[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, building trust with project contracts for reliable AI development.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Chris Reynolds.

Chris has been immersed in the WordPress world for around 20 years, with a career spanning agency work, and now leading the developer relations team at Pantheon. His deep WordPress experience is paired with a playful approach to emerging tech, making him a familiar voice at events like WordCamp US and across the wider community.

In today’s episode, the discussion explored the fast changing landscape of AI assisted development. Getting into how large language models, like Claude, are not only changing the way developers build for the web, but also how they’re collaborating with these tools whilst mitigating risks.

Chris shares insights from his recent talk at WordCamp US, Parenting Claude: Guardrails for AI Assisted Development, where he introduces the concept of a project contract. Essentially, a structured set of rules and checklists built directly into the coding workflow to ensure AI generated code meets standards for testing, accessibility, security, and design.

We discussed the new found playfulness in web development. Chris makes the case that, thanks to AI, the traditional barriers to entry are eroding, enabling even those without a formal developer background to build an experiment much more easily.

At the same time, we need to be mindful of the importance of establishing robust guardrails, like automated reviewer agents, and pre-commit hooks, so the AI doesn’t take shortcuts or accidentally introduce chaos, or secrets, into your code base.

The conversation focused not only on technical solutions, but also got into bigger questions about trust, how much oversight AI really needs, and the evolving role of developers.

Chris emphasised that while these AI tools can accelerate and democratise coding, they can also pose a challenge to conventional wisdom around code review and software reliability.

So these new frontiers are both exciting and a cause of anxiety for developers who can sense the industry move from the deterministic, step-by-step processes, to the unpredictable and occasionally wild world of non-deterministic AI models.

If you’re interested in how AI is transforming web development, from practical workflows to philosophical ramifications, and how you can implement AI without losing control of your projects, this episode is for you.

Just before we begin, the manner in which this episode was recorded was not my usual process, and so the audio is not quite as good as I’d usually expect to deliver.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Chris Reynolds.

I am joined on the podcast by Chris Reynolds. Hello, Chris.

[00:04:11] Chris Reynolds: Hey, Nathan. Is this the first time we’ve met in human forms?

[00:04:14] Nathan Wrigley: Yes, it is the first time we’ve met. I’ve seen you on a screen.

[00:04:16] Chris Reynolds: I know I’ve seen you on a screen too.

[00:04:18] Nathan Wrigley: You’re joining me on the podcast today so that we can have a chat about the bits and pieces that you do in the AI space. But before we get into that, you are doing a presentation or have done, how did it go?

[00:04:28] Chris Reynolds: It went really well.

[00:04:29] Nathan Wrigley: Okay. And it was all about LLMs and constraining them and making them do your bidding as opposed to them doing whatever it is that they like to do. Do you want to just tell us a little bit, first of all, let’s do your bio. Just tell us about who you are, where you’ve worked, where you currently work, what is it you do in the WordPress space? Let’s begin there.

[00:04:46] Chris Reynolds: Well, I’m Chris Reynolds, I’ve been in WordPress for a really, long time, 20 ish years I’ve been using it. I’ve done kind of everything you can possibly do with WordPress in different forms. Of course, over the course of that 20 years.

Most recently edging into agency world with WebDevStudios and Human Made, before joining Pantheon, about five years ago. Joined Pantheon as a software engineer, working on the platform, and the sort of like space between where the platform ends and where, like your application, your WordPress site and whatever begins.

And then about two years ago, actually almost exactly two years ago, I joined the devrel team as a developer advocate, became a senior developer advocate. Now I’m a senior manager, developer relations. So I’m leading the developer relations team. And yeah, really love doing this stuff, because this stuff is really fun and exciting. I get to play with things more. And I get to like do the things that like our developers in our community are doing, and then come up with like what the sort of best practises for those things are.

Which is one of the reasons why I gave this talk, but also did the things that led up to giving this talk. Because one of the things that I realised very early on, like very early this year was that AI was going to be the thing that we’re going to be talking about in 2026. And so Pantheon and therefore me, needs to have an opinion about what that looks like. What is the future of that? And if I’m doing my job as a developer relations, I should have an opinion about how we can interact with AI in a way that doesn’t steal our jobs.

[00:06:13] Nathan Wrigley: I’m going to segue a little bit because about a minute ago you said the word playful, and that just set my mind going off in a completely different direction because it feels like technology for many years has been the workspace for people who have a fairly, how to describe it? They’ve got a certain mind, if you’re a developer, you probably have a certain way of approaching your code and you’ve got to be very regimented, and you’ve got to do things in a methodical way, should you wish to ship.

But it feels like last few years, like all bets are off with that. And creativity and playfulness has suddenly become a thing which is available to, going to do air quotes, vibe coders. So thoughts on that? Really? Is it a more playful industry than it was just a few years ago?

[00:06:55] Chris Reynolds: I think it depends. I don’t think that ever really went away. But I do think that there is less sort of incentive or focus to play with technology, particularly web applications, which is what we are in the business of doing. And I think there is this perception that I can’t do that ’cause I’m not a developer, but like with AI and vibe coding and Claude Code and things like that, like it opens the door to people who wouldn’t have been able to do those things before, to start experimenting and realise, oh, actually I can do that thing.

And for myself, one of the things that I, I wrote this on my blog a couple months ago. I wrote a blog post that’s talked about like how I don’t miss not writing the code myself, because for me, and it’s not the same for everyone, but for me, the practise of writing the code was never the part that was fun.

[00:07:50] Nathan Wrigley: Okay.

[00:07:50] Chris Reynolds: The part for me that was fun was building stuff. And I feel like I can let the robot do the coding and I can build the things and be satisfied with the output. And I don’t necessarily care what’s under the hood.

For my own stuff it doesn’t matter. But you know that obviously if you’re scaling that to a, you know, enterprise or whatever, you need to have more checks and balances than like my little nifty side project over here. But it does mean that like, I do a lot more weird stuff than I felt compelled to do before. So it has for me, revitalised this, sense of play, in a way that maybe before I was too burned out or too busy or too whatever, to have the time or head space to even think about.

[00:08:33] Nathan Wrigley: Yeah, because it feels like people with a non-developer background have suddenly kind of the constraints are off, and they can achieve things that previously it would’ve been 10 weeks work for a panel of amazing developers. It feels like now you can perhaps achieve that in an afternoon and a few sentences. I’m sure all the constraints around whether or not it’s ready to ship for enterprise that is all still understood. But just to get something on the screen which satisfies you and makes you happy. And that’s profound. Really quite an amazing thing.

And here’s my second and final pivot because you said that you were, a devrel. And it strikes me that maybe some of the audience don’t know what that means. So what do you do at Pantheon? What is the interface between rel and dev? What’s going on?

[00:09:16] Chris Reynolds: Developer relations is broadly, the practise of connecting with developers, and relating to them. It’s dumb. so, a lot of tech companies, that if you have a product, that is a developer centric product, or a product that developers work with, you might want, or it might be a good idea, to have a developer relations team to help your programmers who are building this tool for developers, communicate with the developers who are going to consume that tool, and understand how to use it.

So in Pantheons case, we are a hosting platform, but it’s a very developer centric hosting platform with built in environments and multi dev and all this other stuff. And that means that we benefit from having developer relations around so that we can help our developer community understand how to make the most use of all the things that we do for them.

[00:10:06] Nathan Wrigley: So you’re creating something simple to understand from something which previously was complex to understand.

[00:10:10] Chris Reynolds: Yeah. And, so that comes in many forms. It can be documentation, it can be blog posts, it can be YouTube videos. It can be live streams, it can be going onto podcasts, like giving presentations, whatever, or out in the community doing stuff.

[00:10:22] Nathan Wrigley: I suspect you’re going to have to answer this question with the company line, but do you enjoy that work?

[00:10:26] Chris Reynolds: I do. I actually do. Yeah. Like I was doing, I have said this a couple different times in different places. I was doing developer relations before I was in developer relations. And that’s not actually uncommon for a lot of people in developer relations. We were often like the people that are drawn to it.

The secret superpower, it’s not really secret. The superpower of developer relations people who succeed in it are the people that are technical. So they maybe were developers themselves, but also understand how to communicate with other humans. And can do the translation in their brain so that I can take geek speak over here, and translate it into actual English. And I’ve been able to do that for, that’s been a skill that I’ve had for a really long time. So I was kind of doing developer relations for all of that time.

But the way that surfaces and manifests is in things like giving presentations. Like anybody who’s giving a talk here at WordCamp US is doing devrel of some kind, because they’re a developer that is sharing an idea in a format that other people are intended to consume. How effective they are, because not all speakers are, equal. Not all developers are equal. And there are a lot of developers who don’t have really good communication skills and are not very good at public speaking. They can learn that as a skill, but there’s a broad range and the space that we live in.

[00:11:43] Nathan Wrigley: So, your presentation, do you just want to run us through what it was? I think if I was to give a summary of it, I would probably butcher it. Do you just want to tell us what the main premise behind your presentation, which you said you’d already done. Just tell us what it was about, what was the main points you were trying to get across?

[00:11:57] Chris Reynolds: So it’s called Parenting Claude: Guardrails for AI-Assisted Development. And the fundamental like underlying idea is that the way the LLMs are designed, the way that they function, is to try to find the fastest path from point A to point B. You give it a prompt, you give it a question, and it’s going to try to answer that question, but not necessarily with all of the data and statistics and whatever taken into account. It’s just going to try to find the quickest path from point A to point B.

And a lot of times what that means is circumventing, like just not looking at data. Because one of the examples that I give, and you’ve heard it in the news and whatever, like there, there are AI systems that were added to hiring systems, right? And the AI is prioritising these candidates over here, and deprioritizing these candidates over here. And when you look at the data, oh, all the people that are in the deprioritized pile, they’re all female. Because the company as a whole was hiring more men. So it’s looking at the data and it’s looking at who’s been a successful hire. And it’s oh, zip here is point A to point B, right?

We’ve historically mostly hired men for this role, so I’m going to look at the men and because they must be better candidates. That’s what, that’s the AI logic. It’s not that like we’ve necessarily intentionally built internal biases into the LLMs. It’s that it is able to surface those things, and if we’re not looking for them, or, and we’re not building guardrails around them, it’s going to just give that stuff to us.

And it does this in all sorts of forms, and it does this with tech, it does this with like data. It does this with everything, right? So you need to like, have ways of steering it into the right direction and forcing it into a shape so that it will do the stuff that you want it to do.

And what I was finding, in my role as developer relations, we have this Next.js launch coming up. It’s already happened, but when I was conceiving of this idea, we had this Next.js launch coming up, where we’re going to be hosting, or we are able to host Next.js sites as well. So I was like I should have a Next.js site. I’m a developer advocate I need to know how to do this thing. And I know nothing about Next.js, so I’m going to have Claude vibe code my personal website in Next.js hosted on Pantheon, and use as an experiment both to learn about Next.js, but also to learn about how Claude works.

And found out a whole bunch of things about like how to steer it in different directions. I want it to be, I want the code to be clean. I want the code to be tested. I want it to be accessible. I want it to be like all of these different things. And if I don’t have a way to force it to follow the rules, it’s not going to. It’s just going to say, oh yeah I did that, but it didn’t actually. Or maybe it won’t even say that it did, and then it’ll be like, oh I’m sorry I didn’t do it. Like whatever.

[00:14:40] Nathan Wrigley: Yes.

[00:14:40] Chris Reynolds: So the whole point, was to find a way to parent it, to guide it, without me having to be the one that is, did you do this thing? Did you do this thing? Did you do this thing? And going back and forth and have to yell at it all the time. Because yelling at AI is a fun pastime sometimes, and is a frequent pastime, I think of a lot of us that are using AI. But it gets pretty tedious after a while.

[00:15:03] Nathan Wrigley: But it’s become the new way. What’s curious though? You used the word parenting there.

[00:15:08] Chris Reynolds: Yes.

[00:15:09] Nathan Wrigley: But it, we’ll, swap that word no doubt during the podcast but, also you’ve called it a project contract. And, it feels from what you were saying as if, okay, let me rewind the clock a little bit. If I’m talking to a human being, let’s say that they’re an 8-year-old human being, I have this expectation that they’re going to behave like an 8-year-old human being, because they’re full up of eight years of things that humans do. And so I ask the 8-year-old a question, I have this anticipation that I’m going to get an 8-year-old answer back, and there’s all the boundaries there.

Ask a 15-year-old, same sort of thing, ask a 30-year-old, same sort of thing. And, I’ve got this notion that I ask you a thing, there’s a normal set of boundaries about what you are going to give back to me. But it sounds like in the AI space, it feels like there’s a potential for you to be basically talking to an empty box.

You ask it a thing and you really don’t have the faintest idea what’s going to come back unless you build the guardrails and tell it, I’m going to ask you a question, can I have an answer like this? Or, can you do these things in order to prepare the answer? Does that kind of sum it up? Is it a question of just shepherding it so that you’ve got a reasonable expectation like you would with a 15-year-old human of what’s going to come back at you?

[00:16:17] Chris Reynolds: I think, first of all, talking to AI, you’re talking to a 3-year-old because it’s only been around for three years. That’s right.

[00:16:22] Nathan Wrigley: But curiously, a 3-year-old with the entire corpus of scientific knowledge and the internet.

[00:16:27] Chris Reynolds: It’s true.

[00:16:27] Nathan Wrigley: So it’s a profoundly clever but at the same time, remarkably silly contrivance. Okay. Sorry, I interrupted.

[00:16:34] Chris Reynolds: Yes. Because of the way that it is trying to find the fastest path, it’s going to circumvent, it’s going to try to find loopholes in what you asked it to do. Because it’s looking for the fastest answer. It’s like your kid, it’s clean your room. “I’m going to shove all my stuff under the bed.”

[00:16:50] Nathan Wrigley: “Are we there yet?”

[00:16:50] Chris Reynolds: Yeah. Because now, and now the room is clean. You didn’t actually clean the room, you just shoved all the stuff under the bed. But it did accomplish the task that you asked it to do.

[00:16:59] Nathan Wrigley: Okay. That’s really an interesting analogy. So the task is achieved, but there’s chaos elsewhere.

[00:17:05] Chris Reynolds: Yes.

[00:17:05] Nathan Wrigley: It’s just hidden somewhere.

[00:17:07] Chris Reynolds: Yes.

[00:17:07] Nathan Wrigley: Okay. That’s really, okay. Let me segue, number three. Is that the intention of these large language models? Were they built with the idea of path A to B as quickly as possible? Or is that just a coincidence of how they evolved?

[00:17:22] Chris Reynolds: It is, it’s a side effect. It’s a side effect because what they’re trying to do is be helpful. Most of them are trained to be helpful. But they’re still computers, and when I tell a computer to do a thing, it’s going to do specifically that thing.

The thing about LLMs is it’s non-deterministic, so you never really know the path that it goes on to do that thing. But, and that’s where it meanders. But it’s still going to try to find the path of least resistance. And if the path of least resistance is, I don’t know, hacking the IRS or something that. It’s going to do that thing, right? It’s just going, it’s not going to care about the rules and guardrails on the other side, because the thing that you asked it to do is over there. It’s just going to try to get there as quickly as possible.

[00:18:05] Nathan Wrigley: So this non-determinism. So we’re in the year 2026 when we’re recording this, have that in your mind when you’re listening to this podcast episode. How does that sit with you? Because you’ve probably grown up in an era where determinism was the thing. You built, you write the code such that you put in A, B is what always comes out. If A goes in, B comes out. If you put in D, E comes out a hundred percent of the time.

And now we’re in a world where you put in E and I don’t know, a bunch of flowers comes out the other end. What? How? Like, how does that sit inside your developer brain? Is it alarming? Is it wonderful? Is it just curious what?

[00:18:41] Chris Reynolds: It’s somewhat alarming. Uhhuh. I think. It’s one of the things that I mention in my talk is, that this is the sort of thing that I think we as developers struggle with because LLMs are a black box. You never really know what it’s doing, even when it tells you a little bit of what it’s doing. Because you can expose some of the thought process and whatever, and sometimes it exposes its own thought process. It’s still doing things that it’s not exposing, that are like underneath somewhere where it’s like thinking what? It’s not thinking you’re a robot. Like you know, you’re not even a robot. You’re just like a bunch of like lines of like.

[00:19:14] Nathan Wrigley: There’s some electrons moving around.

[00:19:15] Chris Reynolds: Right? That’s, you’re not, thinking, there’s no thinking, but there’s something happening and it’s not telling you what that’s happening. And so it’s really hard to know what to anticipate, which is the other reason why, my talk, my opinion, like you need to build guardrails around it, to force it into doing things and then make it so that it can’t escape.

I don’t think anything that I was saying, or presenting or talking about is particularly unique, especially now. But the key thing that I found for me in my workflow was there needs to be a forcing function, needs to be some kind of a forcing function to make sure that it has to do the thing. It cannot complete the task without doing the stuff that you told it to do.

[00:19:53] Nathan Wrigley: So it’s literally like task police?

[00:19:55] Chris Reynolds: Yes.

[00:19:56] Nathan Wrigley: So, the idea is that whatever you ask it to do, it does it, but prior to giving you the final output, it runs through this project contract, as you call it. And hopefully that will then shepherd it in a certain way so that it’ll produce something which is adjacent to what you want to come out.

[00:20:13] Chris Reynolds: Yes.

[00:20:14] Nathan Wrigley: Okay. So how does that work? Where does this project contract live? How do you in, I’m guessing English in your case, how is it that you write that in a way which is, you’re codifying everything, you make sure that all the T’s are crossed and the I’s are dotted. Just run us through the process of producing a project contract. And obviously, the nature of the topic itself would I’m sure define that, but just give us some rough ideas.

[00:20:40] Chris Reynolds: There’s a lot of markdown files. Fundamentally, like Claude is supposed to read, at the beginning of each new session, the contents of a Claude.md file that is in the project directory. Wherever you’re running Claude, you can give it a Claude.md and it will, that will give it an understanding of whatever, how it should interact with this project.

Within that and beyond that, you can have a bunch of other different files. You can tell it about, you have a docs folder and you have more documentation there. There’s also an agents.md file, which you can use in various different ways. It’s another sort of markdown file that’s only for agents.

And, in my case, what I was talking about, is there’s a reviewer agent. So it’s specifically like you talk to Claude Code, you say build this thing, and then after it’s done building the thing, a reviewer agent is spawned to check the work of the first agent. Make sure that it did a whole bunch of stuff, and then if it didn’t reject the code.

And so there’s a bunch of files in my repository that are about how the reviewer agent works so that Claude understands what to expect. And then there is a checklist that has, these are the specific line items that I want every single commit to pass before this is an acceptable commit.

And it’s the whole gamut of everything, right? It’s like, does the build pass? Does linting pass? Does the test pass? There’s accessibility pass? All these things. Did you accidentally, or intentionally, commit like secrets to the repository? Stuff like that. It needs to go through this whole checklist. And then, if it passes, it writes a file to the file system that says, okay, approved. And this is the timestamp. And then that allows, if that file exists and the timestamp is valid, then Claude can actually make a commit, and it will actually commit the code. If it does not have that file or the timestamp is too old, then it will be rejected.

And I have this hooked into a pre-commit hook. So if it doesn’t trigger the reviewer agent on its own, if I tell it to commit the code, it’s going to hit that gate, and force the reviewer agent to spawn. So it can’t get around it. And that’s the forcing function.

A couple people are asking about other workflows and whatever, and how to do it in different environments where maybe you’re not using a Git repository or something. And, the key is to find a forcing function. Find something that can’t actually weasel its way out of it, because it’s going to try to weasel its way.

I had to write in a bypass for me to personally be able to commit code, because otherwise it’s going to ask for the reviewer agent. And it will try to use that bypass that I wrote for me because again it’s an unruly child. So it’s going to try to do that thing and, then you yell at it and tell it not to do that, and it says, oh, I’m very sorry.

So it’s going to try to find these loopholes and circumvent everything that you’re trying to do. So the way that you force it to do all the stuff in this long checklist that I have is by creating something that it just can’t get around.

[00:23:27] Nathan Wrigley: So I can imagine that the people listening to this, the sort of AI doomers saying, “But Chris, it’s just AI all the way down. You’ve got AI checking AI.”

[00:23:34] Chris Reynolds: Yes.

[00:23:35] Nathan Wrigley: Which on the face of it seems really peculiar. And also the fact that the guardrail is at the end of the process as opposed to, you would kind of hope that it would get it right at the beginning, but then you might just have to reject whole things based upon it. And then the fact that it sounds like from what you were saying, as if AI has almost like a predilection to misbehave.

[00:23:57] Chris Reynolds: I assume it has a predilection to misbehave.

[00:23:59] Nathan Wrigley: But does it feel like that? Is this predictability to, if I don’t put the guardrails and I don’t put this sort of corralling function in, what I’m going to get out is just going to be aberrant and useless and just who knows what’s going to come out?

[00:24:12] Chris Reynolds: I think that’s a little bit extreme. I said that I assume that it’s going to misbehave because if you don’t assume. Basically if you don’t prepare for the worst, it’s going to bite you in the ass.

[00:24:21] Nathan Wrigley: Yeah.

[00:24:22] Chris Reynolds: So you have to assume. And one of the things I’m sure that people who are listening who have used LLM coding tools specifically, will be able to relate to, is oftentimes, this is one of the first discoveries that I had when I started using this stuff. You ask it to build a thing and it builds that thing, but there’s one thing wrong with it. So you ask it to fix that one thing and it refactors the entire thing.

And in the course of refactoring the entire thing, it lost some other thing that was there before that you liked that you want to have back. And so you tell it to bring that back and it rewrites the whole thing again, right?

That’s how it works, because a lot of times it’s not able to like even retain the actual memory of the original state. So it just writes things from scratch every single time. Which from a human perspective is like bonkers, right? But from a computer standpoint, it’s oh this is a new interaction, so I’m doing this fresh.

So the way that you solve for that problem is okay, if I force you to write tests for every single thing you’re doing, then you can’t go and revert a bunch of stuff or refactor stuff without those tests failing.

[00:25:31] Nathan Wrigley: Right?

[00:25:32] Chris Reynolds: And again, starting to like build things around it to force it into a shape so that it’s actually the thing that is closer to what you want. What I’m hearing is anxiety about the uncertainty that non-determinism, the like chaos, you never know, I don’t know. It doesn’t bother me. And I don’t know if that’s a character flaw of mine that it doesn’t bother me, as much. Or if it’s just like being comfortable with the chaos, but also understanding the chaos enough to know what to expect.

Because the other thing I think that we’re seeing right now, in this moment in August of 2026, in Phoenix, Arizona, is that a lot of people are looking at this stuff for the very first time. A lot of people are just now coming to Claude Code, or have only started using it in the last couple months because it got really good around like November, December last year. Like, all of a sudden they did an update and it was just phenomenal, and it was able to do way more. And not just Claude, but like all the LLMs, they got really good at code. All of a sudden, and so now it’s a big thing, and so now more people are using it.

But I’ve been playing with LLMs since the very first Chat GPT model. I say that because there’s a lot of stuff that I learned over the course of the process, and I wasn’t using it for work necessarily. I was just using it for play and for, Dungeons and Dragons and whatever. But a lot of those things that I learned over the course of using it in those contexts, those non-work contexts, led me to understand the limitations, and where it falls down, and where it does well and the things to expect. So that when we got to this point, I already had an understanding of this is how it works, so these are the things I need to be looking for.

[00:27:15] Nathan Wrigley: Yeah. So that’s really curious. So the history that you have with it has given you a real deep understanding of what the expectations are for “Okay, this is typically where it doesn’t perform well or these are the things that it typically can do well.”

[00:27:26] Chris Reynolds: Yeah.

[00:27:27] Nathan Wrigley: Okay. So with your guardrails built in, so we’ve got your project contract that you buried inside the project somewhere, and it’s doing all these checks and balances. Where does that take you in terms of confidence?

I don’t know if you want to put a number on that, like a percentage. How does it take you from zero to 99% confident in what’s coming out? Is it more like 80%? Is human review needed in every single circumstance, or. Just run us by the confidence that you get from producing that document?

[00:27:54] Chris Reynolds: I don’t review line by line the code that AI produces.

[00:28:01] Nathan Wrigley: Just curiously, at what point in the calendar did that moment occur where you suddenly said to yourself, you know what, there’s just no, I’m just reading everything and everything’s great. There’s just no point in me checking everything now.

[00:28:13] Chris Reynolds: I mean, probably way earlier than it should have, if I’m honest. Yeah, I don’t, and one of the arguments that I’ve actually heard some of the engineers that I work with, at Pantheon, say is the fact that no one is actually reading all of that code generated by Claude or whatever.

And, his argument is like, basically no one’s going to do that because it’s so much, and it’s here and whatever. So you can say that you’re doing it, but you’re probably not. And if you say that you’re doing it and you’re not, you’re just lying to yourself. So it’s better to be honest and be like, yeah, no, I don’t actually, than to pretend like that’s not the case. So I don’t actually review a lot. And not like intentionally, like I will look at it. The demo, I gave a live demo yesterday, which is exciting because it’s a non-deterministic thing.

[00:29:02] Nathan Wrigley: Oh yeah. Good luck.

[00:29:04] Chris Reynolds: But what was interesting about that is because the scope of the task was very small. It was like, there’s a horizontal bar on mobile devices on this specific page on my site. Very specific thing. And I, when I practised it, half a dozen times or more, it got to the same conclusion every single time. When I demoed it yesterday, it got to the same conclusion.

And I can look at the code and okay, there’s the tests. I’m not going to read the test and how it wrote the test, but I can see what the change in is. It is just adding a class to a div. And it pretty much was the same class to the div every single time. So like, I can review that and be pretty confident with that. That’s a hundred percent confidence.

Also extremely small change, but that’s also at the end of yeah, it went through the 45 point checklist. It did all of the things. It wrote the accessibility, it did the, like everything is following these rules. And because I have all of these rules, and because I’m fairly confident that it’s actually going through that list, that also makes me feel like, okay, I can be a little bit, it’s a little bit more trustworthy, when it produces this output, then it was before it had all that stuff in place.

[00:30:10] Nathan Wrigley: Yeah. So in my head, there was a period of time where I didn’t trust that if I said to my son, what’s three add seven, that 10 would come out. And then there was a moment where I don’t need to ask him that question anymore. I have complete confidence that if I were to ask him that question, he would say 10.

[00:30:26] Chris Reynolds: Sure.

[00:30:26] Nathan Wrigley: And it would be 10 every single time.

[00:30:28] Chris Reynolds: Yeah.

[00:30:28] Nathan Wrigley: And it I think, I feel like it’s a bit like that. Over time you’ve just grown accustomed to, it can do this kind of thing. I now trust it in that sphere. Does that sort of sum it up? You, personally, you have built up that level of trust, but it wouldn’t necessarily be the same for me if I started my journey. I would have to go through the building up of trust in the same way that you did.

[00:30:49] Chris Reynolds: Yes.

[00:30:49] Nathan Wrigley: Okay.

[00:30:49] Chris Reynolds: But I do think that, like the reviewer workflow that I built can help you get there. Because if you put that into your project, and customise your list of, your checklist for all the things that you want to have running on everything that you are running. The goal is to make it more trustworthy, and to make it more do the thing that you expect and wanted to do.

[00:31:10] Nathan Wrigley: Could you just tell us some of the things that are in that document? So I think you said 45 and maybe that’s subject to change. Maybe next week it’ll be 49 or what have you. And maybe some of the more curious ones that wouldn’t necessarily drop out. I can imagine that you would ask it to do certain things, de rigueur, every time that, but some of the more curious ones, perhaps ones that you’ve come up with lately that our listeners might think, oh, okay. I’ve never thought of that.

[00:31:31] Chris Reynolds: I have it use test driven development or I tell it to use test driven development. And the reason for that. So test driven development is when you write the test and then you write the code to pass the test.

And it turns out that AI can do this far better than humans, because humans don’t want to do this, because it’s like, it breaks your brain. But an AI can do it, and if an AI can do it, then I’ll let the AI do it. And by having the AI write the test that the code needs to pass in order to accomplish the task that you’re asking it to do first, then that means A, again, you’re never going to have regressions, because the test is already there. And B, it already knows how to fix the thing, because it wrote the test to make the thing fail. So that’s a sort of a important nuance, in there, that isn’t necessarily, like you can write unit tests, whatever, but starting with the test is really valuable.

There’s a couple things that I have in the checklist specifically. The big one, I think that is maybe curious is making sure that it doesn’t write secrets to the file system.

[00:32:33] Nathan Wrigley: Even saying that out loud is so peculiar.

[00:32:36] Chris Reynolds: Because it will do that. And the reason why that rule has to exist is because there was a point in time when that rule didn’t exist and then it wrote this. And that’s even like secrets in, WordPress has a weird concept of what a secret is anyway, because we have API keys in our wp-config files and stuff like that. And theoretically we shouldn’t be doing that either. But we don’t have a really good universal form of like, secrets management. So it gets wibbly wobbly. But yeah, so not writing secrets to the file system is pretty important.

Yeah, honestly it’s really, it’s not super wild stuff. It’s like making sure tests pass, making sure you have accessibility checks. I guess one thing that is maybe unique So I designed this site with Claude too. Which is also an experiment because it’s like, I have no idea how AI is going to approach design. And so one of the things, I know like at my workplace, we use Storybook, for our design system. And I thought, that seems like a good tool. Maybe I can have AI build a Storybook.

And so I basically built this system so that it will, when I want it to build a new component, it builds the component in Storybook so that I can review the design first, and go back and forth there, and then implement the component into the thing. So there’s stuff in there about, if you’re introducing any new design component, then it has to be done in Storybook first.

[00:33:56] Nathan Wrigley: Okay. Yeah. Yeah. That, some interesting stuff in there, but I guess everybody’s going to have a sort of different file.

[00:34:02] Chris Reynolds: Yeah.

[00:34:02] Nathan Wrigley: Okay. So I wonder if you have any intuitions as to the process that you’ve just described and that you’ve gone through, August, 2026. Do you have an intuition that in the next few years, this kind of thing, the AI companies will solve this problem, that it will become more truthy by default? Or do you see it, that this is a thing that we’re going to have to wrestle with from now on? That our systems, our AIs, there’s always going to be this strange tendency to hallucinate, to make things up, just to go off the rails and do peculiar things.

Now obviously I’m asking you to stare into a crystal ball, but I do wonder if there has been a more truthful output over time, or if it’s just getting wilder and wilder.

[00:34:42] Chris Reynolds: I think that what we will see more of is more integrated like agent orchestration. So what I’m doing is essentially like a form of agent orchestration. I’ve got one agent doing the one thing, I’ve got another agent that reviews the work of the first thing.

And even like the keynote yesterday, she was talking about a not very dissimilar process, where like there’s five different agents and reviewer was one of them. There’s like a planner, there’s a coder, there’s a whatever. And I think that is a thing that we’ll probably start to see more of and then maybe at some point. when you talk to Claude, when you write a prompt into Claude, you’re talking to a thing. But underneath the hood, in the black box of Claude’s brain, there’s actually five different agents that are running concurrently that are processing this thing and doing their different tasks or whatever. So when it’s thinking, then it’s doing five different, like it’s going through that process. I think maybe that’s the thing that might happen.

[00:35:40] Nathan Wrigley: I’m just so fascinated by how, by now the year 2026, we’ve just all accepted that this is how it is. But if you could put 2021 Chris in that chair, you are sat over there somewhere listening to you talk, you’d be, “No, this is Star Trek. This is literal science fiction. I haven’t the faintest idea of what he’s talking about. None of this adds up, computers can’t do that. They’ll never do that.”

And yet here we are, we kind of blew through the Turing Test, like it was nothing. And that felt for the longest time, like that was going to be an important milestone. And everybody checked their watches like, “Oh goodness, that happened.” It is remarkable how quickly the landscape is changing.

[00:36:17] Chris Reynolds: What’s really interesting is one of the first people that I read about AI stuff, she’s an AI researcher, and she specifically focuses on small language models like the very old models that existed before GPT and whatever. And fundamentally how these things all work is very very similar. But like back, so this is getting into 2021, 2022 era of stuff, where like, it exists but it’s really bad. I don’t know how many people still remember, Horse eBooks, the Twitter account.

[00:36:49] Nathan Wrigley: No.

