Qlynx test domain

Category: Uncategorized

  • Open Channels FM: How AI Tools Are Transforming Everyday Web Design Practices

    In this episode, Bob and Cami discuss how AI is reshaping web design, offering tips on using AI tools effectively, educating clients, and adapting workflows for better efficiency in the digital space.

  • WPTavern: #225 – Milan Petrović on the Risks of Legacy PHP in WordPress and Why Upgrading Matters for Security

    Transcript

    [00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

    Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, the risks of legacy PHP in WordPress and why upgrading matters for security.

    If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players. If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you or your idea featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

    So on the podcast today we have Milan Petrović. Milan has been deeply immersed in the WordPress ecosystem since 2007, developing an array of plugins, especially for expanding bbPress forums, and running his own company, creating plugins before joining the Freemius team as a full stack developer. With nearly two decades of hand-on experience, Milan has witnessed firsthand the evolution of both the WordPress and PHP landscapes.

    Many WordPress users may be only partially aware of PHP. Perhaps they’ve noticed version numbers in their hosting panel, but few of the millions of WordPress users understand the real impact that PHP versions have on the security and performance of their websites. Milan is here to shine a light on why embracing newer versions like PHP eight isn’t just good practise, but a crucial step for security and efficiency.

    Milan begins by recounting his journey through WordPress development. The conversation gets into the heart of his recent WordCamp Europe presentation, which tackles how legacy PHP code exposes sites to thousands of open bugs and vulnerabilities. And why relying on old versions is, as he describes, an active invitation for automated exploitation.

    The discussion explores the contrast between running legacy code, and using the native shields of modern PHP, and highlights how PHP 8 not only closes security holes, but also delivers major performance boosts, reducing memory usage, and accelerating speed.

    If you’re wondering why you should care about the PHP version your site is running on, or you’re a developer interested in practical ways to harden your code, Milan unpacks both the existential risks of outdated PHP, and the step-by-step benefits for hosts, agencies, and plug-in developers alike.

    He introduces his Vulnerability Lab plugin, designed for developers to see firsthand how code exploits play out differently across PHP versions, and makes the case that modernising can happen gradually, one update, one plugin at a time.

    If you’ve ever questioned how your hosting choice, or plugin stack, could affect your site’s future. Or you’re ready to take the first steps towards building more secure and future proof WordPress products, this episode is for you.

    If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

    And so without further delay, I bring you Milan Petrović.

    I am joined on the podcast by Milan Petrović. Hello Milan.

    [00:03:58] Milan Petrović: Hello Nathan. Thank you for having me here.

    [00:04:00] Nathan Wrigley: You are very welcome. We’re in a beautiful, beautiful media room at WordCamp Europe. And I know that you have already done your presentation because we just had a little chat about the fact that you’ve done it and it went well and all of that.

    Do you want to tell us a little bit about you and your background working with code and developing and security and all of that kind of stuff? And then we’ll talk about your actual presentation and how it went.

    [00:04:25] Milan Petrović: So I started with WordPress almost 20 years ago, so way back in 2007. And I created a lot of plugins for WordPress, and I especially have a lot of plugins for bbPress for expanding forums. Yeah, people still use forums these days. So that was, I really like bbPress and all the stuff I did with that.

    I have been working as a freelancer for a lot of years. I have my own company that was doing plugins, it’s called Dev4Press. But in 2024, I joined the amazing team at Freemius. So for almost two years I am a full stack developer at Freemius. And that was a really nice change of pace for me and the work I usually do before that. So yeah, that’s a short of it.

    [00:05:13] Nathan Wrigley: Yeah. That’s great. Thank you. And so the presentation that you did that is now over, goes like this. I’m going to read the entire blurb because it’s short enough to read, and it says, secure by design, hardening plugins with PHP 8.x. In the WordPress ecosystem, we’re often forced to choose between supporting the lowest common denominator of hosting and implementing modern security. But in 2026, writing legacy PHP 7 code isn’t just a bad habit, it’s an active invitation for automated exploitation. It’s time to stop playing whack-a-mole with sanitisation, and start building products that are secure by design. This talk isn’t just another slide deck on security tips. Through comparisons of a Vulnerability Lab plugin, you will see how common exploits like authentication bypass, and server side request forgery succeed on legacy code, only to be neutralised by the native shields of the latest PHP. You learn how to leverage the modern PHP patterns to ensure your plugins are resilient to a wide range of exploits.

    Now into the show notes I will put Milan’s wordpress.tv presentation so that you can go and watch the entirety of it. I guess basically if at any point you get confused, that would be a good idea, pause this podcast and go and check that out. But, how did it go? How well received was it?

    [00:06:33] Milan Petrović: For me personally, I’m very satisfied with how how it went. I don’t know, it’s a bit overwhelming to be honest, but I am very satisfied and I got a lot of questions after the talk. I met a lot of people that liked what I had to say. And I think it’s good feedback to have, for something that is more technical like this was.

    [00:06:52] Nathan Wrigley: Well touching on the fact that it’s more technical, I have to confess that I think you are going to have to shepherd me through this, because a lot of the content that you I think probably got stuck into is beyond my pay grade. But hopefully we’ll get through it.

    Now at WordCamp Europe, where we are now, I don’t know what the ratio is, but I’m guessing that a significant proportion of the people out there are not developers. They kind of know that PHP is a thing. They realise that WordPress is built on that, but they don’t really have an understanding.

    They’ve probably heard of PHP 7. They’ve probably heard of PHP 8, because somewhere in a control panel that was shown to them. But maybe there’s not much of an understanding of the fact that it gets better over time. It gets secure over time. I think there’s probably a notion of, well, my website works. Why do I need to change anything?

    So let’s get into that. What were you talking about in your presentation? What’s changed in the landscape of PHP more recently that you brought to the fore that you shared with your audience?

    [00:07:51] Milan Petrović: Yeah, I think that PHP 8 was a big milestone for a lot of things. And I’m not sure, but I don’t think that the wider communities are kind of aware about the impact of the PHP, or the server environment in general, on how the websites work and how secure they are. Maybe the WordPress in itself needs to spread more awareness about that.

    Because right now we get a notice in the dashboard that maybe the PHP needs to be updated. But for a lot of website users, that can be too much and too little information at the same time, because they may be not aware of how to do things on their hosting site.

    We need to spread more awareness about how important the changes in the code are when it comes to the newer PHP versions, and what they can do to improve the security. And how developers should be starting to use more of those new features and the new things that PHP provides on a language level nowadays.

    [00:08:49] Nathan Wrigley: WordPress has got this real legacy, I suppose is the right word, of supporting legacy code. So WordPress itself is supported way, way, way back. You can keep using versions of WordPress, which are many, many, many years old. And I wonder what your stance is in terms of PHP, whether or not WordPress runs versions of PHP which are far too old, in your opinion.

    So in other words, should WordPress have a policy of, I don’t know, 8.x only? Or is 7 okay. And I don’t know what other CMS platforms, you know, Drupal, Joomla as was. I don’t know what they do, I don’t know what their posture is.

    [00:09:32] Milan Petrović: I think that one of the most important decisions that, it was done with WordPress early on, is that backwards compatibility, because it opened the doors for a wider adoption. Because you don’t need to change server every year, or you don’t need to upgrade your software that often. And that helped a lot of hosting companies to provide WordPress hosting very cheaply, because they didn’t have to have the latest PHP, they didn’t have to invest much more money into all that. So WordPress got a lot of adoption from backwards compatibility policies.

    But in the same time, that also proved a bit of a problem. Because even the WordPress Core code is kind of stuck because of that policy of backwards compatibility. And it’s not only compatibility with old versions of WordPress, but the old versions of PHP. And we are running now maybe six years behind end of life PHP versions. Because PHP 7.4 end of life was four and a half years ago. And we still support it in the Core.

    [00:10:33] Nathan Wrigley: Yeah, I guess it’s a nice thing to support it. And it, as you described, it was a great way of onboarding the millions of people that came along. But things have moved on.

    What would be some of the top level items? And I’m inviting you to open the scary book and sort of give out the worst case scenarios basically of running legacy code. So really, go to town, frighten us all. What are some of the horrors that await if you’re quite willing to, as a hosting company, support seven point whatever or beyond, six or five, or dare I say it, four, who knows? What are some of the terrible things that await us?

    [00:11:08] Milan Petrović: To be honest, when I was researching some of the statistics and things like that, I was kind of scared when I saw that there are 3 or 4,000 open bug reports for PHP 7 and PHP 5, which are still in use today, and there are WordPress websites running on both of them in the millions. And there are 3 or 4,000 open and confirmed bags that are never going to be fixed. Never. So PHP 7 has thousands of bugs, and I’m sure that not everything security related, but a big chunk of those bags are related to security.

    And there are open exploits that run on the PHP level. They don’t care really about if you are using WordPress or using something else. It’s more like a exploit on the level of a, on a server side that can be quite scary because you, even the technical people are not really sure what are all those bugs. Who is going to go through 3,000 or 4,000 bug reports?

    [00:12:05] Nathan Wrigley: Yeah, so just to sort of describe that, the fact that there is no more updates to the 7 branch of PHP means that all of those bugs which are publicly available, anybody can go and read great detail about what they are. Well that then means that any hacker can do that, and probably did like a dozen years ago. And so really you are painting a picture there of you are asking for trouble.

    [00:12:30] Milan Petrović: There are hosting companies that maybe do things a bit differently because you don’t need to run PHP as it was created. You can build your own version of PHP. You can patch bugs on your own. And a lot of hosting companies are doing that. But in the same time, that also poses a problem. You are going to run WordPress in your own plugins on a platform that is not actually officially PHP supported. It can have some different quirks that make your code run a bit differently.

    A while ago we had the Facebook running their own PHP build, that was quite different from the public PHP. But they used it, and other people started using it. So I don’t know. Still I think that the official PHP is the one you should be on because you never know what other issues. Even when hosting company patches the PHP they’re using, maybe they’re opening doors to something else that is not quite documented on that level.

    I think that the best policies, I don’t expect for WordPress to adopt the latest PHP or only supported PHP versions, but to kind of move quicker on the adoption of the newest version. So maybe we should be quicker to adopt PHP 8.0 or 8.1 is a next minimal required version for WordPress.

    [00:13:50] Nathan Wrigley: When you say you don’t expect WordPress to do it, is that simply because it doesn’t have a history of doing it? Is there a technical reason why WordPress could not keep up with the latest version? I know we’ve got this plugin architecture where there’s thousands and thousands of developers who are all doing their own thing, and there’s all of that. Is there any technical reason why WordPress couldn’t be on the cutting edge, most up-to-date, latest version?

    [00:14:15] Milan Petrović: There are two factors in all that. First one is you can declare, PHP 8 is the minimal version we support. We don’t support PHP 7.4 anymore. And that means that you don’t need to make any changes in WordPress at that point. You can declare it because WordPress is compatible with all PHP versions. It works on 8.0 and 8.5. That’s no problem. But say that branch 7 is no longer supported, you’re kind of pushing other developers and hosting companies to improve their support for newer versions.

    And you don’t need to make immediate changes to WordPress. But at that point, you are open to modernise the code because now you can have more stricter typing across the board. There are some strict typing things in older PHP versions, but with 8.0, you can do all of that. And it doesn’t have to be a process that is done immediately. It can be done gradually. You can update parts of the WordPress Core over time. And it’ll take a few years, to get up to date, but at least you are closing doors to some older versions of PHP, and you are pushing developers as well for plugins to have that policy.

    Right now, each developer can have their own plugins supporting any version of PHP you want. For my plugins, I have policy of 8.0 as a minimal version since this year. And, I’m updating the code as I go along. I don’t do it, it’s impossible to do it all at once. And for WordPress, it’s going to be even worse to make it all up to date. But declaring PHP 8 is a minimal required version, would be a great step in the right direction for wider adoption.

    [00:15:51] Nathan Wrigley: Yeah, I think the problem is simply one of the user base, isn’t it? There’s just millions of people, thousands of developers all doing their own thing. And casting 8.x, 8.0 and above as the new minimum, there’s going to be a moment where some things do go wrong.

    So that calendar plugin that you’ve been using for ages, which just works. And sure, you’ve never really received any updates from the developer, but it just works. Everybody’s booking on my calendar and we are all good. And then suddenly PHP 8 is required and it turns out the calendar plugin now no longer works.

    You can imagine those kind of stories a million times over coming to the fore. But equally, we got to move on. There’s no way of, you know, because we can’t in 10 years still have sites on 7.4.

    [00:16:43] Milan Petrović: We have sites on five point something. I recently checked the official WordPress tracking. 7.4 is on 20% even now. So we are far away from WordPress ditching the 7 branch. And I think there are still few percent of PHP 5 in all that so.

