Latest insights

WordPress Development Blog

Expert tips, tutorials, and insights for WordPress developers.

Measuring AI visibility

Measuring AI visibility

We pointed AI-visibility monitoring at our own site for a quarter. The numbers were humbling, and the measurement method moved them more than reality did. Three real snapshots, the caveats, and what we now track.

WordPress security audit

A real audit of an SME WordPress site: Elementor pinned at 3.11.1 with four critical CVEs, and Contact Form 7 at 5.8 exposed to CVE-2023-6449 arbitrary file upload. The outdated-plugin pattern that fast and AI-assisted builds leave behind, and how an audit catches it.

Too many WordPress plugins

An insurance comparison site arrived with 30+ plugins, a 705 MB database, and a 7.7s LCP. The worst offender was a view counter writing to wp_postmeta on every load. A real teardown of the plugin-sprawl pattern that fast and AI-assisted builds keep producing.

Does AI render JavaScript

Does AI render JavaScript

A June 2026 live test showed six of seven leading Western AI assistants read only raw HTML, not JavaScript-rendered content. What that means if your facts load client-side, and why our stack already serves everything server-side.

The WordPress 7.1 roadmap

The WordPress 7.1 roadmap

Anne McCarthy's WordPress 7.1 roadmap is framed around collaboration, yet real-time collaboration is the one feature that keeps slipping. What actually ships on 19 August 2026, and what the canary-deployment debate says about how WordPress is built.

WordPress supply chain attacks in 2026

WordPress supply chain attacks in 2026

A single week in June 2026 saw the Awesome Motive CDN breach, the ShapedPlugin build pipeline compromise, and a 13-year backdoor campaign exposed. The common thread: the official update channel was the attack vector. What store owners should actually change.

More Articles

The AI Act and labelling AI-generated content

The AI Act and labelling AI-generated content

From 2 August 2026, Article 50 of the AI Act imposes transparency duties on companies that use AI. What you actually have to label, when editorial review lifts the obligation, and how to put two layers of labelling into practice for media, marketing and agencies.

Why shipping an MCP server in your WordPress plugin is the AI move that survives

Why shipping an MCP server in your WordPress plugin is the AI move that survives

Metorik founder Bryce Adams told WP Product Talk that the company's MCP integration drew 500 users within days of a quiet preview launch, faster than any feature he has shipped in ten years. He also said customers churning out of Metorik have an average MRR 40 percent lower than retained ones, suggesting AI is taking the commodity use cases, not the core ones. GravityKit just open-sourced Block MCP for block-level WordPress edits. The pattern is clear: in 2026, the plugin that ships an MCP server is the one that compounds. The plugin that bolts a chat box onto its admin is the one that gets cannibalised.

53 percent of WordPress sites run unpatched CVEs: GuardingWP 2026 audit

53 percent of WordPress sites run unpatched CVEs: GuardingWP 2026 audit

GuardingWP's inaugural State of WordPress Security 2026 report scanned 424 confirmed WordPress installs across 40-plus verticals. The headline finding is that more than half ship at least one plugin with a known unpatched CVE. Patchstack founder Oliver Sild said WordPress 7.0 will trigger an "absolute rush by hackers to steal API keys." This article reads both as evidence that the plugin economy is the structural problem and NIS2 plus DORA already encode the fix.

NIS2 and DORA on WordPress: what a site must meet in 2026

NIS2 and DORA on WordPress: what a site must meet in 2026

The NIS2 Directive (2022/2555) was to be transposed into national law by 2024-10-17. The DORA Regulation (2022/2554) applies directly from 2025-01-17. For a WordPress site operator this means specific obligations if the site relates to a regulated entity. We explain it without panic, with references to the texts of the acts.

WordPress 7.0 Armstrong shipped: AI infrastructure, Abilities API, and what actually changed

WordPress 7.0 Armstrong shipped: AI infrastructure, Abilities API, and what actually changed

WordPress 7.0 codenamed Armstrong shipped in May 2026 with foundational AI infrastructure (Abilities API, AI Services Registry, AI Client), a modernised dashboard, Command Palette everywhere, block-level custom CSS and the Icons block. Real-time collaboration was removed during the release-candidate cycle. This guide is the post-release recap of what changed, what to test, and what to wire up.

Core pathways

Start from the strongest topic pillar

This section routes users and crawlers into the service pages and topic archives that carry the strongest WordPress, SEO, and performance clusters.