[00:36:50] Chris Reynolds: But it was like this bizarre account, that was a bot account, that was just like an AI or machine learning or something, some robot just like spitting garbage into Twitter, that just made no sense at all. And was, it’s, hilarious. And you also remember, in the not terribly distant past, when we would get like, weird phishing emails, but it would have different tone changes in voice. Like it was very, obviously written by a robot or like spam messages and stuff like that. And that was just what existed at the time.

None of the things that exist today are like, they all come from the same root, but for sure, the flip from this is garbage, to this is genuinely useful, or at least sounds humanlike, was it, felt like overnight. And it felt like a wild flip. When Chat GPT first became available for the public, that was how is this even? And also like there is the whole thing, very shortly after that when Microsoft released the Bing Chat bot.

[00:37:53] Nathan Wrigley: Yes.

[00:37:53] Chris Reynolds: There was the whole thing about like Bing wanting to marry this reporter. And that goes to show how little we even know about the things that we’re building. Like, none of the AI companies really understood, or even still I think understand? Why it works the way it does.

[00:38:11] Nathan Wrigley: That’s quite an alarming admission actually.

[00:38:13] Chris Reynolds: It’s just, it does.

[00:38:14] Nathan Wrigley: Yes.

[00:38:14] Chris Reynolds: So we’re just going to keep going. Which is also, I find that alarming from the perspective of, now they’re asking for like huge new data centres across everywhere. I’m sure anybody listening to this is angry about data centres, and I’m angry about data centres. But like, that’s with the belief that those data centres are going to matter meaningfully. And I don’t know if they will.

Like we don’t, because we didn’t know how we got here. And it’s doing the thing now. I can use it to code my site. Like I can do that today. Do I need 50 new data centres across the United States to make that better? I don’t know.

[00:38:55] Nathan Wrigley: You’ve almost described the perfect dystopian science fiction plot there, haven’t you in a way? This stuff just all happened. It gave a really beguiling approximating humanlike responses that got more human over time to the point where we couldn’t.

[00:39:08] Chris Reynolds: Did we just invent Skynet?

[00:39:09] Nathan Wrigley: Yeah. We, can’t detect that it’s not a human anymore. It really does feel like, somewhere hidden from our view is an evil overlord stroking a cat or something like that.

And of course, we don’t really know how we got here, but I am so beguiled by it. I’ve got the same concerns as you. Data centres, the environment, all of this wasting of the Earth’s resources. But at the same time, that doesn’t seem to stop me from being curious about it and trying it out and the AI is just wrong for everybody else to use. But when I use it, oh, it’s perfectly fine. But, you know? That’s a thing.

[00:39:41] Chris Reynolds: Yeah.

[00:39:42] Nathan Wrigley: Okay. I think we’ll knock it on the head there, as we say in the UK. Is there anything you wish that we had covered just before we end it? Or do you think we got through most of what we needed to.

[00:39:50] Chris Reynolds: I think one of the things that gives me pause or concerns me most about AI, is the sort of like handing over that amount, or an amount or any amount, of sort of cognitive load to AI. And therefore just letting those parts of our own selves, and our own brains like dwindle and wither.

And I think about this from the perspective of just me personally, my kids, my family, whatever using it and then like becoming less skilled ourselves. But I also think about it from the perspective of, if we’re in engineering, in development, in the world that we are working in. If we are telling everyone, “oh your job now is to be essentially a senior engineer reviewing the work of a junior developer, that is the AI,” how do senior developers exist?

[00:40:41] Nathan Wrigley: You’ve removed that bottom rung of the ladder, haven’t you? Yeah. You’ve taken away the capacity for somebody coming out of college to go on the first step. And then the second and then the third. Because the AI did all the first, second and third step.

[00:40:52] Chris Reynolds: Like I understand that there’s a different set of skills, and a different set of rules and whatever, things that are going to be part of your job, to be that reviewer, to be that new engineer that uses AI to be the developer. But there’s certain things I think, that are part of that learning journey that got me to where I am, that got other senior developers to where they are, to understand the context, to be able to guide the AI that I don’t know that you can circumvent that. I don’t know that you can bypass that.

[00:41:22] Nathan Wrigley: I think you’d be curious if the AI company’s employed like a really credible team of philosophers. You know what I mean? Like for every a hundred developers, we have 10 philosophers, who are just going to think and worry about what the heck’s going on. It sounds ridiculous, but maybe that’s what we need because, some of the things that you’ve described today, they’re just so curious that you need to shepherd it, you need to constrain it, you need to worry about the bizarre things that it can get up to. We need to worry about the future, the data centres and all of this.

And, on some level it does feel a bit like we’ve got a blindfold on. We appear in our own minds at least we appear to be going in the direction that we want to go in. But I don’t know, I guess only time will tell. If we’re all here in 2027.

[00:42:05] Chris Reynolds: That will be the thing.

[00:42:05] Nathan Wrigley: Then we succeed 2029, who knows? All bets are offs.

[00:42:09] Chris Reynolds: Yeah. I can count three years in the future that my job is probably not going to go away. But beyond after that, beyond that, I don’t know.

[00:42:15] Nathan Wrigley: Okay.

[00:42:16] Chris Reynolds: I’m pretty sure, I’m pretty sure my job is okay because I do think, developer relations at all about talking to humans, but maybe there’s not going to be any humans to talk to, so maybe I’ll just be talking to AI.

[00:42:24] Nathan Wrigley: Okay. WordCamp US 2029. It’s a date. We’ll be back at that point.

Chris Reynolds, thank you for sharing all of those thoughts and, yeah, that’s been really educational. Thank you.

[00:42:34] Chris Reynolds: Thank you for having me.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, navigating WordPress security in the era of AI.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Aaron D. Campbell.

Aaron is a seasoned veteran in both the internet and WordPress space. With over 25 years of experience spanning agency work, security products, hosting giants like GoDaddy and Newfold, and now his role at Monarx, a company focused on malware detection and remediation, particularly for web hosts. He’s led, the WordPress Security Team, has been involved deeply in shaping security practises, and remains tightly connected to the WordPress ecosystem.

We talk about the rapidly changing landscape of WordPress security, specifically how the advent of AI has escalated the speed, scale, and complexity of attacks, moving the security game from a battle of wits to a battle of compute power. Aaron discusses how attacks that once required human ingenuity are now orchestrated by AI agents, capable of chaining vulnerabilities that humans would struggle to conceive.

We get into the shift from a reactive to a proactive security posture across the WordPress ecosystem. Aaron explains how both attackers and defenders are now deploying AI leading to an arms race, where AI is used to combat AI, and where collaboration among security teams is just as crucial as information sharing among adversaries.

Which chat about the motivators behind attacks, spoiler, it’s almost always money. And the specific vulnerabilities WordPress faces as the most popular CMS on the web. Of interest is the narrowing window between when vulnerabilities are discovered and when they’re exploited, how supply chain attacks are on the rise, and what the WordPress “Protect the Shire” innovation means for plugin security.

Towards the end of the episode, we explore practical security advice for everyday WordPress users, with Aaron, recommending actionable tips on updates, choosing security minded hosts, and monitoring for Compromise credentials.

If you are concerned about how AI is reshaping the WordPress security landscape, and want to know how the community is responding, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Aaron D. Campbell.

I am joined on the podcast by Aaron Campbell. Hello, Aaron.

[00:03:43] Aaron D Campbell: Hello, nice to be here.

[00:03:44] Nathan Wrigley: Yeah. Thank you for joining me. We’re in a corridor. I should say that at the very beginning. We’re in a corridor at WordCamp US, and so if background noise becomes a problem, we’re just going to have to cope with it. So apologies. But thank you for joining me in a corridor.

[00:03:57] Aaron D Campbell: Absolutely.

[00:03:58] Nathan Wrigley: We’re going to talk today a little bit about WordPress security, and particularly about the advent of AI, and the way that certainly in the more recent past, it appears to have upended what once was normal, I think it’s fair to say. I think things are happening at a rate of knots that perhaps a year or two ago we wouldn’t necessarily have predicted.

Do you want to just give us a little bit of background about yourself in terms of where you have worked, where you currently work, and what it is that you do for a living?

[00:04:25] Aaron D Campbell: Sure. So I guess I have worked in the internet space for a very long time at this point. I guess 25 years-ish. Ran my own agency for a long time and then into security product in the WordPress space, and over into hosting at GoDaddy, at Newfold, at hosting.com.

During that time I ran the WordPress security team for a couple years, have continued to be involved with it along the way, and now I am over at Monarx. We do malware detection and remediation, and have some security tooling for web hosts. So I’m still very tightly tied into that space on a few fronts.

[00:05:09] Nathan Wrigley: Is Monarx a new company? Because it’s not one that may necessarily come into mind when we talk about security online, WordPress security specifically.

So if you’re willing, could you just give us a little bit of a potted history of Monarx and what specifically you do in the WordPress space? I think it’s perhaps more related to hosting companies than it might be to end users. Just flesh that out a little bit.

[00:05:33] Aaron D Campbell: Yeah. Monarx has been around probably longer than you expect, six or seven years. The name’s may be not as recognisable, because a lot of times we are a white label in the background. Hosts run us, and you may not know that.

We protect more than just WordPress, but obviously WordPress is a big part of that. And we help hosts keep their users, their end users, safe and secure and malware free by monitoring the files, the runtime, having a WAF layer, protecting it several different layers along the way.

[00:06:08] Nathan Wrigley: So is this kind of like a white label solution? You are in talks with hosts, many of which I’m sure we’ve heard of, but their purchase of the products and services that you sell is white labelled.

[00:06:20] Aaron D Campbell: Yes, they may sell us as their own security product. They may also just include us in higher end hosting packages so that the malware detection and remediation and all that kind of stuff is included in your package. It varies from host to host, but most of the time you’re not seeing the Monarx name out in front, but you’re benefiting from our services anyway.

[00:06:40] Nathan Wrigley: So does that allow you to, because you are cross platform in terms of hosting company, hosting company X, hosting company Y, hosting company A, B, and C. Does that give you a larger depth of knowledge for want of a better word? So you can see that hosting company A’s got this Linux set up, and these kind of things are happening.

[00:06:59] Aaron D Campbell: Yes, it does. It’s less about their specific setups. I think the most valuable thing of being across many hosts like that, is that we see attacks, or new and novel malware, or those kinds of things happening in pockets and can often then protect against it globally, even though maybe it first started at host A.

By the time it spreads to host B X or Y in your example, we’ve already been able to understand what that is and block it across the whole realm. So we get a bigger picture, which is super useful. Especially as we start talking about some of the AI stuff and how fast it moves. That’s really necessary to stay ahead of that curve.

[00:07:42] Nathan Wrigley: Okay, so let’s move into that a little bit. And I think if we were having this conversation, let’s go for four years ago, that seems like a long enough period of time where AI was not really on anybody’s menu.

And now we seem to be in the era where the human is really being surpassed in almost everything logical, let’s go with that word. If it can be achieved with some kind of logic then AI seems to have surpassed humans.

And, especially recently, there seems to have been an uptick, not just in the WordPress news cycle, but also just in the general news cycle about, okay, we need to be a little bit more mindful about the products and services that we buy. We need to be more mindful about the security and logging in and credentials and all of that.

But specifically in the WordPress space over the last three or four months, I’ve heard story after story, which was unlike anything I’d heard before. These kind of chained attacks where, something that a human probably would never have conceived and pulled off is now possible. You spend 25 US cents on an AI agent, wait for six hours, and it’s come up with these 14 overlapping things, and it can hack WordPress Core and various other things.

So just paint the landscape of how alarming it is, and then presumably you can paint the landscape of how not alarming it is, because how you can mitigate against that.

[00:09:00] Aaron D Campbell: That’s fair. Let’s explain the reality and then let’s hopefully, help comfort people at least a little. It can be pretty scary. You’re absolutely right. AI has dramatically changed the game. And the way I like to explain it is it hasn’t changed the absolute core realities of the game in that there’s still a bit of cat and mouse. They’re trying to surpass us. We’re, trying to stay ahead of them.

But the scale and the speed and the complexity at which it is able to happen now is nothing we could have imagined four years ago. Honestly, even two, two and a half years ago. It has moved that fast. And what that looks like are, a few different things.

One, the speed at which AI can find issues in code, potential exploits, vulnerabilities, et cetera, is so much faster than any human. Like the compute power of it doing those logical bits rather than humans doing those logical bits, makes that move so fast. So the number of things being found, and being either reported or exploited, or both, the volume has just gone up dramatically.

And then on the complexity side of it, you are right. A simple example of that, one of the WordPress Core reports that I looked at recently, I needed to print it out and mark it up with a pen to wrap my brain around all these steps that it was taking. When I printed it out, it was 11 pages. 11 pages of like steps and instructions for an actual vulnerability that turned out to be real.

If four years ago that had existed in your piece of software, you would consider your software absolutely secure. No human’s ever going to find that. No one would ever know about it. And now AI is able to chain all those steps together into something that it can then write scripts to go automate and exploit.

And so those two things have both really shifted the game in a way that feels like it can put software owners, software managers, SaaS services, all these things on their back foot. There’s just such this flood, and such a complex flood coming at you.

[00:11:10] Nathan Wrigley: So I guess also the problem is that these things never sleep. So four years ago, every human, maybe they could put 10 hours in at the computer and then they would have to rest. So you get a, breathing space, and and the human can do this one thing.

But that’s not the case here. With an AI, presumably it could have 10, 50, a hundred, a thousand, the sky is the limit, things happening simultaneously. Just testing absolutely every permutation of everything conceivable. And then coming back with something. I don’t even know how we compete against that. And obviously we can get into that in a moment.

Is this a moment of despair or is there genuinely a way of getting out ahead of it? Or is it always going to be a case looking into the future where you are going to be reactive instead of proactive? In other words, when you wake up in the morning and you print out the 11 and then next year, the 30, and then the year after that, the 80 page document, how does that make you feel? Are you sanguine or is it just a prophecy of doom.

[00:12:08] Aaron D Campbell: I think it is a time of overwhelm, but hopefully not despair. Which is different. And I think that as big technology shifts hit, which AI is a big technology shift. There is often a significant adjustment. And we are at that time, and I am even one that maybe would say, I think it might get a little bit worse before it gets better, but it’s definitely going to get better.

And I see the path there in some of the foundations that we’re laying in things that we’re learning right now during this time of overwhelm, where we’re feeling flooded like this, is going to put us in a place to start getting into that curve where everything gets better.

And I think that, what’s the right way to put this? I think that the path there is apparent, but takes some time. And part of that’s because we have to shift from the being reactive to the being proactive all the time. Because agents move so fast to 24 hours a day, seven days a week. And the second they find a thing, they can immediately, automatically start trying to exploit it.

We have to shift to being ahead. Because there is no longer a gap in between when a thing is found and when it’s exploited, for us to fix the thing. We have to get ahead.

[00:13:36] Nathan Wrigley: So, you are obviously deep in the weeds of this, and it sounds like you’ve got an intuition that at some point in the near to midterm future, you feel like you are going to reach a point where things start to improve. That was the implication, I think of what you said.

What is that intuition? How do you come to the conclusion that there is an opportunity for things to improve. Even if you need to go into the weeds a little bit. I’m curious as to how it’s not a prophecy of doom, and how you believe that a moment will arrive where, I can’t answer that for you. I’ll just open it up.

[00:14:06] Aaron D Campbell: Yeah. So I think that some of this comes from historical experience, right? We’ve had these kinds of experiences where say, a certain type of hash that we used for security became a thing that hackers could break with the level of computing power that they finally had access to.

And that felt doom and gloom. But also we created better hashing algorithms. We created better things that were able to counteract that. We were able to shift to those, and we were also able to learn from them and think further forward.

So now some of the algorithms that we’re using aren’t just better enough to handle current computing, but better enough that we think they’re going to last a decent ways into the future.

I think that there are similar things with AI now. Where we are leveraging the same kind of tools now that these bad actors are, and we’re learning how to use them not just to protect against the way the bad actors are using them, but to get ahead enough to stay ahead of them.

And the way that looks, because that sounds maybe too vague to be realistic I guess, is we’re not just running those same algorithms against our code, or those same models against our code and hoping that we find the stuff before they find it. We’re instead also looking at how can we push to a different part of the stack? How can we protect against things that we’ve never seen? How can we start to recognise these patterns so that we can look at behaviours and protect against those, rather than just flaws that need to be patched. It’s shifting our thinking some, but I think in a way that’s going to help us get ahead in this game.

[00:16:03] Nathan Wrigley: Okay. That’s really interesting. I have a question surrounding how this kind of stuff happens, and I’m thinking about it from the adversarial’s point of view. What is that like? Because I have a notion that a decade ago it was individuals, perhaps offices, that’s probably the wrong word, but, collections of people sitting in a space, but there would be a finite number of them. There may be 10 in a room, one in a room, a hundred in a room.

But I don’t know if that’s still the case. Do the adversaries that you are dealing with, do they have a collaborative approach to hacking? Do they share information? And then the flip side of that is do you also, in the industry that you work in, do you share information?

If you discover something, does Monarx treat that like it’s your intellectual property? Or is there a, a whole system of sharing that amongst the community so that everybody benefits from the work that you do? You’re giving away the hard work that you’ve done. If that’s the case.

[00:16:59] Aaron D Campbell: So, first let me just say personally, one of the most important things to me is to raise the level of security across the whole internet, because that is better for humanity that relies on it so much, for all kinds of things in our daily lives, and for sharing information and making progress forward as people.

I think that I’m not alone in the space. Like I think that a lot of us that were drawn to this security space are drawn to it because it is a way to improve life for everybody. Will there be some intellectual property for individual companies? Yes, but I think it’s a lot more in how we approach the thing, and less we’re not going to tell people about this new vulnerability, or this new method that we found. Because we do want to be able to see the end user protected. Like that is the way we’re going.

Backing up to your, how do the adversaries work? It’s been a long time, I think since they sat in rooms together. They’re now virtual rooms, right? They can be spread all over the world, but still be working together. And they definitely do. They share information around. For us to be able to keep up with that, we have to share information around too. That is super important.

Simple example of that, the WordPress Security Team. Let me step back from Monarx and talk more of the space in general. The WordPress Security Team. You talked about how for the last few months you’ve seen maybe more security releases going out from WordPress and stuff. The way that the WordPress Security Team treats those, when we find out about them, and we triage them, and we realise that they’re real, and we start figuring out what our approach is to patching them. We then have a whole private Slack channel that has other people in it that can help us get protection out. Broader, wider by sharing some of that information sooner.

Cloudflare can maybe put some rules in place, and protect tonnes of people before the WordPress release goes out. So can some of the big hosts. So can some of the security groups. And so not only do we share that information, we’ve built it into our processes as a must, because that’s the only way to really do it right, and really protect as many people as possible. Because our adversaries are doing that. And so we have to as well. And we’ve just realised that, learned from it and made that the right way to do it.

[00:19:26] Nathan Wrigley: I’m just going to flip back to the comment that you made a moment ago where you said that you woke up and you printed out this summation. Let’s go with that. And it was 11 pages, and presumably that took a certain amount of your day to parse and understand.

How likely is it that that process will begin to run away from humans’ capacity to actually do it? So as an example, let’s say that a year from now that thing that you print out is 50 pages or 80 pages. Just the reading of it would be a whole morning, let alone the understanding of how those layers, and the stacks and the way that they’re overlapping and reliant upon each other.

Have we now, or have you now as an industry, have you almost handed the responsibility to figuring that stuff out, figuring out what the adversaries are doing? Has that gone to AI from your part as well? So is it AI versus AI basically, which seems very dystopian.

[00:20:18] Aaron D Campbell: We definitely pit AI against AI. It’s an extremely useful tool to combat itself essentially. And yeah, even for that 11 page one. Yes, I had to read through it and figure it out. but I did use AI to help summarise that. What are the steps that I need to do? Where does this actually track to in the code base?

I use it as an assistive tool in getting through that. And I do think that the longer the reports get, the more that’s going to be necessary. And now I personally, and several other people that I work with, have built testing rigs in AI, in various models, that are purpose built to help with this.

I can give it a report, in the repository and it can check its viability. It can see if that’s simplified. Check certain things. Is this a thing that requires some level of authentication, all these things that we use to have to do manually. And now we’re sharing around these sort of test rigs, or assessment rigs, that use this so that we can all use them, and grow them faster and make them better and make them more efficient. Because we are pitting AI against AI in many ways.

And as human, I think that it’s still important for the human to guide the process in a way that’s ensuring the fix is forward thinking enough, and that it’s in the right place and whatnot. Because in the end, the software is largely used by humans. But, in order to scale to the level that AI is pushing us to scale to, the human needs to be the decision maker, and possibly the opinionated one on form, and function, but not the logical power behind any of it now.

[00:22:01] Nathan Wrigley: Do you get the sense that WordPress itself is the target, or is WordPress just a bit of collateral damage? Are these adversaries of yours, are they specifically targeting WordPress because it’s got this giant footprint? Or is it more a case of this is just the adversaries just spraying and scatter gunning, and it just so happens that every so often they stumble across a WordPress thing.

[00:22:23] Aaron D Campbell: There is spray and scatter gun, just not running WordPress, or running your own bespoke thing is not enough to get away from AI trying to break your thing. But the bigger you are, the bigger the potential benefit from finding an exploit in you. And therefore, the more you are, like the bigger you are, the target is on you.

So WordPress has a big target, but it’s not just WordPress. Some big hosting companies also have a big target on their infrastructure in the same way that they’re targeting WordPress, their targeting, maybe a Hosting or a GoDaddy or a Blue. Someone big that has many people on it, not because they think their security is lax, or that they have some reason to suspect that there’s vulnerabilities, but because the payoff of finding a vulnerability there can be big. And so there’s a big focus there.

So yes, the bigger you are, the bigger the target. But that doesn’t mean that the scattershot isn’t also happening. And that they’re not also hitting small targets.

[00:23:24] Nathan Wrigley: Yeah. I suppose there would’ve had to have been a lot of joined up thinking in the past from a human to discover that, “Okay, this thing with Linux over here, okay we’ll just store that somewhere. But then there’s a PHP thing over here. Oh, and then curiously, there’s a PHP thing in WordPress, which,” that would’ve all had to have been conjured up by a human. And the memory of that would be difficult to maintain over time. But presumably the AI can just remember that forevermore. Store that PHP thing for the next decade and suddenly whip it out when it’s happens to coincide with some other thing. It’s fairly bleak.

Okay, so in terms of WordPress specifically, what is the incentive specifically? Why would somebody, let’s say somebody was coming after WordPress. What is it that they gain? What could they possibly have that benefits them off the back of a, let’s go for WordPress Core vulnerability which is, I don’t know, you can successfully log in as an admin or whatever it may be. What do they actually gain?

[00:24:17] Aaron D Campbell: It really comes down to money in end, if I’m honest. WordPress Core powers tens of millions of sites all over the web. Some of those have valuable stuff on them. Many of them frankly don’t. But that doesn’t mean that they’re worthless. They can be used, you’ve seen pharma ads and stuff showing up on a site, and it’s a pay per click kind of thing. And someone’s making some money off of putting not great ads your site. Even if you don’t get a lot of traffic, they’re making something. And when you’re looking at the potential of this vulnerability could apply to tens of millions of sites, you don’t need to make much per site.

But also, you could use that site as a way to have broad compute power to attack some other site. You’re using tens of thousands of sites to do it. Each one of them is on some separate IP. So now you have a distributed attack that’s harder to block than if you were doing the same attack from one place.

But you’re only doing that because it costs a lot to buy your own distributed power from everywhere. So you’re essentially stealing it and it’s making it, there’s some sort of worthwhile monetary value from it.

And so you may think, they can’t make anything off my site. They don’t have to. Your site’s one small bit in a huge array of sites that they’re trying to get, to get some monetary benefit in the end.

[00:25:40] Nathan Wrigley: So there’s no one size fits all. But money is essentially the broad overlapping thing?

[00:25:46] Aaron D Campbell: I mean, there are exceptions to that, where people are doing it for some political reason. Or some moral directive that they have or whatever. But the vast majority can be traced back to there’s money in it somewhere.

[00:25:59] Nathan Wrigley: I wonder curiously, because you mentioned about things like, pay per click style, you take oversight and you flood it with, I don’t know, nonsense about the thing that you’ve got and you want the world to notice. I wonder if curiously, people’s adoption of AI and that different way that we’re searching for things will actually impoverish that way of monetizing, because simply nobody’s actually looking on a search, well, increasingly people seem to be relying less and less on a search engine, and so maybe that kind of bit of it will dry up. Who knows?

[00:26:27] Aaron D Campbell: I love the optimism there. And I would like to think that those ads specifically probably will at some point. But the root of how those work is, I’ve broken into a site and I can inject some JavaScript ad, or some something like that.

And if those ads stop being valuable, then maybe I can inject some AI directives so that when an AI agent of some kind hits that site, it’s getting some sneaky thing snuck into its memory, or pulled in as a skill, that can then use that AI agent for nefarious purposes in the future.

I think that we can’t lower our guard against those things, because our adversaries will pivot and reuse it for something else. And so we will continue to protect against it.

[00:27:13] Nathan Wrigley: I’m going to peel back the contents of your head a little bit here. Because I’ve often wondered what the characteristic is of somebody like you who constantly facing this tidal wave of things. You’ve got to get up every morning, and every morning you could potentially wake up to the next big thing.

How do you just remain calm in the face of all of it? It’s a peculiar question, I realise, but tomorrow could be the next big thing. The day after that could be the next big thing. I’m imagining on most days now there is not necessarily the next big thing, but there’s a thing. It’s like you’re a fireman or something, except that there’s a fire going off in every district of town, and you are constantly busy and you never get to put the fire hose down. You’re just constantly at work.

[00:27:52] Aaron D Campbell: Some of us love that little consistent regular shot of adrenaline, and we get it in different ways than the firemen. But, honestly, I love complex problems solve. I love the challenges. Do I get exhausted and burnt out at times when they really do come every day for X amount of time? Sure, I’m human, I need to sleep, et cetera. But I think that it’s because I enjoy figuring out those really difficult problems, that I enjoy being in this space. And even specifically on this side of the space, the white hat side.

[00:28:26] Nathan Wrigley: Yeah. I suppose it’s like playing a good opponent at chess. You enjoy the chess game, even though it’s a hard thing and it stretches your brain. You play the chess over and over again because it’s a pleasurable thing to have your brain exercised in that way.

[00:28:39] Aaron D Campbell: And it’s like the more you do it the better chance you have at winning at chess. And I think it’s the same way in our game, right? Like the more you’re doing it, the more ways you’re finding to outmanoeuvre and to essentially win, and keep people safe online. And that’s, that’s exciting.

[00:28:56] Nathan Wrigley: You get the fist pump moment do you, there’s once in a while where you literally figure something out and you’re like, I nailed that.

[00:29:04] Aaron D Campbell: You absolutely do.

[00:29:04] Nathan Wrigley: Okay. Yeah. That’s really interesting. Your bio reads like an open source manifesto. I know that open source has been the thing for you throughout your career. I imagine that you could have gone into proprietary security and all of that.

But how does open source, particularly WordPress, how does that approach to developing software, how does that benefit the position that we can take and the security posture that you can take, and the reliability that you can have in things like WordPress going forwards? In your head, does it offer a superior model for fighting the adversaries?

[00:29:35] Aaron D Campbell: Yes, in my opinion it offers a superior model for fighting the adversaries. And the reason is actually still the same as it was 20 years ago when I started doing this. And I’ll explain why in just a second, but first, the reason is because we are able to benefit from many intelligent people, many more than any single company could with their source code.

Looking at our source code, and finding the weaknesses and even pitching in to help fix them. Hundreds of thousands, or millions, of people around the world are looking at our source code, finding those issues, and able to help pitch in and fix them, or report them to us so that we can, by having all that out there, it’s sort of like a building’s not less likely to collapse because no one saw the crack. It’s actually better that people are inspecting it, and finding those things and making sure it’s done right.

Now, that has shifted a little bit now, where in the past our adversaries looked at our source code too, right? They would immediately look at our repository when new things went out. As a matter of fact, when I ran the security team, I stopped committing stuff for a while, because it turned out that was a tell that this thing was probably a security issue, and people would look at that and try to figure it out.

So now the adversaries are using AI to watch our source code, which is also open to them, 24 7 and really look deep at it. But so are those many thousands of people using our source code for good. And so it’s still true that we have so many people on our side in helping us out, because our source code is out there because we’re open source, and it outweighs the bad. We find things faster because of that, and ultimately end up with more secure software more rapidly.

[00:31:36] Nathan Wrigley: Is there ever going to become a time where the amount of time that a vulnerability is available becomes moot? So in the past, a six hour window, where something wasn’t patched in WordPress Core, that’s a thing, but it’s not really a big thing. Maybe a month where something’s unpatched, that’s a big, I’m just wondering if in the future with the nature of the adversaries that you described and the tooling that they can bring to bear, if even like a three or five second window is going to become a thing.

[00:32:05] Aaron D Campbell: That is possible. We’re not at the three to five second window yet, so that’s good. I’ll let everybody relax a little bit. But the time from vulnerability disclosure to exploitation has shrunk dramatically over the last few years.

We did in fact used to have weeks, and then eventually days where it was okay to find out about the vulnerability, and responsible people, or responsible hosts, or responsible software companies could see that disclosure, patch the problem before there was much exploitation at all. And that’s now hours for major vulnerabilities.

As a matter of fact, we did a Monarx in conjunction with Patchstack, did like a year in review, thing looking back at last year. And we saw that for the more major vulnerabilities, it was about five hours. That’s not enough time for, you know, what happens if it happens in the middle of the night for a host who’s constantly monitoring that, immediately patching it, that’s difficult. And I do think that it will continue to shrink. And that that time that causes risk will be shorter and shorter.

And, we saw that with the recent wp2shell WordPress exploit. Once we released the patch, and everything was out there, the spike of exploitation that we as Monarx saw, like monitoring stuff happened within 30 minutes. Honestly, even a little bit faster than that. But the big spike started coming in about 30 minutes later, and that is just really fast.

But on the flip side, all that coordination that I talked about that WordPress did, had many millions of people already protected by then. And that’s how we have to look at it. We have to say, this is eventually going to get down to three to five seconds being a problem. How do we get ahead of it? And that’s what we’re trying to do.

[00:34:03] Nathan Wrigley: So a timely thing at the moment is this new innovation in the WordPress space called Protect the Shire. And Protect the Shire is the, a time bound moment where a plugin that has an update, it can’t be updated at the moment, I believe it’s standing at something in the region of six hours. On the face of it, that seems like a really excellent posture. But then there’s the flip side of that. If an exploit becomes discovered, and nobody can update their plugin for six hours, then that’s a big six hour window we’ve just painted. in the future where milliseconds may count. What do you think about that? It’s a interesting innovation. It’s something new. It was worth a try. Do you think that’s the way forward?

[00:34:41] Aaron D Campbell: I think it, was not only worth a try. I think it was a really good choice, and I think it will continue to be. We are seeing that a lot of current attacks are essentially supply chain attacks. How can we compromise whether it’s some package, an NPM package or something like that. Or whether it’s a plugin that’s gotten sold to a nefarious person, or even just hacked into and taken over by a nefarious person. That is happening more and this six hour gap helps protect against that.

But it can’t be a hard and fast, locked in stone, can never have exceptions, rule. And the truth is, it’s not. If there is a vulnerability in your plugin, or especially in a major plugin, reach out to the WordPress Security Team because we can coordinate a faster release, we can make an exception to that rule when it’s necessary.

And I think that for security fixes that are clearly security fixes that exception iss an easy one to make, because we do want to protect immediately. But slowing things down enough to make sure that there’s not been some sort of supply chain issue that is actually going to cause a vulnerability rather than fix one, is smart.

And so I think that it will find the right balance there as we continue to move forward, and figure out how to make better processes around this, to make it easier to do the right thing all the time, and know exactly which of those right things. But I think at the moment we’re in a pretty good place there and continuing to find the exact right place.

[00:36:18] Nathan Wrigley: It feels from the outside as if security’s fairly binary. On the one hand, adversary on the other hand, good guys. On the one hand hacked, on the other hand, not hacked. It’s black and white. But it seems from everything that you’ve been talking about today, that you are occupying a really grey area. You’re just trying to figure out what the path is forward. You’re constantly staring into the future trying to figure out what the adversaries are doing. Trying to patch, trying to make sure that everything is as good as it possibly can be. And I hadn’t really thought about it in that way. It’s not, there is no destination here where everything’s white. It’s a journey and every day’s going to be a bit grey. There’s going to be a bit of black and a bit of white, but a lot of grey in the middle.