    [00:17:01] Nathan Wrigley: Yes, I regularly look at the, it’s like a little donut chart, isn’t it? That is often produced and you gradually see the eight point x whatever section of the pie getting bigger as they produce the next survey. But you’re right, it’s still a significant chunk that’s on 7 and below.

    And whilst when I look at that chart, it doesn’t really bring any alarm bells to the fore, I just think, oh, that’s a shame. But now that you are presenting this talk, and giving me this information, I realise that that attack surface is worse.

    When you gave that talk, who is your target audience? Were you directly sort of aiming at the hosting companies who presumably can do a lot of work very quickly? You know, they could take a million people onto 8 with a little bit of development work and on the back end of their platform. Or are you really encouraging the general WordPress user, like me, to take a bit more interest and make sure that I am going into the cPanel or whatever it is and updating myself? Or is it a bit of both?

    [00:17:59] Milan Petrović: For everyone actually. It’s for developers to be more aware of what they can gain with the new PHP versions. It’s for hosting companies. Because it’s not only about security when it comes to the newer PHP. The PHP is faster and faster. So each new version gets you 5 or 10% more performance without doing anything. So PHP 8.5 is more than 50% faster than PHP 7.4. So that’s a significant update.

    And I have even, one slide was showing how much less memory PHP 8.5 used to run exactly the same piece of code. So it’s pretty wild to see that hosting companies are maybe the biggest factor in all this. They will gain a lot more because they’re going to free a lot of resources to run more websites because PHP is going to use less memory and it’s going to be faster.

    So I understand they need to invest a lot of money to do all that. But, I don’t know, I think that gains from that are very significant, on that level alone.

    [00:18:57] Nathan Wrigley: Yeah, so you described there are really compelling scenario. You know, it’s quicker, it uses less memory, you’ll save money. I mean what else do you need? You’ve just presented the entire argument.

    However, it hasn’t happened. So technically speaking, why do you think it hasn’t happened? Is there an acquisition of new knowledge that is difficult to take in? Is it that simply you would have to, I don’t know, retrain your staff? How do you understand that it hasn’t happened? What are the reasons people are digging their heels in and not making these updates?

    [00:19:25] Milan Petrović: I kind of make the group of two or three types of hosting companies. One, and that’s usually more expensive managed hosting solutions. They are forcing the updates. They’re not maybe on the latest version, but they are forcing their users to use at least three or four versions of PHP back. So maybe 8.2 or 8.3, which is a great step in the right direction.

    There is also a problem of support. If something starts breaking, they’re going to be the first one to be asked about that, because they made the change to the server. So why now website that was working yesterday is no longer working today because of some change made on a hosting level. So there are a lot of factors to play into that adoption.

    But on the other hand, there are a lot of developers that have moved on with supporting PHP 8. A lot of plugins are very much updated and, especially popular plugins. They invested a lot of time to do the update. It’s getting easier to support it. But on the other hand, you have very old websites that are simply cannot move without proper testing, without updating the plugins. And there are cases when you cannot simply update one plugin because something else may break, or you made some changes that will make some other thing break. So it’s a big puzzle that is definitely not easy to solve, but maybe we should start some work on that as a community to do it, and to move people along.

    I don’t want to say force the change, but make people aware of the benefits. Make people aware of the risks if they continue to run the old and outdated software. And the same goes for not updating plugins, not updating WordPress. No matter how much work is done in that regard, there are still most likely some exploits on a WordPress level for very old versions that at some point someone is going to find out about and exploit.

    [00:21:16] Nathan Wrigley: I mean I guess the motto of WordPress was democratised publishing, which means basically make it available to everybody. No matter your level of expertise, make it available to everybody. And I’m sure that if you were to grab the CEO of any hosting company and say, I can save you money, I can save you resources, and all of those things that you outlined earlier, they would, yeah, we know, we know. But we’ve got thousands of non-technical people using WordPress.

    I kind of have this analogy in my head, and it goes a bit like this. Several years ago, I bought a bike. And it sits in my garage and there is my bike. And I expect my bike to work tomorrow in the same way that it did four years ago. And in 10 years, I expect my bike to work. I don’t expect there to be an update to wheels or gears or the saddle. It doesn’t need an update. It’s just a bike. And I need my bike to be a bike and nothing more.

    And I get the impression that many people treat their WordPress website as the same thing. This sort of static commodity that, sure enough, they pay a monthly fee for it, but it’s this website. It’s a thing, and it doesn’t need changing. And so what I’m trying to say is, I’m fairly sure that the hosting companies are met with that an awful lot. The customers who just, it’s a bike, it’s a website. Do you know what I mean?

    [00:22:37] Milan Petrović: Yeah, but you need to maintain your bike. If you don’t do it, it’s going to, your belt is going to rust, your wheels are going to be deflated or whatever. A lot of things can happen with it if you don’t maintain it. So, we don’t need to upgrade everything all at once, but we can start from someplace. We can do it gradually. But still, WordPress needs to be the platform that leads the charging that, because it’s going to force other developers to do it. It’s going to force hosting companies to start doing it. And it’s not a big jump on moving just that one version, but it’s going to help to move things along faster. Let’s see how it goes in the next few years. But I really don’t expect for WordPress to drop 7.4 for at least a year or two, maybe even more.

    [00:23:24] Nathan Wrigley: I loved your rebuttal of my bike analogy there. That was perfect. That’s exactly right. The bike will rust, the wheels will be deflated and all of that, yeah. So we need to drag the WordPress users along.

    Now, in your presentation, you mentioned something that I have never used, the Vulnerability Lab plugin, which you used to demonstrate the attack. Can you just tell us a little bit about that? Because I’d be curious to follow that up, and maybe some people listening to this would too.

    [00:23:47] Milan Petrović: I started it for, created for this talk specifically to add few examples and to run the code that is going to show those things if you run the plugin on the old version and the new version of PHP. And I do plan to expand on it because there are a lot more PHP security elements that can be demonstrated in that way.

    So it can show you, you have like a, in many cases the same code, but if you run it on one platform, you’re going to get one result. And if you run it on the newer one, you will get something different. So it’s useful to show, and some of those changes are quite small, those attributes that you can add to the code are very, very small, but they can really help you to improve security of your plugin.

    And there are more complex security measures that can be implemented, but the format of the talk wasn’t really suitable to mention everything. But this was like something to get you started on the path of discovering what else PHP 8 can offer, when it comes to improving the security of the plugins and what possible exploits and vulnerabilities are there.

    I try to use some obvious things that are very easy to spot. And I’m sure I did made some of those errors myself in the past. So some of those examples are something that I dealt with when I was upgrading my code. So I’m sure that a lot of people can see similar problems in their own code, and similar kind of solutions that can help them to overcome those and to make them much more resilient in the future.

    [00:25:17] Nathan Wrigley: So is your plugin designed primarily, would you say for developers in mind, or is it something that just a typical end user may get some mileage out of?

    [00:25:26] Milan Petrović: No, it’s more for developers that they can see, they can run that code and see how it behaves on the old version and the new version to demonstrate some of those things. And I will definitely expand it to include more examples in the future. Even for myself to like a document, what can happen if you run something in the old version, and the new version?

    I had some suggestions coming to me like, maybe like a pattern library that is going to show what is the pattern that we use with old PHP and how to improve it with a new one, and document which version of PHP is going to support it, and how it’s going to improve the code.

    [00:26:01] Nathan Wrigley: So is the idea then that you would instal it on various different, let’s say that you’ve got a live site and you’ve got, I don’t know, a development site and another development site, is that you would put it on each of those, different PHP versions, and just sort of compare and contrast what.

    [00:26:16] Milan Petrović: Yeah, that can be used.

    [00:26:17] Nathan Wrigley: Yeah, in that way. And what’s the reporting that you get? Is it kind of error logs, you know, that only a developer would be able to understand, or is it in plain language that somebody like me could understand?

    [00:26:26] Milan Petrović: Right now it’s a bit technical because if you run a certain part of the code, some of those elements do have a visual component in the admin section. You will see, one of the examples, if it’s run on PHP 7.4, it’s going to result in a fatal error for sure, depending on the server settings. And if you run it on the new version, you will get a full code running and executing as expected.

    So it’s a bit of a development thing that developers can use themselves to show maybe to potential clients or to website owners what is going to happen if they continue to run the outdated versions of the PHP. So it’s not just, yeah, the PHP 7.4 is bad, but here it is, why it is bad actually.

    [00:27:12] Nathan Wrigley: Okay, that’s a really interesting use case, isn’t it? So if I’m an agency owner and I’ve got, I don’t know, a client over here who is absolutely wedded to this plugin, this calendar plugin say, and we know that the development of that plugin has ended years ago, then trying to persuade that client to find something new, or have something new built is difficult.

    But with the capabilities of the plugin that you’ve created, you’ll be able to show in a sort of readable human way, okay, right. That’s all very well, but we’ve got to get onto PHP 8.0. And when we do that, this is going to happen.

    So that’s actually quite a useful tool for agencies to be able to dangle things in front of the noses of their clients. Potentially, I don’t know, get some new work out of it as well, because there’s this extra work that needs to be done to bring it up to the modern standards.

    [00:28:01] Milan Petrović: Yes. And one example especially demonstrates not only security, it demonstrates the performance. It shows you how much memory that piece of code is using on old version. Almost half the memory is going to be used less with a new version. So that’s very on the nose demonstration on security, and the performance in the same time. So things like that can help. And I will definitely try to invest more time in showing more examples and anyone can contribute.

    It’s a plugin available on GitHub, so any contributions in that regard are welcome. And we can maybe all work to create like a list of patterns that are something that a lot of people can use, and show different people how the PHP can help them move along.

    And again, I don’t want to sound like we don’t need whatever WordPress is doing. We still need to use all the security enhancements that WordPress has built in the Core. Escaping, sanitisation. All that is still very important because you cannot solve everything by upgrading PHP and upgrading your code to use some of the PHP features. There are still a lot of security elements in WordPress itself that are very important and should not be replaced, or removed, from the code. There are patterns that are crucial to ensuring the security is on a top level. So combination of what WordPress already has, plus everything we get with the newer PHP is something that we should strive in the future, and to make things better.

    And it’s not that complicated to start with the process. You can start upgrading small things. You can start with stricter typing. You can start with very small changes, and then gradually you can add those new attributes. You can replace some of the functions that you may be used with old version of PHP, but there is something better in the new version. So that’s something that everyone can do. Do a bit at a time so not everything at once. Spend time and make some gradual upgrades, and that’s going to help moving along.

    [00:29:57] Nathan Wrigley: You are obviously here to talk about where PHP meets WordPress, but presumably you, yourself are gaining intel from the PHP community. Is there a resource, like a central PHP resource that you would direct people to, or would you rather steer them towards kind of WordPress resources? The things that people are doing in the WordPress space and the hosting space. There’s not really a question there, but it’s more where do you find your information? Where’s the most reliable place?

    [00:30:25] Milan Petrović: You need to check everything. PHP website is a really good resource to find the information about what’s coming in the next version of PHP, because the preparations take up to a year to release a new version of PHP. So they’re now on a cycle that every December we get a new feature version. So in December this year, there is going to be PHP 8.6. And you already know most of the things that are coming to that version. You have the detailed list of changes for every PHP version. And that’s something that any developer should look at, and to see maybe something that will drive them to upgrade.

    In the current usage of third party libraries, there are a lot of libraries used in PHP that have moved on beyond 7.4. There are a lot of libraries that now require 8.1 or 8.2. If you depend on some library for, I don’t know, parsing URLs, or doing something else, something for security, something for whatever. You may face the problem that if you want to use the latest version of that library, you will need to have the newer PHP version. So you are kind of forced to upgrade your plugin requirements to meet with the requirements of the third party libraries.

    And outside of WordPress ecosystem, those libraries will move much faster with the adoption of newer PHPs versions than WordPress itself, because they don’t deal with millions and millions of websites that are affected. They are creating the library the best way they can. And they want to ensure that their library is secure, that their library has access to the latest features. So they are going to bump requirements for those libraries on their own. And if you are depending on it, you need to do it yourself for your plugin. So it’s kind of, those libraries are kind of forcing the hand of some developers to upgrade, even if they maybe are not ready at this point to do it.

    [00:32:15] Nathan Wrigley: Yeah, it certainly sounds like there’s no lack of information out there. If you make your business to find the information, then it’s all there. You’ve just got to make the effort to go and find it.

    I’ve kind of run the gamut of everything I wish to ask. However, I’m very conscious, as I said at the beginning, that this conversation is a little bit above my pay grade. Is there anything that I missed that you wished you had been asked that you wanted to get across?

