.com, Ronnie Burt covers what’s new with WordPress Agent: it now designs a custom theme from your answers, hands you off to a simplified AI Editor with Preview and Edit tabs, and can install and manage plugins when you ask. The latest WordPress.com changelog also opens premium themes to every paid plan, starting with Personal.


WooCommerce 11.2.1 fixes two regressions: classic checkout on stores that remove address fields with filters, and postcode validation in the Checkout block for Argentina and a few other countries.

Theme Development for Full Site Editing and Blocks

If you’ve ever had to explain to a client why they should move to a block theme, Simon Cooke has done the work for you. His Human Made guide on how a WordPress block theme is built, and why it matters for enterprise sites walks through each part of a block theme and who owns it, with a side-by-side comparison to classic themes. He’s clear that moving is a project, not a theme swap. The point he lands on: when design rules live in the theme, a page built by someone who joined last week follows the same rules as one the designer built.


What if you could point a tool at any static HTML and CSS site and get an editable block theme back, headers and footers included? That’s the Static Site Importer, and Chris Huber of Automattic talks it through with Nathan Wrigley on WP Tavern in episode #238 on making migration to WordPress easier than ever. You’ll hear how it crawls a site, maps HTML elements to blocks, and handles trickier features like WooCommerce, plus how it fits into the broader Data Liberation effort.


WooCommerce’s Purple theme has a new home. Luigi Teschio announced that Purple development moves to the WooCommerce monorepo, as the first theme in its new themes/ directory, so contributions and bug reports go there now. One of the stated reasons is that keeping themes next to the blocks they use makes it easier for contributors, and AI coding tools, to see how templates and patterns use WooCommerce blocks. Nothing changes for existing installs, and Purple still releases on its own schedule. For more background, Bob Dunn’s Do the Woo episode on WooCommerce themes in 2026 covers Purple and theme performance.


 “Keeping up with Gutenberg – Index 2026” 
A chronological list of the WordPress Make Blog posts from various teams involved in Gutenberg development: Design, Theme Review Team, Core Editor, Core JS, Core CSS, Test, and Meta team from Jan. 2024 on. Updated by yours truly. 

The previous years are also available:
2020 | 2021 | 2022 | 2023 | 2024 | 2025

Building Blocks and Tools for the Block editor.

The new @wordpress/ui package will gradually replace @wordpress/components, so how much of an existing plugin can you move over today? Ryan Welcher found out live by migrating Advanced Query Loop to @wordpress/ui with the Design System MCP.


Once your page registers WebMCP tools, those tool definitions are an API, and the consumer is a language model. Pascal Birchler built playwright-webmcp for testing WebMCP tool surfaces, with linting, Playwright matchers, agent evals, and a site audit CLI. He lists the failure modes that make this tricky: vague descriptions the model ignores, schemas the browser quietly rejects, and two tools on the same page with nearly identical names.


Extension developers no longer need to duplicate a WooCommerce ability just to expose a few extra fields. Luis Felipe Zaguini opened a call for testing extensible abilities for extension fields, an experimental API in WooCommerce 11.3. Extensions can add fields to product, order, and order item reads and writes, register query filters, and refuse a change with a validator before it saves. It’s off by default, so turn on Extensible abilities under WooCommerce → Settings → Advanced → Features to try it. The gift wrap example in the post is a good place to start.

What’s new in Playground?

The best way to find out what’s hard about site editing is to watch someone try it. Jamie Marsland built a user testing app for WordPress on Playground and Spacefast to do exactly that. You send a tester a link, and Playground spins up a fresh site in their browser from your existing demo blueprint, with a card of five to seven tasks in the corner. The results page shows how long each task took, who needed the hint, and whether the site actually changed. It’s also an MCP server, and it’ll flag a task that gives away the button name.

AI in WordPress

Two weeks after the MCP Adapter arrived on WordPress.org as a canonical plugin, the AI team got approval to make MCP a default part of WordPress. Rae Morey reports on the move to make MCP a default part of WordPress, with 7.3 floated as a target. That doesn’t necessarily mean merging the adapter into Core: bundling it, enabling it through existing interfaces, and building specific capabilities into Core are all on the table. It’s also a reversal of the reasoning behind the canonical plugin, and maintainers are asking what changed. The AI contributor summary for October 21 has the meeting’s side of the discussion.


Andy Peatling launched WordPress Agent Benchmarks to measure how AI agents handle WordPress, and Rae Morey walks through the first results. Across 193 sites built for requests that suited WordPress, agents chose it zero times, even though they named it as an option about half the time. Using the MCP Adapter alone, they completed no tasks on existing sites, largely because it doesn’t yet bundle the abilities for common operations. Brian Coords asks what WordPress would have to change in helping agents choose WordPress, drawing on a WP Minute panel with Andy.