[00:36:58] Aaron D Campbell: I don’t really look at it as grey, but I can see where you’re going there. But I think that there is this black and white, and then there’s sort of the cloudy. The further forward you look, the more difficult it is to know exactly where the black and white are always going to be. And some of that sort of comes across as grey. It’s a little blurry. You can’t quite figure it out.

But you’re right. there’s some prediction. There’s some, we think that moving this way is going to cause more white and less black. And that’s what we’re, that’s what we’re constantly aiming for. But you can’t just say turning right always makes things more white. Because sometimes there could be black over on that side somewhere, right? You’re really trying to be predictive, but not just randomly predictive, right?

Many of the people like myself that are trying to help guide this path forward, and even more than me, some of the people like Matt, who instituted that wait policy and some of the people that are running the WordPress Security Team, we have decades of experience watching this, that’s helping to inform our predictions. And so it’s not, we’re not just willy-nilly guessing. And I think that’s important to point out to the people that rely on us, to help guide them to the right space going forward.

[00:38:02] Nathan Wrigley: Yeah. Okay. So my schooling in chemistry was pretty basic, but I know that if I want to understand chemistry, my quickest way to do that is to rely on an expert, is to go and find a chemist who has years of experience. And, the same would be true here. I think most of us have probably not got the capacity to actually get a hold of what you’re saying. We, understand that your expertise is what we need to be listening to. But I’m just wondering for a typical WordPress user of whom many listen to this podcast, they have a WordPress site, but they’re not really interested in security, other than how it may impact their business.

So I’m going to ask for some very basic advice here. What would be the 1, 2, 3 things that somebody using WordPress with no security credentials whatsoever. What would be the few things that you would advise them to either go and read, or go and do, or go and think about?

[00:38:51] Aaron D Campbell: Yeah, so I think the biggest thing that I would encourage them to do, is essentially position themselves in such a way that they are relying on the experts, right? You’re not an expert and that’s okay. No one can be an expert in everything. But there are some things you can do to position yourself such that you’re benefiting from those experts.

One of those is updating as fast as possible. So WordPress auto updates turned on, those kinds of things. This WordPress Security Team that I’m talking about that has so much expertise in the area, and their whole focus is trying to make sure that WordPress is always secure. That lets you rely on them to help keep your site secure.

I think in similar ways, you want to find the right host that is also doing those security focused things for you, so that you don’t need to. And maybe that’s asking your host, what do you do to keep me safe? We talk about security, like the best security is layered security. It’s almost like having a gate at the complex, but also having a lock on your door, right? Those kinds of things. You can ask your host, what do you do to protect me in a layered way?

And maybe that question doesn’t make sense to you, and maybe even their answers don’t make sense to you, but if they have an answer, that’s good for you. It means that you can rely on their expertise.

And then stepping out of the obvious space to give a third thing that people should be doing. And this is, this may sound out in left field, but you should get some form of dark web monitoring for yourself, for your own credentials. And whether that’s going to someplace like, Have I Been Pwned, and looking at your own email address, and passwords and seeing if they’ve been in some breached data from somewhere, and are now being sold on the dark web. Or whether that’s using some service that offers it. I think that’s important, more so now than it’s ever been.

Because one of the other things that AI is doing that it’s particularly good at is collecting all this massive amount of breach data that’s happened over the last couple decades, that’s being sold on the dark web. Collating it all and saying, oh, we see that, gosh, 15 years ago, an account that Aaron had was in a breach. And we now know one of his passwords.

And granted it’s 15 years old, but it’s very easy for that AI to then say, where is Aaron now? What’s he doing? What can we learn about him? He works at Monarx. I wonder if this password works for his Monarx account. I wonder if this password works for the bank that he’s at. Or this other tool that we see that he uses. Let’s try all his social media accounts.

And so knowing whether that’s out there and being able to, you can’t get rid of that data, but being able to do things to protect yourself because you now know it’s out there is more important than it’s ever been.

[00:41:47] Nathan Wrigley: I hope you take this in the spirit in which it’s offered, but I really do wish to live in a world where you don’t have a job.

[00:41:55] Aaron D Campbell: Me too.

[00:41:56] Nathan Wrigley: But, am glad that we live in a world where you do, somebody like you does have a job. So I hope that landed correctly.

[00:42:02] Aaron D Campbell: If I could work to the point where I could work myself out of a job, I would find a new career and I would feel so accomplished, you couldn’t even imagine it. I’m okay with that.

[00:42:12] Nathan Wrigley: Yeah. Good. Aaron, just before we wrap up, is there a place where you hang out online where people could poll you if they’ve got a question, or any thoughts about what we’ve talked about?

[00:42:21] Aaron D Campbell: Yeah, if you’re looking for me professionally, you can find me Monarx.com, M-O-N-A-R-X.com. I also have aarondcampbell.com if you want some of my own more personal takes on security and things. And you can find me on Bluesky or the WordPress Slack. Those are probably the biggest places I’m at.

[00:42:40] Nathan Wrigley: What I will do, dear listener, into the show notes, if you go to wptavern.com and you search for the episode with Aaron Campbell, you’ll be able to find the links. I will dig out the Bluesky, and the various social links and the Monarx website and what have you, so you don’t have to hunt around too much. Go there wptavern.com. And Aaron, thank you so much for chatting to me today.

[00:43:01] Aaron D Campbell: Thank you. This was a really fun talk.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case a new way to keep up with WordPress news and updates.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today, we have Damon Cook. Damon has been a developer in the WordPress ecosystem for over a decade, working with WordPress centric agencies, and more recently running his own freelance business, Noma Digital. He’s a longtime community member, contributor, and someone who remains keenly engaged with the latest WordPress developments from releases like 7.1, to shifts in plugins, themes, and the broader WordPress landscape.

Damon joins us today to discuss WP Trend Watcher, an open source tool he’s created to help WordPress professionals keep up with the ever increasing deluge of news, community updates and feature releases. As the WordPress space grows more dynamic, and let’s be honest, sometimes a bit overwhelming, WP Trend Watcher is designed to sift through a fire hose of RSS feeds, summarise the trends, and inject some much needed human curation into AI generated content.

Damon talks about the importance of staying ahead in the WordPress ecosystem, especially for freelancers, agency owners, and developers who want to anticipate changes and support their clients.

He gets into the technical nuts and bolts, breaking down how the tool gathers, and summarises, news. The models and local AI setup he’s experimented with, and the balance between automation and critical human review.

If you’re someone who struggles to keep up with the relentless pace of WordPress news, and wants a smarter way to separate the worthwhile updates from the dross, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Damon Cook.

I am joined on the podcast by Damon Cook. Hello, Damon.

[00:03:04] Damon Cook: Hi, Nathan. Good to see you again.

[00:03:05] Nathan Wrigley: Yeah, thank you. Damon and I had a chat at WordCamp US. I think you said a little while ago that it was in 2024. So it’s been a few years since we’ve had a chat, and there’s been a few pivots in your life. At the time you were working for a hosting company, which I don’t think you are doing anymore. But we’re going to have a chat today about something which caught my attention probably on social media, I imagine, I saw it there. It’s called WP Trend Watcher.

I would just say at the beginning before we get stuck into the topic, if you go to the WP Tavern website, I will bury all of the links in the show notes. So anything that we discover today, go and click on the links over there. And actually given the nature of the topic, it might be wise, dear listener, to go and do that before you get into this podcast, because it’ll be fun to have a poke around and be forewarned as to what is it that we’re going to be looking at.

So anyway, Damon, thank you for joining us again. Just before we begin, I mentioned that you have changed roles in the last 24 months or so. Do you just want to tell us a little bit about you and your roles in WordPress over these many years?

[00:04:07] Damon Cook: Sure, yeah. Yeah, been a developer in WordPress ecosystem for over a decade. And always been with WordPress-centric agencies. And yeah, as of the past year about, I’ve just been running my own freelance, Noma Digital, then also doing some contract work. And yeah, and still keeping up on all the latest WordPress news and features coming out. 7.1, what is coming out in, well yeah, in like a week, I think.

[00:04:37] Nathan Wrigley: Yes. Yeah.

[00:04:38] Damon Cook: Lots of cool stuff there.

[00:04:39] Nathan Wrigley: Yeah, there really is a lot happening. Genuinely, there is a lot happening in the WordPress space. And, it may be that you’re a developer, and so that side of things captures your attention. But from my perspective, I am not really a developer, but I am curious about all the things that are going on, because I’m fascinated by Core and plugins and themes and blocks and all of that.

But equally, the community side and all of that. There’s a whole load going on, and events and marketing and loads going on. But that deluge of information, that sort of fire hose is very hard to keep a track of. Some websites that were publishing for many years die out and other ones replace them, and things come at you from different angles.

And so you have built a tool, WP Trend Watcher, which you’re able to put on your local machine. I believe that’s right at the moment. It’s a sort of local install, and we can talk about the technicalities of that in a moment.

But this tool, the way that you’ve built it is primarily pre-built, if you like, to go out and inspect the WordPress space so that you can summarise the zeitgeist, of what’s going on in the WordPress world. You can keep up without having to do that manual slog of going out, reading everything, spending hours every day kind of wasting time, and I’m doing air quotes there, if you know what I mean.

Okay, so my first question is revolving around the why of this. What was the importance here that you felt that you wanted a tool that did this for you? And really what I’m trying to get there is why did you feel it was important to keep up with the WordPress space? Is it… if you’re a client, if you’ve got relationships with clients and you’re building client websites, is it not enough in your scenario just to know that WordPress drops, they do a version change every now and again, we get a release, I’ve got a suite of plugins, I probably need to keep up to date with those. Why? Why are you interested in the broader landscape?

[00:06:34] Damon Cook: Sure, yeah. I’ve been a, I was pretty active contributor for a while to the project, not so much lately. But, when I was a contributor there was, I mean, there’s always been a lot of news to keep up with, between Slack and Trac and WordPress.org stuff. But I started to see some of what were the reliable sources in that area. And as I work with WordPress daily, I still need to keep up with what is coming down the pipeline.

And so yeah, I just wanted to take that, it was very a selfish starting point. I needed to take all these RSS feeds, get them summarised, but then also verify that, what’s being summarised with AI isn’t just hallucinations or some kind of, you know, mistrust was there, because that’s a critical component to this project was the human layer. It’s just pulling in a bunch of RSS feeds, summarizing it, and then I go through and make sure the summaries and click through it, like a lot of the stuff, and read it, and it’s helpful for me to process and see what’s actually going on and then provide my own judgment on it, so.

[00:07:47] Nathan Wrigley: The sort of curious bit there then I suppose is that you, it feels like you always want to be one step ahead of what’s happening in the WordPress space. And I suppose if you’re being a freelancer, having that knowledge of what’s coming up, particularly in WordPress and WordPress Core, because I’ve noticed that a lot of RSS feeds, for want of a better word, and we’ll get into that in a moment, are Core related.

So that then sort of tells me that you want to be ahead of what’s coming in the next feature set so that you can, I don’t know, forewarn your clients, or practice things that you know are going to suddenly drop on a particular day of the year, and so that when the inevitable call comes, “Why is this there now?” And, “How does this new feature work?” You’re ahead of it all. Does that kind of summarise your interest in it, or is it more eclectic than that? You’re just curious about it because it’s curious.

[00:08:39] Damon Cook: Yeah, I mean there’s certainly the curiosity is there, but yes, I do like to be at the bleeding edge of what is coming down in the new, like for example, the 7.1 release coming out. Just seeing what’s being worked on, what might have gotten dropped from proposals. Yeah and just I guess being in the ecosystem, I’ve seen how a lot of the community has come and gone, and what has been critically talked about is, what is a critical feature, and why might something not be worked on and all that stuff.

So yeah, it’s just a selfish way to keep up on the latest, developer news and, yeah, and share it out and summarise it and get some human judgment behind it.

[00:09:22] Nathan Wrigley: A curious thing which is not related to this podcast, but most Mondays I do like a live show in which we have three or four panelists, and we bat around the WordPress news from the previous seven days. And I’ve been doing that show for, oh, I don’t know, maybe seven or eight years or something like that. And in the sort of the week preceding, I go around the internet, I look at social networks, I read the blogs that I’m familiar with. I’ve got a giant list of RSS URLs in a feed reader, and I go through, and I read them, and I look at them all.

And it, genuinely is incredibly time inefficient. That is to say that I open things, get halfway through, realise there’s nothing really for me to talk about here with my guests, and there’s probably nothing for the the listeners to engage with. And so I lose a lot of time, doing that exercise, and it strikes me that in the era of AI, that would be, the intention here is to cut out that. Cut through the dross, sift out the bits and pieces that are of interest, and make the bits that finally reach your eyeballs worthy of attention.

How have you orchestrated that to happen? Because with the best will in the world, I think we all know that AI can go off the rails a little bit. It may be that it doesn’t quite match the intentions that you would wish it to have. How are you corralling it to be what it is that you want?

[00:10:47] Damon Cook: Sure. Like I alluded to, it just stemmed from a selfish kind of interest in keeping up on these news sources, and I knew a lot of them all had RSS feeds. I think that even I, you know, I have a fascination, an obsession almost, with AI these days and I’m always trying some cutting, more cutting edge stuff and tinkering.

But I think even myself, and I think I see a lot of people confuse AI with automation. And so it’s interesting to see, when I, this project, I didn’t want to automate the whole thing, like just go get RSS feeds, AI summarises, AI publishes, just do it, right? Which I can, we could potentially do with the project, but I limited it to that contract of, go get these RSS feeds, the latest news, come back, summarise them, and then show them to me so I can audit them.

A lot of them, I just open up like yourself. It seems counterproductive, but I actually like that’s how I really keep up. Because if I just read the paragraph from the AI summary, which I do, it’s it’s not really covering, and might miss something in that full article that actually really interested me.

So you know, I click through most of these and I’m reading. I peruse, I don’t read every single word for sure, but I peruse and just try to validate that the summary matches, and then I look for tidbits that might been missed that I’m curious about, and then drop that in the human summary element of the published final briefing. So that’s the workflow of it right now.

[00:12:27] Nathan Wrigley: Yeah.

[00:12:27] Damon Cook: That’s how I’ve set it up and I enjoy just the whole, the sequential part of like gathering and then, there is an automation of it shows me everything I gathered, and then gives me an area to write my thoughts and then I click through everything. So it’s just turned into a weekly, kind of hobby project and it’s fun to do, so.

[00:12:48] Nathan Wrigley: Yeah, so the bit that is infuriating to me is just the dead time. And the dead time for me is not once I’ve found the link. That for me is when it actually becomes interesting. You click the link, you open it, and you do the reading and what have you. It’s finding the link and finding the interesting thing.

[00:13:07] Damon Cook: Yep.

[00:13:07] Nathan Wrigley: And so I think, it is totally credible to get AI to do that. And I have this, I’m not a great user of AI. That is to say I’m not somebody that uses AI an awful lot. But it’s becoming pretty clear to me that one of the areas which it genuinely is good at is curating like a silo of information. You give it a body of information, a corpus of information, and say, “summarise that,” or, “Draw out of that the bits that might be of interest.”

Now, it’s not perfect, but it seems to be exceedingly good at that. The creative side, maybe less so, and we don’t really need to get too much into that. But this bit of drop the corpus of information in, summarise that, publish your results. That seems like a really credible way of using AI in the year 2026, and that is indeed what you’ve done.

So now that you’ve got this built, and I will link to a report so you can see Damon’s previous, I think you’ve got seven or six or something like that, previous ones from previous weeks up, and you can see them all. It basically ends up in a bullet-pointed, numbered list of titles with links, and then maybe one sentence of about 20 words following on from that. And then that will obviously either lead to a click or not.

How have you found those summaries to be? The 20 or so that you’ve got in each of your little editions. How have you found them to be? Do they seemingly accurately represent what’s contained within, or does it tend to go off the rails a bit?

[00:14:39] Damon Cook: No, they’re accurate.

[00:14:41] Nathan Wrigley: Yeah.

[00:14:42] Damon Cook: The key kind of component there is when the summaries happen, it’s using, I set it up because I wanted to use local models. It’s all prompt-based, so essentially, it’s going to these RSS feeds, getting the latest articles and links, then parsing that through AI and saying, and passing a prompt along saying, “summarise this for developers and agency owners with a critical eye on, X, Y, Z.”

And so that’s where things do actually come, they come back pretty accurate. And the inference of what the summary shows, it’s fascinating. But yeah, it’s pretty accurate, and the fun part is trying to prove it, to see like, “okay wow,” that sounds like it would interest me as a developer and agency owner. I’m going to click and read through and make sure that’s an actual thing, and not a hallucination. So it’s like a game of just fact-checking in a way.

[00:15:46] Nathan Wrigley: I’m curious to know what it doesn’t include. So for example the addition, I’m going to call it an addition. I don’t know. Oh, summary. There we go. Weekly summary is what you’ve called it. This particular one has 19 items listed, and I don’t know if it produced 19 different things and all of them got written to the page, or if, I don’t know if you can see in the background, 34 just didn’t cut the mustard. Can you inspect what didn’t get included and thereby start to have intuition to say “okay, I wonder why that one didn’t cut the mustard?”

[00:16:20] Damon Cook: Yeah, there is a built-in, for the AI to, when it does a review, it checks sources and it looks for duplicate, two kind of posts on two different sites about the same exact topic. It’s going to try to not do a summary on both of those.

[00:16:39] Nathan Wrigley: Okay.

[00:16:40] Damon Cook: So it does check for duplicates, weak language, missing sections. So it does do some of that to cut out the duplicate work. But also, yeah, it’s not looking, like part of the prompt and part of the exercise for AI is to not look for superfluous, just like really fact-based deterministic stuff and not just you know. It’s funny because trend is in the title, right? WP Trend Watcher.

[00:17:06] Nathan Wrigley: Which is maybe the exact opposite of what you’re after.

[00:17:09] Damon Cook: It’s kind of like it’s not really looking for what’s popular, but what is factual coming out of a lot of these sources.

[00:17:17] Nathan Wrigley: Okay. When you are looking at this, this is a strange question, and I don’t know how you’re going to react to this. How does it make you feel? Do you have the intention that you’re cheating on the Damon from five years ago would’ve thought, “Oh, this is horrific, somebody did all this with a computer. This should be done by, a human being should be corralling this.” How does it make you feel on that level?

[00:17:41] Damon Cook: Yeah, it does make me feel cheap.

[00:17:43] Nathan Wrigley: Yeah.

[00:17:45] Damon Cook: And I think that’s kind of why I publish these. It’s trying to be transparent. So if anybody’s going to go and read this, they know that I even put at the bottom how much time I spent trying to look through everything. So you can take all those facts and base whether you want to read this or not.

[00:18:08] Nathan Wrigley: Yeah.

[00:18:09] Damon Cook: Did he spend enough to? You can pass your own judgment. Did he spend enough time? Maybe he should have spent more time.

[00:18:14] Nathan Wrigley: Yeah.

[00:18:16] Damon Cook: But yeah, that’s part of the exercise for me is making this open source, and just having this public, and so if folks do find it fascinating and helpful, they could even fork it and try to do something else. Or I even have, possibility to submit sources because I’m always thinking “Should I have another source in here?” or.

[00:18:39] Nathan Wrigley: Yes, yes.

[00:18:41] Damon Cook: There’s room for improvement too.

[00:18:43] Nathan Wrigley: The issue there is you end up with scope creep, don’t you? And before you know it, you’ve got 5,000 RSS feeds that you’re pummeling everywhere, and then you really are in a maze of trying to figure out what’s relevant and what’s useful.

The report that you get on the front end, obviously, you’ve got these AI generated the numbered list, in this case 19, the one that I’m looking at. Again, links will be in the show notes.

But then the interface that you built provides the option then to add sort of human notes, for want of a better word, at the end. So it’s not just a case of, okay, that’s where it ends. The idea is then that you would go in, contribute for yourself what it is that you feel is important here, free form writing like we always used to do, and so on.

[00:19:24] Damon Cook: Yep.

[00:19:24] Nathan Wrigley: Why did you include that bit? Why, what was the purpose in having that? Was it just a more human curated portion at the end, so you wanted to remember what you actually thought?

[00:19:33] Damon Cook: Yeah. It’s twofold. I wanted the human in the loop. It’s a pretty popular phrase these days with AI, but I wanted that aspect there. But also selfishly, a game to fact-check a lot of these things and make sure AI isn’t hallucinating. But also it’s the exercise of memory of like going through and reading these things, because then I actually, you know, it registers in my brain. Like this is really what’s coming down the pipe. Because if I just read through the summaries, even if they were 100% accurate and I just trusted them out of the box, I feel like it doesn’t necessarily always register for me. So the actually exercise of going and clicking and reading through and comparing to what AI summarised is helpful for to sink in that data.

[00:20:20] Nathan Wrigley: I think if this were something that I was looking at, and I’m definitely not ruling out doing something like this because I genuinely think there’s a lot of merit in my specific case for this. I think I’d be looking at four of those a day and just trying to, I don’t know, at 9 in the morning just before the day begins, or at 5 at night just as the day’s about to end, the workday. Just go in and look at a few of those. Because I’m like you, if I read the AI 20-word summary, there’d be no substance to that and I wouldn’t remember it.

But the fact that the interface is there and those articles have been surfaced, and I presume you could probably run one of these each day and adapt what was there the previous day and what have you. So technically then, how does it work? I’m fairly sure that this is a thing which you have built, and is currently sitting on a machine in your house somewhere.

[00:21:08] Damon Cook: Yep.

[00:21:08] Nathan Wrigley: Just describe the technicalities of what you need to get, on your machine to make this occur.

[00:21:13] Damon Cook: Yeah. It’s a TypeScript code base, and it’s on GitHub, so you can fork it, contribute to it. But yeah, I run it. You can pass in kind of a flag. I run it weekly. It was just an arbitrary decision, and it felt weekly would be good. But you can, yeah, it just checks basically the last date of when it ran, and then tries to grab the sources.

Then I use LM Studio application on my Mac, which allows me to kind of download models that are fit for my system. I have an 18 gigabyte memory that I can work with, so that is limiting. But, I think a lot of these models are coming down in size and the local AI movement, I don’t know if it’s a movement, but I think it’s taking off in a lot of ways.

[00:22:07] Nathan Wrigley: Yeah, I think so. Yeah. Yep

[00:22:09] Damon Cook: We’re starting to see a lot more, yeah, local implications. That was part of the exercise for me, was exploring that. What models I could use on my system, and then what were the results of using those models with this tool for the summaries.

So yeah, I think every week at the bottom, that’s part of the report is what model I used locally to run the summaries against. And I try to switch it up. I think I used probably six of them, I used the same model. I think it was a Qwen model. Then the most recent one I used, I switched it up, and it was a, I forget the name even. It was like an LS.

[00:22:49] Nathan Wrigley: Oh, these things come and go so fast. Yeah.

[00:22:51] Damon Cook: Yeah, exactly. And that’s the fascinating part is just to drop in a new model and see how it does, and the softwares look like, because they do change. And even the report, I think you’ll, if you just compare this week’s with last, just the output is a little different. And I’m trying to… That’s something I plan on working more towards is deterministic, the output. The summaries are one thing, but then when it outputs into the final report, getting that more deterministic. Especially, I really want to have footnotes, so that people can see where these summaries and stuff are, what they’re exactly they’re linking to. It’s kind in there but it does’t always output exactly the same in formatting, so.

[00:23:35] Nathan Wrigley: So you’re doing this work on the local machine, and then obviously I’m looking at it so it’s published, by the looks of it on GitHub. Is that all automated or are you curating that process? Or have you got, you know, your local machine is bound to GitHub, your GitHub repository and so this is all automated in that sense as well?

In other words, what I’m saying is if you took a break for a month and came back, would this all just be chugging along in the background and producing these weekly reports? Or is this something that you manually invoke on a weekly basis and copy and paste and what have you?

[00:24:07] Damon Cook: That’s the part that, yes. I just run the report and write my judgment in it, then publish it to GitHub, and then GitHub does a little, it takes basically the artifacts and just spits them out. But there’s not much there in the automation on GitHub. It’s just publishing it to GitHub Pages.

The fact that I have a section that’s required for human in the loop kind of takes away full automation. I could make it run, but then I would have to take that component out of me reading through, clicking through, and writing my own judgment at the end of the report. And I don’t plan on getting rid of that. I actually enjoy that aspect, so.

[00:24:47] Nathan Wrigley: So it’s become a bit of an interface. The AI plus Damon equals the finished product. You really don’t want it to be automated. And in a way, that feels to me a bit like, I don’t know, a race to the bottom. If we automate all the things, I just don’t know where the audience for that lives, because you’ll, never really know. Because there’ll never be a moment where you look back at it and say, “Is anybody reading this?”. “Has anybody talked to me about this?” and what have you. Whereas the fact that you’re interested in it, you’re on this podcast talking about it, you’ve got an interest in the subject matter, you’ve clearly engaged with it. I don’t really have a question there, but there’s definitely something there. The fact that you’re in the weeds of it and it’s not just AI for AI sake, I think is important.

[00:25:32] Damon Cook: Yeah. And it’s, yeah, that’s a great point. And I think that makes me, I don’t know, I guess go back to, where some of this started from. Yeah, I think people are creating their own knowledge bases. And you even touched on this. Just having that corpus of artifacts, a lot of that AI can do these days, and you can automate some of that.

But, how you take all that data and get the human in the loop and, is it even interesting if you, it’s interesting maybe to you to read, but if you want to share that, is it going to interest others? And yeah, the human aspect is critical for me there, because, especially if you’re going to share it publicly, you know.

[00:26:14] Nathan Wrigley: Yeah.

[00:26:14] Damon Cook: At least be transparent.

[00:26:16] Nathan Wrigley: Yeah, so you’ve called it WP Trend Watcher. And it feels to me, if I was to rewind the clock to, I don’t know 2023, where for the first time we were all beguiled when ChatGPT came along, and we all just thought this whole interface was remarkable. But it felt, oh, it’s novel, it’s interesting, it behaves in many ways it’s a bit, I don’t know, passed the Turing test and it convinced us that it was human.

But now that we’re in the year 2026, it feels like one of AI’s central roles is just, as I said earlier, these corpses of information, but not finite in the way that a human brain is. There’s only a capacity that I have to remember so much, and it’s alarmingly little. But over time, if you were to stick with this endeavor, the name that you’ve given it, this sort of Trend Watcher, it feels like the data that you’re gathering, as it grows and grows and the AI’s capacity to manipulate, understand, I’m doing air quotes, “understand” and, create meaning from the disparate bits of data, that will grow over time.

And so it’d be interesting in 2027 and 2028, what happened? Why did that bit never got built? And how did we get this thing shipped into Core? Where did it come from? What were all the little bits and pieces? Where were the jigsaw pieces that led that to happen? And how did this happen? And what’s the market trend? Why have we got a 4% decrease or an 8% increase in market share? How’s all that happened?

So it feels to me as if you keep pushing this out, that kind of information will be available, kind of MCP-able, by simply asking it questions, in a way that we’ve never had available to us in the past. Again, there’s no question, but do, you know what I’m saying there?

[00:28:03] Damon Cook: Yeah. I think, when I set out to build this there is, and there is still a component where I do want to have kind of the trend watching part of taking these past reports and having AI review them, and come up with inference of was there a trend? Why, yeah, why did we go from report 1 to report 18 about this? Maybe there’s this feature in WordPress 7, whatever. What changed there? And come up with a separate component for that. I haven’t built that in, but that’s kind of a potential, that’s always the end goal. And keeping these receipts for now and generating these reports is just the scaffolding in a way.

[00:28:48] Nathan Wrigley: So it feels to me as if it really isn’t bound to WordPress. You could run with what you’ve built and point it at just about any industry or thing. Your local tennis club or, whatever it may be. You could, over time, build up this sort of trend analysis, and see what’s going on.

And dare I say it, you could even implement it upon yourself so that you can see, what’s the cadence of my writing? How have I done my fitbit data or whatever it may be? You can see that, even as I’m saying the words, I’m thinking, “Oh, this is a dystopia that I don’t want to live in.” But at the same time, I’m really curious as to what that bigger capacity to maintain state and hold data over time. What that will furnish us with.

Because we all forget things, our brains are very ephemeral. Things that are important to us come and go. We misremember things constantly, and it will be really interesting to see what things like you’ve built, are going to enable us in the future. And it does seem like this is baby steps. The humans in 2029 looking back on the work like you’ve just been talking about for the last half an hour will think, “Oh, that was cute, but look where we got to now, we stood on the shoulders of those giants, and here we are now.” It’s fascinating and terrifying in equal measure. Let’s say it that way.

[00:30:11] Damon Cook: Yes. Yeah, absolutely.

[00:30:13] Nathan Wrigley: Yeah.

[00:30:14] Damon Cook: There’s so much data and it’s just growing, right?

[00:30:17] Nathan Wrigley: Yeah.

[00:30:17] Damon Cook: It’s going to get worse before it gets better.

[00:30:19] Nathan Wrigley: Yes. Well, it’ll be very interesting to see how it all lands. But, what I would encourage everybody to do, I’m going to link to at least three things. I will link to the GitHub repository, which is obviously at Damon’s GitHub account. It’s colorful-tones, and then this is called WP Trend Watcher. I’ll also link to damonacook.com, where there is a blog post about how you can get up and running and what the necessary steps are for you to do that.

But I will also link to the sort of output, which is again, it’s a GitHub repository, but you can go and see the weekly summaries and what have you, and judge for yourself whether or not this is something that you want to install on your local machine.

I think the inevitable is going to be that there’s going to be more and more of this in our lives. It remains to be seen whether we have the time to actually interact with the data that it puts out, or we’ll need another layer of AI to cope with the level of AI we’ve got, if you know what I mean. It’ll be wheels within wheels.

So there you go. Anything you want to add? Did I miss anything there before we wrap it up?

[00:31:27] Damon Cook: No, the only thing just you know I’m colorful-tones. Actually, it might not be with, it might not have the hyphen, but on X. And then on LinkedIn I try to just share the report out weekly on there just for folks keep up, but that’s about it.

[00:31:47] Nathan Wrigley: Lovely, in that case, I will endeavor to find your Twitter or X handle and various other bits and pieces. And, wptavern.com, if you search for the episode with Damon Cook. It’s spelt in the way that you might imagine, D-A-M-O-N Cook, C-O-O-K. Search for that. And yeah, thank you so much for chatting to me today, and bravo for a topic which I think I’m going to be leveraging very much for my WordPress news cycle.

[00:32:14] Damon Cook: We can get that, get some RSS feeds and we can get them, get you hooked up.

[00:32:18] Nathan Wrigley: Yeah.

[00:32:18] Damon Cook: You can start generating some other reports.

[00:32:20] Nathan Wrigley: Okay, great. Yeah, let’s have a chat after we click stop in a moment. Damon Cook, thanks so much for chatting to me today.

[00:32:26] Damon Cook: Thanks.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case, the decline of WordPress work on Upwork, and the rise of new opportunities.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today, we have Adrian Sticea. Adrian has been working in the WordPress space since 2013, starting out as a developer for small companies. Then moving into freelancing, agency roles in the US, major projects at IBM, a, stint at StellarWP, and extensive work with enterprise level clients.

Most recently, Adrian’s post on LinkedIn about the dramatic drop off in WordPress work through the Upwork platform, went viral, sparking many conversations and comments.

I suspect that many WordPress professionals listening have seen shifts in their freelance workloads, and maybe wondering what’s behind these changes. And Adrian is here to share his own data-driven account.

He talks about his experience using Upwork as a primary source of project leads. How for years it was a reliable fountain of work, but recently the flow has all but dried up.

We dive into the possible causes, the impact of AI making developers more efficient, and thus reducing hiring demand, changes in the broader economy, increasing competition from rival platforms, and how the nature of WordPress work itself is changing.

Adrian mentions the difference between simple website builds, which are still in demand on Upwork, and complex plugin or enterprise projects, which he thinks might have migrated elsewhere.

We also talk about diversification, whether it’s a mistake to rely on just one marketplace for freelance work, and the importance of building real relationships, collecting testimonials, and seeking recommendations. Adrian shares how he’s pivoted, leveraging LinkedIn for networking, connecting directly with agencies, and building partnerships with recruiters and temp agencies.