    [00:32:38] Milan Petrović: No, I think we covered a lot of stuff in that.

    [00:32:42] Nathan Wrigley: Well I’m glad to hear it. That’s great. Yeah, thank you.

    In which case, I’m assuming, given that you’ve come to an event like this and you’ve put a plugin on GitHub, you are sort of semi available, or very available, to have conversations with people around this. And if that’s the case, where’s the best place to find you online? A website or an email address or a Twitter handle or whatever.

    [00:33:00] Milan Petrović: We included the slide with the contact information. So even the email, if someone wants to get more information, they can do it on various social networks as well. So any input about all that is welcome. And I’d be happy to help if someone needs, some pointers or additional information to get started with all this.

    [00:33:21] Nathan Wrigley: Well, thank you. That’s very much appreciated. As always, if you go to the show notes on the WP Tavern website and click on the episode involving Milan, you’ll be able to find, buried probably towards the bottom, all the different bits and pieces, the wordpress.tv video that will go with his presentation and various other links that have been discussed during the course of this episode.

    So with that said, Milan, thank you so much for chatting to me today. I really appreciate it.

    [00:33:47] Milan Petrović: Thank you. It was really great, and I appreciate your invitation for the interview.

    [00:33:52] Nathan Wrigley: You are so welcome. Thank you.

    [00:33:53] Milan Petrović: Thank you.

    On the podcast today we have Milan Petrović.

    Milan has been deeply immersed in the WordPress ecosystem since 2007, developing an array of plugins, especially for expanding bbPress forums, and running his own company creating plugins before joining the Freemius team as a full stack developer. With nearly two decades of hands-on experience, Milan has witnessed firsthand the evolution of both the WordPress and PHP landscapes.

    Many WordPress users may be only partially aware of PHP, perhaps they’ve noticed version numbers in their hosting panels, but few of the millions of WordPress users understand the real impact that PHP versions have on the security and performance of their websites. Milan is here to shine a light on why embracing newer versions, like PHP 8.x, isn’t just good practice but a crucial step for security and efficiency.

    Milan begins by recounting his journey through WordPress development. The conversation gets into the heart of his recent WordCamp Europe presentation, which tackles how legacy PHP code exposes sites to thousands of open bugs and vulnerabilities, and why relying on old versions is, as he describes, “an active invitation for automated exploitation.” The discussion explores the contrast between running legacy code and using the “native shields” of modern PHP, and highlights how PHP 8.x not only closes security holes but also delivers major performance boosts, reducing memory usage and accelerating speed.

    If you’re wondering why you should care about the PHP version your site is running on, or you’re a developer interested in practical ways to harden your code, Milan unpacks both the existential risks of outdated PHP and the step-by-step benefits for hosts, agencies, and plugin developers alike.

    He introduces his Vulnerability Lab plugin, designed for developers to see first-hand how code exploits play out differently across PHP versions, and makes the case that modernising can happen gradually, one update, one plugin at a time.

    If you’ve ever questioned how your hosting choice or plugin stack could affect your site’s future, or you’re ready to take the first steps towards building more secure and future-proof WordPress products, this episode is for you.

    Useful links

    Secure-by-design: hardening plugins with PHP 8.x – Milan’s presentation at WordCamp Europe 2026

    bbPress

    Dev4Press

    Freemius

     Vulnerability Lab plugin on GitHub

  • Open Channels FM: Multi-Layered Security and the Future of Hosting in an AI World

    In this episode, Adam and Aaron discuss evolving web security in the AI era, emphasizing proactive strategies, layered defenses, and the vital role of hosts in protecting websites against modern threats. Secure your online presence!

  • WordPress.org blog: Your Guide to WordCamp US 2026

    WordPress.org blog: Your Guide to WordCamp US 2026

    WordCamp US: Powered by WordPress, Driven by Community, August 16-19, 2026
    📅 August 16-19, 2026 | Phoenix Convention Center, Phoenix, Arizona

    WordCamp US 2026 returns for another year, this time in Phoenix, Arizona, for four days, August 16 to 19. It comes at a moment of real energy for WordPress, as artificial intelligence reshapes everyday workflows, the business of building and maintaining sites is shifting, and new people keep discovering the platform every day. Four tracks address this moment, covering AI, Honing Your Skills, Technical WordPress, and Beginner WordPress. Between them, there is something for everyone, whether you lead an agency, freelance for local clients, write code for a living, or are building your very first site. Whatever draws you in, you will leave Phoenix better equipped and better connected than ever.

    Get Your Tickets
    Sign Up for Contributor Day

    Phoenix itself rewards anyone who adds a day or two to their trip. The capital of Arizona sits in the Sonoran Desert and pairs a lively downtown with a rich arts and food scene. The Roosevelt Row arts district is known for its galleries, murals, and independent restaurants. It is also home to one of the largest art walks in the region. Nearby, Chase Field and the Footprint Center host professional baseball and live shows, and the surrounding desert offers striking scenery at places like Papago Park and the Desert Botanical Garden.

    Start with Contributor Day

    The week begins with Contributor Day, a full day set aside for giving back to the project that makes everything else possible. Attendees will gather in teams to improve WordPress itself, from Core code and documentation to design, training, accessibility, and translation.

    WordPress is so unique because we’re not just a product; we’re a movement.

    Matt Mullenweg, WordPress Cofounder

    Contributor Day is open to everyone, whatever your skills, and whether or not you have ever contributed before. Come and experience the open source collaboration that is at the heart of the project. Signing up in advance helps us prepare our veteran contributors and provide you with the best experience.

    Explore Real-World Projects on Showcase Day

    Day 2, Showcase Day, is dedicated to real-world WordPress projects and focuses on how teams develop features, manage publishing, and run demanding sites at scale. It brings to life the kind of work collected in the WordPress Showcase, the directory of standout sites built on the platform, from global brands like Disney to community publishers and institutions like NASA. Past WordCamp US Showcase days have brought teams from the likes of Wikimedia and CANCOM to explain how they manage large, high-traffic systems. Other sessions took a builder’s perspective on catching bugs faster with automated testing and even running the Block Editor inside a custom app.

    Dive Into Two Conference Days

    The two main conference days will bring a full slate of sessions across four tracks. First among them is the AI track, which treats the technology as a tool to handle with care rather than a headline to chase. Its sessions set guardrails for AI-assisted development, prepare for a web where AI agents become the visitors a site must serve, and weigh the legal and ethical questions of putting AI tools in the hands of clients. Speakers from companies like Elementor will be taking a look at where the web is heading, while keeping the focus on what teams can adopt today without giving up control of their work.

    The Technical WordPress and Honing Your Skills tracks cover the craft and business of building with WordPress. On the technical side, sessions dig into modern development workflows, automated testing with tools like the browser-based WordPress Playground, and plugin pipelines. The Honing Your Skills track adds practical guidance on pricing, maintenance, and how the agency model is changing as clients ask for more. The Beginner WordPress track keeps the door open for newcomers, with approachable sessions that make your first WordCamp less daunting. Hands-on work runs through all of these tracks, so alongside the talks, attendees will find workshops and working sessions where they can build something real and leave ready to apply it to their own projects.

    Not all of the value happens in the session rooms. On the show floor, the Happiness Bar is a free, drop-in help desk where you can sit down with a volunteer WordPress expert and work through whatever has you stuck. The Sponsor Hall next door is where many of the best unplanned conversations happen, and its Career Corner gives anyone weighing their next move a relaxed place to browse the job board, meet company reps, and see who is hiring across the ecosystem.

    Plan Your Trip to Phoenix

    Getting to Phoenix is straightforward. The Phoenix Convention Center sits in the heart of downtown, less than five miles from Phoenix Sky Harbor International Airport (PHX) and about 15 minutes away on the Valley Metro light rail. WordCamp US has a room block at the Sheraton Phoenix Downtown, close to the convention center, so book your hotel before the block fills, and reserve your ticket if you have not already. The full event lineup and details live on the WordCamp US 2026 site, and the conference closes with an evening social before everyone heads home.

    1. 🎟 Reserve your ticket
    2. 🛏 Find accommodations
    3. 🚌 Plan your trip
    4. 📍Explore Phoenix

    Help Us Spread the Word!

    Whether attending in person or following along online, share your experience and help welcome others to the WordPress community. Use the #WCUS and #WordPress hashtags to tell your story on social.

  • Open Channels FM: Understanding Open Source Law and AI Impacts in Modern Software Development

    In this Open Web Conversations episode, host Anne Bovelett chats with lawyer Carlo Piana about open source software’s legal challenges, AI’s impact on coding, and the importance of proper licensing and attribution.

  • Gutenberg Times: Gutenberg Changelog #132 – Proposals for Core, Calls for Testing, WordPress 7.1 and Gutenberg 23.4 and 23.5

    In episode 132 of the Gutenberg Changelog podcast, host Birgit Pauli-Haack and guest Ellen Bauer explore the latest updates within the WordPress ecosystem. The conversation centers on the releases of Gutenberg 23.4 and 23.5, the recent WordPress 7.0.1 maintenance update, and the strategic roadmap for the upcoming WordPress 7.1.A significant portion of the episode is dedicated to major merge proposals destined for WordPress 7.1 that aim to evolve the core software.

    These include “Core Abilities” for AI agent integration, the new “Knowledge” post type for managing site standards and guidelines, and “Design System Theming” to enhance consistency and accessibility via CSS custom properties. The hosts also discuss the shift toward mandatory iframing for the post editor in block-based themes, a critical architectural change designed to improve content rendering.Beyond core architecture, the episode highlights user-focused improvements such as enhanced responsive editing controls, which now allow for granular canvas resizing without preset limits. They also touch on media-related updates, including aspect ratio controls in the media editor, and improvements to the Icon block.

    With WordPress 7.1’s Beta 1 approaching, Birgit and Ellen emphasize the importance of community involvement, encouraging developers and site owners to participate in ongoing “Call for Testing” efforts. Whether discussing React 19 status or new grid layout properties, the episode serves as a comprehensive briefing for anyone looking to stay current with the rapidly changing landscape of the block editor and WordPress core development.

    Show Notes / Transcript

    Show Notes

    Special Guest: Ellen Bauer

    Announcements

    Community Contributions

    What’s released

    Post Editor iframed

    Punted from 7.1

    Gutenberg releases

    Stay in Touch

    Transcript

    Birgit Pauli-Haack: Welcome to our 132nd episode of the Gutenberg Changelog podcast. In today’s episode, we will talk about proposals for core, calls for testing Gutenberg 23.4, Gutenberg 23.5, and whatever side ideas we have about 7.1, which is in the works. I’m your host, Birgit Pauli-Haack, curator at the Gutenberg Times and a full time core contributor for the WordPress open source project sponsored by Automattic. With me today on the show, and I’m very delighted to tell you that is Ellen Bauer, product manager at WordPress.com and early adopter of block themes. Thank you for joining me, Ellen. How are you today?

    Ellen Bauer: Thank you very much. Always happy to be here. I’m great. I just landed back in Bangkok this week where we are. I’m staying here a little bit longer with my family this year from Germany, visiting family and attending a meetup. And yeah, it’s good to kind of do that travel because it always inspires me to get out of a routine. And yeah, I’m really glad I’m here now and motivated.

    Birgit Pauli-Haack: Yeah.

    Ellen Bauer: To get back into working, improving WordPress.

    Birgit Pauli-Haack: That’s a great time to spend in Germany. And I hope you had luck with the weather.

    Ellen Bauer: Well, there was this heat wave in the second week. It completely knocked me out, to be honest.

    Birgit Pauli-Haack: Yeah, that was really hard. And a lot of people say that.

    Ellen Bauer: It was great and went on the last day I went to Legoland for the first time, which was also an experience and exhausting, but great.

    Birgit Pauli-Haack: That’s here between Munich and Augsburg.

    Ellen Bauer: Yeah, I think it’s close. Yeah.

    Birgit Pauli-Haack: Yeah, between my first time. Oh, nice. Yeah, maybe I should go there too. But it is fun.

    Ellen Bauer: It is fun. Maybe not. I don’t recommend to go in the summer on a Sunday, which we did, but. Oh yeah, that’s actually really fun.

    Birgit Pauli-Haack: Family day. Yeah. So you mentioned you attended the meetup in Porto. What was your takeaway from the meetup with digital?

    Ellen Bauer: So it was actually the main reason I came to Europe for it was the first time all products meetup from Automattic in beautiful Portugal for me, also the first time I’ve been to Portugal, which shouldn’t happen to not visit before. But it was really cool. I love Portugal. Really lovely people, beautiful vibe, nice weather. Yeah, it was really relaxing, really a treat. And then very inspiring and motivating to be in the product group for the first time all together in a nice setting and we had amazing conversations. For me, I also got to know my team a little bit better because I just sort of recently switched into dot com, so that was helpful. But yeah, also a lot of meaningful, deep conversations and I’m really, really motivated after that meetup.