Is the MCP Adapter safe? Brad Williams of WebDevStudios calls it a door: “You decide which rooms it opens into.” He explains why production use of the MCP Adapter is a governance decision, not a plugin decision. An agent gets whatever abilities are exposed, using the permissions of the user it connects as, and every plugin you install can add more. His advice is to write the agent’s job description before you hand over the keys.


If you connect an AI client to WooCommerce, this one needs action before you upgrade. Darren Ethier explains that WooCommerce 11.3 removes its deprecated MCP endpoint. Requests to /wp-json/woocommerce/mcp will return a 410. Install the MCP Adapter, create an application password for a user with only the capabilities the client needs, and point the client at the adapter’s default server. Extensions that hooked into the old endpoint’s filters should check the post’s full list of what’s been removed.


WPShout’s guide on how to connect Claude to WordPress opens with the question most guides skip: where your site is hosted decides which route you take. WordPress.com, Jetpack, and other self-hosted sites each get their own path, and the walkthrough uses a free MCP plugin with a least-privilege grant. It’s also candid about a gap: the WordPress MCP Adapter has no OAuth server of its own, so claude.ai’s sign-in can’t connect to it directly yet.


Post revisions spent years bloating databases. Human Made thinks they’re about to become valuable. In WordPress revisions: agentic gold?, Noel argues that every revision records what changed, who changed it, and when, which makes them a log of how your team really works. Mine them for repeated changes and you’ve found the workflows an agent could take over. The post includes a prompt you can run, on a copy of your database and never on production.


Need a plugin .zip from Gutenberg’s master branch?
Gutenberg Times provides daily build for testing and review.

Now also available via WordPress Playground. There is no need for a test site locally or on a server. Have you been using it? Email me with your experience.


Questions? Suggestions? Ideas?
Don’t hesitate to send them via email or
send me a message on WordPress Slack or Twitter @bph.


For questions to be answered on the Gutenberg Changelog,
send them to changelog@gutenbergtimes.com



by Justin Tadlock at October 24, 2026 04:18 PM

October 23, 2026

Open Channels FM: Navigating the Value of Friction in a Fast-Paced World

As technology advances, prioritizing speed and convenience can undermine critical engagement and reflection. While automating tasks may enhance efficiency, it risks diminishing the unique value individuals bring to understanding and decision-making.

by Open Channels FM at October 23, 2026 04:17 PM

Open Channels FM: Faster Security with Anthropic AI, But Open Source Needs Real Human and Corporate Support

Faster security scans reveal new software issues yet patching and project upkeep require committed maintainers and company contributions.

by Bob Dunn at October 23, 2026 02:05 PM

October 22, 2026

Open Channels FM: Game Porting and Software Creation Accelerate with AI and OpenAI Concerns

Shifting barriers in tech reveal new questions about trust, safety, and sustainability in software.

by Open Channels FM at October 22, 2026 02:08 PM

Open Channels FM: Balancing Digital Life While Making the Internet Weird Again

Bowe Frankema shares how digital creation affects daily life and what bringing weirdness back to the internet means.

by Open Channels FM at October 22, 2026 12:08 PM

October 21, 2026

Open Channels FM: Munich Bets on Open Source as Meta Apple and NVIDIA Drive Local AI and Hardware Choices

Munich’s shift to practical open source, Meta and Apple’s AI partnership, and NVIDIA’s hardware-driven open AI models

by Open Channels FM at October 21, 2026 03:00 PM

WordPress.org blog: Critical PHP Security Release

The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP.

Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application firewall (WAF) rules in place to mitigate the vulnerabilities, but you should still check for updates from your web host and, if necessary, update PHP as soon as possible.

Within WordPress, you can see which version of PHP your site runs under Tools > Site Health > Info > Server. Many web hosts provide this information in your web hosting administration panel too.

These vulnerabilities are not specific to WordPress and affect any server that hosts a PHP application. No WordPress update is required or planned for these issues.

Versions of PHP prior to 8.2 no longer receive security updates from the PHP project.

If your site runs a version prior to this and you manage your own web hosting, you should consider taking your server offline while you prepare to update to a newer version of PHP. This advice is being published by several national cyber security agencies. To quote the UK National Cyber Security Centre:

Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated.

Further information on wordpress.org:

by John Blackbourn at October 21, 2026 01:44 PM

Follow our RSS feed: 

WordPress Planet

This is an aggregation of blogs talking about WordPress from around the world. If you think your blog should be part of this site, send an email to Matt.

Official Blog

For official WordPress development news, check out the WordPress Core Blog.

Subscriptions

Last updated:

November 04, 2026 07:00 PM
All times are UTC.