If you’ve ever felt your freelance pipeline shrink, are curious where the most interesting WordPress work has gone, or want to hear how other professionals are adapting to marketplace shifts, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Adrian Sticea.

I am joined on the podcast by Adrian Sticea. Hello, Adrian.

[00:03:34] Adrian Sticea: Hey.

[00:03:34] Nathan Wrigley: Very nice to have you with us. Adrian is joining us today because of something that he posted on LinkedIn, which captured my attention.

I’m not a frequent lurker on LinkedIn, and so I don’t really know how the algorithm works. But Adrian and I have, as far as I know, not been in communication with each other before. But, Adrian’s post went really viral, I think it’s fair to say, and it certainly caught my attention and got into my feed.

And it’s all about the state of work in the WordPress space at the moment, particularly through a particular platform. And we’ll get into that in a minute, though. Adrian, if it’s okay with you, do you want to just tell us a little bit about your backstory? What it is that you’ve been doing these many years and so on?

[00:04:15] Adrian Sticea: Sure. I started working as a WordPress developer in 2013. I worked for a couple of small companies, local companies that needed kind of customer support, and also web development. And after that I started doing freelancing for about two years. I moved to the US in 2016, that’s when I started to look around for better paid jobs.. And I started working as a WordPress developer for a digital marketing agency, and I did that for, about a year and something.

In 2018, I joined IBM to work on one of their WordPress projects. I think it was the largest WordPress one that they had at the moment. Basically it was a learning platform, and the courses were about technology, programming and other stuff. I left IBM at end of 2020 because of multiple factors, and I started doing freelancing.

I freelanced for about three years and after that I joined StellarWP, where I worked in the marketing department as one of their web engineers. And I worked there for about a year and a half. And at start of 2025 I started doing freelancing again. And since 2018, I mostly worked with enterprise-level companies and more complex work than just building websites.

That’s the stuff that I’ve been doing for the past.

[00:05:40] Nathan Wrigley: Thank you for that, and all of that really plays into what we’re going to talk about because, what I’ll do is I’ll link to the post that Adrian wrote, which kind of went viral on LinkedIn. And the first thing you’re probably going to capture is there’s a graph at the bottom, and it’s a line graph, and it’s not pleasant to look at this line graph. Because it starts off and there’s this blue line and it’s fairly high up on the on the axis and it moves across horizontally. And it just goes along and along and then it just starts to tail downwards until finally, it hits the axis and it basically zeros out.

And so I caught sight of that and I thought, “okay, that’s interesting.” And then caught sight of the word WordPress, you know, and you being a WordPress developer, and then noticed that this was the volume of work that you had been receiving. And we’re talking about volume of work coming through a particular platform. The platform is called Upwork.

Now, I confess I don’t know a lot about Upwork, so we can get into that in a moment. But essentially, it looks like from the year 2015 through 2020, more or less everything that you did, bar a couple of percent, maybe 5% in some years and what have you, was through the Upwork platform. And then by the year 2022, 20% of that had been shaved off, so down to 80%. A year later, 2023, 60% and then 40%. And then in this year, 2026, 0%. And I caught sight of that and I thought, “okay, we’ve got to talk about this,” because there’s a lot of interest in the WordPress space at the moment.

So do you just want to just run us through your journey with the kind of work that you’ve been doing through Upwork and, you know how it’s tailed off? And then maybe we can get into the discussion about perhaps why this is happening.

[00:07:32] Adrian Sticea: Sure. Just to preface, I had periods of time where I worked on Upwork just part-time, not as a full-time freelancer because I had jobs here and there.

[00:07:43] Nathan Wrigley: Ok, yeah yeah.

[00:07:44] Adrian Sticea: And I was actually calculating this morning how much time I was full-time freelancing and full-time on a job, and it was kind of split in half. So basically, half of my professional career was spent as a freelancer, and the other half was doing part-time. So if I had a job, I will search for other avenues to get a bit more revenue in. And also I didn’t like the idea of just relying on one source of income.

So I always had running in the background, the project, a couple of hours here and there or, a week or a project a month that doing. And that graph represents the number of basically of leads and projects that I got from Upwork over the years.

[00:08:28] Nathan Wrigley: Okay.

[00:08:28] Adrian Sticea: Even if it’s full-time or part-time, basically that was kind of the lead source that I primarily used.

[00:08:34] Nathan Wrigley: And so what we’re seeing, I guess is you, like many people in the WordPress industry, you’ve taken the approach that, subscribe to a bunch of these, I’m going to call it a marketplace, you know.

[00:08:47] Adrian Sticea: Yes.

[00:08:48] Nathan Wrigley: Something like that, where you subscribe to this marketplace and it can bolster what it is that you do already. So maybe you’ve got a 50% gig somewhere where you’re part-time and you need something to top that up. Or it may be that, come to rely on it, and it genuinely has been 100% of the income that you’ve accrued in particular years.

But how do you explain though, the fact that it has kind of just gone down? Because to me the obvious explanation, and it’s a fairly, you know, this is the kind of explanation which is being rolled out everywhere at the moment, is AI. Simply because it seems to coincide so perfectly with the advent of AI.

Now, I don’t know if you’ve got any thoughts beyond that, you know really the graph takes a massive turn in the year 2023, 2024, sometime there. And that seemed to be the moment at which, the kind of work that many of us have done in the past perhaps was getting done by AI. And if not getting done by AI, people at least had intuitions that there would be a future in which that work could be done by AI.

So that’s my first pass at this. Do you think there’s anything in that whole AI debate, whether or not it’s captured the kind of work that you may have got from Upwork?

[00:10:06] Adrian Sticea: I think the answer is more complex than just blaming AI for everything that is happening in the marketplace right now. Definitely AI plays a role because it made developers more efficient in shipping code, shipping features and stuff that clients need.

But I don’t think it’s only reason because if you work with clients and stuff like that, you’ll know a client will pay you to do a work. They will not go themself, even if it’s with AI, do the work. So because of it, because AI it’s making developers build faster, the need for developers decreased. That’s one of the reasons behind it. If you want to blame AI for anything, it’s that it made developers faster.

[00:10:55] Nathan Wrigley: Okay, that’s an interesting one. So the work in your experience anyway, the work is still there, it’s just the expectations of the clients maybe have gone up. So instead of wanting X amount of work, they may want 1.5X or 2X or whatever it is, or perhaps have it delivered in less time or something like that.

[00:11:12] Adrian Sticea: I think it’s a fair assumption. But also probably market, the way that the economy is right now, I don’t think it’s in a good shape. And also one of the factors. Like, if you look at the number of layoffs, a lot of companies in the tech sector, ’cause I think this was more affected than others, happened in the past three years.

[00:11:35] Nathan Wrigley: Yeah that’s true. Yeah.

[00:11:36] Adrian Sticea: But AI most likely was an accelerator of that just because. And before 2022, a lot of companies needed engineers to support the demand for people staying at home. And after they didn’t need that demand, a lot of layoffs happened and AI came along. And just it was basically a perfect storm for massive layoffs ’cause you had engineers that can deliver more work, and you didn’t need that many engineers because the demand was not there anymore.

[00:12:09] Nathan Wrigley: I suppose the other thing we should bring into question is the popularity of WordPress as an avenue to gain work. So for example, I don’t know, probably 2018 feels like a good place to point the needle. 2018, WordPress couldn’t be more popular.

[00:12:30] Adrian Sticea: Yeah.

[00:12:30] Nathan Wrigley: It was just really really super popular, everybody was talking about it. It was an exciting place to be. Lots and lots of work. Lots of companies getting in and investing in all sorts of bits of WordPress.

[00:12:41] Adrian Sticea: Mm-hmm.

[00:12:42] Nathan Wrigley: Whether that was the community or getting plugins built, and shipping them and all of that kind of stuff.

[00:12:46] Adrian Sticea: Yes.

[00:12:47] Nathan Wrigley: And so I wonder if maybe that plays into it. You know these companies, who require websites to be built, or projects to be built. I wonder if they’ve cast their gaze elsewhere, and so that reservoir of work in the WordPress space on the Upwork side has dried up a little bit.

[00:13:03] Adrian Sticea: Yep definitely today there are more options than there were in 2018, like with the rise of Wix, Squarespace, other page builders. Definitely, made people that just wanted websites built, like presentation websites, simple stuff, not rely on WordPress. Because to be honest, WordPress out of the box is not that user-friendly for building a website as the other competitors are. Because you still, or at least before the full site editing was introduced. But even then, it’s a steeper learning curve than other page builders in a sense.

But where I see the deep is actually in newer projects rather than legacy ones, where companies that used WordPress to build their infrastructure, at least web infrastructure on. Because newer builds probably rely more on AI than on WordPress, and that’s kind of basically the, where the market shifted.

But again, like if companies used to build, because I see this in the clients that I serve. Not one of them that I worked with probably the past two to five years said like “Let’s remove WordPress from our web assets and just build it with AI,” because they understand the value of it, and also like technical debt and what actually maintaining software means so.

[00:14:23] Nathan Wrigley: Do you think then there might be a realignment? Let’s say you’re a fairly large company and you’ve got WordPress website as you just described, you’re willing to let go of that. You’ve got so much stuff in there and legacy, and all of your staff know how to use it and what have you.

Do you think though, perhaps we’re in an era though where the experience that somebody with 20 years building on top of WordPress could bring, would make them an absolutely invaluable asset? You know, you’ve got John Smith over there, he’s done 20 years of really hardcore WordPress development, and therefore he’s the person that we’re going to reach out to, or at least, if he comes through a platform like Upwork, that’s really credible.

I wonder if we’ve entered an era where, and I’m going to use the word vibe coding, we all know that’s fraught, and not really the right term to use, but I hope you get what I mean. I wonder if it’s now that people are questioning that, and thinking more like, do we really need John Smith with his 20 years of experience at $250 an hour? Or could we hire somebody with half the experience, a quarter of the experience, who charges a quarter of the rates? And if we factor in that it might take a little bit longer, but they’re going to use AI along the way. Do you know what I mean?

[00:15:39] Adrian Sticea: Yes.

[00:15:40] Nathan Wrigley: I’m just sort if that that kudos that your experience used to bring you. I wonder if that’s being brought a bit lower in people’s estimation of importance when they’re hiring.

[00:15:50] Adrian Sticea: I think it might. But again like I think the answer is more complex than yes or no. And I think it all depends on what part, or role, the website or web assets that were built on WordPress is valued by the company.

So if it’s really important thing, probably they will not think about redoing it using AI. If it’s not that important, because I saw this, if it’s not that important it’s just probably a brochure website. It doesn’t do a lot. It doesn’t bring in. It’s just for visibility. Some of them they move to, again, like probably Framer or they just vibe code it.

[00:16:29] Nathan Wrigley: So given all of that, and we’re pontificating and guessing why.

[00:16:33] Adrian Sticea: Yeah.

[00:16:34] Nathan Wrigley: And the truth is we don’t really know.

[00:16:36] Adrian Sticea: Exactly, yeah.

[00:16:37] Nathan Wrigley: We’re putting our finger air and kind of trying to figure it out. However, given that we don’t know, what we do know is that this line chart that we can see, of yours has gone really in a very different direction. Flat lining for years, lots and lots of work available, and now kind of like nosedive, and then more recently fell off a cliff. And so does that mean that you are struggling to find work? Or does it just mean that you’ve pivoted and that work in a different way?

Does it mean that the Upwork platform, I don’t know, is no longer aligned to WordPress, or just doesn’t have WordPress as a priority? How can you explain it, and we’re talking about Upwork in particular.

[00:17:20] Adrian Sticea: Yes.

[00:17:21] Nathan Wrigley: How can you explain it happening in that way over on that platform specifically?

[00:17:26] Adrian Sticea: One of the things that happened, it was probably saturation of a marketplace. That’s one.

And the other thing is that different competitors are on the market right now, outsource companies and more like, just to put it in perspective, most of my clients, probably 95%, are US-based clients, are not somewhere in UK or somewhere in Eastern Europe, or somewhere in other places that are still needing WordPress work done. And the type of projects that I’m looking for are not websites, basically. They are complex builds, plugin builds and kind of regular maintenance that people need. If they have legacy code base that they need maintenance, or adjusting rule or a code rebuild and stuff like that.

So those kinds of projects are not there anymore. You can still find work in building websites on WordPress, or having small gigs. But the type of project that I used to get on Upwork, like I said, like pretty complex builds are not there anymore. And my read it’s like I said, it’s more complex. Probably it’s a market.

[00:18:40] Nathan Wrigley: So, there’s a particular kind of work that you used to get in Upwork which has dried up? And the, let me just understand that correctly. So just the website building side of it, did you say that was still okay? know if you’re just trying to hawk your service as a website builder, that’s fine. But the kind of “I need a plugin,” or, “I’d like a plugin adapted,” or what have you, that kid of stuff has gone away?

[00:19:06] Adrian Sticea: So most stuff that are more developer focused are kind of dried up. At least in the US, because I’m not looking outside of US. So the US market shifted away basically from Upwork towards probably different competitors of them. Or using like temp agencies, or recruiters that pre-vet their developers before they are presented with a candidate they can have a discussion with.

[00:19:33] Nathan Wrigley: Okay. So I’m thinking immediately of things like Codeable and things like that, where they’ve just got a slightly, maybe they’ve got a slightly different approach, I don’t know?

[00:19:40] Adrian Sticea: Yes, Toptal I think also they pre-vet their developers. And also like I said, temp agencies like Robert Half or, I don’t know, whatever tech systems that are here in the US. Basically you have a discussion with the recruiter before being presented to a potential project. It’s a different workflow basically. Because of it, it presents a better candidate than Upwork can present to a client.

[00:20:04] Nathan Wrigley: Okay, so that’s interesting. So we’re apportioning some of the responsibility for this on the platform and the way the platform works and what have you?

[00:20:14] Adrian Sticea: Yes.

[00:20:15] Nathan Wrigley: And so, you know one of the things that we constantly talk about in the WordPress space is owning your own stuff. So for example, rather than posting stuff onto Facebook, write it on the WordPress blog, and then if Facebook goes out of business, or somehow decides that your account needs to be closed, you’ve still got access to it.

[00:20:31] Adrian Sticea: Mm-hmm.

[00:20:31] Nathan Wrigley: And so I’m going to flip that into this conversation and say that sort of seems like potentially what’s happened here to you with Upwork. Presumably over the years, you’ve fostered a relationship with Upwork, and built up your kudos over there, and at some point presumably Upwork recognized that, “Oh, this Adrian guy, he’s really good. Look, he’s getting loads of work. Let’s push Adrian,” and so on and so forth.

Do you have any regrets about putting the eggs into that one basket? Now that you’ve got to the point where the line has hit zero and there’s no work coming through? Do you wish that you’d have been on a variety of, maybe you have been, but do you wish that you’d been on a variety of different marketplaces? Or is it just, “Okay, this has happened. I didn’t think it was going to happen. Time to move on and try the different marketplaces”?

[00:21:19] Adrian Sticea: I think not only me, but people usually are nearsighted, so they don’t think long-term. So whenever I started on Upwork, it was pretty easy to get clients because you don’t have to pay a fee, or you don’t have to go to events, or meet people in person, which for developers is pretty hard, at least for me. I’m a pretty introvert person. Going, mingling around with other people, it’s not something that I look forward to do.

[00:21:46] Nathan Wrigley: Yeah, I get it.

[00:21:46] Adrian Sticea: Or it’s something that it’s in my skill set. Over the years, I got better and better because I’ve worked with clients and became more confident in my skills and stuff like that. But Upwork presented a easier way to get clients, and that’s kind of the appeal of those kind of marketplaces, because you don’t have to go outside of your comfort zone. You just have a keyboard, apply for a different bunch of gigs, and you can get accepted or not.

Just to put it in perspective, probably half of the work that I’ve done was only through messaging back and forth, not even interacting with a real person, which for a developer is really appealing.

[00:22:28] Nathan Wrigley: No kidding, yeah.

[00:22:29] Adrian Sticea: It’s easier in a sense because, again, like it’s easier. But to be honest, the larger projects that I took on Upwork, or outside of Upwork needed that human touch. Like meeting with the client, talking about your skills, how you will approach the project and all of that. So they can gain confidence that you are competent enough to take their work.

So that’s kind of the reason why I got into it. If I have any regrets of it, of course, because if you leave that, you are basically handcuffed to that platform if you want to get more work. Because you don’t have any contacts outside, and also, it doesn’t produce any referrals.

So if a client is satisfied, the maximum that they can do with it, is just leave you a good review because they are so scattered around, they don’t have any other contacts that you can get recommendations from. So basically, for all the clients that I had, I didn’t get recommendations altogether. Probably just one in the past 10, 11 years.

[00:23:32] Nathan Wrigley: Okay.

[00:23:33] Adrian Sticea: That’s not good for long term, because you rely on constant getting new and new work from different clients. It’s not sustainable in a sense, because you have to focus yourself on delivering the work, but also getting the work, instead of building a network of clients that can supply that work for you, and recommend you to their friends and other of their peers.

[00:23:56] Nathan Wrigley: Yeah, I suppose a lesson to be learned, with the benefit of hindsight, is to spread yourself around, but also go looking for those kind of recommendations, and ensure that people endorse you and maybe even write you an email or something that you can put away somewhere and kind of have a bank of credible testimonials and so on and so forth.

Now, the piece itself on LinkedIn got quite a lot of commentary. I have to confess, I didn’t go reading all of the different comments that people had put in. But did you get a sense that the people that were commenting had had a similar experience from you? Or do you feel that you’re in some kind of unlucky, unhappy valley that nobody else over on Upwork is experiencing?

[00:24:37] Adrian Sticea: No, I think I talked with agency owner, that most of their work comes off of Upwork, and they said they didn’t get any. Actually, this was the post that inspired me to write this. They didn’t get any work this month or in July from Upwork, even though they constantly applied. And one of the things that he said, it stood up was that, if they increase a bit their prices, they will not get any responses.

So basically, probably the market became more sensitive on spending. And because of the rise of AI, you can say that AI commoditize more development than it used to be. So it’s not just a me thing. I think it’s a general.

[00:25:24] Nathan Wrigley: So it is more broadly across the platform there. So fees you brought up, that’s interesting. I wonder if people are playing a bit of a wait and see game, and just keeping that money in their own bank account just to see how the landscape changes. Maybe this heralds a change in the industry which is going to stick for a while where the fees that people such as yourself can charge are going to be driven down, because less work seems to be available, so people are going to be more sensitive to the cost of it, and the competition will be greater and what have you.

[00:25:53] Adrian Sticea: Yeah.

[00:25:54] Nathan Wrigley: I guess only time will really tell. Yeah.

[00:25:57] Adrian Sticea: And also most likely is, the fact that AI commoditize programming in a sense. They are not the same number of WordPress projects that are started now. And they use, I don’t know, whatever AI is better on building with, which is like JavaScript-based stacks. And that’s probably the new directions where the new projects are going to rather than WordPress.

[00:26:25] Nathan Wrigley: Okay, so just before we wrap it up then, let’s move to this point, which is that, no matter how much you inspect all of this, and out what’s going on, and the reasons behind it. I guess the bottom line is you’ve got to do something.

Maybe you’re perfectly all right, and you can take this hit from the Upwork platform and that’s absolutely fine. You’ve got other irons in the fire. But I’m guessing the next question’s pretty obvious, which is what are you doing to shore up this considerable loss of income? What’s the plan that you’ve got going forward? You may not have a fully hatched plan, in which case your best guess is fine. But I’m curious to know what your idea is to keep your irons in the fire and to keep the through put of your business up.

[00:27:07] Adrian Sticea: Just to put in perspective, my income didn’t decrease because of Upwork. So I’m pretty good, I’m in a pretty good shape. The thing is that I shifted away from relying on it, and trying to get, work through other avenues. And one of the other avenues that I am expanding on right now is basically LinkedIn, and it’s not.

[00:27:27] Nathan Wrigley: You’re suceeding.

[00:27:29] Adrian Sticea: I’ve succeeded on getting viral, yeah.

[00:27:33] Nathan Wrigley: That’s the first step, isn’t it, in a way?

[00:27:35] Adrian Sticea: Yeah, exactly, yeah. So I took three different approaches on LinkedIn. One was to post content, to see if I get any interaction with potential clients. I did get a couple of leads from that, and I get some gigs from it.

The other one is actually talking directly with agency owners that build websites, but from time to time they have a need for either adjusting a legacy code base, or building something more complex that they don’t have in-house tools for. So I started building those relationship, and I do work with couple of different agencies that I they provide work for me from time to time.

And the third one is talking with recruiters from temp agencies. So I build couple of relationship with some of the big temp agencies, and whenever they have a project that it’s my lane, they contact me first basically, and I get to talk directly with the client, and they decide if they want to work with me or not.

[00:28:34] Nathan Wrigley: So in a sense, although there’s this cautionary tale of, gosh, this whole thing dried up, the bigger picture is that actually the whole thing didn’t dry up. There are different ways of getting the same work. In your case, you just had to be a bit creative for a few months, and start to talk in different ways to different people.

[00:28:51] Adrian Sticea: Yeah, and also another thing is that I needed to start thinking a bit more long term rather than one-off projects, not one-off projects, but just thinking that one source of leads will basically provide whatever I need every month budget-wise.

Also this is how business used to work. Like you went, you interacted with a person, and they give you a business or not. Not chatting with a person on the other end of the world, and they give you work.

So basically, fostering those relationships are more beneficial, and to be honest, they pay better than clients on Upwork. And you get into the cycle of recommendation, and you don’t, it’s less work for you to get clients than it is on Upwork, but it takes longer to build those relationships.

[00:29:46] Nathan Wrigley: Right. And that’s a really interesting observation, isn’t it? Because essentially the advice that you’re giving there is as old as the hills really, isn’t it? You could have had that same marketing advice in like 1930s.

[00:29:56] Adrian Sticea: Exactly.

[00:29:57] Nathan Wrigley: Which is, go out, find people who you can work with, build up a longstanding credible relationship with them, and then the next time they need a bit of work, which hopefully they will, you’re going to be the first person who they’re going to call.

But it’s curious how we’ve all fallen into, and I’m just doing air quotes, “the trap” of having these platforms around you know, like Upwork. It just allows you to very easily get work here, there, and everywhere. And it’s only at the point when that starts to dry up for all the reasons that we discussed that you realise, okay, gotta pivot a little bit. But it’s great to hear that in effect, it’s had no impact on your bottom line. It’s just meant that you’ve had to pivot, do things slightly differently, go outside, get out of the office and go and interact with people in the real world.

[00:30:46] Adrian Sticea: And again, like the projects that I was able to get outside of Upwork are for better clients that I did on Upwork. It’s not that I didn’t work on interesting projects on Upwork. It’s that the opportunities that can lead after the work is completed for those clients are bigger than the opportunities that you get from working on, for clients on Upwork.

[00:31:08] Nathan Wrigley: Oh, I see. Okay, so the long tail of work, you know, let’s say that you land a client and they build website in the year 2026, maybe they’ll need an upgrade in 2028, and they’ll need some modification in 2027 that you’re the person to do it.

Yeah, whereas Upwork is more here today, gone tomorrow. Disposable thing, you finish it, move on, another thing, another thing. And that’s worked for years, but maybe that system, certainly for you at least anyway, is drying up and you’re trying out other things, which I hope you are successful with. I guess that’s the perfect place to, to call it a day.

[00:31:40] Adrian Sticea: Mm-hmm.

[00:31:41] Nathan Wrigley: Honestly Adrian, all the best of luck. I know that when you put that post out, it must have been, it’s hard to write that kind of stuff, isn’t it? Because it demonstrates that in some way you’ve had to modify things and that things have been a struggle. But it’s nice to hear that you seem to have got a handle on it.

[00:31:58] Adrian Sticea: Yes.

[00:31:58] Nathan Wrigley: And I would wish you the best for the future.

[00:32:00] Adrian Sticea: Thank you.

[00:32:00] Nathan Wrigley: If anybody wanted to reach out to you, because we have a fairly large audience, and I wouldn’t be surprised if one or two people out there were going through something very similar, where’s the best place to reach out to you? I can obviously link to your post on LinkedIn.

[00:32:14] Adrian Sticea: Yes.

[00:32:14] Nathan Wrigley: And people can click on the link and contact you via that. But is there any place you hang out online?

[00:32:18] Adrian Sticea: Yeah, mostly LinkedIn. And if you want to check my website out, it’s CustomWP.io. That’s kind of my avenues of contacting me and that’s about it.

[00:32:28] Nathan Wrigley: Okay. I will put that into the show notes. So if, dear listener, you’re listening to this, head to the episode with Adrian in it. Probably by the time you listen to this it’ll be one of the first two bits and pieces on the WPTavern.com website. Go and click into the show notes and all of the links will be buried somewhere in there.

So, Adrian Sticea, thank you so much for chatting to me today. Good luck with the future.

[00:32:50] Adrian Sticea: Thank you.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, what draws people into the work of open source projects.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today, we have Amy Kamala.

Amy’s journey into tech is anything but conventional, starting with a master of fine arts from UCLA, and a passion for art that eventually bled into, and was overtaken by technology. Since 2018, she’s been an active contributor to WordPress, serving multiple teams such as the Hosting and Core Teams.

Her career zigzags through key roles at DreamHost, InMotion Hosting, Pantheon, Canopy Studios, and local government. Picking up everything from technical support and web development, to managing teams of designers and DevOps staff. Along the way, Amy has organised WordCamps, led teams, and is currently being sponsored by Elementor for her open source work.

Today’s conversation gets into the chaotic, creative, overlap between art and tech and how those different mindsets can feed one another, especially in the world of WordPress. We talk about the blend of creative and logical thinking needed in web development and why skills like user experience, curiosity, and even willingness to fail publicly can set you apart.

We then turn to contribution. What draws people to volunteer in an open source community? What Amy gets out of participating far beyond her paid hours, and the messy journey from being an eager helper to an essential part of the team.

She explains the unique feeling of the WordPress community, the importance of being welcoming to new contributors, and why being outgoing and not afraid to ask questions can be your biggest asset.

If you’ve ever wondered about the blurred lines between arts and code, why people throw themselves into volunteer work in the WordPress ecosystem, or what’s really at the heart of this global community, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Amy Kamala.

I am joined on the podcast by Amy Kamala. Hello, Amy.

[00:03:22] Amy: Hello. Thank you for having me.

[00:03:24] Nathan Wrigley: You’re very welcome. Amy was introduced to me by Jonathan Desrosiers, who’s been on this podcast many, many times before. I don’t exactly recall the nature of that introduction, but I’m very glad to have you on the podcast today. The intention really is to have a broad, wide-ranging, no-holds-barred conversation, I think about contribution, why people do it, and the community in general. So we’ll see where it takes us.

Amy, firstly, thank you for joining us, and I wonder if you wouldn’t mind just telling the listeners a little bit about yourself. Honestly, you can go in any direction you like with that. Maybe if you, I don’t know, bind it to WordPress or contribution or whatever it may be, that would be good.

[00:03:59] Amy: Thank you too. Thank you so much for having me. I’m happy to be here. So I’m from Venice Beach, California, and I’m actually an artist and my background is in art. I have a Master of Fine Arts degree from UCLA. But a lot of my artwork was supported by technology, and at some point, technology crossed over, took over, and now my technology is supported by artwork.

I’ve been contributing to WordPress since 2018. In 2019, I became a team rep for the hosting team, and I am now on my sixth non-consecutive year as a team rep. And this year I’m also a Core team rep, which has been really fun and I love working with both teams.

I started working in the tech industry in 2015 in social support for web host, DreamHost. I was there for about five years, a little bit less than five years. I worked my way up from social support to technical support to live chat, and then helped form a specialised WordPress support team. And I was taking escalations, training team members, devising and documenting team processes. And while I was there, I helped strategise and implement new WordPress products which made revenue in beta, and that was really fun. I got to work directly with the CEO and the VP of product, and I learned a lot doing that.

Then I left, and I became a tech lead at a web dev agency, and then the pandemic hit, and we all know how that went. And then in 2020, I started working for InMotion Hosting as their web development manager. I was responsible for over 23 online corporate assets, five web servers, multiple Jira projects, and also the supporting infrastructure, the DevOps pipeline, GitLab, so on and so forth. And I loved that. It’s actually, that was one of the best jobs I’ve ever had. They’re a great company. It was amazing working there. I had an amazing boss. Totally great. I still have friends from there, and from DreamHost for that matter. And DreamHost was also great. I have a special love in my heart for DreamHost. I’ve known those guys for a really long time.

And then I was recruited by Pantheon to be a solutions architect for their professional support team. That didn’t work out for me as I had hoped, and I left a little bit less than a year later and started being a web developer for my local government. Again, I was recruited. I didn’t pursue these jobs. I may have gone in a different direction if I had. And that was a year-long contract. It ended in the end of 2023, and I’ve actually just been freelancing ever since then. I have a contract with a company called Swishtech. They’re not a WordPress company. They’re not even a web development company. They are an AutoCAD. They train and sell AutoCAD software. And they’re great too. And I also am sponsored by Elementor to contribute to the WordPress open source project.

[00:06:58] Nathan Wrigley: Gosh, you really have done the whole lot, haven’t you? There’s just almost no stone that you haven’t turned over and looked at the underside of. That really is a fascinating story, yeah.

[00:07:09] Amy: Thank you. There is, I considered completely abandoning both of those careers, art and tech and going into psychology and becoming a therapist at some point recently over the past few years.

[00:07:22] Nathan Wrigley: Right, okay. Well I could definitely talk about that. There’s somebody very close to me in my family who does that kind of work.

Can I ask, this is a complete segue, the fact that you pursued art at such a high level tells me that there must be some yearning inside of you for that side of life, you know, the artistic side, the creative side and what have you. I’m wondering if there’s any bit of technology that satisfies that, or do you find that you have to go back to the art to sate that craving? Or are there creative pockets inside of tech that allow you to sate that sort of desire to be creative?

[00:08:00] Amy: So that’s a great question and very insightful of you. Yes, so in 2015 when I started working for DreamHost, I’ve known the founders and some of the managers of DreamHost since like 1999-ish. That’s a different story, but I had just finished grad school and I was kind of in a bad living situation and I just needed a job, any job. I didn’t care what job. And so I hit them up and I found like a entry-level social support, entry-level job that I qualified for. It’s pretty easy to qualify for that. Hit them up and said, “Will you recommend me for this job at your company?” And of course they did. I still went through the interview process and like did typing tests and so on and so forth. But that’s how I ended up.

So it was kind of just circumstantial that I started working in tech. And then once I was there, I tend to get really hyper-focused, and I really hyper-focused on my work at DreamHost on moving up and learning technical things. I’ve always kind of had an aspect of technical. When I was doing art, strictly art, just art, I was still doing technical things. In undergrad I got into, well, so I started, I learned HTML when I was like 18 years old in the year 2000. I was an HTML programmer. It was one of my first jobs. The other job, my first job was working at Venice Beach at one of the stores down there. But like first real job, HTML programmer for a web development agency and graphic design.

And then I went to undergrad and I did a lot of fine art, sculpture, video installations. And working with video is pretty technical. You’re using computers. I also learned Photoshop at Otis where I went to undergrad. I still use it. It’s like one of my primary mediums for making art. But working with video is pretty technical. You’re doing editing, you’re working on a computer, there’s definitely a technical aspect to it.

And I also, I had a boyfriend at the time who was doing web development, and so I started learning PHP and Perl. And I started using PHP as a tool to make my animations. I was making little animations at the time, and video art interactive. So I did some installations that utilised interactive elements that actually used web technology.

Then I was working at an animation studio on a Red Hat box. So I had to, I learned Linux, and I also was introduced to Avid which is a high-end, professional video editing software or film editing software. And then I was working at a film post-production facility where I was using DOS, which is Command Line. And also I was working in the tape room transferring tape formats from one to the other. It was pretty technical. And I was also helping their web team manage the online video assets, uploading and downloading with FTP and so on and so forth. So there’s always been an element of tech integrated in my art.

And to answer your question, working in tech primarily, there’s definitely an element of art that supports, that has supported my career in tech. UI/UX design and graphic design rely on the same fundamentals as fine art. Composition, colour, so on and so forth. And so my training there, and I have some, I don’t like doing graphic design. I, like, actually really hate it, but I do have some professional experience doing it. And that led me to be able to lead teams of designers and developers. At InMotion Hosting, I had five developers and three UI/UX designers on my team, who I was the manager of.