    Birgit Pauli-Haack: Oh yeah. So when you said meetup, I’m still in the community brain, so I thought it might have been a WordPress meetup because I spent some time. And that’s probably also the reason why my brain went there instead of the internal. Because I spent some time with meetups, local WordPress meetups in Salzburg and in Erfurt and also in Munich. I restarted the meetup here in Munich with a few of the original founders and some other people and. And it’s a totally different vibe than a WordPress conference.

    Ellen Bauer: That is true. I love meetups.

    Birgit Pauli-Haack: You meet 15 maximum 20 people and then you learn more about how they use WordPress, what they really move a normal user. So it kind of grounds you much better than kind of always being in the contributor section, kind of.

    Ellen Bauer: So that is true. Well, there was WordCamp Europe, which I didn’t attend because it was just so much. I attended WordCamp Asia, which I also loved this year. That was such an amazing experience and very motivating. And I talked to a lot of people who are meetup organizers in India and I really now want to visit one of their meetups. It sounds fun. I also visited the meetup here in Bangkok before and I love the people there, the really tight community. And I’m also. I have been thinking for many years now that I should actually start a meetup in our town in New Zealand. I haven’t committed, but I’m always coming back thinking about it. So maybe I should just commit and do that because it would be cool to have like a local.

    Birgit Pauli-Haack: Yeah.

    Ellen Bauer: In New Zealand. There aren’t many around, but it would be cool.

    Birgit Pauli-Haack: Well, the first thing that you need is a co-organizer. So don’t start until you have a second person to do that because we travel a lot. Well, I travel a lot and I cannot be at every meetup, so I need somebody else to do that. So that was kind of back of mind.

    Ellen Bauer: That’s a good advice.

    Birgit Pauli-Haack: Yeah. And the meetups in India, they’re really big. They’re 40, 50 people.

    Ellen Bauer: I talked to someone and. And they have 200 people every month on Surat. I was like, I want to come. Yeah, it’s amazing. Like, I want to visit.

    Birgit Pauli-Haack: It’s a small word camp for an evening kind of thing.

    Ellen Bauer: That is so true.

    Calls for Testing

    Birgit Pauli-Haack: All right. Yeah. So work for 7.1 is progressing and there are calls for testing out, and this is the first time that there are so many out there. There are five of them. And if you want to learn what’s really in 7.1, there’s no better way to take a deep dive and heed the call for testing.

    So there’s a call for testing for the responsive styling and yes, it’s coming to WordPress now. And then there’s a call for testing for the new modal media editor that opens up when you click on the crop icon in the toolbar of an image block or a cover block. And then there is the call for testing for the client media processing. That’s a feature that comes to 7.1 where the client, the browser is actually doing a lot of work in uploading the upload side of the image uploads and the resizing and then dumps it into the WordPress media library.

    There’s also a real time collaboration outreach effort that is also a call for testing. And then there’s a call for testing for getting Unicode into email addresses. And that’s kind of fun too. So the testing has done an amazing job putting those calls for testing together because you get instructions on how to use it and videos to show you how to use it and then the instructions also for the testing. So your mental work on how do I test this is already done. You’re just going to follow the script and, and then have room in your mental room to observe your feelings for whatever you’re doing and kind of try to, to verbalize them and share your feedback. So it’s really interesting and I hope you dear listeners are going to heed those calls. One or two of them. You don’t have to do all of them. Yeah, I don’t grade you, but there will be a test. Yeah.

    Community Contributions

    Then there are also two. Well, I said two, but there are actually three merge proposals from the contributors. There’s new things coming to WordPress Core. One is expanding the WordPress Core abilities. It’s a merge proposal to add three read-only abilities to cover the settings, content and users for AI. And it gives AI clients real tools to call so the agents can understand what your site’s configuration, post and people are doing. There’s a discussion should this be in core, should this be a plugin and all that you can read up on the post. And the second one is also for AI is the guidelines to build knowledge on your website. Yeah, what’s your tone about what’s the tone of voice, the expression, what the topic is about and what the members are, what the standards are and all the notes for revision and capabilities. So an AI agent could follow those instructions as well.

    And for people who manage multiple sites with one AI they can actually it’s different for every site. So it’s really important to have that on the site to give that that’s a new content type and new settings pages for these things. So you can even use your AI to update those guidelines. There’s one thing and then of course the last one is the bigger one and that’s a merge proposal for the design systems theming Andrew Duthie published a merge proposal bringing design tokens and new theme components to WordPress built by the Gutenberg Components team. But it turns the hard coded admin styles into CSS custom properties so your plugins and screens stay consistent and accessible.

    Then a color ramp tool generates harmonious accessible scales from just two seed colors and the user color scheme reaches the site editor which will come into I think 7.1. So with a dark mode on the horizon. So it’s a good time to get involved in the discussion now, dear listeners, and to make your point of view listen to and converse with others on the impact for you and your business and for your clients because that’s where the decisions are made. Some of them are already made but they are loosely held, so to speak.

    There’s a whole aspect of WordPress is we have strong opinions but they’re loosely held. If you have a good argument and you have a good use case or a different point of view, you are listened to. Of course if aired respectfully and even if it’s not respectful it should be because we all want to do the same thing. So the links to all the merge proposals and calls for testing will be in the show notes. You get to pick what you are interested in and so that’s a whole thing that happened in the last three weeks when we didn’t have a Gutenberg change log. So I wanted to catch you up. Any thoughts on that Ellen, that you want to share with our listeners?

    Ellen Bauer: I think on the merge proposals but I think for the calls for testing the responsive styling of course sticks out to me because we have been calling for that for so long and the user the feedback was always there like what is that without responsive styling? So now here it is. So yeah go ahead and test it and I will do the same and kind of contribute to make it better or improve what. What we can. But here we go. We finally have. I think the number one ask always this is missing in Gutenberg.

    Birgit Pauli-Haack: Yeah. I think the number one ask is not the responsive design because Gutenberg is responsive in certain areas. It’s a viewpoint. It’s a media kind of thing. Yeah. So what is a tablet? What is a mobile. And to change things for those screen sizes. And there was a big hesitation and there’s. On the developer blog, there’s an article about intrinsic design that’s built into Gutenberg. And I think the thinking was, okay, intrinsic design is what comes after media queries. Comes after. So because we need to also talk to what is component in the container queries in CSS and all that. And at the start of Gutenberg people wanted to push the envelope of intrinsic design and then see what’s missing. And. And now we know where it all goes and how to. To change it. And there is a. Yeah, we talk about it a little later when we come to that. Yeah, but so that’s kind of. That part why it took so long, I think was the reason why I kind of went on the drain there.

    Ellen Bauer: That is true. I’m glad that we didn’t do like earlier versions of it. It seems late, but yeah, there’s. There’s a reason.

    Birgit Pauli-Haack: But I think, yeah, a lot of plugin companies actually filled that gap quite nicely. I also saw a few implementations where you didn’t have three viewports or breakpoints, you had six, so. And I kind of couldn’t imagine that a normal user can keep in their head six different sizes to control the styling and when something needs to be changed to find it again where that actually was changed. I get the hesitation. So yeah, yeah..

    Ellen Bauer: You quickly go a little overboard with that. And I’m also glad that we didn’t do that on the core level.

    What’s Released – WordPress 7.0.1

    Birgit Pauli-Haack: Yeah. So that brings us to what’s released and it’s release week kind of thing. So on Wednesday and we’re recording this on Friday, July 10, Thursday, July 9, WordPress 7.0.1 was released with bug fixes from the major release. And the release candidate announcement has a list of all the fixes in track and from the Gutenberg repo,

    I’m preparing an article for the Gutenberg Times. I will probably put in the show notes about what the fixes actually did is the WPKSS or however say that CSS corruption on some of the admin design glitches and some more. So you can have a summary of that. Yeah.

    On Wednesday, just the day before 7.0.1, a user ask in the core channel, what is. I see all the communication. Yeah. What is the latest version actually, and at that time it was still 7.0, but we say but tomorrow it’s going to be 7.0.1. 7.0.1. Yes. Yeah, yeah.

    So 7.1 last month Anne McCarthy posted the roadmap 7.1. It was aspirational and also very concise with an outline and links to the tracking issue for the many features contributors have been working towards. Beta 1 of 7.1 is scheduled for next week. That’s July 15th. And by then we will know the full picture of what made it and didn’t make it into the release features from the Gutenberg plugin releases 22.6 through 23.6 will come to 7.1 unless they’re behind an experiment flag or plugin or plugin only as guardrail 23.6 release candidate. And that’s what’s getting into the beta version is on July 14, so one day before the beta version, because that’s where all the NPM packages are created and all the things get into the branches. Right feature branch.

    The final release of 23.6 is moved to July 22nd. That was kind of decided by the release tech leads to get it all just in time for beta and organize that. So the deadline for enhancement into the plugin on 7.1 is July 14, the day before beta. So if you’re a contributor and you want to get the feature that you were working on in this weekend is probably crucial because it also needs to be reviewed and approved. So give people time to get in there.

    So yeah, what should be on your radar for 7.1 is the mandatory iframe of the post editor. We mentioned it before. It actually has also a lead time to come to this point is the post editor runs inside or the block editor should run inside an iframe because it isolates the content from your admin styles and makes the viewport units and media queries work correctly against the editing canvas rather than the browser window. And in 7.1, iframing becomes more enforced for block based themes or for all themes because it ensures that canvas behaves predictably and the blocks render accurately for both the post editor and the site editor, template editor and pattern editor and plugin developers.

    So plugin developers who have not updated their Block collections from version 2Block JSON version 2 to 3 should actually upgrade to make this all work. If you want to catch up on the newest discussion, there’s a Gutenberg PR that’s called Always the post editor for book theme. And that’s the 79819. And if you put that in your playground, you can actually add some of the plugins or your staging site, or add it to the staging site, then you can test your things. I think the biggest problems are sites that are maintained by people that do not read the make blog or do not listen to podcasts or read blog posts about their site or the software. And those are sites that haven’t been maintained for a while, otherwise they would have already upgraded things. Yeah.

    Ellen Bauer: So block themes need to do anything too. They haven’t. No. Right.

    Ellen Bauer: I haven’t looked into that.

    Birgit Pauli-Haack: It’s a problem for blocks. Yeah.

    Ellen Bauer: That are in the block plugin collections.

    Birgit Pauli-Haack: Yeah. That only. They were only meant for post editor and have never been used inside editor or something like that. Because those would have broken already. Because the site editor since 2020 kind of uses an iframe version. So if you use the block in a template or use the pages thing from the site editor, the pages administration from the site editor, you will know when the block breaks. And in the post editor, if you go into the console, you see the notification that it’s going to be deprecated. But if you’re only in the post editor and never look at anything else and those blocks might break if they’re not updated.

    Ellen Bauer: What should they do if this happened to them?

    Birgit Pauli-Haack: There are some guardrails in place and there were two PRs. That one is the hard kind of, okay, we do all the iframe insight and that’s going to be in beta. And in beta, listening to the feedback will decide if there will be a switch to the other less hard choice there in terms of saying, okay, if it’s a block theme, it’s going to be an iframe post editor. But if it’s not a block theme and. Or if there are blocks on the page that are on the old version, like the version 2, then it will not be iframed, but that is subject to change. It’s kind of. There’s a trial and error kind of process here to figure out what is the best way move forward. Because the first post blog post about that was actually published in June ‘21, so five years. And then there was another one in November 2025, and there was another one in February ‘26. So there is a lot of leeway or runway for agency developers and plugin developers to kind of update, but sooner or later there will be a push to make it final and then deal with the consequences. Yeah.

    Anne McCarthy’s roadmap included two updates that we already know have been already punted. So that’s the update to React 19 and the deprecation of the classic block. Those things have been punted. And there are blog posts on the make blog for the reasons and next steps for that. It’s pretty much the classic blog where there was a lot of communication around it that said, okay, maybe it’s not a good time yet. And for the RAC 19 there were too many backwards compatibility issues, but it’s going to come. So it just needs a little bit more runway to get final to that point. All right. Any thoughts about that?

    Ellen Bauer: Not really. I’m excited for 7.1. I think we haven’t mentioned the release time. Is that still planned for WordCamp US and like August 19th.

    Birgit Pauli-Haack: Yes, the planning is July 15th being beta and then August 5th being release candidate and August 19th final release on the last day of WordCamp US.

    Ellen Bauer: Okay, cool. I’m excited.

    Birgit Pauli-Haack: Yeah, I’m excited too. There are nice features in there and there are nice updates to the site editor there and I’m very excited about that.