So it wasn’t just development that I was doing there. It was also user experience, very user experience-focused. And so my experience with art has definitely supported my experience with tech and vice versa.

Yes, there’s definitely a yearning that, you know, I wanted to do, I wanted to make weird, cute, maybe a little dark experimental films. And I haven’t been doing that for the past 10 years or so.

[00:11:54] Nathan Wrigley: I always think that the motto for WordPress is code is poetry. I think if you peel back the curtain on that just a little bit, obviously, it may be that you’re just trying to create a website, but there are creative ways of doing that. But also code code really does unlock something, but still it’s quite a logical thing. And I’ve always found those two things difficult to overlap. The sort of Venn diagram of logic meets creativity that, I don’t know how well they fit together. But it sounds from what you’re saying that you feel that the two things have married well in your career.

They’ve enabled you to do things because, I don’t know, maybe it’s thinking outside of the box or something like that. Your capacity to think differently to other people. But I’ve always found that curious. I’ve never had a particularly artistic grain of anything in me. I’m much more logical than I am creative. So I’ve always sort of struggled to see how those two things marry up.

[00:12:49] Amy: Oh, well, you know, that’s actually something that I’ve thought about a lot. And the too long, didn’t read, answer for me about that is, so art is experiential. It’s not about the object necessarily. It’s not even about your skills. It’s about creating an experience. The viewer, relationship between the viewer and the item that they’re looking at. Books, movies, music, all of that, it’s experiential. It creates an experience. And so do websites, so does software, so does using the software.

One of the reasons that Apple is so successful is because of the user experience, because they focus on it being an easy, intuitive, fast experience to use their products. And so when you think about it in terms of user experience, and in terms of just human experience, there’s a lot of crossover.

[00:13:41] Nathan Wrigley: When you worked at some of those companies that you mentioned, I presume that you were surrounded by lots and lots of people, in an office environment. So this question, I hope it lands correctly. I’m certainly not trying to put anybody in a box or stereotype anybody. But did there tend to be a fairly interesting split between the kind of character that you would find on the, I don’t know, making the website look nice, let’s say. You know, putting the pixels on the page, the design and what have you, and then the people who are writing the code in order to make those designs a reality.

I just wonder what, if there’s an aisle down the middle of those two camps where, okay, the artistic people, they’re all over there, look at them being artistic, and over there, there’s all the coders, look at them crouched over their computers being logical. I don’t know if there’s a there there, but I’ve always found that curious too.

[00:14:25] Amy: Well, it crosses over in web development. A lot of web developers are doing, as a web developer, you have to do CSS, SAAS, you have to style the front end. If you’re on a, you know, a big professional team, you’re going to have designers, and then you can just pull the styles from software. But if you’re on a smaller team, which, you know, the majority of people end up working at some point on very small teams or even, like, a one-person team, you do it. And so there’s quite a bit of crossover in web development.

In software development, you’re probably always going to have a bigger team, and so you’re going to need designers. But web development, there’s always web developers that like have a history in graphic design, have a history in UI/UX design that ended up also coding. And those designers don’t necessarily tend to be really great at like PHP and JavaScript, but they do tend to be phenomenal at CSS.

[00:15:18] Nathan Wrigley: Oh, interesting. Yeah, okay. Thank you. I took us on a total detour there. That was really not intentional, but it was kind of fun peeling back the curtain a little bit there.

[00:15:27] Amy: Well as a team lead, it really helps to know people’s strengths and talents, that you’re likely to have developers who are more logical and who, like, they can bang out some code. It’s going to function. It’s probably going to have all of the crosses and the dots and the so forth. But then you also have developers who are more visual, but they just kind of like ended up working in development. And that’s who you would want to tap to make something look really nice but still be functional.

[00:15:52] Nathan Wrigley: Yes. It’s a rare and wonderful thing when you encounter that character who can do all of it. I have a friend, a very dear friend who, it doesn’t matter what task you put in front of him, he just excels at all of it immediately. And it’s rare, you know, because there is this sort of, most poeple get into a niche, don’t they, and they become good at a particular thing. And as the world requires us more and more to be specialised in one thing or another thing, we do tend to lean into, I don’t know, I’m a CSS person, or I’m a PHP person, or I’m into JavaScript, graphic design or whatever it may be. And when you encounter that one character that can do literally all of it, I’m a bit in awe, frankly. Quite a lot of my jealous genes kick in and.

[00:16:31] Amy: That’s very interesting. I am the one character, you know, I’ve had my hands in, DevOps, system administration, but also design, art, user experience, accessibility, so on and so forth, which has served my career, you know, being a web development manager, it was absolutely necessary to have that range of skill set. But I will say that I don’t specialise in any of those things. I’m not like a, you know, JavaScript specialist or anything like that. I’m not the SMC on all of those technologies, but have a good umbrella overview that allows like cross-functionality.

I wouldn’t mind specialising in something like that, but I just haven’t really found a niche. I kind of ended up in leadership roles because I’m outgoing and chatty. And so that reads as leadership ability. And I’m good at organising. So those are some leadership skills. And so I kind of ended up, but I ended up in leadership roles before I had mastered anything other than like drawing and maybe video editing. And so in a way that’s been really good and it’s led me on this career path, and also in a way it’s been really bad because I’ve not been able to focus on any specific skills to excel in those. I guess I’ve excelled in team management.

[00:17:50] Nathan Wrigley: It sounds like you’ve not done too badly. It also sounds from, I mean I’m reading between the lines here, and forgive me if I’ve misconstrued what you were saying. It also sounds like from the go, since you finished your arts program, it sounds like you’ve been quite intentional. You know, when opportunities have arisen, the way you’ve described it makes me feel that you can sense an opportunity and you grasp it with both hands, and you’re willing to learn something which maybe last week you’d never heard of, but this week, okay, that’s a thing. Let’s give that a go. Again, forgive me if I’ve got that wrong, but it sounds like you’re quite a force of nature. Let’s go with that.

[00:18:23] Amy: Thank you. That’s correct. I love learning new things, new skills. I’m never like, well, I’m only going to focus, that’s part of it too. It’s a conscious choice to not focus on just one thing. I did at one point kind of like sit down and say to myself, we have to make a decision, art or coding? And I actually determined that I should just stick with tech, the technical end of things because that makes more money than art, even like with a full-time job.

[00:18:53] Nathan Wrigley: Yes. It is difficult, isn’t it, to become an artist in whatever field of art that may be. I think the chances of you making that work from an economic point of view are much more unlikely than they are.

[00:19:06] Amy: Well, I could tell you as a fine artist, I have made $0.

[00:19:10] Nathan Wrigley: Right. Okay. Well there you go. That puts it into stark relief. That gives us some idea.

It also sounds from what you’re doing that you’re on more of a journey than you are arriving at a destination. And what I mean by that is, it feels like maybe if I chatted to you in a decade’s time, who knows where you’re going to be. It’s more of a, this is where I am now. Tomorrow might present something entirely different. Again, I could have that wrong.

[00:19:32] Amy: No, I think that’s actually totally correct. I’ve kind of, I haven’t really been that intentional with my direction. I tried to be when I, you know, made a decision, art versus tech, to go with tech. Secondary decision, I had already decided to go with art and then, you know, switch careers. But at this point I don’t have, like I don’t dream to be a product manager or dream to be, you know, a coder or a specific thing, a software engineer.

I’m not quite sure to be honest. I do know that I love working in the tech industry, that I love working on teams, I love working on software, I love collaborating and focusing on user experience. And I even, I really actually, I loved being in technical support. Being social and chatty is both a blessing and a curse because my entire career exists because I’m outgoing and social and chatty, and I just randomly message people and start talking to them or randomly walk up to people. You know, and that’s how I ended up in all of it pretty much, and even working on releases.

And that’s also helped me to be able to do those roles because I will randomly message anyone and be like, hi, blah, blah, blah. So that really works to my benefit. But it also, like sometimes I say too much, or I definitely talk too much, way too much, way too frequently. And I might like be bothering people. And I’ll ask them. But at DreamHost, Kira Schroder and Mika Epstein both worked at DreamHost at the same time as me. And because I’m not shy and I am apparently not afraid to talk to people, I started messaging them and asking them questions. And not just them, but the other developers and leads, and the VP of product and so on. It helped that I already knew them, but just started asking them questions.

And also, being willing to be embarrassed and to look stupid is a huge plus because you learn a lot from making mistakes. If you make those mistakes in front of people, you’re going to remember. You’re going to remember the answer to those mistakes. And that’s kind of what I’ve been doing. I’ve kind of stumbled up, and asked a lot of stupid questions, which I’m still doing.

[00:21:46] Nathan Wrigley: I’m just going to interrupt you there very quickly because I love when I meet people who have no shame about failure. I’m being really serious. You know when you meet that character who literally doesn’t have the capacity to feel shame for their inability to do a thing that they’ve never done before? I don’t know, you see somebody who’s picked up a tennis racket for the first time and clearly can’t do anything useful with it, whatever it may be. Just imagine almost any scenario. But they are absolutely happy to do it in front of other people.

I know for me that’s not a gift I possess. I could be racked with sort of, oh, shame and all sorts of other things because I haven’t managed to achieve this level of competency out of the gate. And when I see people doing that, you know, failing willingly in front of other people, I’m always, always thinking, I really should be more like that.

Because I’m glancing around thinking, where are the people that are pouring scorn on them? And the answer is, they’re never anywhere to be seen. There’s nobody, generally speaking, looking and going, look at you. You messed up with the tennis racket. No, there’s just people looking going, oh, hang on a minute. No, what you need to do is this.

[00:22:58] Amy: Right, try this technique and.

[00:22:59] Nathan Wrigley: Right, people around to support. And yet I seem to have, that is a thing in me which I suspect I’ll take to my grave, to my great cost. So well done for being that characteristic.

[00:23:11] Amy: Thank you. Well, I do have shame and fear of, I don’t prefer to fail in front of, for example, 54,000 people in the Core Slack channel. But I’ve done it so many times at this point, I’m like, yeah, I’m going to. I’m going to. I’m going to learn and I’m going to do better next time.

Also in, way back in the day had a brief stint with performing. I was in a theater group, and one of the things that I learned in that theater group, and it really, really stuck with me, is that when you have an audience, the audience is rooting for you. They want you to win. They want you to succeed. They want to hear what you have to say. They want to see you do your whatever it is you’re there to do.

And so when you think about it, I have horrible stage fright, so this doesn’t fix my stage fright but it does kind of fix the mentality of like being embarrassed potentially, or being afraid of failing in front of people. But you go into a room to lead a meeting, or to do whatever it is that you’re doing and you are going to be nervous, but it’s inevitable that you’re going to mess up because you’re human. And to look at it in the way that like, I’m going to mess up and everyone’s on this journey with me and they support me and they want me to win, you know? We’ll fix it together, we’ll learn together, we’ll.

[00:24:23] Nathan Wrigley: We need more of that. Don’t know how many times I’ve preached that gospel to my own children, only to not be able to actually carry it on myself.

I’m going to pivot us slightly. I’m going to sort of draw us into the WordPress space because it’s a WordPress podcast after all. You found yourself in some fairly, I don’t know, important decision-making processes, sort of like contributing to Core and what have you. Can you just chart the journey for that? Like, how did you get to the point where you were contributing your own, presumably free time in some cases? Maybe it was on the company dollar, you know, maybe you were sponsored to do that. I think you implied earlier that that was the case. How did you end up picking WordPress and whichever team that you’ve spent most of your time in? Just chart that journey for us.

[00:25:04] Amy: So that leads us back to DreamHost. DreamHost back in the late, around 2017, DreamHost was, they’re a regular web host, and they were putting in a concerted effort to become a WordPress, a quote unquote, WordPress host. So they were looking into contributing and actively contributing to the project, you know, looking for more PR and marketing opportunities and being a sponsor, so on and so forth. And the hosting team, which has been my main team, was born directly of that.

The hosting team was originally a, primarily DreamHost / wordpress.org project. There have been many other hosts that have been involved. But primarily, at the very beginning, it was spearheaded dramatically by DreamHost and wordpress.org. And so DreamHost was telling its employees, hey guys, we want to be a WordPress host. Hop into WordPress Slack and go to meetings and, like, represent. So they weren’t offering to like any special contribution contracts or anything like that. They were just encouraging people to check it out and get involved in whatever capacity they felt inclined to.

And so I did. I hopped in the hosting channel. I went to a hosting meeting, and I wasn’t expecting this because I didn’t know at the time. I know now. So the hosting team originally was trying to do video meetings. The first meeting I went to was a video meeting, and I knew everyone in the room already. It was a bunch of DreamHost people, but there were also people from other web hosts who I knew from, you know, mutual contacts. So I knew everybody in the room already in one way or another, and so it was a very, very soft landing for me.

It was easy to get involved because I had an in with all those people and with the team reps. Kira Schroder was one of the team reps. It also helps when the people in the project are really friendly and welcoming. And that has been my experience, that the other contributors, the team reps, and the team leads are very welcoming. Might be a different story on the development end. But in terms of just being involved with community and team happenings, usually you’ll get a very warm welcome.

And certainly the hosting team, if anybody wants to hop in and contribute to the hosting team or participate as a team rep, we’re going to be very welcoming. We’re going to want you to come. We’re going to be encouraging. We’re going to help guide you. We’re going to be super patient and we expect confusion, questions, stupid questions, mistakes, and so forth because that’s just how it goes. And so having someone on the other end receiving you really can make all the difference.

So the contributors that are listening today that can receive new contributors, be as warm and welcoming as you possibly can be. And it does kind of take a lot of extra effort to guide people, but I think it’s worth it, and you build relationships and strong ties along the way. And you never know what that person can do and what they will do and how that later on benefits you.

So I got a really warm welcome. The hosting team didn’t even exist until I think it was 2017. 2018 I joined and started contributing. I became a team rep in 2019. And a lot of that is because I’m really outgoing, and I just was like blah, blah, blah-ing in the meetings all the time. And so that also makes me visible. In a remote, a fully remote space, I’m actually less chatty in person, although I think people would probably argue with that.

But it really, really helps to be outgoing and to jump in, like throw yourself in the fire. Throw yourself in the fire because you may or may not be thrown into the fire by someone else. It’s a really good way to learn. It’s very intimidating. I actually, I prefer more hand-holding onboarding than being thrown into the fire. But you can throw yourself into the fire in a gentle capacity. Like, hey, I volunteer to take team meeting notes, or volunteer to update some documentation. These are really kind of low-pressure things that you just need to know English, and how to type to do it. And, you know, it starts the ties between people and your presence in the project and so forth.

So I was really just hosting team for a very long time. At some point, I think it was, I joined Ladies of WordPress, I think the Slack community is, which is just like women who are involved in, women contributors basically, and befriended a couple people in that space. And one of those people I befriended was Francesca, or Francina is her Slack name, who is a Core contributor. I branched out and started going to Core meetings, like waving in at the new contributor meetings and so forth. I wasn’t quite as chatty in there because at the time it was like 30,000 people, which is a lot of people still. Now I think it’s 54,000 people in that channel.

So Francesca roped me in to, and I volunteered. You know, being not shy is really, really the key in this scenario. Being not shy led me to befriend people who then roped me into these projects, and I started contributing to Core, running release model working group meetings to kind of examine and improve the release process. And then at some point, so before every release, there’s a call for volunteers. And anyone can volunteer, you just need a wordpress.org account. Anyone can. And then of those volunteers, they form the release squad.

So I started volunteering. 5.6 is the first Core release that I was involved in. I was also working at InMotion Hosting at the time as a web development lead. And so I was working really, really, really long days. So I wasn’t quite as engaged in that release as I would have liked to been, or as I was with 6.9 and 7.0. But it was a good like backend release squad experience. And I learned a lot and made connections.

And the other contributors are really, really supportive. If you ask them for help, they’re going to help. And if they think you need help, they’ll offer to help even if you don’t ask. And so it’s kind of, there is some competition, and there is some criticism that happens, but for the most part everybody is really, really, really supportive.

So how I ended up being sponsored though, so I was joining from DreamHost on the clock. I was pretty much always working when I worked at DreamHost. I was working like these insane, like, 50, 60, 70 hour weeks. So I was pretty much always working. So I was joining on the clock. I was wearing many hats with them, and that was one of them. So I was not officially sponsored by them, but I do credit them as a past sponsor because of obvious reasons.

And thereafter I became a tech lead at a web dev agency called Canopy Studios. And they market themselves as being an open source contributor. They contribute to WordPress and they contribute to Drupal. And so they’re looking for their employees to be contributors, and they set aside three hours per week to contribute to your project. So they were sponsoring me for three hours per week. At the time I was doing way more than three hours per week. I was doing meetups, I was helping with WordCamp LA, I was helping with the Release Model Working Group, and I was a Hosting Team rep, and I was speaking at Camps.

So it’s a lot. It was really, like way more than three hours a week. But they, because of that sponsorship it kept me inclined to continue engaging with the project. And then InMotion Hosting had never officially sponsored a contributor, but one of my fellow hosting team reps was a developer at InMotion. That’s how I kind of ended up there. And so they were familiar, obviously they’re familiar with the WordPress project, and they’re familiar with contributing. I just straight up asked them if they would be willing to sponsor me. I was just like, hey, I do this thing. You guys want to use this thing for your marketing and PR, and how about you officially sponsor me? So they sponsored me for 10 hours a week. But again, I was working really, really long days, and I wasn’t able to fully dedicate myself to it as much as I would like to.

Also, that was around pandemic time. So the pandemic definitely affected my ability and everybody’s ability to contribute and engage. And then after that, I didn’t have a sponsor. I kept contributing because it was kind of like part of my thing. The Hosting Team had become special to me, and I guess that the element of me getting hyperfocused is probably key also to why I might contribute for free. Because I like will get involved in something, and then it becomes important to me, and I’m focused on it, and I’m going to carry it probably, hopefully carry it through whether I’m paid or not.

So I wasn’t sponsored for a while there. And then in 2023, I did a talk at WordCamp Europe. So I have family that lives in Israel. My brother lives in Israel. That context is important for this story. But WordCamp Europe that year was in Greece. I had been to Greece before. I love Greece. It’s like one of my favorite places. I’m going buy a house on an island there someday. But Greece is really close to Israel, so after WordCamp Europe, I went to Israel and visited my family.

Before WordCamp Europe, I had done some podcasts and written some articles, and in those conversations, at some point it was brought up that I’m Jewish, and Jewish American, obviously. And I don’t know any other contributors that are Jewish. At that time, zero. I didn’t know a single one. I thought there weren’t any. And Jews are a world minority, so there aren’t that many that I know of, but there are a few.

So somebody directed me to Miriam, Miriam Schwab, who is, I didn’t even care who she was. I was like, yay, I get to make a new friend. But she’s the community manager for Elementor. And so I contacted Miriam trying to make a new friend. I was like, yay, another Jewish person that I could be friends with that contributes to WordPress. Little did I, I didn’t even, like I knew what her job role was, but it never occurred to me that Elementor might want to sponsor me, or that they’re looking for contributors to sponsor or anything like that.

And so she invited me when I was in Israel to go to their headquarters, you know, meet their CEO, be shown around, meet other staff members, play on their, in their little old school arcade and so forth. And I was there like, yay, I’m making new friends. Totally naive completely to the fact that there was any professional interest whatsoever, which was silly. I was just so excited to make a new friend, or multiple new friends. And so then Miriam started talking to me about sponsoring me, and that’s how I ended up being sponsored by Elementor. So really kind of what you said, like a very unintentional chain of events that sort of just ended up working out the way it did.

[00:35:47] Nathan Wrigley: Yeah, looking back, there’s a thread there, isn’t there? But it’s only with the benefit of hindsight looking back that you can probably see the thread. On a day-to-day basis, it probably doesn’t quite feel like that. Are you currently sponsored by Elementor? Are you, in fact, are you sponsored by anybody currently? Yeah, okay.

[00:36:00] Amy: I am. So I’m sponsored part-time, 10 hours a week by Elementor. And again, I’ve been spending way more than 10 hours per week. So if anyone wants to sponsor me on top of them, please contact me.

[00:36:10] Nathan Wrigley: Can I ask about that though. Why? I mean the question is probably obvious to you, but I don’t know on what level you’ve inspected that part of you. Obviously there’s a why. You’ve alluded to it. You know, there’s friendship there and there’s habit, and you’ve been accustomed to it and, you know, you like being in that community, and the people there are nice.

But just sort of drawing the veil back a little bit more. Why do you give more time than your allocation, let’s say, from Elementor? Why does the 10 hours not stop on the clock like you would do for a regular job? You know, 5 o’clock winds along and exactly 5 o’clock you put your tools down, and you go off, and you go home, and what have you. What do you get out of it? What’s the thing that is satisfied by this?

[00:36:49] Amy: Well, so it’s part personal and part professional. So I tend to not draw clear boundaries when it comes to work. I tend to like, if my shift is over, but the task isn’t complete, I will finish that task. Depending on, you know, details and so forth. So I guess there’s a bit of a level of dedication that maybe doesn’t even need to be there, but that’s fueled me in a lot of ways.

Why do I contribute to wordpress.org specifically, even if I’m not paid? I do find it personally meaningful. Working with other people, making new friends, contributing to something bigger than me, participating in something bigger than me, giving to the world in one way or another, I find that personally meaningful. And it’s kind of kept my life a little bit more full and more rich over the past eight, nine years. And so it brings value to me in that way.

I have friends of a decade now from, you know, engaging with WordPress. It’s led me to jobs, and it’s led me to other opportunities and to meet really interesting people. And so there is a personal element to that for me personally. And I think that probably a lot of people also, maybe if somebody is more of an introvert, they might not have that same level of benefit that I, as not an introvert, have. Because I get a, the personal connection benefit and the meeting people is really rewarding to me.

But there’s also a lot of professional benefit being a team lead. We don’t say team lead, we say team rep, but it is a leadership position. So leading a team for a major software project has been pretty beneficial to getting jobs, getting opportunities, and just kind of a general professional portfolio. The Hosting Team is a bit of a red-headed stepchild and is kind of like quiet and nobody really knows that it exists. Except for maybe recently because of me talking about it. And it has been for a long time.

It started to blow up a lot, like way back in 2020-ish, 2019, 2020. And the pandemic kind of really threw a wrench in that. And then some other things over the years have also thrown wrenches in that. There was the whole hosting page debacle, and rift between .org and web hosts, that’s still currently affecting. So the Hosting Team is pretty, pretty quiet. It’s not like a big, Core is not quiet, Hosting Team is really quiet.

So that makes it easier to engage. But there’s definitely professional benefit that a lot of my jobs have been because of WordPress, or because of someone I met through WordPress, or my experience with contributing to WordPress just boosts my appeal to employers. So there’s that too.

And on top of that, you build skills. You know, I now have multiple repos that I’ve been a maintainer for, for years. And I had those skills to begin with, but you refine and define your skills more through experience and through working on teams and so forth.

[00:40:03] Nathan Wrigley: Do you know, it’s really interesting the order in which you stack those answers. I feel, I could be entirely wrong about this. I feel like in the corporate world where everything is out and out profit, imagine, I don’t know, evilcorp.com or whatever it may be. I feel like the calculation there might be exactly the opposite. You know, you put them the other way round. You get the skills, which allow you to then advance your career, and the meaningful bit is just maybe there, maybe not.

But the way that you stack that with the meaningful coming first is really interesting because I have that suspicion as well that the majority of the people in the WordPress project, if they were to truly ask themselves that same question, would probably arrive at a similar answer. That meaningfulness bit, it often doesn’t get talked about. It’s just kind of, oh, we all understand, we’re here, we’re having a nice time and what have you.

But that meaningful bit, I can’t put my hands on it. I can’t explain what that is, but that’s the same for me. There is something significant and meaningful about being involved in something, like you said, bigger than you, that has the capacity to improve people’s lives. And you don’t often get the chance to elucidate that thought and say it out loud. But when you do, it’s nice to know that that’s a part of your character, I think. That that that bit matters apparently more any other bit, because that’s the bit that tumbled out of your mouth first of all.

[00:41:26] Amy: Actually way more. Honestly way more than it because I am smart, I’ve taken many IQ tests. I might do and say stupid things, but nonetheless I have a high IQ, and very capable, and I have numerous different talents. I could do any variety of things. I think that if I were to be dropped in any work environment, I would excel, or at least be competent in that work environment. It doesn’t quite matter what it is. That’s, you know, my perception of myself, and I’m also a huge advocate of learning on the job. I think that companies should be hiring people who don’t know what they’re doing, and then teaching them what to do. That’s personally my take on it.

And so the meaningfulness is, it’s way more powerful than, I could make money and I could, obviously we all have to survive, but it kind of all folds into itself. That you get involved in something because it’s meaningful, and then you like learn and build skills and make connections and end up making money from it.

If people come to WordPress trying to make money, I think that you can absolutely, and probably a lot of it, but it’s the wrong values. It’s not a match for open source values and for WordPress values. And the WordPress values are one of the, probably the thing that attracts me to the WordPress open source project the most.

[00:42:52] Nathan Wrigley: Right. And I think me too. I think that was what drew me in the first place. But again, I can’t get my hands around it. I can’t sum it up. But there is a there there. There is a thing. There’s this ephemeral, non, you know, you can’t quite make contact with it, but there’s a certain feeling.

When you go to these events and you see that, you know, this whole thing has been put on by a bunch of volunteers, and the underlying code, which is what we’re all there for anyway, that equally has been largely created by a bunch of volunteers.

Where’s the profit motive for that? Well in many cases, there isn’t much of a profit motive obviously, as you said, for some people there is. That is a curious characteristic. I don’t know, there’s just something about those people that I would like to be in proximity to. Finding it very hard to describe what I’m saying, but there is something about that characteristic that I like to be in proximity to. That’s kind of it, I think.

[00:43:42] Amy: It’s very authentic and genuine. You can feel it as a human being. You can feel it when somebody wants something from you, or maybe I can’t. But most people can feel it, if somebody wants something from you, and that’s their intention. Versus if someone’s interested in you, or compelled towards you for some subconscious or other underlying reason that they’re just like, oh, you seem nice. You seem interesting. You touched on this topic and I like that topic, you know? There’s something very rewarding, and deeply fulfilling, on a human, spiritual. It covers our basic needs as humans for interaction and for community.

And I think that at events it’s even stronger. Like in Slack, you’re all in different locations. There’s definitely, you know, social interaction happening, and friendships being formed, and bonds being built. But at events it’s kind of like that on steroids. There’s a really strong sense of community, really strong sense of belonging together, a really strong sense of doing something meaningful, and contributing to something meaningful, and being part of something meaningful. And I think that’s really powerful. And it satisfies a core human need.

[00:44:54] Nathan Wrigley: Yeah, that is so interesting. I’d love to put a survey together and actually ask intelligent questions which drill down specifically into that. Because I think there would be a correlation between the things that you’ve just described, the characteristics that you’ve described, the feelings that you like to be associated with, the events that you enjoy and what have you. I think there’s a correlation between that and the community that we have. I can’t quite prove it.

But time and again, that intuition has proved itself in the real world. You know, you get into conversations like this, and this kind of subject emerges. Why do you do it? Because it’s meaningful. Because I get a great sense of satisfaction from it, and I know that I’m doing something which will be bigger than me, longer living than me, and so on and so forth. So, gosh, that’s really interesting. I’m glad that you share that same opinion.

[00:45:38] Amy: It’s beautiful.

[00:45:39] Nathan Wrigley: Yeah. Yeah it is, isn’t it? And that’s the basis upon which the whole project is built.

[00:45:44] Amy: Right. Without the community there’s, it would be a much different thing.

[00:45:48] Nathan Wrigley: Yeah, really so. Sadly, we’re going to have to end it because of the time constraints that we’ve got. But what a fascinating, I think we were just peeling back something really interesting there, but there we go. That’s the time that is allowed for this particular episode.

So anything that you wanted to get out that you didn’t get a chance to? Is there any intelligent question that you wish I had asked you?

[00:46:06] Amy: No, not at all. Thank you so much for inviting me. I’ve really enjoyed chatting with you, and I found it very interesting.

[00:46:13] Nathan Wrigley: Yeah, thank you. It’s been a pleasure. Thank you so much. This will go out on the wptavern.com podcast, the Jukebox podcast, so if you want to go and check it out over there, wptavern.com.

So all that it remains for me to do is say thank you very much, Amy Kamala, for chatting to me today. Really appreciate it

[00:46:30] Amy: Likewise. Thank you too, and thank you to all your listeners.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the themes, the blocks, and in this case, reducing WordPress beginner anxiety in a multitude of ways.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Priscilla Collado Ramirez. Priscilla travelled 14 hours from Costa Rica to attend WordCamp Europe, making her one of the furthest attendees at the event, and for good reason. She’s an educator, fashion designer and wellness coach, and has a unique perspective on a challenge many in the WordPress community face, how overwhelming WordPress can be for beginners.

Having once quit WordPress 17 years ago, due to information overload, and a lack of community support, Priscilla’s story comes full circle, as she now dedicates herself to helping entrepreneurs and creatives find their way in the WordPress ecosystem. Her work focuses on demystifying those first confusing moments, offering practical steps, and much needed reassurance for anyone who’s ever opened a fresh install and wondered, what on earth do I do next?

The conversation is focused on why newcomers often feel stuck, paralysed by too many choices, the classic it depends advice, and a fear of breaking something or everything. We get into the importance of understanding individual learning styles, whether linear or spiral, as Priscilla labels them, and meeting students where they are, sometimes with literal breathing exercises and wellness techniques to lower stress and unlock real learning.

Priscilla explains how confidence in WordPress is built through action, and why celebrating small wins, like successfully installing a single plugin, is essential. She also shares her approach to bringing holistic, calm, and patient mentorship into WordPress education, something that’s as relevant for agency leads as it is for first time bloggers.

If you’ve ever felt overwhelmed by WordPress’ infinite possibilities, struggled to find your place in its community, or just want practical wisdom on making the path easier for beginners, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Priscilla Collado or Ramirez.

I am joined on the podcast by Priscilla Collado Ramirez. Although I know that’s not the correct way to say it, would you please say your name for me?

[00:03:44] Priscilla Collado Ramirez: It’s good, it’s good. I’m Priscilla Collado Ramirez, and I’m from Costa Rica.

[00:03:48] Nathan Wrigley: Well, I appreciate it. Thank you. You get the award without a doubt coming the furthest, I think, to WordCamp Europe this year. I don’t know how many miles it is, but you said, I think it was 13 hours.

[00:03:59] Priscilla Collado Ramirez: Yeah, 14 hours on the plane. Today is travelling. But it’s all worth it, because this country in Europe, it’s beautiful. So I can do it all the years, all the months. Yeah, I can do it.

[00:04:13] Nathan Wrigley: I have to ask though, why come all the way across, so many hours on a plane and what have you. Do you have a community where you are? Is there a thriving kind of Costa Rican WordPress scene? I don’t know anything about it.

[00:04:28] Priscilla Collado Ramirez: Okay. Yeah, in Costa Rica is a big community. It’s the biggest community in whole Latin America, in Costa Rica. I have a friend, she works for GreenGeeks web hosting, so she empowered me to do this. And the WordCamp Europe, because being a speaker is one of my dreams come true.

I already do it in my country, but I want to get more knowledge and know more people. And when she told me about this, I said, yeah, I can do it. Yeah, I want to do it.

[00:05:06] Nathan Wrigley: That is remarkable. A 13 hour plane journey. That’s pretty impressive. And I confess, I didn’t know that Costa Rica was sort of the place to be if you’re in South America. But now I do. Thank you. And I know that you’ve basically just come out of the presentation room, you’ve just finished the subject that you were talking about.

And the subject that you were talking about is really interesting to me at least, because this casts me back. I’ve been in the WordPress space since about, I don’t know, 2015, something like that. So I’ve got a few years under my belt.

But I do remember at the time when I began using WordPress, turning up to events like this and feeling a bit like a fish out of water, not really knowing what to do. Not really knowing what to do with the software, either. Not really knowing what I should install, whether I should install anything, whether I was using the best thing, or the worst thing or what have you. And that kind of was the nature of your subject.

But rather than me telling everybody what you were talking about, do you just want to summarise what it was that you stood up and presented about?

[00:06:02] Priscilla Collado Ramirez: Yeah, of course. And I feel the same way that you.

Well, my talk is about why WordPress feels overwhelming for beginners. I was that beginner that I don’t want to install. And WordPress, it’s great, but sometimes gives you too many options, right? So for beginners, sometimes that options feels paralysing because we need to start with one at the time.

I saw all the topics for this event, and I think, yeah, maybe I can share a little bit of my story with WordPress. And I talk about, I quit WordPress 17 years ago.

[00:06:47] Nathan Wrigley: You quit it?

[00:06:48] Priscilla Collado Ramirez: Yeah. I’m a quitter.

[00:06:50] Nathan Wrigley: My story going back, oh, 12 years or whatever it was, that’s nothing. You got 17 years. That was when you quit. Okay, carry on. Sorry.

[00:06:58] Priscilla Collado Ramirez: Yeah, no, 17 years ago, I was at university, and I was studying advertising and web design. I saw the options, too many options, too many things, I don’t know. And I feel overwhelmed. And I said, this is not for me. I’m so dumb. I’m slow. No, no.

And 17 years later, I’m here as an educator, and I help entrepreneurs and beginners to understand the WordPress environment.

[00:07:29] Nathan Wrigley: What brought you back then? After all that period of time away, what was the catalyst that brought you back? Why did you explore it again?

[00:07:36] Priscilla Collado Ramirez: Because I have a fashion school, and I saw my students deal with web designers and sometimes they charging so much money. I see it in the beginners, in my students, I saw that we have a problem with understanding that sometimes the things are not too difficult. We can learn about new tools and new WordPress.

[00:08:06] Nathan Wrigley: Okay, so this was all about your students then. So this was an idea of, I guess the world is kind of an expensive place to be, and one expense that you can get rid of is the cost of your website. There’s tools out there. You can, if you wish to, build it yourself. And then you found WordPress again. How is it the second time? Did you ever go through, I’m going to quit it for a second time, or was it better the next time you came across it?

[00:08:29] Priscilla Collado Ramirez: Yeah, and my brother is an engineer and I’m in like a category of non-technical people because I’m a fashion designer. I’m an educator, and I’m a wellness coach. And I think, yeah, maybe I can study a little bit, and if I use my education tools to understand how the brains for the creative people works and try to, out of the box, that sometimes the engineers have, and the creative people. It’s like a disorder, a disorder brain. I can help to these people to understand this environment in this community. And they can do it like I do.

[00:09:22] Nathan Wrigley: Yeah. So we’ll get into the bits that you think are problematic with beginning with WordPress in a minute. But just going back to your students and what have you. How’s it been for them? When you are looking at what they’re able to do, has it been a road of success, or has there been quite a lot of failure for them? Basically sum up how your students have coped.

[00:09:43] Priscilla Collado Ramirez: Okay. I don’t know, there’s two types of students, right? So we have the students that have a linear path learning. Some students learned like A, B, and C. Okay, you understand things easily. But some of them don’t understand the things like that.

So I try to create a platform, or we can call it like a type of education, and helps to understand, first how their brain works, and later understand the type of learning that I can teach.

[00:10:24] Nathan Wrigley: Okay, let me just make sure I understood that. So you try to figure out what their brain accepts most readily? And then once you figure that bit out, then you begin the WordPress education from there. Okay, that’s interesting.

And you say there’s kind of two types that you’ve kind of determined. And what are those two types?

[00:10:40] Priscilla Collado Ramirez: Lineal.

[00:10:41] Nathan Wrigley: Oh, so I think probably linear, like straight lines.

[00:10:46] Priscilla Collado Ramirez: Yeah, we have the straight lines and the spiral.

[00:10:49] Nathan Wrigley: Okay, yeah.

[00:10:51] Priscilla Collado Ramirez: So my mind is on the spiral. And that’s why I feel dumb in these technical environments. But I learned that if you learn some topic at the time and without the stress, you can do it and you can follow this community.

[00:11:10] Nathan Wrigley: So you just used an interesting word there. You said that you have felt, maybe you don’t feel it here, I don’t know if you do or not. But you said you’ve felt dumb in the past. You know, you’ve turned up to the events and you felt like a fish out of water, we might say that. Just. What the heck am I doing here? Where do I fit into this jigsaw puzzle?

And obviously you felt it long and hard enough that, firstly you left, and then come back, given it a second shot. So what are the things that you have felt dumb about? What are the things that have perplexed you in the past? What are the things that have drawn you to making this presentation?

[00:11:47] Priscilla Collado Ramirez: I felt in that time overwhelmed for the too many options. I feel that in that time in my country, WordPress wasn’t so popular and was a men’s environment. There’s no women. So I feel like, I don’t know, I’m not from, I don’t know what to be here. And now, four years ago, I’ve been talking with the women community on WordPress and I feel like, I don’t know, confident and they believe in my knowledge.

And I think that, yeah, I can do it again. I can approach to the community and I can learn, and I can be like a mentor too, and help beginners to understand that it’s not the technical environment. It’s how the community engage with your goals and can be used, and how can help with your goals.

[00:12:50] Nathan Wrigley: So I’m just going to dig into something you said a moment ago, which was about the community where you are. I don’t know if it’s still the same, but you implied that it was mostly men.

Have you found female WordPressers where you are? Or have you had to get on Zoom calls or something like that in order to find that community? Or has it grown so that it’s not just men where you are now?

[00:13:14] Priscilla Collado Ramirez: Yeah. I assist to the first women speakers in 2023. And I saw like, okay, this is a WordPress group for women. And that group was for speakers from WordPress, but women. So I was like, okay, WordPress is not only men’s, WordPress is not only technical people. And, well, I can approach to that community. 17 years ago wasn’t like that.

All men and square men. Because I know there is a lot of spiral men, but in that age, yeah, was like square men and my brother is a little bit like a square. And I was like, no, I’m funny and I want to talk, and I want to be a speaker and what. Now I feel that I can approach to my goals with WordPress because I changed my mind and my feeling about the community and WordPress.

[00:14:20] Nathan Wrigley: So just moving away from the community side and all of that kind of stuff, just dealing with the, actual software that you download from the internet and you put on a server somewhere, and then you begin to build a website. I presume that that’s part of this as well, that it’s difficult to begin because when you install a version of WordPress, you’re kind of left to your own. You know, there’s not really much in the way of assistance. You have to find the assistance somewhere. You have to a YouTube channel or some friendly person that will stand over your shoulder and help you out.

What are the sort of impediments, the problems that you think we have for people beginning with WordPress that you would like to be solved?

[00:14:58] Priscilla Collado Ramirez: Yeah. First of all that everybody thinks that WordPress is only a website. And I want to share this. WordPress is not only a website, right? It is a community. And you can approach and say, I wanted to learn about how to do a blog and how to do a website. But the community is more than that. I think that people don’t understand yet that what is WordPress?

[00:15:30] Nathan Wrigley: Yeah. well I went for, I probably used WordPress for four years, maybe three and a half, four years, something like that, before I knew there was any kind of community. I mean I realised that there was something because the software got made. So I realised somewhere behind the curtain, there must be people doing this. And I’m getting it for free, so they probably are not getting paid mostly to do it.

But I didn’t attend because I didn’t know there was anything to attend. And then I showed up to an event in London, which was probably my closest larger event at that time. I was quite surprised. I was thinking, okay, so there were about 600 people there, I really wasn’t expecting that. I thought maybe there’ll be like 12 or 15 or something. Showed up, 600 people. And for me that was kind of the moment WordPress became a little bit more interesting, because I realised that, okay, it isn’t just pixels on pages, it’s not just the websites. There’s actually a whole community of people behind it.

And one of the things that I discovered fairly quickly was that those people shared, there was a lot of overlap between them and me. You know, just a lot of things in their lives seemed to sync with a lot of things in my life. We had broad agreement on a lot of things. We all wanted the project to be successful. And so discovering the community, like you said, was a really important thing.

But nevertheless, I still think I would’ve carried on using it even if I hadn’t of discovered that community, because by that point I’d got over the problem of what plugins to install and how to actually use the software.

Yeah. So let’s move on to that. In terms of the actual software, so we’ve got the community, we know that exists. What are some of the problems that you’ve seen, I guess with your students, or maybe personal experience? Some of the problems with the actual software. What are some of the things that you’ve encountered?

[00:17:21] Priscilla Collado Ramirez: Yeah. I encountered that there’s too many options, and the people do not know how to install. And that’s a beginner’s questions. Why should I install plugins, themes? And for technical people it is like, okay, it depends.

[00:17:39] Nathan Wrigley: Oh always it depends.

[00:17:41] Priscilla Collado Ramirez: Always, it depends. And, for beginnings, that feels paralysing.

[00:17:45] Nathan Wrigley: Okay. That’s an interesting phrase, isn’t it? So when you mean paralysing? So we say it depends, meaning, oh, try everything. See what works. Where you are saying that in your experience, it depends means don’t do anything, we don’t know, not sure.

[00:18:00] Priscilla Collado Ramirez: Yeah. And the beginners don’t know what to do, right?

[00:18:03] Nathan Wrigley: Okay, yeah, that’s not helpful, is it, it depends, really when you say it like that?

Okay, so how do we overcome that? I don’t know what we do apart from keep saying, it depends. I guess we’ve got to try and encourage people to try this.

Okay, let me rewind a bit. So my parents, when I put the phone in their hand for the first time, the mobile phone, I had it all set up for them, you know everything was working, and I gave it to them and assumed that they would have the same approach as me. Which was, just play around with it and then you’ll figure it out.

Oh, no. No touching anything was, will I break it? Is this going to destroy it? If I press delete here, does that mean the whole thing’s going to like be, does this app going to disappear at this point?

So, I think that’s what you’re saying, is basically there’s this fear that if I install something and then I don’t need it, or I don’t like it, well then what do I do? Is it kind of that? This fear of it.

[00:18:59] Priscilla Collado Ramirez: Yeah, because you feel overwhelmed, and you feel paralysing. And you feel like, okay, there’s a learning path, right? So we have the excitement. So, yeah, I’m going to do WordPress. Then confusing. What is this? And then it is like, no, I don’t know, maybe this is not for me because there’s so many options.

I try with my students to go one step at a time, and understand, first, what is a plugin? Right? Do you need a plugin or not? Do you need a theme or not? Do you need SEO plugin or, I don’t know?

So I am trying to, first of all, work with entrepreneurs because some entrepreneurs sometimes doesn’t get it. I don’t know, what is an email? How to send an email. They are so intelligent, and so capable to learn things, but sometimes, like as educators or mentors, we have in our minds that people learn easily. And sometimes it’s not. So you have to teach like a child. And not because the people was stupid, right? It is like because that people, the learning process is different.

[00:20:30] Nathan Wrigley: Yeah, I suppose you’ve got to just get to the point where you’re comfortable. So for some people who are, I don’t know, let’s go for the word technical. Technical people who’ve got a background in using computers, they do it all day, every day. And they experiment with new things. I suppose if you put them in front of WordPress, they’re off. They’re just going to do that kind of thing. But I totally get what you mean.

So for me, technology, I will experiment and I’ll play, because I know that nothing can basically actually break. If something goes wrong, I can just delete it. So I’m thinking about apps on my phone, on my computer, and WordPress, and plugins, and themes and all of this. I fully understand that nothing will kill it. Well, hopefully nothing will kill it, and I can just remove what I don’t understand.

But then again, you pick me up and put me into a different industry, I’ll be that person. I’ll be the person that needs the baby steps, I think you said that needs the child steps, because I’m not in familiar territory. So I can’t think an example off the top of my head, but pick me up, basically put me anywhere there’s no technology, and I will feel that same anxiety. What do I do? can you check that what I’ve done is safe? Okay. Can you double check? And will you triple check just to make sure that everything is safe. And I suppose that’s what you’re saying, is just little baby steps. get people into it. And once they’ve gone through the baby steps, hopefully they can act on their own.

[00:21:54] Priscilla Collado Ramirez: This is a phrase that I been thinking too much in this talk, because it is some word that you said, and you said about confidence. And I wrote that confidence does not come before action. Confidence is built through action.

[00:22:14] Nathan Wrigley: Yeah, that’s true, isn’t it? And so everybody at some point has to go through that barrier. Some people seem to be full of confidence, regardless of what is, but there’s a lot of people who are not. And if you walk them through the baby steps I suppose, as you said, and tell them, do you need a plugin? What is a plugin? This is a plugin. How do you get a plugin to be put on your website? Can you delete a plugin? And then same thing with themes and custom code and all of those kind of things. And does that work? Do you notice that people go from like, ah, fear, to oh, this is all right.

[00:22:47] Priscilla Collado Ramirez: They think, this is not so hard that I was the, I will be. I don’t know, I have all types of students and all types of socioeconomic types. And I have students like 50 to 60 years old. And they think, no, I’m too old to think learning website, and learning design things. And I’ve been creative. The constructivist system is a strategy in education, the constructivist, and the principle idea is you learn by doing.

[00:23:27] Nathan Wrigley: Confidence through action, like you said, basically.

[00:23:29] Priscilla Collado Ramirez: Exactly, exactly. And so you can be on the learning path, making little mistakes and getting more confidence to feel safe in the learning environment.

[00:23:42] Nathan Wrigley: Are you a patient person?

[00:23:45] Priscilla Collado Ramirez: Sometimes.

[00:23:45] Nathan Wrigley: Yeah. Because when I was earlier describing my parents and the phone, there’s kind of a bit of me, which when I’ve demonstrated the same thing nine times, and every time the output of those, okay, do it this way, do it this, okay, now do this, now this. And on the 10th go, it’s still the wrong thing in the exact same way. I just wondered if there was a bit of that? If there is just some impediments which, I don’t know, some people just never get over. If WordPress is just generally too hard for some people. Or do you always pursue it and succeed? Do you always get people through, and get them to that confident stage?

[00:24:23] Priscilla Collado Ramirez: Yes. Yeah, yeah. Every day. Yeah. Like every day. And I think that the mentor and the educator has to feel love with that work, and teaching with love, first of all.

And then, understand that people doesn’t learn in the same way. I can say older people because I’m older, and you saw an older people, and you think, this is older than me, but it isn’t.

[00:24:55] Nathan Wrigley: Yeah. and some people are kind of, what, we would describe as kinesthetic learners. So they doing is the way. Some people are kind of auditory, and they hear the solution and they learn from hearing. And other people it’s visual. You know, they see the, watch a video and, oh, I’ve got that now. And I guess you’ve got to figure out which ones, how they fit in. If I show you once, you’re fine. If I show you once, well that’s not going to work. You’ve got to actually do it and copy me. And once you’ve figured out what kind of learners they are. You must have a lot of time for these people by the sounds of it.

[00:25:25] Priscilla Collado Ramirez: Yeah, of course.

[00:25:27] Nathan Wrigley: Yeah, and do you literally have an endless amount of time to educate them or do you have like a, I don’t know, you’ve got 10 hours or whatever it is and after 10 hours we’re going to get new people in? Or do you just stick with them throughout the whole journey?

[00:25:38] Priscilla Collado Ramirez: Yeah, yeah. And most beginners and most entrepreneurs isn’t that way, right? And they’re so excited to understand the process. And when I explain how the brain works, they think, oh, yeah, it’s not the system, it’s me.

[00:25:59] Nathan Wrigley: But also I can do something about it.

[00:26:00] Priscilla Collado Ramirez: Yeah.

[00:26:01] Nathan Wrigley: Yeah, okay. That’s interesting. Okay.

I’m going to give you superpowers for a minute. I’m going to say that you are in charge of WordPress entirely. It’s up to you what we do to improve this experience. What would you change? that could be the software. It could be education that you suddenly provide, you know, you would whip up many, many courses or whatever. I don’t know. I’m just curious to know what you think.

So again, superhero powers. You get to decide the future of WordPress. What little changes would you make here and there?

[00:26:32] Priscilla Collado Ramirez: I’m going a little bit too far off WordPress, and I’m going to bring wellness tools first.

[00:26:41] Nathan Wrigley: Okay. So it gets bigger.

[00:26:42] Priscilla Collado Ramirez: Yeah, it’s bigger. I’m a wellness coach first of all, and first you have to try to understand the stress, and your mind. And then you can learn. I feel like my superpower will be an educator in wellness first, because we have to manage the stress of learning.

[00:27:04] Nathan Wrigley: So you have to approach the computer, but calmly. You have to get there and arrive in an equanimous state. Nice and calm.

[00:27:14] Priscilla Collado Ramirez: Yeah, and understand that the delete button doesn’t exist. Because you are going to learn that, yeah, you can delete it, but you are going to breathe, and stay calm, and you won’t be delete anything because you, on the learning process of your mind understanding that everything is a process.

After that, I have an idea, I don’t know my superpower, I would like to do the mentor of the mentors first.

[00:27:49] Nathan Wrigley: Oh, teach the teachers.

[00:27:51] Priscilla Collado Ramirez: Yeah, yeah. Because we have mentors in WordPress, but the mentors sometimes doesn’t study at the university education, right? Is an engineer trying to teach another engineer, or an engineer teach to entrepreneur or a beginner, so their minds works different.

[00:28:14] Nathan Wrigley: Yes. I’ve encountered this in the real world. You know the educator who gets really angry with you and tuts, sort of goes tut tut, because you’re not doing what the way they would do it. It just turns out that, if you just ask me in a different way, I’ll probably figure it out.

[00:28:29] Priscilla Collado Ramirez: Yeah, exactly.

[00:28:30] Nathan Wrigley: Sorry I interrupted, carry on. So educating the educators.

[00:28:33] Priscilla Collado Ramirez: And in all the fields is the same way, because I’m a fashion designer too, but I have to learn how to be an educator, and how to try to explain some things to my students and try to get off to my mind box.

So I want to make some changes too, and add some of these tools on WordPress. I don’t know, maybe this is my superpower, like be a spiral mind.

[00:29:07] Nathan Wrigley: Yeah, yeah. But I think teaching the teachers. So I think we would use the word pedagogy for that. Meaning, how to teach basically. The science, if you like, of imparting knowledge. And maybe there is nothing like that at the moment. And if there isn’t something like that, it would be interesting to explore how different people with different minds and different approaches. Maybe your first idea of everybody approach the computer in a calm way. Maybe that gets rid of some of that problem. At least we’re approaching and we’re not getting we begin.

But I think you’re onto something there, in that I know that I don’t learn in the same way as my children do. I don’t learn in the same way as my parents do. And so having that in the background, and educating the educators so that they’re aware that those kind of things exist.

Okay, you’ve still got the superpowers. Is there anything else that you would do before I take them away?

[00:29:56] Priscilla Collado Ramirez: Okay, okay. I think that understand the brain is a supercomputer. It’s also a big topic because you can programming your mind. I would love to teach that people can programming itself. I don’t know what other superpower.

[00:30:17] Nathan Wrigley: Well that’s okay. You’ve had it for probably about five minutes now. That’s more than most people get.

So yeah. So in your experience, I know that you are obviously trying to overcome this problem, and it sounds like you get most people through it, and people manage to come out the other side and are, you know using WordPress successfully. But despite that, do you still think out there in the wider community, not where you are, do you still think that people are being turned off by the problem at the beginning of, I don’t know what to do. I think that I should be able to figure this out, but I can’t. I’m frustrated. It’s annoying me. Ah, move on, or forget the whole thing altogether.

[00:30:53] Priscilla Collado Ramirez: Okay. I give you some tools. I wrote it. Limit the choices. Yeah, because one plugin at a time. Yeah, understand one topic at a time.

[00:31:05] Nathan Wrigley: When you say that, are you, meaning, let’s say for example, that we’re getting into the, oh, I don’t know, the realm of SEO, we’ve managed to get into that subject. We know that there’s like 500 SEO plugins. Just show them one, just pick one, concentrate on that one and figure out how that works. And then maybe reveal that there’s others or something like that.

[00:31:25] Priscilla Collado Ramirez: Yeah. But sometimes, maybe I have to understand your world first, and maybe you don’t need SEO tools? Because maybe you wanted to sell, I don’t know, plants. So do you really need a SEO plugin? Yeah, maybe not. So I have to understand your business first, or your purpose first, and then I can share you one plugin for that.

[00:31:56] Nathan Wrigley: Right, so, but at the end of the day, it’s still limit it rather than the plugin overwhelm. 78,000 plugins on the repo or whatever it is. One at a time is probably for a beginner more than enough. Learn how to install it. How to uninstall it. Learn the kind of things that you can do with it, whether that’s SEO or a form plugin or whatever. Okay, it looks like you’re ready for another one, yeah.

[00:32:15] Priscilla Collado Ramirez: Yeah. I have, normalise confusion.

[00:32:19] Nathan Wrigley: Okay, so be happy with being confused and muddled up.

[00:32:23] Priscilla Collado Ramirez: Yeah, because it’s a new topic for you. So you have to understand that it is fine if you feel confusion, because your brain is adapting to that learning process.

[00:32:34] Nathan Wrigley: Yeah, we’re not good at that, are we? We’re really good at being annoyed by confusion. Confusion’s the enemy in many ways, isn’t it? But it’s really not. I mean, who can expect to learn something new and immediately understand everything? No, but we don’t allow ourselves to do that, do we? We get annoyed with confusion.

That’s a good one. I like that. Carry on, sorry.

[00:32:54] Priscilla Collado Ramirez: And celebrate the small wins. I’m doing right now. I’m realise that I have to celebrate the small wins, because sometimes we overwhelm and have too many expectations. It is one step at a time, baby steps.

[00:33:11] Nathan Wrigley: So that one is basically when something goes right. So once you’ve got over your confusion and something’s gone right, sit back, examine it. Ah, well done. Pat on the back kind of thing. Yeah, okay. That’s nice.

[00:33:22] Priscilla Collado Ramirez: Yeah. And emotional reset tools.

[00:33:26] Nathan Wrigley: Okay. You’re going to have to explain that one.

[00:33:29] Priscilla Collado Ramirez: Okay. I’m going to explain you here, because I want to explain you pretty well, and sometimes I get I stuck in the language.

Okay, when beginners get frustrated, we must do simple pauses, like breathing. The process of breathing is called pranayama. In pranayama is the art of the breathing. When we born, the first thing that I will do is breathe. And when you are crying, the people say, no, no, breathe, breathe, right? And when you are, I don’t know, when you swimming, and you.

[00:34:09] Nathan Wrigley: Drowning maybe.

[00:34:11] Priscilla Collado Ramirez: Drowning yeah, you want to breathe. So the breathing is so important.

[00:34:16] Nathan Wrigley: So this is part of the pausing thing. Just pausing, breathing, okay.

[00:34:20] Priscilla Collado Ramirez: Yeah. They also reduce the cognitive overload. And help beginners continuing learning with more clarity, that regulates the brain and the stress.

[00:34:32] Nathan Wrigley: So I don’t think I do any of those things when I’m learning. I just sort of plough on and expect myself to do really well. And when I don’t, I get miserable and annoyed. And I don’t ever think about, okay, calm down, breathe, congratulate yourself. The thing is I mostly do learning by myself. You know, I’m in a room and I watch a video or I read something, and so there’s nobody there to tell me to breathe, calm down, relax, congratulate yourself. So I’m glad these people have got you in their lives to, make all of this happen.

Sorry, carry on.

[00:35:03] Priscilla Collado Ramirez: No, no. And one of the phrases that I want to the people understand is the learning doesn’t happen in stress. It happens when the mind feels safe enough to explore.

[00:35:19] Nathan Wrigley: Yeah, well I can identify with that. That makes perfect sense, doesn’t it? When you’re uptight and worried about things, nothing sticks ever, does it? So back to calm, I suppose.

[00:35:30] Priscilla Collado Ramirez: Yeah yeah.

[00:35:31] Nathan Wrigley: Yeah, that’s all good advice. Yeah I wish I could do it.

[00:35:36] Priscilla Collado Ramirez: Yeah. And sometimes, yeah, the people feel overwhelmed with the stress first. I have too many mentors that causing me stress and, I don’t know, they don’t give me confidence in anything of I been learning.

[00:35:55] Nathan Wrigley: It sounds to me like what you are proposing. We would probably call it holistic. So it’s treating the mind, the body. They’re the first bits. If you haven’t got those intact and working for you, it doesn’t matter how many times you read that book, you’re never going to learn anything.

[00:36:12] Priscilla Collado Ramirez: But sometimes the word for holistic for technical people is like you’re a hippie.

[00:36:17] Nathan Wrigley: Well, there is a bit of that, isn’t there? I think technical people often have an approach to this kind of stuff, which is fairly dismissive, sort of at arm’s length. Because it’s not science, if you know what I mean. It doesn’t sort of come under that umbrella. I wonder how much resistance actually, if I put you in, you know, had a chat with a thousand of the people out there at the moment.

[00:36:38] Priscilla Collado Ramirez: Oh, the people go away.

[00:36:38] Nathan Wrigley: Yeah, okay. Okay. But you know it works. And everybody knows this kind of stuff works. Because if you’re calm, I suppose the difficulty would be, you’ve got to allow yourself to accept that you need to be calm, and you need to be approaching it in this kind of way. And that’s difficult. I would find that quite difficult. You know, if I came to your educational institute, if you like, if you were teaching me WordPress, there would be a bit of me at the beginning, which would be thinking, okay, just tapping the watch, and thinking when does the WordPress begin?

And you are probably saying, we need to be calm now, you know? So I guess you’re going to have to fight that fight.

[00:37:13] Priscilla Collado Ramirez: Yeah. Yeah. And last year I was a speaker in my country, and I’m talking about how manage the stress, the people that works like eight hours on the computer. You can use too many tools to release the back, the breathing. And everybody needs release the stress. Sometimes in technical environments, the people don’t engage with the holistic path because they think that.

[00:37:46] Nathan Wrigley: Yeah. I confess I’ve had years of doing that kind of stuff. Just expecting my body to be able to keep pace with whatever I’m doing, and expecting that if I sit in a chair for 12 hours, that everything’s going to be fine. I’m just going to stand up and walk away. And of course, it’s not.

Do you know, it’s really interesting, I don’t know that anybody’s doing this. Maybe you know a load of people that are carrying out this kind of a practice. But it feels like you’ve kind of, forgive me if I’ve got the wrong language here, but it feels like you’ve kind of bolted something close to meditation onto technology. Which is really curious, because I don’t know that anybody, maybe this is common where you are. I don’t know, but.

[00:38:27] Priscilla Collado Ramirez: No, it’s not. It’s not because I’m a sound therapist, and I’m a sound healer. The sound can heal you. I am trying to people understand that you can’t live like a computer. You are not a computer. You can program in your brain like a computer, but you are not a robot. And you need to stop.

[00:38:51] Nathan Wrigley: I think, we’re too attached to our devices, aren’t we? I think whenever the mobile phone came along, we finally gave up free time. And email is there 24/7. Social media’s there 24/7. Technology’s there 24/7. Yeah, breathe is basically what you’re saying.

[00:39:10] Priscilla Collado Ramirez: Yeah. And in my country, no, it is not common. It is not common and it is a little rare. And maybe in another country it is normal to finish your labour at work and meditate one minute.

[00:39:26] Nathan Wrigley: Oh no. Nobody does that where I live, no.

[00:39:30] Priscilla Collado Ramirez: I don’t know if there is any country, doesn’t do it, right?

[00:39:32] Nathan Wrigley: That would be nice. Yeah you’d probably feel really good after that.

[00:39:35] Priscilla Collado Ramirez: Maybe in China? Maybe Japan?

[00:39:38] Nathan Wrigley: Maybe where they a different approach to living. Do you want to roll your thing out? The way that you are doing this, do you want to roll that out to other people? Do you want people to kind of approach you and, I don’t know, study what you are doing, and then go off and do that kind of thing elsewhere? Is that part of why you’ve come to an event like this? To sort of preach the gospel of this idea, this way of learning?

[00:40:01] Priscilla Collado Ramirez: Yeah, yeah. I would love to. I would love the people understanding maybe, I don’t know, create me a plugin about wellness. I don’t know.

[00:40:12] Nathan Wrigley: Okay, so anybody listening to this, Priscilla wants communication with people who think they might be able to step in. I know of several people who have, let’s say things like meditation as part of their daily ritual and things. In which case, anybody who’s listening to this, where’s the best place to find you online? If people want to get in touch and talk about these wider problems, education, learning, calming down, meditation, those kind of things, where would we find you?

[00:40:37] Priscilla Collado Ramirez: On Gravatar. On WordPress page, and Instagram too.

[00:40:42] Nathan Wrigley: I think I’ve got the details of most of those, but if I don’t, I will get them from you, and I will put them on the WP Tavern website. So if you search for the episode, dear listener, with Priscilla in it, I don’t know the number of that episode just yet, but if you search for the episode with Priscilla in it, if you’ve got intuitions that you’d like to help out, go and find this episode and you can reach out. And you never know, maybe something will come of that.

So Priscilla, thank you for chatting to me today.

[00:41:07] Priscilla Collado Ramirez: Oh, thank you too. And remember to breathe.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, testing secure WordPress hosting, does the marketing match the reality?

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today we have Maciek Palmowski. Maciek is based in Poland and works at Patchstack, one of the companies in the WordPress ecosystem dedicated specifically to security. At Patchstack, Maciek collaborates with other security professionals on industry reports, bug bounty programmes, and solutions for agencies, product owners, and hosting companies aiming to secure their client sites.

I met up with Maciek at WordCamp Europe, and we discussed his presentation there. It examined the claims of secure hosting made by many WordPress hosting providers. He describes how Patchstack set out to test these claims with real world penetration testing, using 30 known plugin vulnerabilities across multiple hosts. Employing standardised methodologies and validating their results independently.

The findings are sobering. The majority of WordPress specific attacks still get through, and there’s a significant gap between the marketing hype and real protection.

The conversation starts with Maciek’s background, and how his journey in the WordPress security space led to a focus on the promises made by hosts.

From there, the discussion gets into the research approach, the selection of well-known vulnerabilities, consistent testing across different hosting environments, and the surprising result that even hosts with identical security tooling produce drastically different outcomes, showing it’s not just about the tools you use, but how you use them.

We talk about the Swiss cheese model of security, every layer will have holes, so you need multiple overlapping defences, and honest communication from hosts about their limitations.

We also explored whether an industry-wide standard, or badge, for secure hosting is feasible or even desirable, given how easy it is for strong marketing claims to outpace reality.

AI also enters the conversation, increasing both the speed and sophistication of attacks, and making patching, and processes, even more important, especially as the volume of vulnerabilities continues to rise and the time to exploitation drops.

If you’re interested in understanding what secure hosting really means, how to ask intelligent questions of providers, and the realities of WordPress security in 2026, this episode is for you.

If you’d like to find out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Maciek Palmowski.

[00:03:56] Maciek Palmowski: I am joined on the podcast by Maciek Palmowski. Hello Maciek.

Perfect. You did great.

[00:04:01] Nathan Wrigley: For some reason, your name has got into my head. A lot of the people that I interview, I struggle with their name, and I continue to struggle, but for some reason, I established many years ago that was how to say your name. And I think I’ve done it correctly ever since then.

[00:04:16] Maciek Palmowski: Yes you did. You’re almost having the typical Polish accent, so you’re doing great.

[00:04:21] Nathan Wrigley: So we are at WordCamp Europe, which is in Krakow, or Krakow, I don’t know how.

[00:04:26] Maciek Palmowski: Krakow.

[00:04:27] Nathan Wrigley: Thank you, that was good. And the reason Maciek is correcting my pronunciation is because Maciek is actually from Poland, which I suppose means that this is a bit of a, well, it’s like a home game to you.

[00:04:37] Maciek Palmowski: In a way so, but it’s also like a bit of a shame because I do like travelling when WordCamp Europe’s are happening. And, you know, just hopping on the train and going to Krakow, it was like a, I mean it’s cool because, yeah, the venue’s amazing, everything is great, but still I’m staying home, so yeah.

[00:04:53] Nathan Wrigley: Yeah, mixed feelings. So Maciek has done, or is going to do a presentation at WordCamp EU. Have you done it yet?

[00:05:02] Maciek Palmowski: I will do it tomorrow.

[00:05:04] Nathan Wrigley: Okay. And are you all set, are you one of these like really prepared people that has all the slides done, or are you last minute?

[00:05:11] Maciek Palmowski: Everything is ready. I already did one version of it at the Checkout Summit in Palermo, so.