    Gutenberg 23.4

    And now that brings us to Gutenberg 23.4. Let’s go and talk about things.

    Ellen Bauer: So that was released June 17th. We’re also going to talk about the next release 23.5 right after. So let’s start with this one first.

    So I think the most exciting things in there are related to media. And the first thing that is pretty exciting is if you load media into the post editor, you now get like a little notification snack bar that kind of tells you the progress of your uploads. Like if you load dump, just dump in like 20 images you’re going to see. And you also I think timed first image, second image, third image. We are used to it, I don’t know from apps and stuff. So I think that is really, really helpful to see the progress of the loading there.

    Birgit Pauli-Haack: Yeah. And Adam Silverstein did an amazing job to get this all done. There’s a second one that also that the upload process is now enabled. So when it’s interrupted because you’re offline or something, it also resumes automatically the upload on the when the connection returns. So this would save quite a few hurry up and wait kind of thing. When you’re maybe on a train or in a country where you don’t have stable Internet connections to upload your media.

    Right now, I only highlighted that because it’s in the same thing that the client side media processing is now geared towards 7.1. So the plugin’s only guardrail has been removed and it can be merged into WordPress.

    Enhancements

    The next one is the playlist block. It now has a visualization style selector so it has the playlist lock. When you try and test it, you’ll see there is a visualization kind of where the music builds some animation on top of the track and you can select the styles now for that. And also it now has a track length setting so you can set up the settings for that as well.

    Ellen Bauer: Another thing I kind of liked because I’ve built that before is if you have, I don’t know, on a WooCommerce theme or something, if you want to have the log out log in or for any other kind of purpose, you can now get that into an inner block of the navigation submenu. The lockout lock in. That wasn’t possible before. It’s a small thing but very helpful for whenever you want to have that in a drop down or sub menu.

    Birgit Pauli-Haack: Yeah. If you have a membership site or subscribers only content and you. You offer them a nice accessible way to log in and log out. There’s a very minimal change, but you might need. You will notice it. It’s the time to read icon has been renamed to time. So it’s not. Might be getting rid of redundancy, but I’m not sure it’s even clearer. It’s clear enough. So yeah, that’s the change.

    Ellen Bauer: Yeah, I think that’s mainly kind of to reuse it, to be able to reuse it for more things. Right.

    Birgit Pauli-Haack: Yeah.

    Ellen Bauer: Another thing that I think is a little bit bigger and quite helpful is that now it’s possible that columns and gallery blocks can be transformed into grid variations for layout styling. I think that’s kind of cool. I think I wanted to do that many, many times.

    Birgit Pauli-Haack: Yeah, me too. Because I forgot that I have a grid block and I tried to do things with the columns block.

    Ellen Bauer: Yeah, yeah. So often you kind of start out in a column and then you realize no, that should be a grid.

    Birgit Pauli-Haack: And then again for the media. But this time it’s out of the block editor. The media editing modal has changed and it has some new features, better features, new libraries. And we talked about it before on this podcast. But now you can reorder the details field has been reordered and then now you have aspect ratio controls for the mobile toolbar and they refactored a little bit the modal layout in total. But this is a great, great tool. So these are all just the usability issues. The main feature was already in 23.2 or 3 and there are editable attachment fields. And the mobile tool. The mobile toolbar has been updated to include the aspect ratio controls. Also uses the zoom uses now plus and minus buttons. Yeah. Instead of the spyglass.

    Ellen Bauer: Oh yeah. That is actually very helpful an update on the dashboard. And you maybe have to help me out if I’m not 100% sure if I understand that correctly. So we always had the grid columns and now they are opinionated. So pre designed responsive. Is that correct if I say that like in your dashboard, like the two columns, I think it’s maximum four columns. It doesn’t go more than four and then it reduces like it nicely responsive by default, right?

    Birgit Pauli-Haack: Yeah. It goes from 960 desktop width, so four columns to two columns between a tablet kind of size, between if it’s smaller than 960 to 600 and if, if it’s smaller than 600 or 600 and smaller, it’s going to one column and has a mobile kind of view there. So it’s definitely responsive. But that’s the dashboard. It’s about the admin dashboard. It’s not in the block editor. So that grid has nothing to do with a grid block in the block editor. So we have a little issue there with using the same words for different things. But that’s because it’s all grid based. But it’s a good thing.

    And contributors have an experiment on redesigning the dashboard and also let blocks going in there and all that. So it’s. It’s quite interesting to see that there are more additional features in there like this day before. Right. So if you’re in a block, you can. They’re figuring out how to put the previous day and previous years. So if you have a blog for 30 years or 10 years, you. You get. Or even five years. Yeah. You get a notification, what you published about this time of year, last year or something like that.

    Ellen Bauer: Yeah, I like that.

    Birgit Pauli-Haack: And that was actually kind of nice.

    Ellen Bauer: It kind of embraces your blogging history.

    Birgit Pauli-Haack: Yeah, exactly.

    Ellen Bauer: One actually kind of cool little change that I really like is in the site editor now. The admin color scheme, if you select another one, get translated into the site editor. So I know a lot of people always say, oh, you go into the site editor and it’s this black different looking user interface. And yeah it’s. Why is it so dark? So now it kind of adopts the color scheme you have selected. And I think this like part of bigger work going into kind of making the interfaces more be like one thing instead of.

    Birgit Pauli-Haack: Yeah. The unification of the admin interface is also a long time coming and I think that’s a, that’s a fantastic step. Yeah. To kind of just make it sure that if you have a green sidebar that it’s also green in the site editor.

    Ellen Bauer: Yeah. Because why, why wouldn’t it be?

    Birgit Pauli-Haack: Yeah. So on the client media side again, the ultra HDR JPEGs that are detected by upload and then the originals are kept unmodified and the sizes subsizes. They preserve their ICO standards. So you have a better quality of the Ultra HD but it also handles the bigger sizes. So it’s a nice addition to the media upload feature that we talked about before.

    APIs

    Ellen Bauer: And then we also have an update on APIs. Oh, God. You have to help me with this one. I read it, but now I’m kind of like what was that about again? The future it will help.

    Birgit Pauli-Haack: So it tracks per entity, the view configuration for pages. And then so it’s about the pages of pages, posts, patterns, template parts, templates and have their default layout in the grids being the, the layout grid in the admin. So when you’re in the site editor you have a choice when you look at templates, what kind of layout. You have a grid layout, a list layout and these kinds of things. And now there is actually an API that you can extract that view configuration for several other things. If you’re plugin developers, you can then replicate what the, what the priority is or what the preference is for your user. And you see that in the rest API when you pull out the information and display it again, that you get the configuration with it. I don’t know.

    Ellen Bauer: So you can practically kind of unlock whatever the configuration was in default and then use that in a plugin or something, right?

    Birgit Pauli-Haack: Exactly. Yeah.

    Ellen Bauer: The same screen.

    Birgit Pauli-Haack: So when you. One use case could be if you are using WordPress as your content container, but have another application that displays things as a headless or in another. In another admin content management system that only talks to WordPress with all and pulls out the things that are in WordPress and measures it up with other data that’s also in the system, then you are able to display the same what the user sees in the WordPress admin, you can display that also in your system at the same time. So that kind of would be one of the use cases that I just made up.

    Ellen Bauer: Yeah, that makes sense and very good to explain in that way. What else do we have next?

    Experiments

    Birgit Pauli-Haack: So the dashboard we talked about that now has also an events widget that can be filled.

    Documentation

    I wanted to point out one documentation thing that is really a big deal that Juan Margarido has taken on in April or May and push that through a merge now with 23.4 and that is the auto generation of the per block API reference from the block JSON files.

    So, until now it was really hard to figure out, okay, what’s the block markup and are there all the supports in there? Because the documentation was handmade. So if somebody updated a block’s configuration and block JSON and added support to it for other things, it would not show in the documentation until someone touches the documentation page. And for 90 blocks or so that are in core right now, that’s a moving target and fast moving target. So he proposed to go in and auto generate that documentation page for humans and AI to map multiple things.

    So one is the parent relationship with other blocks like think accordion block and the sub blocks there, the attributions in the table, in a table that what the block supports and with links to explain those features. So if you don’t know what the alignment or support of a block is, you can look it up right from there and then what block styles come with core so you don’t have to figure that out from the interface. So like the button comes with two styles, one is the default, the other one is the outline style. Then which CSS selectors are automatically created and then an example of the block markup. And last but not least, also the links to the source of the information and the packages. So you have a full 36-degree view on the block. And because the documentation is auto updated, it comes right there when the new features are kind of added to the block and it will be shown in the documentation.

    This not only helps the developers and theme developers to have a better handle on or one lookup page or section in the documentation, it also helps AI agents to form a comprehensive space to learn about WordPress blocks. Because I have found that AI sometimes just does a custom HTML block and puts it all there instead of using a column block or cover block or something like that.

    So this is a very big deal because that’s something where AI elevates human capabilities because he used AI to run the code that parses the block JSON and puts it into the documentation page and then also has that documentation page from the GitHub repo into the developers.wordpress.org document block editor documentation automatically merged there. So this is a big deal. And kudos to Juan Margarido. He also spent some time getting some community input from the documentation team from the Gutenberg leadership. We had a hallway hangout with a Q and A and it finally was merged now. So kudos.

    Ellen Bauer: Yeah, that’s pretty cool.

    Gutenberg 23.5

    I think now we’re moving to the latest release, 23.5, released July 1.

    Enhancements

    I think the first thing we wanted to highlight was that the design system token defaults now with out a runtime which practically, as far as I understand it correctly, helps that all the styling from the design system is just there by default. There’s nothing that got missed. Is that correct? Yeah, because it happened before that some design elements were in style.

    Birgit Pauli-Haack: Exactly. Yeah. It’s now available as public export. That’s pretty much so you can use it in your own apps that you put into apps. I say it’s also called plugin, so you can use it without having to import it into your plugin via NPM and these kinds of things via the build process. So you can just import it into your app here.

    But I also want to point out again the match proposal for the design system. Everything there is kind of in a holistic way explained and also what it’s supposed to come to. And these are all plenty of the component work that’s done for 23.5 and released or merged is actually in support of the design system and the UI revamp of the components.

    Ellen Bauer: I think about the block library. And we have a few other updates in the release. The first one is that the viewport states and the controls are now support for they supporting aspect ratio and all the related controls with that.

    Birgit Pauli-Haack: So I think yeah, it’s part of the styling system. Yeah.

    Ellen Bauer: For image blocks featured image block media library also no, no background images. A background cover image and cover block, yeah.

    Birgit Pauli-Haack: Also yeah, okay, that’s the viewport states is the name that they give the responsive editing screens. So those controls are now also available.

    There’s also a line item in the block library section of the changelog about the classic block to hide it from the inserter that has been reverted. That’s part of the blog post that I mentioned earlier that was published after the release of 23.4, so I wanted to point that out.

    The next one is that the media editor modal is now available also for the cover block that comes with that. I think I mentioned that already. But now when you have a cover block with an image, you can also use the media editor modal to crop it, to rotate it, to tilt it and all that kind of things.

    Ellen Bauer: That’s a nice add on small but also visually really nice to have is that the icon block now has controls for flip and rotate the icons, which is very nice to have like a. One of the things you like kind of expect to be able to do and then it’s super difficult. So now you can do that. And then it also. What is the second one about?

    Birgit Pauli-Haack: Oh, it just adds a default placeholder instead of to the blockchain.

    Yeah. So there was also a big push to have text alignment support for some of the text blocks. And now the block quote. I think there were seven or eight blocks that have that again. This time there was missing text align support and that has been rectified. So now you have also text align support for the block quote.

    Yeah, that was one thing that threw me quite a bit and quite often I always went back to the quotes block. But a quote block and a pull quote have different use cases and a pull plot is an excerpt from the article and you couldn’t make it not centered. It was kind of odd that you couldn’t left align it. Which is my favorite. Yeah. Centered when you have more than one word in the center, you hardly can read it. Or more than one line. Yeah. So I always wanted to be left aligned and I can’t quote just a sentence. Yeah. So I’m really great that they have a text aligned support now that makes sense.

    Ellen Bauer: It’s these little things that kind of throw you, throw you off if you don’t have them and you’re like, why can’t I then? I think one of the biggest things in this release is that the resizable editor now it’s like fully resizable. You can drag it along. It’s not just mobile, tablet, desktop, you can get your own size and preview it. I think this is one of the biggest releases in this. In this update 23.5. So can you do anything else? You can resize it.

    Birgit Pauli-Haack: Yeah, yeah. It has a handle though. You can resize it. So you have a handle to make it smaller but not as small as mobile. So you can see if. If somebody uses a tablet whatever and odd width you can kind of test it if, if your settings actually work there or your. If the. The layout is there. But you cannot change the viewports themselves. Yeah. They are not customizable. It’s just so you can see the preview there. Yeah.