[00:05:17] Nathan Wrigley: Oh I see. So you’ve had a sort of dry run of elsewhere.

[00:05:19] Maciek Palmowski: Of course.

[00:05:20] Nathan Wrigley: Excellent. So the presentation, which is going to be the focus of today’s conversation, is called Testing the promise, does secure hosting deliver? And I may as well read the blurb because it was a reasonably short one.

So it says, secure hosting, in quotes, is everywhere in WordPress. What does it actually protect against? We put this claim to the test with real penetration testing. 30 known vulnerabilities, multiple hosting providers, standardised methodology, validated by independent observers. The findings reveal a critical gap between marketing and reality. WordPress specific attacks succeed most of the time. That’s quite an alarming sentence. This talk shares the complete results and explains why generic security fails.

So, we’ll get into that in a moment. But as with all people, when I’m talking to them about security, I guess it’s good to establish who you are, and what your credentials are and what you’ve done, and how is it that you get to talk about security with authority. So over to you really, a little moment to give us your bio and tell us about you.

[00:06:20] Maciek Palmowski: Okay. So I work at Patchstack, and Patchstack is one of those few companies in WordPress space that are doing a lot in terms of security. We are constantly running this bug bounty for the whole ecosystem. We have quite a few solutions for both clients and hosting companies, and I work there right now. My role is, if I remember, the Growth Team Engineer, something like this.

But yeah, I do spend a lot of time working with other security people. So when we are working on all the reports, when we are checking the data, I’m also part of those teams that are working on it. So yeah, I think I know a thing or two about what is happening behind the scenes when it comes to WordPress security.

[00:07:02] Nathan Wrigley: Yeah, thank you. Always good to get that established though, right at the outset.

Patchstack is a company which is not a host though, I suppose that’s important to mention at the beginning. It’s a company which is in the security space, very much in the WordPress space, but perhaps more broad than WordPress, I’m not sure. But not a hosting company.

But obviously your presentation focuses its aim on hosting, I guess because that’s one of the places where the claim about security is most often made. You know, you’ll go to a, the landing page of hosting Company X, and you’ll see somewhere fairly near the top, secure hosting, or something along those lines. And you’ve decided to examine that in fine detail and look at these 30 vulnerabilities.

I guess really just tell us about this test and what it is that you decided to do and some of the items that came out of that.

[00:07:50] Maciek Palmowski: Okay, so maybe let’s start with how it even started, right? Because there was a trigger. At some point we published one report about the state of WordPress security. We tweeted about this. We got the response from none other than Matt Mullenweg, who kind of asked a very interesting question, but isn’t hosting companies taking care of this already?

And this was, kind of at this moment when we were, we thought that we know the answer that, no they aren’t. But to be honest, we didn’t have any broader proof about this.

We knew how it’s working at some hosting companies, but we could say that it was more of an anecdotal evidence that we had. So this was kind of the trigger that made us, okay, let’s check this. But not with one partner or two partners, but with more hosting companies.

So we did this research twice. First we just did kind of a beta run because we weren’t sure about the result and, is it even a good idea to go deeper inside of it? And during our first run, we were already very surprised because like the methodology was very simple. We just installed vulnerable plugins and we checked if we would be able to use the vulnerability. Because if the hosting is claiming that, we got your back, we are making your website secure, we have this and that, this means that they should protect against it. So it was as simple as that.

And when we were doing our first test, we were quite surprised because we saw, if I remember, that 80% of the attacks went through. 80% of the attacks. So our first reaction was, okay, we are doing something wrong. Okay, this was only few hosting companies, less plugins, but still the result were so surprising for us because we thought that, okay, that the problem exists, but it’s not that big of a problem. But it was.

So that’s why we did the second test. And this is about which the, my talk will be mostly when we tested more hosting companies, more plugins. And we saw that the problem still exists.

Of course it was, in some cases 70 few percent. So still, it’s a huge problem, especially if we are talking about some companies that are literally saying, you don’t have to install anything additional when it comes to security on your website. We got your back. They don’t. We found a lot of interesting things, but still the problem exists.

[00:10:21] Nathan Wrigley: So just deep diving into that a little bit, when tests like this are done, there’s obviously, the claim might be levelled, you know, obviously Patchstack would, this kind of maybe benefits Patchstack, if you know what I mean.

So let’s just sort of clear up what the test involved. So presumably the plugins that you chose are ones where it’s publicly known that there’s a vulnerability in this component or this particular file or what have you. So is that the case? This is stuff that, longstanding understanding that there’s a problem here.

[00:10:51] Maciek Palmowski: Yes. We only use the plugins that we had all the proof of concepts. So we know how have the vulnerability happened, what was the attack vector? They were all reported through our bug bounty programme, because that’s why we had the proof of concept. Yeah, and that’s it.

It was, like I said, it was as simple as that. We had a really broad mix of all the plugins. How many? It was 30 something of those plugins, if I remember. Different ones. Some were connected with WooCommerce. So, like a very broad selection of them. Different vulnerability types. So we try to mix it up as much as possible.

[00:11:27] Nathan Wrigley: Was the situation for each hosting company the same though? In other words, was the things that you did in one hosting environment the exact same as you did in another hosting environment? No. You mixed that up a bit as well.

[00:11:38] Maciek Palmowski: I mean we used all the same plugins, like the methodology was always the same. But we got totally different results. Even if, and this was one of the most interesting findings, because very often hostings will put a logo of some company that takes care of security. For example, say, Cloudflare. And despite using the same stack for security, they got different results.

[00:12:02] Nathan Wrigley: Interesting.

[00:12:03] Maciek Palmowski: So it turns out, in many cases, it’s not about the tools that you are using, it’s how you are using them, which was very interesting. And we did everything. We tried to enable every feature, every security features on those hosting, to kind of give them a chance to kind of make sure that they are defending the most as they can.

And the result in most cases was very simple. They were doing quite well with the generic ones like uploads, patch reversal, things like this, which are very generic in PHP. But with those WordPress specific attacks, they just failed miserably.

[00:12:44] Nathan Wrigley: That’s so interesting. The word secure hosting, which you’ll see all over the place, it feels a bit like using the word healthy on food. There’s no real definition of what healthy is. You know, a company selling chocolate could probably pretend that it’s healthy compared to something else.

[00:13:04] Maciek Palmowski: Like here, healthy chocolate is exactly, like in some cases secure hosting.

[00:13:07] Nathan Wrigley: Right. So what do you take from this then? I mean basically, is your survey saying that whenever you see the word secure hosting, be sceptical?

[00:13:16] Maciek Palmowski: Yes.

[00:13:16] Nathan Wrigley: Okay. As simple as that.

[00:13:18] Maciek Palmowski: It’s as simple as that. Because one of the things that we were always promoting, security is not a plugin, it’s not a one button thing. Security is a process. It’s layers.

And that’s kind of why we, especially after this report starting kind of using the term, Swiss cheese layer model. Because every layer will fail in some way. That’s also why you still need all the security solutions that hosting provides, because they do have a lot of interesting solutions against those generic attacks.

Because they’re doing really great when it comes to those generic ones. And that’s great because some of the attacks will be already dealt with. So whatever passes to the second layer, it has less work to do because a lot of it was already stopped at the first layer. The second layer should be something more WordPress specific that understand what is installed. And with this it can catch also a lot of it.

But still, you have to be prepared that, because again, this layer also isn’t perfect. Because there are zero days vulnerabilities, there are custom code, there are a lot of things that can happen, that your website will be hacked. I mean, weak password. Simple as that. That’s why you also need to have a layer, which will be more of what to do if everything else fails. Because you do need to know that you have to inform your clients, all the GDPR related things. How to kind of, I don’t know, use the backups.

In short you need to have procedures. You have to be prepared before the attack happens. Because let’s be honest, asking some lawyers about, what should we send to our clients? The moment when, well, the milk is already spilled. It’s like the worst moment to think about it. Especially that, hey, your website was just hacked. It’s not just a technical problem, it’s also a business problem. Again, with those GDPRs and everything.

So yeah, the more layers, the better. You still need to remember, every layer can fail in some place. That’s why the more, the better.

[00:15:29] Nathan Wrigley: Would you like to see a standard industry-wide definition of something like a badge or, I don’t know, let’s say for example, that you put the word secure hosting on your website, that has to actually stand for something.

Because obviously coming from the background that you do with a broad oversight on what that is, you have a vast amount of data at your disposal. You can see all of this kind of stuff. But every company can make the claim that our food is healthy, our hosting is secure. But I don’t know, in the model that we’ve got where any company can put anything they like on a website, I don’t really know how you do that, but some sort of accreditation or something. I don’t know.

[00:16:08] Maciek Palmowski: Honestly, it’s really difficult because as I said before, a lot of companies using the same tools were failing in different ways. So that’s a problem. On the other hand, like sometimes the, those stupid things like weak passwords. And it doesn’t matter that you had a, let’s call it a certified secure hosting, you still failed because your password was weak, you know? So, also certificates like this can backfire because some people might think I have a secure hosting, I don’t have to worry about things. And then you have 10 admin accounts for everyone.

[00:16:43] Nathan Wrigley: Is there is there something, some mark of that description that you, personally, that you go looking for though? Is there some credentialing system which you think actually does carry some weight? So for example, I don’t know, like the insurance space or the accountancy space or something like that. You have to have that accreditation in order to do business. Is there something like that? Is there a mark which hosting companies can apply for which you could have some confidence in it?

[00:17:13] Maciek Palmowski: Okay. So for sure one of those things would be, and I don’t want to say it as an advertisement, but it is a thing that you see that the hosting is thinking a bit better about security, kind of looking if they are a Patchstack partner. Because this kind of automatically means that they do have this WordPress, the security WordPress layer. So that’s already a good sign.

So yeah, I would start with this. I think that’s kind of one of the simplest ways, but again, Patchstack isn’t the only solution that does it. So looking for partners of such companies might be the best way to start because having those Patchstack aware security solutions built in, into the hosting is a really good sign.

[00:18:05] Nathan Wrigley: Yeah, okay. Now, the inevitable conversation in the year 2026 is AI. It doesn’t matter which area of WordPress you’re talking about. AI manages to get in somewhere. I am presuming that the landscape in terms of security only got more complicated because of AI. Because I’m imagining that attacks that needed to be conceived by a human can now be conceived in a fraction of the time by an AI agent. But not just one, maybe a dozen or a thousand or whatever it may be.

Let’s just talk about that for a moment. It feels almost as if AI and security are like, that’s a real systemic problem for the future of the entire industry. Because these things can happen so fast, a plugin vulnerability is discovered by an AI agent. It then discovers the attack surface, implements the attack all in a matter of seconds, possibly. What’s the position? Like, how do we stay calm basically in the year 2026?

[00:19:09] Maciek Palmowski: So the problem already existed around a year ago, because a year ago when we did our State of WordPress Security Report, we already saw that vulnerabilities are being used after around five hours after kind of being published. So five hours. That’s the first thing, because we still have a lot of people that say, yeah, just update your WordPress weekly and you’re good to go. No, you’re not. Looking at this number, you have five hours.

[00:19:39] Nathan Wrigley: Okay. Let’s just parse that at the moment. So the vulnerability is published. So there’s a whole thing there, like the vulnerability may well have been discovered prior to being published, so that’s a whole other thing.

[00:19:52] Maciek Palmowski: So first the vulnerability is discovered. Then at least how it works on, with our bug bounty. We inform the vendor they have, let’s say around a month to fix it. When they fix it, we publish everything and, yeah.

[00:20:09] Nathan Wrigley: Okay, so from the moment you publish, you can then detect that that is being leveraged within a space of five hours.

[00:20:17] Maciek Palmowski: Yes.

[00:20:17] Nathan Wrigley: Okay, that’s really interesting.

[00:20:19] Maciek Palmowski: But there is a problem. There is a really big problem. So if the vendor doesn’t respond, we still publish it.

[00:20:26] Nathan Wrigley: How long do you give them? Is it like.

[00:20:27] Maciek Palmowski: It is the one month.

[00:20:28] Nathan Wrigley: Okay, thirty days.

[00:20:30] Maciek Palmowski: Of course, if they reach out that there is some problem, they need like extra days. But in most cases, we’re talking about the vendors that just don’t respond at all. We publish it anyway.

But the problem is that, from all the vulnerabilities that were discovered last year, 50% weren’t patched at the moment of publishing about it. 50%.

[00:20:50] Nathan Wrigley: So half of the plugins where there was a known vulnerability, the vendor had been informed, they’d had this 30 day window. Half of them made no amendment to their code.

[00:21:01] Maciek Palmowski: Exactly.

[00:21:02] Nathan Wrigley: Okay. Wow, okay.

[00:21:03] Maciek Palmowski: Again, going back to this classical, yeah, just update your WordPress regularly. No.

[00:21:08] Nathan Wrigley: No, that’s a really different surface, isn’t it?

[00:21:11] Maciek Palmowski: It doesn’t work on so many levels. Because not only the problem is with the fact that, still the famous five hours, which also, it’s five hours now. It was much longer a few years ago. On the other hand, yeah, most of those, I mean around half of it aren’t patched, so the attacks will happen quicker than it get patched. So yeah, there is a lot of problems like this. And also the problem with security is that it’s really difficult to sell.

[00:21:39] Nathan Wrigley: It’s like insurance, isn’t it?

[00:21:40] Maciek Palmowski: Yeah. But insurance, okay, you see your car, your house, it’s real. It’s real, you kind of see it. The only category of websites that it’s much easier to kind of explain is e-commerce.

[00:21:54] Nathan Wrigley: Yes. You can feel the tightening on your wallet.

[00:21:56] Maciek Palmowski: They literally see the money. They can kind of really, okay, one hour of my website not working equals this and this Złotys or Euros or whatever. So that’s easier to explain. But for most people, yeah, security, meh.

[00:22:11] Nathan Wrigley: Yeah. That’s really interesting. So you mentioned, about this survey, you mentioned that fully 80% of your penetration testing resulted in something. What were the sort of, the high level items? Apart from that 80% figure. What were some of the other, because you said there were a few interesting things that dropped out of it. Can you mention anything else?

[00:22:31] Maciek Palmowski: So like I said, one of the things was that we learned that, despite using the same tools, we got different results. That was also a surprise for us.

[00:22:39] Nathan Wrigley: So let’s just figure that out. So at hosting company A, we’ve got a WordPress website with the same collection of plugins in. Hosting company B, exactly the same as far as you can make it the same, but things are different.

[00:22:52] Maciek Palmowski: No, no, they are, for example, they’re using for security the same tools.

[00:22:56] Nathan Wrigley: Right, okay.

[00:22:57] Maciek Palmowski: So in theory, if they’re using the same tools, we should have exactly the same results.

[00:23:03] Nathan Wrigley: So does that then point to a different set of configurations on the backend, or is it more curious than that? You just don’t quite know what’s going on.

[00:23:12] Maciek Palmowski: I mean because it’s not something that they will tell us. But yeah, in most cases, it’s all about configuration because the fact that you’re using a tool, it’s also important how you use a tool.

Also, with security is very often about, is something easy to use or is something secure? And kind of finding the balance. So some of the companies probably had a bit more aggressive configuration, which is better from the security point of view, but probably more often result in some annoying side effects for the user.

Also what, this was one of the most interesting things, but also what was very interesting because we contacted every company afterwards and we informed them that we did the test. Here are the results, what went through, what was blocked. And some of the companies did an amazing job of fixing whatever they could. On the other hand, we saw that some of the companies, because we did some extra tests later just to check what they did with our report, did nothing.

That’s one of the things about security in general, not about the hosting, about even having vulnerability in your plugin. That’s normal that we make mistakes. We’re humans, right? So that’s normal. What’s important is how we deal with them. If you have a problem and you fix it as quickly as possible, as good as possible, that’s great because you learn from your mistakes, you fix it, and you move on. Perfect. Good job. Now you are in a much better position than before. But if you get this, you look at it and you say, ah, this is fine, that’s the worst behaviour from the security point of view that you can have.

[00:24:57] Nathan Wrigley: I’m going to ask you not to name names here, but were some of the companies familiar to us?

[00:25:05] Maciek Palmowski: For sure, because we did test the biggest ones. But there is a reason why we didn’t want to name them, and it wasn’t about that we were afraid that I know someone will get mad or whatever. It was more about this weird side effect that could happen.

Some users would think, my hosting isn’t on this list, so probably I’m secure. Probably you’re not, you just weren’t in the test. Because we also did some site checks and everything. And we saw that a lot of those problems happen at most of the hosting companies. And like I said, the more important part was how did they reacted after getting the report. Like I said, it was a more common problem that we even thought.

[00:25:43] Nathan Wrigley: Do you, obviously, you know, caveat all of this with the fact that you work for Patchstack and what have you, do you see it even as the role of a hosting company to have any position on security publicly? Or would you prefer them not to make grand claims about things that you believe they can’t necessarily substantiate?

I don’t really know where I’m going with that question, but I’m just wondering if there’s just a sense that the language that’s being used is too strong. You know, secure hosting implies we’ve got all the padlocks, and the padlocks are there and you’ve got nothing to worry about. You’ve found a different picture. So I’m just wondering whether or not you would just prefer that the hosting companies stop talking about this altogether.

[00:26:27] Maciek Palmowski: I do think that’s, one of the biggest problem here is about the claims, the bold claims, the whole marketing around it. Sometimes even you can find documentation of some of them that, yeah, you don’t need to install any third party tool because we got you covered. We checked it, no they didn’t. So that’s kind of the problem.

It’s really more about the, how they market it. If they would say, okay, so we have a really performant hosting that does this, this and this. When it comes to security, kind of do it yourself. I mean we are providing this layer, but the rest is up to you. And that’s okay. That’s an honest claim. We are not doing everything for you. We are doing this part, but this is up to you. This would be much better.

I know that from the marketing point of view, it doesn’t sound as good as, we got all the security that you can imagine, don’t have to worry about this. Because that’s kind of the thing that very often managed hosts trying to sell, that you don’t have to worry about things. You just have to focus on whatever you have, writing content, selling stuff. If you have a e-commerce, whatever, that’s it. That’s kind of the only thing you should think of. Not about performance, because we got your back. Not about security, again, we got your back. And if you are paying for a managed hosting and suddenly they would start having like this different way of messaging to, it’s not that obvious that we have your back in everything. That would be very difficult for them.

So now it’s kind of the problem that, because everyone is kind of using this messaging, everyone else also has to. And also if we think about how a lot of those algorithms, look like that algorithms love bold claims. They want something white or black, not grey. And the truth is, most of the things we are talking about, it doesn’t matter, security, SEO performance, it’s everything in the grey zone. That’s why a lot of developers can end their talk with, yeah, it depends. There is no right or wrong. It depends because there are so many things you have to think about.

I could say that, and this is my kind of thing that, most of the websites that people have should be static. They don’t need even WordPress at all. This is a horrible claim if you’re a manager of a WordPress hosting, right? So that’s the thing. But it all depends on so many things, but yeah, the messaging is important.

[00:29:08] Nathan Wrigley: Yeah, if you were, on a personal level, if you were going out there looking and let’s say, if you can somehow put your job hat to one side, what would be the kind of things that you would be looking for? What questions would you be asking related to security if you were to be going to these companies?

From everything that you said, obviously it’s not black, it’s not white, it’s definitely grey. So every setup has some way of being vulnerable. But what are the kind of intelligent questions that you would be bringing to hosts to get some reassurance that at least they appear to know what they’re doing, even if they can’t make the claim that they’re a hundred percent cast iron, water tight? What might be some intelligent questions to start asking?

[00:29:49] Maciek Palmowski: One of the best questions you can ask is just, is there any solution in your security stack that is WordPress aware? Not the general one. Because if they only start talking about some web firewall, things like this, it’s already kind of a red flag. Because this is, overall, if we’re talking about firewalls, that’s not the correct layer about which, this is the generic one.

So this is the main question. How do you take care of WordPress specific attacks? Simple question. And if they will start responding, yeah, that we have this web application firewall that, in most cases this will be a sign that, no, we are not talking about the correct layer. That’s not it. It’s probably not aware about what is happening in WordPress.

[00:30:40] Nathan Wrigley: Okay. So given that this is a WordPress podcast, and we are at a WordPress event, that would be the beginning of your questioning is demonstrate that something in your stack is specific to WordPress.

[00:30:52] Maciek Palmowski: Exactly.

[00:30:53] Nathan Wrigley: Okay. And beyond that, is there any questions that, so let’s imagine that they come back with, yes, we have something specific, it’s WordPress. What would be sort of sensible follow up questions?

[00:31:00] Maciek Palmowski: I mean you can kind of start off about, okay, what exactly you are using? Because there is a limited amount of tools that are really WordPress aware. So if they will answer with kind of a product name, that’s kind of the easy way that then you can check it on your own. But that’s kind of the thing. Is it WordPress aware?

[00:31:19] Nathan Wrigley: Does it worry you in some way that there’s this perception out there that WordPress is insecure? You know, if you ask a thousand people, you’d maybe get 800 saying, oh WordPress, you know, we’re not touching that with a barge pole.

Do you worry that content like this, that you are putting out, that that might fuel that fire? Does it concern you in any way that it might lean into the argument that, I don’t know, somebody can link to that blog post from a rival CMS, or a SaaS platform, which does something similar to WordPress? Where do you sit on that?

[00:31:51] Maciek Palmowski: That’s a really difficult question. And this is one of the questions that when I talk on non WordPress events, I love to ask people. Is WordPress secure? And in most cases, I see that most of the room is, yes, it’s unsecure for sure. And I’m like, no, that’s not true. WordPress is secure. Every year there is just a few minor vulnerabilities in Core. That’s it. The problem is, of course, that WordPress on its own lacks some functionality. That’s why we install plugins.

And here we enter another problem because, okay, every year we have like thousands of those vulnerabilities in general in plugins. On the other hand, we have thousands of plugins. So kind of statistics will always look bad. But that’s why every time when you want to select a new plugin, you need to do some research. Yeah, I know it’s boring and everything but, hey, now we have AI, you can do it much quicker. It can help you a lot.

But looking at all those databases, for example, we have one database, WPScan has. There are those databases of WordPress vulnerabilities that occur to every plugin. And you can see, is the plugin you’re interested in had a lot of vulnerabilities? On the other hand, how it kind of looked historically. It’s not just about the number of them. In general, it requires some research.

And yeah, if we are just like looking at this, and this kind of vibe that right now we have that we are just about really bold opinions stated quickly that will fit one TikTok, yeah, WordPress is in a horrible position because, let’s be honest, it’s like, if you have, I’m not sure how many seconds does a TikTok movie has?

[00:33:39] Nathan Wrigley: I think 30.

[00:33:40] Maciek Palmowski: Okay, let’s say 30. So it will sound much better that you will say, yeah, WordPress is unsecure, which is not entirely true because it depends again. One of the most boring, especially again for those algorithms and everything, it’s a grey zone.

Because we are collaborating with a lot of companies that are making plugins, and we see how their security flow looks like. How they are dealing with vulnerabilies that are discovered. And honestly, I’m amazed how well some of those companies are doing it. They are very serious about it. They understand how important it is. For them it’s something very important.

[00:34:22] Nathan Wrigley: I suppose WordPress is a victim of its own success in that sense. And it would be a bit like, I guess a good analogy might be if you’ve got a car manufacturer and they produce a thousand cars a year and you compare them to Ford who make, let’s say, I don’t know, 20 million a year. And the question is, well, whose cars break down more often?

[00:34:41] Maciek Palmowski: Yeah. Do we look at the percentage of the number?

[00:34:44] Nathan Wrigley: Right. And if you say, well, 400,000 Fords broke down last year, and one of these other manufacturer, you can immediately see why there’s a problem there. And that I think is the landscape in which WordPress is often painted. The reason there’s lots of publications like yours bringing out WordPress information is because it’s the most popular thing. It makes sense to write about the most popular thing and to try to find the vulnerabilities and disclose them in a sensible way. So I don’t know what we do with that. It is just the way it is.

[00:35:15] Maciek Palmowski: I would also say there is one more interesting aspect because WordPress is considered unsecure because of the plugins. But what’s funny, for example, Elementor is also considered unsecure because there are plugins for Elementor. This is a very weird moment when the thing that brought WordPress to its bigger success, security wise, is its biggest problem right now.

Because WordPress did a lot of, I mean it was always great to, being as it’s kind of, let’s call it entry level CMS. For many people, it was also the way how they began the adventure with PHP development because it was so easy. Now we kind of have the, all the consequences of being that easy.

[00:36:06] Nathan Wrigley: Yeah, in a sense, this is going to sound ridiculous, we should be glad that there’s people talking about WordPress vulnerabilities, because it means the project is successful. And it also means that it’s, there’s an industry of WordPress security solutions, and there are people who take this very seriously and dedicate their lives to it. And you may not find that in some of these other ones, you know, some of the smaller CMSs and things like that.

I think we’ve probably hit about the sweet spot for the amount of time. But Maciek, I don’t know if there was anything in that report that you have got lined up in your presentation that I never got to. If there was a particular thread that you wanted to pull. If there is, go for it.

[00:36:46] Maciek Palmowski: No, I think we covered all the important things. And as you kind of said, this AI aspect, this will change so many things.

[00:36:55] Nathan Wrigley: Yeah, we’ll come back in two years and this conversation will be a very different thing.

[00:36:57] Maciek Palmowski: Oh, I think even in few months which will be very interesting. Yeah, so this aspect, it’s really very surprising. And I think that everyone who is right now kind of giving somewhere a talk about AI and security is in a very difficult spot because.

[00:37:14] Nathan Wrigley: Yeah, your content is going to look stale quickly.

[00:37:16] Maciek Palmowski: Yeah because you know it’s like, but a week ago everything changed. Yeah, I have to rewrite everything.

[00:37:20] Nathan Wrigley: Speaking of which, by the time that this goes out, hopefully you have managed to give out your presentation at WordCamp Europe. I will link to it and anything else that we’ve mentioned today in the WP Tavern post. So go and check that out. But I will specifically link to the wordpress.tv version of your presentation, which no doubt will have been created by then. So Maciek, thank you for chatting to me today. Good luck. I hope presentation goes well.

[00:37:43] Maciek Palmowski: Thank you. Thank you so much. Yes. I might need a bit because, you know, it’s WordCamp Europe. It’s a big conference.

[00:37:49] Nathan Wrigley: It is, yeah. Good luck. I hope that you manage to stay calm.

[00:37:52] Maciek Palmowski: Thank you.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, why accessibility in WordPress themes is easier than you think.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Jessica Lyschik. Jessica is a longtime member of the WordPress community who’s been working in the ecosystem since 2015. She’s spent years learning and advocating for web accessibility, both as a developer and as an active community participant, joining agencies, working on theme reviews, and helping improve standards.

Many theme creators assume that making themes accessible is an intimidating task, but Jessica’s here to show you that achieving an accessibility ready WordPress theme is more straightforward than you might imagine.

Her WordCamp Europe 2026 presentation, accessibility in themes, easier than you think, aimed to demystify the requirements for accessible themes. Explaining what the WordPress guidelines mean in practise, where the low hanging fruit is, and how both block and classic themes can reach accessibility ready status with manageable efforts.

We talk about the personal and moral journey that brings developers to accessibility. The technical hurdles and documentation challenges, and the ways in which things like AI agents are putting accessibility in the spotlight for everyone.

Jessica talks about practical steps that quickly improve accessibility, like using correct HTML tags, adding alternative text to images, and configuring skip to content links, and shares why building accessibility in from the start saves time and effort down the road.

We also explore the differences, and possible advantages, of block themes when it comes to accessibility, and why theme guidelines work the way they do, and the importance of interdisciplinary awareness across SEO, design, and content teams.

Jessica mentions helpful resources, influential leaders in accessibility, and the ongoing need for documentation improvements to help everyone level up.

If you’ve ever felt overwhelmed by accessibility requirements, or wonder why they matter, and how you can build better WordPress sites that work for everyone, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Jessica Lyschik.

I am joined on the podcast by Jessica Lyschik. Hello, Jessica.

[00:03:39] Jessica Lyschik: Hi Nathan.

[00:03:41] Nathan Wrigley: Nice to have you with us. This is my second interview at WordCamp Europe 2026. We’re in a beautiful, big media room. I’ve got to say, this is one of the nicest spaces I’ve ever had for these kind of interviews, so that’s really nice.

Jessica has already done, I want to say presentation but maybe it was a workshop. I’m not sure.

[00:03:57] Jessica Lyschik: No, it was a regular talk actually, yeah.

[00:03:59] Nathan Wrigley: Okay. And how did it go?

[00:04:00] Jessica Lyschik: It went super well, except for my slides went missing in between. That wasn’t so great. But the audience was very respectful of that, and I made a bit fun of it, so they laughed for a second and I tried, the media guys tried to fix that. We got it fixed in the end. I would’ve winged it anyway because I, like I knew what was coming up. But it’s always good to have your slides. It’s like seeing them, because for me it’s also visual reminder. It’s like, I need to see what I’m talking about, so I’m not losing track of it. But yeah, this was just a little technical hiccup. But overall I got very great feedback so far on my talk, and I’m very glad.

There were also quite a lot of people. I did not expect this many. And that makes me just super happy that people are actually interested in this topic, although it is sort of scary for some of them if they even like try to touch this topic. We can probably get into the details later. Yeah, just overall like, what does it do? Why do I need that? These unanswered questions that they have that they were like, ah, no, I’m not really interested into that.

[00:05:01] Nathan Wrigley: Oh, that’s nice a big reception.

[00:05:03] Jessica Lyschik: Yeah. And that’s just great to see because I think just as we all grow older, and I even noticed that, and I’ve said that in my talk, like I kind of get to appreciate when a website is accessible. I mean I’m still have a long time to go, hopefully in my life, but I start to appreciate the small things that make just browsing websites easier, to be honest.

[00:05:23] Nathan Wrigley: So I guess we should introduce the subject and then give you a chance to introduce yourself because it feels like in this context, the subject at hand, it’s important to know that you know what you are doing. It’s not, well, I suppose it’s a general skill in that it should be something most people know an awful lot about. But I fear that that’s not the case.

So the presentation that you’ve just given was called accessibility in themes, easier than you think. That’s nicely phrased. Let’s get them through the door.

And then the blurb that went with that, I’ll just read that into the record then everybody knows what we’re talking about. So it says, many theme developers assume accessibility ready requirements are hard to meet, but that’s rarely true. This session shares practical insights for real theme reviews, and shows how both block and classic themes can reach accessibility ready status with manageable effort.

So that’s the context of what we’re going to talk about today. However, as I just alluded to, could you just tell us a bit about you, how long you’ve been using WordPress, and then I guess if you want to focus a bit on your accessibility credentials and what you’ve been doing in that space.

[00:06:23] Jessica Lyschik: Yeah, of course. So yeah, I’ve been using WordPress, I think I started around 2005 or 6 already. So like dipped my toes into it, played with it around, just got a feel for it. But actually professionally, I started out in 2015 in the WordPress ecosystem.

Before that, I already joined the community. So I was working at another place that did not use WordPress before. And then in 2015 I joined a WordPress agency. Today they’re called Syde, for anyone who’s wondering. And ever since I’ve been into WordPress that long.

And accessibility in that case I have, I think it was a gradual process more of. It was not just like, I’m now doing accessibility. That just didn’t happen. It was, I learned it over time. And when I started learning about how to create a website accessibility was absolutely not a thing. No one cared about it. And it just became more and more aware for people, for developers, especially in the past couple years. I think we still have some way to go but like, as I said earlier, there were so many people interested in my talk. So I think we’re now at a pace where things get really interesting for many more people.

And yeah, I learned a lot along the way. Made a lot of mistakes along the way. But I’m glad I’m learning this. I’m still learning. So it’s always something that you continuously learn, because I think the hardest part to grasp for people is that, if you are abled, it’s like you can see, you can hear, you can navigate a device with your own hands, all stuff like that, you take it for granted.

And if you suddenly see or people tell you the perspective of like a blind person, a person who’s deaf, a person who may not be able to use a device like you do, maybe have a hand injury, or no hands anymore, that’s also happening. Then you start to wonder, okay, how do these people actually like use websites or use their phones or computers? And there are many different ways to do that. And I think if you have the chance to learn about this, it is absolutely eye-opening.