    Ellen Bauer: Which is very helpful like visually.

    Birgit Pauli-Haack: Yeah. Especially when you get a call and you don’t have that device on hand. Yeah. That a client sees or a client has a complaint from their clients that something is wrong on the view. You can just kind of tested in the block editor without having the device on hand.

    But there is a long standing request to be able to change the viewport numbers and because right now they are hard coded to I think 768 is the desktop and then 467. Yeah. 468 is the tablet and or between there is tablet and then below is the mobile. But there is good news. There is coming with 23.6. It’s already merged is in PR where you can change that via the theme JSON. So theme developers are now able to change viewport numbers for their sites. There is no UI yet for it. But that’s typical. That theme JSON is first. So theme developers can test it out and can actually use it. But for the UI you need a little bit more information how things are going and how users would work with it.

    Ellen Bauer: And there’s also been a smaller change on. If you add a note that just. It’s simplified how the show more or less collapse works. If you have a long note you want to collapse it and show more or less. I think that just has been reworked or simplified.

    Birgit Pauli-Haack: Right.

    Ellen Bauer: I don’t think it’s anything we see on the user side. Right. It’s more in the background. Yeah.

    Birgit Pauli-Haack: It’s just faster. Yeah. It’s kind of that. Okay. Mostly performance issue. Yeah. You’ll see a slight change there.

    There is the experiment of the omnipresent toolbar which is pretty much the admin bar. In the editors you see the admin bar, the black admin bar on top of the screen when you’re logged in and you look at your website from that perspective and you also in the post editor you see the black toolbar but you couldn’t in the site editor or in the other editors. So now the experiment is to show it but then also unify the interface because the design view or the site editor has its own W to go back to the other admin. And when it’s in the admin bar you just click where you normally click to get to the site. So it’s all unification of the interface pretty much. And now you can see the site icon instead of the dash icon if you select it as well in the toolbar. So there has been an ongoing effort and some of it might come to 7.1. It’s on the roadmap for the admin bar everywhere, so to speak.

    Ellen Bauer: I think one thing that I remember I struggled with quite a lot is the flex behavior of children. So now there has been.

    Birgit Pauli-Haack: You mean your child? Well, it’s not the flexibility of toddlers.

    Ellen Bauer: The Flex elements. I love flexbox CSS always have. But I think we always had a problem that they weren’t behaving like exactly like CSS. Flexbox should behave. So now one of the changes has been that so flex children that had a fixed width, this is now like truly fixed. I think it was squishable before. Can you say that? Is that correct? And now it’s like a truly fixed width to zero. So I think that’s one of the things visually that helps a lot. And then the other one was grid layouts now have fill available space, toggle. Is that correct? I think it’s just a toggle in the settings. Right. That you can toggle on and off and then you have auto fill and auto fit behavior. Okay. And this behaves exactly like CSS grid behavior.

    Birgit Pauli-Haack: Yeah, you would expect. Yeah, that’s pretty nice. There was some. Some quirkiness to the grid block and the grid layouts and I’m glad that Isabella is working on that constantly to improve it and to get back to it.

    Ellen Bauer: Yeah, she’s doing great work. I met her live at WordCamp Asia this year and it was really pleasant because I love flexbox Grid. I always love these blocks and CSS settings and they never quite worked. How I or like went into that depth, I wish they had. And yeah, she’s. I think, like, she has the same opinions, so it was a good chat.

    Another thing that is kind of cool and fun to have is that now global styles allow text shadow settings. So, yeah, there’s these options of text shadow, if you ever want to use that in like a cool, fun design or. So now you can set it in global styles, which is really cool. That wasn’t possible before at all, I believe. Right?

    Birgit Pauli-Haack: Yeah.

    Ellen Bauer: Right.

    Birgit Pauli-Haack: It’s a new style support.

    Ellen Bauer: I really like that.

    Birgit Pauli-Haack: Yeah, I tested it and it’s really nice. There are some presets in there that come from core, and I still need to figure out or find out how you can switch off some of the styles and how you can add your own styles like you can do with the shadow box. The shadow box has a feature that you can switch out the core styles with your own styles or just switch them off, but you definitely would need that for the texture as well.

    Ellen Bauer: Maybe we will add that.

    Birgit Pauli-Haack: Yeah, it’s not there. It’s the first version and the first version is pretty much a minimal viable kind of setup. Yeah.

    The next thing is again Media Editor modal. It now has some error states. You can magnify the crop to fill the canvas and the current post always includes the initial options. There are also minor fixes, but that is because it gets ready for 7.1 release. So every aspect of it is actually and comes from feedback from the call for testing. The call for testing was actually already issued in I think in May. So it’s already a month in or two months in. So there is already some feedback coming back.

    The data layer has a feature for the real time collaboration or many features, but one of them stands out is that you can disable collaboration per post. So if you have maybe a recipe or a book post type and you don’t want anybody to collaborate with you on that, you can switch that off. It’s probably best for very visual post types or it’s also necessary for template parts or for navigation. Those are also post types. You can control that now.

    So there was a for a while in the text controls there was a prop to have the next 40px default size and there was underscore. Underscore was an experimental property and that now has been made the default. So if you had a 36 before or 32 on the default size for the text box, then if you wanted to be in the same realm as WordPress itself, you had to use the underscore next 40px default size prop to have the same sizes of the controls and now those are default now. So you don’t have to do this experimental prop to use but it will change how things work. So you might want to, as a theme developer or a plugin developer, you probably want to check your plugins, your text control components, how they change behavior or at least the default layout. So that’s why I’m calling that out here in the episode.

    And also a similar thing is known that 23.6 Gutenberg 23.5 bumps. The minimum required version to install the Gutenberg plugin is now 6.94 versions 23.5 and newer. So if you are on 6.7 or 6.8, you are not getting the newest version of the Gutenberg plugin. So I think. Oh, there’s one more. Did I overlook something?

    Performance

    Ellen Bauer: No, I think on performance you highlighted that blocks migrate markdown converter from showdown to marked. And what does that do?

    Birgit Pauli-Haack: It actually is just performed faster. Yeah.

    Ellen Bauer: Oh, yeah. Okay.

    Birgit Pauli-Haack: And it also has a different parser, so it might have a say. It’s G. What’s it called? GTM. There is a standard for markdown that comes from GitHub and it now adheres to that standard. Yeah. So that’s updated. It’s a minimum change most people wouldn’t even need to do. But if you copy paste something from GitHub or from other Markdown editors or from your AI agent, it’s a different parsing process.

    Ellen Bauer: I just researched that and it said that the previous one was like from 2018 or so and this is just like a faster newer version that we updated to. Okay, that makes sense.

    Experiments

    And then there was one last highlighted thing on the block library unwrapping. Classic block migration notice experiment.

    Birgit Pauli-Haack: Yeah, that’s part of the effort to the classic logic. But that has also been reverted so it will not announce that this is deprecated. So it’s important to know that that line item in the change log has been overwritten already with a newer version that comes to 23.6 on July 22.

    Various

    Ellen Bauer: And there was another small update on icons to self declare icons color on the icons block.

    Birgit Pauli-Haack: Oh, nice. Yeah, I overlooked that. I got lost in the changelog already. So.

    Ellen Bauer: I mean there were a lot of these smaller things.

    Birgit Pauli-Haack: Oh yeah. So if you have an icon, it can say I’m. I’m only in blue or something like that. What does it mean, the current color?

    Birgit Pauli-Haack: Oh, current color. Yeah, of course. Duh. Yeah. I was still stuck on tab sync finally second the tab sync because it’s the. For stabilizing it to come into 7.1. The tabs block is still under active development until July 14, so don’t start building on it yet because there’s API cleanup and refactoring going on where the contributors try to nail down the final version before it gets into core. Yeah, that’s the end of it.

    Ellen Bauer: Wow.

    Birgit Pauli-Haack: Yeah, we still had a lot to talk about, Ellen. Yeah. So apart from the responsive styling, are you excited about some things that come to 7.1 in the near future?

    Ellen Bauer: I think for me, being like a Visual X thing builder or and working on blocks, I think responsiveness is a big one and I’m excited to see how. Yeah. How we just kind of improve things. Also, I like that we are looking more into the dashboard and finding ways to unify the experience. I think this is one of the things that always come up that it looks kind of like two different versions, partly outdated. And I think we need to move along and kind of come to maybe not make everyone happy, of course, but come to a compromise that we can all live with and then move forward. I think this would really help WordPress to kind of shine in a way that it doesn’t look outdated or not like one product. I think if we can come together and do that and push for that change, that would be really, really helpful for all of us and for everyone and for WordPress. So I’m excited to contribute and help to make this happen.

    Birgit Pauli-Haack: Awesome. Awesome. Yeah. Yeah. I like the new blocks that are coming. Of course. I have been a fan of blocks since the beginning of the block editor, so I like that the playlist block and the TAMS block. And finally. The table of content. There is an effort to actually have the table of content come to WordPress. Right now. It’s only available for years in the Gutenberg plugin.

    Ellen Bauer: I didn’t even know. I thought it would be in.

    Birgit Pauli-Haack: Yeah.

    Ellen Bauer: Even small things like rotating icons and stuff like that or having them be the current color and all these grid and Flexbox things. They. We need these things. I think it’s still very, very important to have professional settings like that available.

    Birgit Pauli-Haack: Yeah. And this is a visual person. You’re probably also happy that you now can have in the group block. Background gradients. Gradients. We all love gradients. I love gradients. I love gradients. Yeah. And there’s these kinds of things.

    Ellen Bauer: They’re like, why aren’t they there? And so responsiveness. And I think just of kind of growing up Gutenberg and the editing experience.

    Birgit Pauli-Haack: Yeah.

    Ellen Bauer: Seems. And even like with AI helping on a lot of things and being able to patch CSS and stuff on onto things to make things better that we don’t have. I think it’s still important that we aim for a really high quality experience in manual editing so people find what they’re looking for and are not frustrated or get lost. I think that’s just the quality we want to stand for and have in WordPress no matter what.

    Birgit Pauli-Haack: Yeah.

    Ellen Bauer: I think the standard should like, should be. We aim. Should aim for that as being just there for people, for users.

    Birgit Pauli-Haack: I think we. We develop, as I say. Yeah. Are kind of really immersed in this AI grace and hype and also the possibilities and the usefulness of AI in our work. There is a danger that we forget that WordPress users that are writers or publishers actually are not using AI to do their work on WordPress. So we definitely need a delightful interface and all these small changes, quality of life changes and the big changes like the responsive editing and the dynamic galleries and whatever is going to come. The modal editor, the media editor needs to be delightful and useful for humans that are kind of having fun and producing more content for the Internet that is kind of. Yeah. Eating it whole, so to speak, with AI.

    Ellen Bauer: Yeah, yeah, I love that too. Delightful is a beautiful word to use. Yeah. We want to delight people using WordPress and this should be our aim. AI or not, like in whatever. We have to meet users wherever they are, however they want to use the tool. It shouldn’t be, oh, we can leave this stuff now because everyone uses AI. I think if we have a user interface, it would be delightful. If it’s not yet delightful, we have to make it delightful. And AI can only help us to do that because we can contribute faster, we can move things faster. So let’s use AI for that, to delight users to meet them wherever they are for everything we offer, and we do offer a user interface. So here we are with some work to do.

    Birgit Pauli-Haack: I think that’s a good end of the show today. Thank you so much, Ellen, to be on the show and walk with me through those changes that are coming and if people want to reach you, how is a good way to reach out to you.

    Ellen Bauer: So I am in the community Slack WordPress community Slack. I’m also on social media, not that active to be fair, but reachable anytime. I think for WordPress community, the community Slack is the best place to reach me. But if you look at my name, Ellen Bauer, you can find me online on all kinds of platforms and I’m oh, I’m actually revamping my Manu and my Little Elmo Studio blog. So there’s going to be a new design and I’m really excited to get blogging again. Also doing a lot more like a few more YouTube videos. I have some ideas for that over the summer month now. So, so wonderful. Yeah, I will share if I have some news on that. Look out for Ellen or Elmer Studio and just reach out anywhere.

    Birgit Pauli-Haack: Excellent.

    Ellen Bauer: Yes, I’m always excited to hear from you.

    Birgit Pauli-Haack: Wonderful. Thank you so much, Ellen.

    Ellen Bauer: Thank you for having me. Birget, you’re welcome to be on the show.

    Birgit Pauli-Haack: It’s delightful to have you to overuse that word.

    Now, dear listeners, the show notes will be published on GutenbergTimes.com podcast this is number 132, 132. And if you have questions and suggestions or news you want us to include, send them to changelog@gutenbergtimes.com that’s changelog@gutenbergtimes.com thank you all for listening. And until the next time, goodbye.

    Ellen Bauer: Bye.

  • Gutenberg Times: Roadmap 7.1, Gutenberg 23.5, Responsive Styling, Migration to Block themes — Weekend Edition #368

    Gutenberg Times: Roadmap 7.1, Gutenberg 23.5, Responsive Styling, Migration to Block themes — Weekend Edition #368

    Hi there,

    After a four-week break — courtesy of a sciatic nerve with strong opinions — I’m happy to be back in by office chair and in your inbox. There is plenty to catch up on.

    Beyond the updates on the new WordPress and Gutenberg versions, you’ll find stories below from WordPress veterans on migrating to and working with block themes on client sites and dive into more complex theme solutions or

    Don’t let me keep you from your light summer reading.

    Have a splendid weekend ahead!

    Yours, 💕
    Birgit

    Developing Gutenberg and WordPress

    The team around release lead Aaron Jorbin pushed WordPress 7.0.1 Maintenance release out the door to update millions of WordPress sites. The update covers 17 Trac tickets and 14 Gutenberg PRs. The full list is available in the RC 1 announcement post from last week.

    In WordPress 7.0.1 Fixes Registration Spam, wp_kses() CSS Corruption, and 7.0 Admin Design Glitches, I cover the most important fixes for end users and developers of this release. You’ll learn how the registration-spam loophole got closed, which admin design glitches were sanded off, and why developers can finally remove their wp_kses() CSS workarounds. Update your sites soon if auto-updates aren’t enabled.

    Ryan Welcher compiled What’s new for developers (July 2026), and it’s all about the 7.1 cycle getting real: Beta 1 lands July 15, final release August 19 at WordCamp US. You’ll want to test responsive styling, the React 19 runtime flag, and Unicode email addresses now. Also on your radar: merge proposals for Core Abilities and Guidelines, the 40px component default, icons inheriting color, and Playground’s MCP support.

    🎙 The latest episode is Gutenberg Changelog #131 – Gutenberg Plugin Releases 23.1 – 23.3, Calls for Testing for 7.1 and more

    Berislav “Bero” Grgičak announced what’s new in Gutenberg 23.5, released July 1. The headliner: you can now drag the editor canvas to any width, with the device preview dropdown and resize handles working together for responsive editing. The experimental Media editor gains a magnified crop canvas, pixel-snapping handles, and Cover block support. Also notable: text shadows in Global Styles, flip and rotate controls for the Icon block, and a minimum WordPress version bump to 6.9.

    For the next episode of the Gutenberg Changelog, I sat down with Ellen Bauer to chat about what’s coming next for WordPress. We dug into the latest Gutenberg plugin releases (23.4 and 23.5) and the recent WordPress 7.1 update. Plus, we walked through some big merge proposal, like the Design System Theming. our excitement around responsive styling coming to WordPress. It’s a packed episode full of news you won’t want to miss! The episode will land in your favorite podcast app over the weekend.

    WordPress 7.1 roadmap and more calls for testing

    Anne McCarthy published Roadmap to WordPress 7.1., scheduled for August 19, 2026. Longstanding styling gaps are being tackled: responsive styling and interactive-state styling let you adjust blocks per viewport or on hover — no custom CSS required. You’ll also find new Playlist, Table of Contents, and Tabs blocks, a smarter command palette, a Design → Identity screen, the admin bar inside the editors, a media editor modal, and expanded Unicode support for email addresses.

    Also mentioned Real-time collaboration, Knowledge Guidelines, React 19 upgrade, Classic block deprecation have been punted since the posts came out. Beta 1 arrives July 15 and will settle which of the other Roadmap features are in and which will be punted to a future release.

    The latest Weekend Edition listed three calls for testing. Meanwhile, two more came online:

    Nikunj Hatkar, this year’s team rep of the Core Test team, posted a call for testing responsive styling. You’ll be able to style blocks differently for tablet and mobile right in the editor — no custom CSS or media queries needed. The underlying PR unifies the resizable canvas with the device-preview switcher. Fire up the linked WordPress Playground instance, walk through the four test scenarios, and share what feels intuitive or broken. Plugin and theme developers should test their canvas integrations, too.

    Dennis Snell published a call for testing Unicode email addresses. With initial support merged, is_email() and sanitize_email() now accepting non-ASCII addresses like grå@grå.org, and validation aligns with the Web Hypertext Application Technology Working Group (WHATWG) spec. You’ll want to check your plugins and themes: the new WP_Email_Address class gives you structured access to local and domain parts, and a snippet lets you disable Unicode support until third-party integrations catch up.

    Three Merge Proposals

    Core contributors put together three merge proposal for new features to be added to Core for public comment.

    Jorge Costa published a merge proposal to expand WordPress Core Abilities in WordPress, adding three read-only abilities covering settings, content, and users. Building on the Abilities API from 6.9, they give the AI Client real tools to call, so agents can understand your site’s configuration, posts, and people. Settings and post types opt in through a dedicated flag, and management abilities are planned for a later WordPress version.

    Greg Ziółkowski published a merge proposal for Guidelines built on Knowledge, a new custom post type headed for WordPress 7.1. Knowledge gives your site one shared home for standards, memories, and notes — with revisions, capabilities, and REST access built in. Guidelines is the first feature on top, letting you capture voice, tone, and per-block rules right where writing happens. Although, originally aimed at WordPress 7.1, in their latest comment, Anne McCarthy indicated that it needs to simmer some more before it’s considered for inclusion in WordPress Core.

    Andrew Duthie published a merge proposal for Design System Theming, bringing design tokens and a new theme component to WordPress. Built by the Gutenberg Components Team, it turns hard-coded admin styles into CSS custom properties, so your plugins and screens stay consistent and accessible. A color ramp tool generates harmonious, accessible scales from just two seed colors, and the user color scheme reaches the Site Editor — with dark mode on the horizon.

    Plugins, Themes, and Tools for #nocode site builders and owners

    Anne Katzeff published a tutorial exploring the WordPress Cover Block for parallax scrolls. You’ll learn how the Fixed Background setting turns a Cover block into a layered parallax effect — background, middle ground, and foreground text moving at different speeds. The post steps through nesting a second Cover block, switching which layer scrolls, and improving text readability with grouped backgrounds. A video tutorial rounds it out. She also demos her process in this YouTube video.

    Carrie Dils shared a case study, One Header, Two Themes, on phasing a legacy Elementor site toward Full Site Editing without a rebuild or content freeze. Using ThemeSwitcher Pro to run two themes side-by-side, she built one shared header in a plugin that both themes render. You’ll learn from five real-world snags — WooCommerce’s hooked blocks, cascade conflicts, routing gaps, query-string bypasses — and why shipping the shared layer first de-risks everything after.

    Gina Lucia compared WordPress block themes vs page builders on the Ollie blog. You’ll get a clear-eyed walkthrough of what classic themes, page builders, and block themes each handle — scope, design control, performance, lock-in, and maintenance — with side-by-side tables. Her conclusion: block themes combine sitewide design control with visual editing natively, so you rarely need a page builder anymore, though migration costs and team habits can justify keeping one.

    Elliott Richmond explained why he spent 16 months turning 400+ holiday cottages into WordPress blocks. The kate & tom’s site moved from ACF flexible content to a native block theme, freeing the marketing team from waiting on custom widgets. You’ll appreciate his candor: 10,590 widgets migrated via a purpose-built plugin, re-run against fresh production snapshots, with flaky conversions fixed by hand. Even untuned, PageSpeed jumped from 22 to 67.

    Wes Theron published a video tutorial, How to Create and Edit Navigation Menus in WordPress, for anyone getting comfortable with block themes. In under ten minutes, you’ll learn how to edit your menu with the Navigation block, add pages, posts, categories, and custom links, and build dropdown menus. Timestamps let you jump straight to the part you need — handy if dropdowns are the only thing standing between you and a finished header.

    Theme Development for Full Site Editing and Blocks

    Henrique Iamarino shared how the Automattic Design team built a WordPress theme without ever opening Figma. You’ll follow the making of Crafted, a production-ready theme created almost entirely in the WordPress Editor: Global Styles for typography and spacing, Create Block Theme to save edits to theme files, WordPress Studio for local review, and an AI assistant for finishing-touch hover CSS. His takeaway: the Editor is now a professional design surface.

    Justin Tadlock explained how to dynamically load template parts in block themes on the Developer Blog. Instead of maintaining a pile of near-identical templates, you can hook into the render_block_data filter and swap a template part’s slug on the fly — say, a different sidebar per post category. His walkthrough covers early returns, fallback behavior, and file setup, and the technique works for headers, footers, and banners, too.

    “Keeping up with Gutenberg – Index 2026”
    A chronological list of the WordPress Make Blog posts from various teams involved in Gutenberg development: Design, Theme Review Team, Core Editor, Core JS, Core CSS, Test, and Meta team from Jan. 2024 on. Updated by yours truly. 

    The previous years are also available:
    2020 | 2021 | 2022 | 2023 | 2024 | 2025

    AI and WordPress

    Jeff Paul announced what’s new in AI 1.1.0, the latest release of the canonical AI plugin. Two experiments headline, type-ahead text suggests inline ghost text as you write in the block editor, and key encryption secures your AI Connector API keys in the database. You’ll also find smarter content readiness checks with locale-aware counting, more control over guest comment moderation, a new core/read-settings Ability, and a peek at 1.2.0 plans.

    Need a plugin .zip from Gutenberg’s master branch?
    Gutenberg Times provides daily build for testing and review.

    Now also available via WordPress Playground. There is no need for a test site locally or on a server. Have you been using it? Email me with your experience.

    Questions? Suggestions? Ideas?
    Don’t hesitate to send them via email or
    send me a message on WordPress Slack or Twitter @bph.

    For questions to be answered on the Gutenberg Changelog,
    send them to changelog@gutenbergtimes.com

    Featured Image:

  • Open Channels FM: The Real Challenge of Technological Solutions: Exclusion in the Age of Verification

    David Snead, director of the Secure Hosting Alliance and a long-time Internet policy leader, shares his perspective on the complexities that emerge when technological solutions like age verification are implemented in the digital infrastructure space. Dave’s reflection highlights how the push for more secure, regulated environments can unintentionally create barriers for vulnerable or less tech-savvy […]

  • Otter Blocks 3.2.0: AI Page Building and a New Design Library

    Otter Blocks 3.2.0 is now live, bringing AI that builds full sections and pages, a redesigned AI writing toolbar, AI form autoresponders, a completely rebuilt Design Library, a new Content Slider block, more reliable forms, and full WordPress 7.0 support. This release focuses on the slowest part of building in the block editor: getting started….

    The post Otter Blocks 3.2.0: AI Page Building and a New Design Library appeared first on Themeisle Blog.

  • How to Connect AI Agents With WordPress using MCP (Step by Step)

    How to Connect AI Agents With WordPress using MCP (Step by Step)

    AI assistants like Claude Code, Cowork, and ChatGPT are incredible productivity boosters, and if you wished that you could connect these AI tools with WordPress directly, then you’re not alone.

    Lately, I have been using WordPress MCP by WPVibe to let my AI assistant manage my website, and it’s truly amazing how much time this saves. You can simply ask it to create a post, upload image, handle admin tasks, and more from a single conversational prompt.

    In this step by step tutorial, I’ll show you how to connect your favorite AI tools with WordPress using MCP along with sharing a few work examples, so you can see what becomes possible when you combine WordPress + AI.

    How to Connect AI Agents With WordPress Using MCP

    You can use the quick links below to jump to any section:

    What is a WordPress MCP and What Can It Do?

    MCP stands for Model Context Protocol. It is as an open standard that lets AI assistants connect to outside tools and services.

    Think of it as a universal adapter. Instead of every AI tool building a custom integration with every service, they all speak the same language, so any tool and service that support MCP can work together.

    With a WordPress MCP, your AI assistant can see what your website supports and carry out tasks from a plain-text prompt. It does this using a connection WordPress already has built in (the REST API), so there’s nothing extra to install.

    You can use WordPress MCP to manage your WordPress site and perform tasks including:

    • Draft and publish posts – Create blog posts as drafts, set titles, add categories and tags, and publish when you’re ready.
    • Upload media – Pull images from any public URL directly into your WordPress media library.
    • Manage categories and tags – Create or rename taxonomy terms and assign them to posts.
    • Run admin tasks – Flush your site cache, check which plugins are active, and activate or deactivate plugins.
    • Use plugin abilities – On WordPress 6.9+, many plugins register their own actions the AI can discover and run automatically

    Each of these can be done from a plain-text prompt from your favorite AI tool like Claude Code, Cursor, ChatGPT, etc. I’ll show you the exact prompts once you’re fully set up.

    What You Need Before Getting Started

    • Self-hosted WordPress 6.9 or later – With the REST API enabled (it’s on by default). You need version 6.9 or later for plugin abilities API which is allows you to use AI to manage plugins like AIOSEO, WPForms, etc.
    • A publicly accessible site – Your site must be reachable on the internet because local development sites won’t work unless exposed via a tunnel.
    • A free WPVibe account — You’ll create this during setup.
    • An HTTPS-enabled site — WordPress application passwords require SSL and they won’t function on http:// sites. See our guide on how to add SSL and HTTPS to WordPress.

    Step 1. Set Up MCP on Your WordPress Website

    The easiest way to add MCP to a self-hosted WordPress site is with WPVibe.ai. It’s free and runs on a hosted server, so there’s no infrastructure to configure. It also works with every major AI tool through a single setup.

    You can read our full WPVibe review for a deeper look at everything it can do, but this guide covers what you need to get connected.

    Other ways to set this up: There’s also an official WordPress MCP Adapter, which pairs with the new Abilities API in WordPress 6.9, but it’s built for developers and needs manual configuration.

    Install and Activate the Vibe AI Plugin

    First, you will need to install and activate the free WPVibe plugin. If you need any help, our guide on how to install a WordPress plugin covers each step.

    Along with connecting your AI tools, the WPVibe plugin unlocks WP-CLI commands, theme file editing, and the plugin abilities that I talk about later in this guide.

    Once activated, go to Vibe AI » Vibe AI in your WordPress dashboard. You’ll see the MCP server URL and a three-step setup guide.

    Keep this tab open. You’ll need the URL in the next step.

    The Vibe AI plugin admin page in wp-admin showing the three-step connection setup

    Step 2. Connect Your AI Tools to WordPress

    With WPVibe set up, connecting your AI tool takes under a minute. You add the same server URL to any AI client you use: https://mcp.wpvibe.ai/mcp.

    You’ll find instructions on how to do this in the official WPVibe documentation. But let me show you exactly where to find that setting in some popular AI platforms.

    Connecting Claude

    If you’re just getting started, I recommend beginning with Claude.

    The simplest method is to add the WPVibe URL once via Claude.ai on the web, and it syncs automatically to Claude Desktop, Claude Code, and the Claude mobile apps with no separate setup needed.

    Note: On Team and Enterprise workspaces, only an Owner or Admin can add connectors. Individual members on those plans can authenticate with WPVibe once the admin has added it, or use the Claude Code method in step 3 below.

    1. Free, Pro, and Max plans: In Claude.ai, go to Customize » Connectors. Click the + button, select ‘Add custom connector’, and paste https://mcp.wpvibe.ai/mcp.
    2. Team and Enterprise (admin only): Go to Organization settings » Connectors. Click ‘Add’, select Custom » Web, and paste the WPVibe URL.
    3. Claude Code (any plan): In your terminal, run claude mcp add --scope user wpvibe --transport http https://mcp.wpvibe.ai/mcp. Then, open Claude Code, type /mcp, select wpvibe, and choose ‘Authenticate’.

    Once saved, follow the on-screen prompt to authorize your WordPress site.

    Connecting Claude.ai (Web) to WPVibe
    Connecting ChatGPT

    WPVibe is available directly in the ChatGPT App Marketplace, so both free and paid users can connect without copying server URLs or editing config files.

    In ChatGPT, click ‘Apps’ in the sidebar and search for WPVibe. Then click ‘Connect’ on the app page and sign in with your WPVibe account when prompted.

    After connecting, ChatGPT pre-fills ‘@WPVibe’ at the start of each message. You can delete it with backspace for prompts unrelated to WordPress. Leave it in place when following the authorization step below.

    Connecting ChatGPT to WPVibe
    Connecting Cursor

    Cursor adds MCP servers through a JSON config file. In Cursor, go to Settings » MCP and click the ‘Add new global MCP server’ button. This opens the mcp.json file.

    Add the following entry and save:

    {
  "mcpServers": {
    "wpvibe": {
      "url": "https://mcp.wpvibe.ai/mcp"
    }
  }
}
    Hosted with ❤️ by WPCode

    1-click Use in WordPress

    Make sure you restart Cursor after saving.

    WPVibe will appear in the MCP list once it connects.

    Cursor Settings showing the MCP panel with an option to add a new global MCP server
    Connecting Windsurf

    In Windsurf, open the Cascade panel and click the ‘Plugins’ icon (puzzle piece). Search for WPVibe, click ‘Enable’, and complete the sign-in flow when prompted.

    To configure manually instead, edit ~/.codeium/windsurf/mcp_config.json and add the following, then restart Windsurf:

    {
  "mcpServers": {
    "wpvibe": {
      "serverUrl": "https://mcp.wpvibe.ai/mcp"
    }
  }
}
    Hosted with ❤️ by WPCode

    1-click Use in WordPress

    Note: Windsurf uses serverUrl (not url) in its config file. Using the wrong key will cause the connection to fail.

    Authorize Your WordPress Site

    With the MCP URL added to your AI client, go back to Vibe AI » Vibe AI in your WordPress dashboard.

    Under step 3, you’ll find a ready-to-copy prompt with your site’s URL already filled in.

    The WPVibe Setup Page

    Paste that prompt into your AI chat. Your AI assistant will call WPVibe and return a one-click authorization link. Simply click it to approve the connection.

    You never see or copy a password. WordPress and WPVibe handle the credentials securely in the background.

    WPVibe site showing connected status in the Vibe AI plugin admin after authorization

    What You Can Do Once You’re Connected (Worked Examples)

    Once your AI tool is connected to WordPress, here are the first prompts I tried, including one for WooCommerce store owners.

    My examples are from Claude Code terminal, but these will work with whichever AI tool you connected.

    1. Write and Draft a Blog Post

    Type this into your AI tool: ‘Create a draft WordPress post titled “How to Start a Blog” with an intro paragraph explaining why blogging is still worth it.’

    AI Prompt for Drafting a New Post

    Your AI assistant calls the WordPress REST API, saves the post as a draft, and returns a confirmation with a link to edit it in wp-admin.

    Nothing goes live until you choose to publish it yourself.

    A Draft Post Created Using AI
    2. Upload a Photo to Your Media Library

    Type: ‘Upload this image to my WordPress media library: [paste a public image URL]. Set the alt text to “A person working at a laptop”.’

    AI Prompt for Adding a Public Image to Your WordPress Media Library

    WPVibe validates the source URL, downloads the image, and adds it to your media library with the alt text you specified.

    You can reference it in any post from there.

    WordPress media library showing a newly uploaded image via MCP

    Note: The prompt above uses a public URL, which is the simplest approach. Uploading a local file from your computer works too, but WPVibe will generate a browser upload link as an intermediate step.

    3. Manage Your WooCommerce Store

    WooCommerce 10.9 ships with native MCP support, which exposes product and order abilities through the same standard that WPVibe uses.

    If your site runs WooCommerce, try: ‘Draft a new product called “Summer T-Shirt” with a short description and a price of $29.95.’

    AI Prompt for Creating a New WooCommerce Product

    The product saves as a draft in your store. Beyond creating products, your AI can also query orders, update their status, and add order notes, so you can handle routine store admin from the same chat window.

    You can see the example below.

    A New Product Created by AI and WPVibe

    The next three examples go beyond WordPress’s built-in actions. On WordPress 6.9 or later, plugins can register their own actions (called ‘abilities’) that your AI discovers automatically, so if you use these tools, you can drive them from the same chat.

    4. Optimize Your SEO with AI

    If you use AIOSEO, then you can ask your AI to handle common SEO tasks from the chat window. It can check TruSEO scores, generate meta titles and descriptions, and run SEO audits.

    My starting point was to ask it to find every post missing a meta description and write one for each.

    Try this prompt: ‘Find all posts missing meta descriptions and write and apply them in one go.’

    Claude Code chat showing prompt to find and apply missing AIOSEO meta descriptions

    Your AI checks every post, writes the missing meta descriptions, and applies them through AIOSEO in one step.

    See our complete AIOSEO setup guide to get it configured first.

    AIOSEO meta description field in WordPress showing an AI-generated meta description
    5. Manage Landing Pages and Maintenance Mode

    If you use SeedProd, then your AI can manage your coming soon page, maintenance mode, and landing page settings without going into wp-admin.

    For example: ‘Check if maintenance mode is currently active’ or ‘Enable the coming soon page.’

    6. Build a Form with AI

    If you use WPForms, then your AI can build forms from a plain-English description.

    Try: ‘Create a contact form with name, email, and a message field.’ WPForms creates the form in your dashboard, ready to configure and embed.

    Before using this, make sure you enable write access under WPForms » Tools.

    Enabling MCP Write Access for WPForms

    WPForms Lite supports basic field types. Paid plans add phone, date/time, file upload, and more.

    See What Your Site Can Do

    You don’t have to guess which of your plugins support this. Because WPVibe automatically discovers every registered ability, you can just ask your connected AI: ‘What can you do on my WordPress site?’

    It will list the abilities your installed plugins expose, so the answer stays accurate no matter which plugins you run.

    Is WordPress MCP Safe?

    I had the same concern when I first tested this. Here’s how WPVibe handles security.

    WordPress manages the connection using application passwords, a built-in feature that creates a separate password for each external tool you connect. The AI only gets the permissions of the user account you connected.

    So, it’s worth connecting with a limited, non-admin account rather than your main administrator login. If you create a dedicated Editor-role user for the connection, then the AI can only do what an Editor can do.

    WPVibe encrypts your application password before storing it, using a separate key for each site, and keeps it on secure servers hosted by Cloudflare. Every connection between your AI client, WPVibe, and your WordPress site is encrypted too, so your credentials are never exposed along the way.

    WPVibe also doesn’t store your conversation content. It stays within your AI client.

    On the WordPress side, new posts always save as drafts and deletions go to the trash rather than permanent deletion.

    To fully revoke access at any time, go to Users » Profile in your WordPress dashboard and scroll down to the Application Passwords section to delete it.

    Troubleshooting Connection Issues

    Connecting your AI client to WordPress is the step that trips people up most often.

    If the connection fails or WPVibe doesn’t appear, then work through these checks:

    • WPVibe isn’t in your client’s tool or MCP list – Restart the AI client after saving the config. New MCP servers only load on a fresh start.
    • The connection fails silently in Windsurf – Windsurf uses the serverUrl key, not url. The wrong key produces no error message, so double-check it.
    • Application passwords won’t authenticate – Your site must run on HTTPS. Application passwords don’t work over http://.
    • Your AI client can’t reach the site – The site has to be publicly reachable. A local development site won’t connect unless you expose it through a tunnel.
    • Authorization keeps failing – Re-check that you pasted the correct MCP server URL: https://mcp.wpvibe.ai/mcp.

    Frequently Asked Questions About WordPress MCP

    Is WPVibe free?

    Yes. WPVibe has no API key costs and everything in this guide works on the free plan. There is now a paid Pro plan (early-access pricing, $99 per year) that adds higher daily usage limits and priority support, not new features, so you don’t need it for anything covered here.

    Does WordPress MCP work with all AI tools?

    WPVibe works with Claude.ai (web), Claude Desktop, Claude Code, ChatGPT, Cursor, and Windsurf. Because MCP is an open protocol, any new AI tool that adopts the standard will work with the same WPVibe setup automatically.

    Does WordPress MCP work with WordPress.com?

    No, not through WPVibe. WordPress.com has its own built-in MCP setup that works differently. This guide covers self-hosted WordPress (WordPress.org) only.

    Do I need WordPress 6.9 to use MCP?

    No. You can create posts, upload media, and run admin tasks on WordPress 6.0 or later. WordPress 6.9 is only required if you want to use plugin abilities like those from All in One SEO or SeedProd.

    Can I connect more than one WordPress site to WPVibe?

    Yes. WPVibe supports multiple sites under one free account. Install the Vibe AI plugin on each additional site and complete the site authorization step. Your existing WPVibe account covers all your sites.

    What happens if I disconnect WPVibe from my site?

    You can remove a site from WPVibe in the plugin admin or on wpvibe.ai at any time. To fully revoke access, also delete the credential under Users » Profile » Application Passwords.

    I hope this article helped you get WordPress MCP set up on your site. You may also want to see our guide on the best AI Automation Tools for WordPress.

    If you liked this article, then please subscribe to our YouTube Channel for WordPress video tutorials. You can also find us on Twitter and Facebook.

    The post How to Connect AI Agents With WordPress using MCP (Step by Step) first appeared on WPBeginner.