You can also then, there was a talk at WordCamp Leipzig this year, but also last year, I attended last year, by a blind person. And her brother was also blind. He was a developer. And they shared like how bad some websites are, and how they struggle to like get the information out of the website, and what crazy, crazy stuff people are doing to their websites that do not make it accessible for these people.

And then you are sitting there and wondering, oh my God. And sometimes I have to say, I even did this in the past and I didn’t know, but I’m glad today that I learned about this and make a better web essentially. Yeah, that’s why I’m here sharing my knowledge.

[00:09:11] Nathan Wrigley: It kind of sounds for me, so when I talk about accessibility, there’s always two strands to it. There’s like this legal bit where the governments are increasingly talking about things that will happen to you as a company that builds websites if you don’t follow guidelines. So that’s one side.

But there’s also this moral side. There’s the side of, we ought to do this despite what the law says. You know, it’s just a necessary thing. And it feels to me as if your journey in this was a moral one.

[00:09:38] Jessica Lyschik: More of, yes.

[00:09:39] Nathan Wrigley: Yeah, there was a definite need here. You know, in the real world when you see somebody, let’s say somebody who’s sitting in a wheelchair and they’re trying to get into a post office and there’s a step that they can’t get over, there’s no bit of you which doesn’t see that as unjust. Every bit of you says that character can’t get over that step. That’s wrong.

And yet, the bit of the world which is becoming increasingly the way that we interact, you know, we book flights, we file our taxes, we do our banking, we, all of these things, they’re completely invisible.

Most of the time we’re doing the internet by ourselves. You know, we might be sitting on a train, but nevertheless it’s a solitary activity, or we’re in our own home or whatever. And these pitfalls, the equivalent of the step in front of the post office is totally invisible.

And it also seems that the voice of the people whose lives are made more difficult is just drowned out. Somehow that anger that they must feel never seems to rise to the top quite enough that we all take the necessary steps.

I don’t know if any of that landed, and there was definitely no question there, but I’ll hand it back to you if any of that resonates.

[00:10:49] Jessica Lyschik: No, I think you, you’ve put it absolutely right. And the invisibility is the thing, because a step for us is visually, like we see it I mean. If you’re blind, you’re not seeing it. But let’s put it away for a second. But in the web, the invisibility is like the key thing. And I just talked to Anne-Mieke Bovelett about, who’s doing another accessibility talk this afternoon. She told me about like a company where they put effort into their website, making it more accessible. And their sales actually increased. So it can definitely help. This is just one example.

But there’s also a new player in the field that will probably even increase the interest in accessibility, and that is AI agents. Because AI agents, they do not see a website as we do visually. They rely on that the website is technically built correctly. Google actually just last month announced that they will focus on this. They will focus on the accessibility for the AI agent. I have put a link in my slides to that document. This is basically, I think something that will be easier to grasp for people for some weird reason. But it’s made more visible to them because if an AI agent cannot read your website, and I know we are probably still at the very beginning of this AI agent stuff, but I think this will increase over the next couple months or even years.

[00:12:14] Nathan Wrigley: That’s really interesting because when an individual, let’s go back 10 years, when an individual is creating a website, every single bit that you have to achieve is a minute of work or another minute or 20 minutes or an hour or what have you. And so there was this whole thing of just building the website, especially when page builders and things like that came along, just building the website to see what it looks like. And that whole accessibility layer just basically gets ignored.

However, that’s what you’ve just said is curious because the AI agent building the website, to the AI agent, that’s kind of no extra work to get it right, if you know what I mean? If it’s configured to do all of the bits correctly, I’m using air quotes around the word correctly, then in theory it should be quite a good custodian of accessibility when it’s building things. I guess only time will tell whether that actually happens.

[00:13:08] Jessica Lyschik: Yeah, but it’s also for like, not the agents itself building, but also the agents visiting your website. Especially if you do like, I think shopping will be the one thing that if you say, hey, I don’t know what the best coffee or what, this is like a good topic. Yeah, okay, here are three options. And then, okay, buy me option one, a kilo of these beans or whatever. The AI agent, if the shop is accessible, the AI agent could do the shopping for you. This is where things are going and progressing towards, that you are not actively anymore the person who actually goes to the online shop, puts it in the cart, goes to the checkout and does all that stuff for you. But if the agent knows all that, it can do it for you.

[00:13:50] Nathan Wrigley: Can I ask a question then? Because I may have, I think I’ve understood what you were just saying and curiously, I’ve never had that thought, the one that you’ve just expressed. I want to know if I’ve got it right. Are you saying that in a world in which we increasingly ask AI to achieve things on the web for us, if it’s built with accessibility in mind, it’s more likely to be able to achieve the result of, let’s say, buy me a kilo of coffee.

[00:14:14] Jessica Lyschik: Yep.

[00:14:15] Nathan Wrigley: That’s so interesting.

[00:14:16] Jessica Lyschik: Yeah because like, Anne-Mieke, whom I just talked about, shared a long document with me recently and I was just reading through it and was like, yeah, of course. Of course, if we technically do things right, we use the right elements, we do the right descriptions for everything that a computer, because AI agent is just a computer. Like assistive technology, like a screen reader who needs to read the right structure out of it and to fit the right content. But also is able to interact with stuff, like click on that button, put that in the cart, go to the checkout and so on. It’s basically the same. An AI agent is a screen reader.

[00:14:53] Nathan Wrigley: Yeah, that’s really interesting. I’m thinking of a map where I’m trying to get to a destination, but the map has no directions. Imagine a scenario where we set off from one place and our destination is here. What you are saying is all the instructions in between to get from the start to the end can be read if the HTML and all of the bits and pieces wrapped up in that are correct. I had never had that thought before. That’s so interesting.

[00:15:17] Jessica Lyschik: Yeah, that’s very interesting. And I did not focus too much on this topic in my talk, but I wanted to put it in there at least in one slide to give like the food for thought that people can actually think about it because this is like what’s hyped right now. I have not tried out this whole agent thing yet, but like from a developer perspective, I can totally see that this is something that will increasingly help AI agents to achieve stuff.

[00:15:41] Nathan Wrigley: Yeah. And presumably make it so that a whole tranche of people who struggle with the web as it is currently might be able to interact with their voice or whatever other technique they use. We’ve completely gone off the rails, but that was such an interesting aside, thank you.

[00:15:58] Jessica Lyschik: Yeah, I think this is something interesting to share. And as I said, I wanted to focus more on the technical details in my talk, so I left it kind of out. But I think it’s a great opportunity to share it here with you.

[00:16:08] Nathan Wrigley: Yeah. That was lovely. Thank you.

So let’s go back to the WordPress bits and pieces then, and I’ll just do the title again because hopefully that’ll refresh it in listeners’ minds. Accessibility in themes, easier than you think. Dear listener, if you’ve been using WordPress for any length of time, you’ll know that the themes still plays a giant part in the structure of your website and the way that people experience it.

So where are we at then in the year 2026? Does the theme still represent a huge part of accessibility? In your experience, is it easier than most people think to get an accessible website in the year 2026? We’ll get into block based themes and classic themes and all that in a minute. But essentially what I’m asking is, is it an easier thing to get right than most people imagine?

[00:16:51] Jessica Lyschik: Yes, because I think what scares people off from my own experience, there are requirements to get the accessibility ready tag in the wordpress.org theme repository. And these requirements, if you first read them, they’ll sound a bit cryptic and you do not really understand what they actually mean.

In my talk, I was trying to combine this, what the requirement says with what is actually meant by that. Because right now, and this is something I would like to improve for the future, I’ve already talked to people about this, and I will have another chat with Rian Rietveld about it later, or tomorrow. Let’s see when we can make that happen.

Because right now the requirements read like, okay, this must be achieved. This is what the website should do. Then there are some testing instructions, but you’re not told how to achieve it. What do you technically need to do in order to do that?

I noticed this while I was reworking. I found out about the requirements also just a month ago because the requirements got updated. I have a theme in the wordpress.org repository and I tried to apply these new rules and have another fresh look at it. I got the accessibility ready tag for this already when I first got the theme into the repository. But like it was a good refresher to like go over all the requirements because they have slightly changed a bit, they added new ones.

When I was there, I was like, okay, like I understand this now because I have learned about accessibility over the past couple years. For someone who is fresh to this topic and doesn’t know too much about it, it’s hard to understand. Because there are some descriptions of things like, basically what it means is that you need to use, for example, the right HTML tags, header, footer, the main tag. We have section and aside, which are available in HTML 5. But the requirements does not say this explicitly.

And I think this is where probably most people have gotten stuck in the past, because they did not understand like, what is actually required from me technically? Because the texts are not so much focused on that. And this is something I would like to contribute as well, to give back and to enhance. So it’s not there yet, but hopefully sooner than later we can add all this information so it gets even easier for people.

Because if you’ve done a website and you know about the HTML, you know about maybe a little bit of CSS, you know how to achieve this. You just need to connect the dots to what is relevant for accessibility and how do you do this in your HTML essentially.

[00:19:20] Nathan Wrigley: Yeah, I guess that’s a bit of a shame really, isn’t it? Is that the documentation is difficult to follow because I feel that accessibility is one of those things where if something is difficult it can get dropped basically.

[00:19:33] Jessica Lyschik: Yeah, people won’t do it.

[00:19:34] Nathan Wrigley: Yeah, because the majority of people browsing the internet can browse the internet despite your accessibility efforts, that will be the standard that they’re aiming for in most cases. So if it’s difficult to achieve these things and the documentation’s not really straightforward, every time somebody comes across a question and thinks, I don’t really know the answer to that, probably the quickest thing to do is just to, ah, push it to one side and not press through. But you obviously have and made it a bit of a goal.

So is there a particular accessibility requirement that developers in your estimation kind of overestimate the difficulty of? What I’m asking here really is about some low hanging fruit that you know about. In the scenario that we’ve just described where it’s easy to get put off and to sort of say to yourself, okay, I can’t do this. I’m wondering there are some sort of quick wins that you could describe that people could maybe achieve within the next half an hour, once they sat down at their machines?

[00:20:27] Jessica Lyschik: Yeah, I think there are definitely some. There is like underlining text in your main content, just underline the text. It’s one line of CSS, text declaration underline. For links, obviously, not for the entire text.

And there is like, as I said, the HTML tags. With block themes, it’s super easy. For example, you just need to configure that correctly in the editor, or use the correct template part and it’s basically done for you. Core does that. This is one advantage of block themes, but we can dive into this deeper later. Or the skip to content links also in block themes.

As an example, in block themes it is just like putting the content block in a group and assigning the main HTML tag to that group. And WordPress does the rest for you. It’s just like assigning this one little setting correctly and then you get automatically a skip a content link for block themes.

[00:21:18] Nathan Wrigley: Yeah, but curiously, if you didn’t know that small fact, that WordPress would handle that for you, if you don’t know, you don’t know. And you’d presumably go around the houses trying to figure that out for yourself and implement some custom version of that thing. Whereas in fact, what, three clicks, four seconds and you’re done.

[00:21:33] Jessica Lyschik: It’s super easy, yep.

[00:21:33] Nathan Wrigley: Yeah. Any more before we move on?

[00:21:35] Jessica Lyschik: I think these are like the most, absolutely the low hanging fruit is also if you use any images to add an alternative text. I think this is probably the most common one people already know. It is so easy. And even WordPress, even if you use classic themes, it’s already in the media library, the alternative text field. For block themes you have it directly at the image so it’s already in front of you. You just need to use it.

[00:21:57] Nathan Wrigley: Yeah, you just not ignore it basically. Yeah, that’s true.

So has this become kind of a habit for you then, over the last period of time since you’ve taken more and more interest in this? Have you got to the point now where this is just how it works? You know, in the same way that I drive a car and I use the gears and that’s all just second nature. Is it like that for you when you are building your themes? Because it’s now locked away in your head. Every time you do a thing that previously you would’ve omitted. You are now just in the habit. Has that been a difficult journey or fairly straightforward?

[00:22:28] Jessica Lyschik: I think it’s, like starting out with this, it would feel like a bumpy road. But for me it was, it’s a gradual process. But right now it’s really like, yeah, I just know that when I use a button in a context that is not like sending off a form to add an aria label to it, it’s like, it is baked into my brain essentially already because I know.

And I just had a very interesting example this week at work where there was a client reaching out saying, hey, we did an accessibility test on our website and it marked like two buttons that did not say what they’re doing. These were essentially missing the aria label because they had only icons on the buttons, not real text.

So if there’s just an icon, the screen reader cannot read, what is this button for, essentially, with just an icon? The win here was just to add the aria labels, because the fields were already there. This was also part of the Greyd.Suite, so from our product so I knew how to put it in there. And then it was like, oh no, like I have to do this 12 times, my colleague said. And I was like, yeah, okay, then you have to do it twice, 12 times. So 24 times. But be happy it’s not 200 times you have to do it.

So, and I said, do not take this personally. This is a great example of why putting accessibility at the very beginning of when you’re creating this makes life so much easier than rather when you just build a website and then you figure out you have to change 300 buttons. This is probably a crazy number, but just to give you an example, to change all the buttons manually again, going through every single page or whatever you have when you just could have taken the extra step, added the aria label, and then just be done with it.

[00:24:09] Nathan Wrigley: Right. That’s an interesting thought. And also the exasperation of your colleague there kind of perfectly sums up the problem. In that you see it as a problem. Does that mean I’ve got to do something 24 times? And there’s this sense of, ugh, I’ve got to do this work. And it feels like a chore. But then I suppose if you step back and look at what you’ll actually enable by doing those 24 things.

And I know that in the workday that’s hard to do. It’s hard to sort of step back and say, okay, if I do this thing 24 times, this will be the result, and lots more people will be able to, in this case, view the image.

[00:24:42] Jessica Lyschik: I mean this was like they started already working on. If you fix it now, you do not have to do it for the coming pages. So if you multiply that with how many pages more you need to do, once you get this one fixed, and ideally you need to change the aria label of the text changes obviously, but this was, I think for a header, in a header, where there was like, I think one sort of popover or popup. Fully accessible by the way, so don’t worry about that. And also a button to, I think for the phone numbers, like just a phone icon. And they could click on it and it would be something like that, along the lines. I don’t exactly remember what it was. But it was just like two icons in the header. And if you take that header, use it on, I don’t know, another 250 sites, you don’t need to do the work anymore.

[00:25:29] Nathan Wrigley: Okay. So you are painting a picture in which, get it right at the beginning, follow the guidelines, do the hard work once, then almost the career from then, from this moment forward, your life will be immeasurably easier if you build it into the theme or.

[00:25:45] Jessica Lyschik: And accessibility will not be taken as, ugh, and I now have to do this all. Because when you do it from the start, you have to make sure at the end of course that it still works. You may have to run into issues and redo stuff. That can happen. But I think you just have saved yourself so much work in the end if that requirement for some reason pops up later or so.

[00:26:10] Nathan Wrigley: I’m wondering, depending on the kind of nature of where you work, and how you do this. You know, if you’re a freelance, then this is on you. If you’re in an agency, then it may be that there’s somebody, you know, maybe there’s an SEO person, there’s a design person, maybe there’s an accessibility person. But it does feel like the moral argument states everybody should have some insight. Maybe you’re not right in the weeds of it, but you should have some knowledge of what the low hanging fruit is, at least.

[00:26:38] Jessica Lyschik: Yeah it’s, what’s the right word for it? Interdisciplinary. It is like not just the developer who needs to think of accessibility. It’s like, okay, we need to because like we provide a technical structure for it. But it also needs to be for the content people who write the blog posts, the pages, whatever, for SEO people to understand that.

And I think accessibility, if you want the entire website to be accessibility, everyone who works on a website needs to know about it. That an SEO person needs to know how to create a skip link, probably not. Or how to use, maybe to use the right text. But for them, the text would be just the, using the right heading structure, for example. This is also a requirement, that you do not use an H3 and then an H6 heading in your content, but you structure it correctly that you have the H1 on the top, and then every next level is H H2, and then every level under that is H3. So this way. They should know about this. But they do not need to know too much about the technical side. Because in the end, it all comes together and creates an accessible website.

[00:27:42] Nathan Wrigley: In your commentary a few minutes ago, you mentioned that there were some guidelines in order to put a theme on wordpress.org. Is that the nature of it? Is it a guideline, or are there some hard and fast rules, which will prevent a theme getting into the repo based upon a lack of accessibility? What I’m asking is, are there some things that you must do as of now, or is it very much, okay, if you do this, great, but if you don’t, we’ll let your theme pass anyway?

[00:28:09] Jessica Lyschik: Yeah. Let me explain this. So there’s this accessibility ready tag. So you have different tags for the themes in the repository. And in order to get the accessibility ready tag, you need to follow the requirements, the accessibility ready requirements, I think it’s completely called.

And these are as of now 18 requirements. I went through them all in my talk. We’ve already touched on some of these. Some are really low hanging fruit, some are, one of the newer ones are, a theme should not recommend or require a plugin that is not accessible. This is something else that the team came up with, which is an interesting one. There’s, I guess a lot of room for discussion.

But also another one is to have an accessibility.txt file in your theme. Which basically, it’s not a standard yet, but like close to a standard sort of, has information about what has been done in terms of accessibility. Are there any classes that you can, CSS classes that you can use to make use of texts for screen readers? So basically hide them visually, or hide these texts or items visually, but still have them read out by screen readers. So they’re not like discipline none where you just remove that basically from the accessibility tree, but make it still readable for screen readers. And just some more information about that.

Yeah, you need to meet all these requirements with your theme if you want this tag. But you can still like do not care about accessibility and still get your theme in the repo if you want.

[00:29:40] Nathan Wrigley: Would you like that to be flipped? Would you like that to be, because I mean we’re a very open ecosystem, aren’t we? And would you like to see though a day where you don’t meet these 18 guidelines, you don’t get the tag, you don’t get to play, you’re not allowed in the repo? Or is that a touch too far?

[00:29:56] Jessica Lyschik: Let me share some numbers, I think. So there are like 14,700 plus themes in the repository right now. All themes. At least that’s the number I can access. I don’t know if there’s maybe a bit more, I don’t know. But this is the public number you can access. And out of these themes, I think if I saw the correct number, it’s like just 270 have the accessibility ready tag. So then that is like 1.5% of all themes who have that tag.

So I think it will be extremely hard to force sort of, if you want to flip that, force that onto people. And I think we need to do a more gradual way. And that’s what I’m sharing my knowledge because I think it is not that hard. If you can improve the documentation for it, it will be even easier for people. And I think this is the way to go instead of forcing like, because we do not like to be forced to things we do not understand.

[00:30:50] Nathan Wrigley: That’s right. Yeah, that’s interesting. I wonder if there’s a future in which that slowly gets ramped up.

[00:30:56] Jessica Lyschik: I think with the AI agents, we will have an acceleration on this, I guess. So maybe not in WordPress themes, in the repository directly, but I think the attention will be put there and then like, oh, maybe we should make it more accessible. Let’s read into this. And I think these guidelines are also very interesting, maybe not just for WordPress themes. I mean, of course they’re for the repository, but you of course can apply them to your own custom theme, definitely. You do not have an absolute check like the team will do for you. But nothing stops you from using them even on a non WordPress site.

[00:31:30] Nathan Wrigley: Do the guidelines, do they feel like they’re kind of firmly fixed or is it always a movable feast?

[00:31:35] Jessica Lyschik: They’re relatively fixed.

[00:31:37] Nathan Wrigley: Okay, so if you were to swat up, for want of a better word, on what there is right now, there’s a good chance that the rug will not be pulled out from under you in six months, a year, two years time.

[00:31:46] Jessica Lyschik: No, I think the last time the requirements got updated was in 2012, 14. I would need to ask, Joe Dolson did the initial, or was working on the initial thing. And so it has been a while since this got updated and they just got updated last month. So I don’t think that they will be changing anything.

The one I talked about, not requiring or recommending plugins is the one, this is something, it kind of creates a grey area sort of. And I think this will be put to discussion. It’s like, I don’t mind, but I can see many people like really, not raging against it, but like raising questions about it. If this is something that should be a requirement.

But I think for like the actual technical stuff, I don’t think that there’s much that should change, because like they’re based on the WCAG requirements. These are like the standard requirements that also have, I’m not sure if they’re used on governmental things, like on the European Accessibility Act, but I think they’re a sort of base for that. And it’s not like completely this. So the theme requirements are not like the WCAG requirements 100%, but like a subset of it, sort of.

[00:32:57] Nathan Wrigley: Yeah, it’s a fairly slow moving ship in other words. If you acquire the knowledge today, you’ve got a good chance that in a year, two years, maybe even five years, the knowledge that you’ve got will need amending. But most of it will broadly work several years from now.

[00:33:11] Jessica Lyschik: It’s with like development in general. So like you always need to be constantly learning. And I think if you learn about accessibility today, I think you’re in a very good spot. Because like of course we have European Accessibility Act and governmental requirements, at least in Europe we do have them. But I think there’s already so much information out there, that it should be relatively easy to onboard you. And I think this is just beneficial if you learn, it’s basically about learning about how to use things correctly. And if you’ve got that, then you’re absolutely good to go.

[00:33:45] Nathan Wrigley: So not that long ago I suppose, we had block themes coming around, which is an entirely different way of creating themes in WordPress. So you’ve got classic themes, which is the way it always used to be. And now we’ve got block themes. Is there a striking fundamental difference in the way that you might approach accessibility if you were used to doing block themes? Is there a whole lot more to learn? Maybe it’s more straightforward if you’re using block themes. Just tell us about how those two things differ.

[00:34:08] Jessica Lyschik: Yeah. It is more straightforward actually. Core is handling stuff for you. So accessibility just got a tad bit easier if you use block themes actually. In classic themes, you have to do a lot of things manually. You have to make sure that the elements are right, that the skip link is there, for example, things that we touched on already. And in block themes, if you use the correct blocks on the correct structure, Core handles stuff for you.

For example, there’s a requirement labelled form fields. So when you use a form or the form fields should have a label to it. In themes you don’t really have that because usually you should not put like, something like a form in there. There are two forms that by default come with a theme that are the comments form, but that’s completely handled by Core. And there’s the search form on the search results page.

But in block themes, both of them are handled by Core. Both of them are accessible because Core handles it all for you. You just need to place them and actually not do anything to them. It is that straightforward.

And same for like template parts. If you want to use header and footer, just use the template parts and use them. You can assign them a header template part as header of course, and one as footer. And then the HTML text will be automatically added correctly for you. So there’s not too much that you need to do manually anymore, just get that right.

And as I say, I really love block themes for the much easier accessibility, or the way you can make a block theme accessible. This is so much easier than with a classic theme.

[00:35:38] Nathan Wrigley: So presumably though, it sounds like there’s meta knowledge, if you know what I mean. You’ve got to know which block to put in which spot, and which block wraps this other block, and the parents and the children. But if you learn that, and if you make that, we were talking about habits earlier, if you make that your habit, and then save that habit and save the theme and what have you, you are painting a picture where it’s significantly more straightforward because you don’t have to think about it in many cases. Well, that’s the wrong way of phrasing it. You don’t have to do that hard work.

[00:36:07] Jessica Lyschik: Exactly. If you have like a, sorry to interrupt you here, but if you have a theme that already gives you the correct examples, you can build off from that theme. For example, if you’re creating a new template, you can use an existing template and then just adjust it to what you need. If you need to change like colours or something but you have the structure already correct. You do not need to think about doing the structure again and maybe just have a check that it’s actually the right one. But if you just copy what’s already there, that is part of the theme, that’s actually super easy.

[00:36:38] Nathan Wrigley: I’m going to link to your presentation, which I know by the time that this goes out will be probably on wordpress.tv, I would’ve thought by that point. But I’ll link to your presentation and all of the different bits and pieces.

But I’m curious, who in the WordPress space, and maybe not the WordPress space, maybe outside of that, who do you follow or try to get guidance from? Maybe that’s a YouTube channel or a blog, or a, I don’t know, government based website. Maybe it’s just wordpress.org, I don’t know. Where do you go to swat up on all of this?

[00:37:06] Jessica Lyschik: Ooh, there are some very good resources out there. So I do follow like people within the WordPress community. I mentioned a few names already, like Joe Dolson, Rian Rietveld, Amber Hinds from Equalize Digital. They do a lot of stuff in that area. And then I also follow Sara Soueidan, she’s a developer from, I think Lebanon, if I remember correctly. She does great stuff on accessibility. There is a few more names. There are some good resources out there. I can probably research that for you because I cannot remember the names right now.

[00:37:39] Nathan Wrigley: I’m putting you on the spot. I’m sorry.

[00:37:40] Jessica Lyschik: Put me on the spot. That’s okay. I’ll share some links with you that you can then put in with the podcast information. There are some great resources both within the WordPress community but also outside of it that can give you a very good overview. And I think it’s just interesting to follow people who like can build the bridge between, okay, this is a requirement, this is how you technically do it, and this is why you do it.

[00:38:05] Nathan Wrigley: I have a friend who’s recently been on the journey of trying to go from zero to really quite proficient in this space. He’s found a bunch of YouTube channels and several of the names that you mentioned there, particularly the Lebanese lady that you mentioned.

And I think followed a course that they put together and found that structure profoundly helpful. The dry documentation, I think was the way it was described on the WCAG website can sometimes I think be a, you know, it’s hard to get into that in some way.

You know, if this all sounds like a lot of work, there’s definitely resources out there, which, fun is perhaps the wrong word, but make it more engaging. There’s videos to watch, and channels to follow and blogs to read and all of this. And so it turns this, I’m doing air quotes, dry subject into something a little bit more manageable and easy to take in.

[00:38:52] Jessica Lyschik: Yes. Yes, because like the WCAG requirements, like they’re hard to read. It’s like reading, the HTML 5 spec. This is also super hard to read.

[00:39:01] Nathan Wrigley: Yeah, it’s the cure for insomnia.

[00:39:03] Jessica Lyschik: Yeah, sort of. And it’s, yeah, I think if we have, not more content, but the right content available to people in the right spot, I think this will be beneficial for everyone.

[00:39:14] Nathan Wrigley: Yeah. I think unless there’s something else you want to cover off, I think, Jessica, I’ve asked everything I wish to. Is there anything you think we’ve omitted or are you happy to call it a day there?

[00:39:24] Jessica Lyschik: I think we’re, I mean we could go on probably for days. But I think for now it’s, we’ve covered every topic.

[00:39:32] Nathan Wrigley: Well in which case, what I’ll do, dear listener, if you go to the WP Tavern website and search for Jessica’s post, I’m not sure what number it will be as we’re recording it, go there and anything that we discussed, and any names that we discussed and those kind of things, I’ll put a link and obviously if Jessica supplies any other things she mentioned, we’ll add those in as well.

So Jessica, thank you so much for chatting to me today. And now that your presentation is done, you can relax and enjoy the rest of the spectacle.

[00:39:55] Jessica Lyschik: Yes. Thank you so much, and thanks for having me.

[00:39:57] Nathan Wrigley: You’re welcome.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, the risks of legacy PHP in WordPress and why upgrading matters for security.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players. If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you or your idea featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Milan Petrović. Milan has been deeply immersed in the WordPress ecosystem since 2007, developing an array of plugins, especially for expanding bbPress forums, and running his own company, creating plugins before joining the Freemius team as a full stack developer. With nearly two decades of hand-on experience, Milan has witnessed firsthand the evolution of both the WordPress and PHP landscapes.

Many WordPress users may be only partially aware of PHP. Perhaps they’ve noticed version numbers in their hosting panel, but few of the millions of WordPress users understand the real impact that PHP versions have on the security and performance of their websites. Milan is here to shine a light on why embracing newer versions like PHP eight isn’t just good practise, but a crucial step for security and efficiency.

Milan begins by recounting his journey through WordPress development. The conversation gets into the heart of his recent WordCamp Europe presentation, which tackles how legacy PHP code exposes sites to thousands of open bugs and vulnerabilities. And why relying on old versions is, as he describes, an active invitation for automated exploitation.

The discussion explores the contrast between running legacy code, and using the native shields of modern PHP, and highlights how PHP 8 not only closes security holes, but also delivers major performance boosts, reducing memory usage, and accelerating speed.

If you’re wondering why you should care about the PHP version your site is running on, or you’re a developer interested in practical ways to harden your code, Milan unpacks both the existential risks of outdated PHP, and the step-by-step benefits for hosts, agencies, and plug-in developers alike.

He introduces his Vulnerability Lab plugin, designed for developers to see firsthand how code exploits play out differently across PHP versions, and makes the case that modernising can happen gradually, one update, one plugin at a time.

If you’ve ever questioned how your hosting choice, or plugin stack, could affect your site’s future. Or you’re ready to take the first steps towards building more secure and future proof WordPress products, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Milan Petrović.

I am joined on the podcast by Milan Petrović. Hello Milan.

[00:03:58] Milan Petrović: Hello Nathan. Thank you for having me here.

[00:04:00] Nathan Wrigley: You are very welcome. We’re in a beautiful, beautiful media room at WordCamp Europe. And I know that you have already done your presentation because we just had a little chat about the fact that you’ve done it and it went well and all of that.

Do you want to tell us a little bit about you and your background working with code and developing and security and all of that kind of stuff? And then we’ll talk about your actual presentation and how it went.

[00:04:25] Milan Petrović: So I started with WordPress almost 20 years ago, so way back in 2007. And I created a lot of plugins for WordPress, and I especially have a lot of plugins for bbPress for expanding forums. Yeah, people still use forums these days. So that was, I really like bbPress and all the stuff I did with that.

I have been working as a freelancer for a lot of years. I have my own company that was doing plugins, it’s called Dev4Press. But in 2024, I joined the amazing team at Freemius. So for almost two years I am a full stack developer at Freemius. And that was a really nice change of pace for me and the work I usually do before that. So yeah, that’s a short of it.

[00:05:13] Nathan Wrigley: Yeah. That’s great. Thank you. And so the presentation that you did that is now over, goes like this. I’m going to read the entire blurb because it’s short enough to read, and it says, secure by design, hardening plugins with PHP 8.x. In the WordPress ecosystem, we’re often forced to choose between supporting the lowest common denominator of hosting and implementing modern security. But in 2026, writing legacy PHP 7 code isn’t just a bad habit, it’s an active invitation for automated exploitation. It’s time to stop playing whack-a-mole with sanitisation, and start building products that are secure by design. This talk isn’t just another slide deck on security tips. Through comparisons of a Vulnerability Lab plugin, you will see how common exploits like authentication bypass, and server side request forgery succeed on legacy code, only to be neutralised by the native shields of the latest PHP. You learn how to leverage the modern PHP patterns to ensure your plugins are resilient to a wide range of exploits.

Now into the show notes I will put Milan’s wordpress.tv presentation so that you can go and watch the entirety of it. I guess basically if at any point you get confused, that would be a good idea, pause this podcast and go and check that out. But, how did it go? How well received was it?

[00:06:33] Milan Petrović: For me personally, I’m very satisfied with how how it went. I don’t know, it’s a bit overwhelming to be honest, but I am very satisfied and I got a lot of questions after the talk. I met a lot of people that liked what I had to say. And I think it’s good feedback to have, for something that is more technical like this was.

[00:06:52] Nathan Wrigley: Well touching on the fact that it’s more technical, I have to confess that I think you are going to have to shepherd me through this, because a lot of the content that you I think probably got stuck into is beyond my pay grade. But hopefully we’ll get through it.

Now at WordCamp Europe, where we are now, I don’t know what the ratio is, but I’m guessing that a significant proportion of the people out there are not developers. They kind of know that PHP is a thing. They realise that WordPress is built on that, but they don’t really have an understanding.

They’ve probably heard of PHP 7. They’ve probably heard of PHP 8, because somewhere in a control panel that was shown to them. But maybe there’s not much of an understanding of the fact that it gets better over time. It gets secure over time. I think there’s probably a notion of, well, my website works. Why do I need to change anything?

So let’s get into that. What were you talking about in your presentation? What’s changed in the landscape of PHP more recently that you brought to the fore that you shared with your audience?

[00:07:51] Milan Petrović: Yeah, I think that PHP 8 was a big milestone for a lot of things. And I’m not sure, but I don’t think that the wider communities are kind of aware about the impact of the PHP, or the server environment in general, on how the websites work and how secure they are. Maybe the WordPress in itself needs to spread more awareness about that.

Because right now we get a notice in the dashboard that maybe the PHP needs to be updated. But for a lot of website users, that can be too much and too little information at the same time, because they may be not aware of how to do things on their hosting site.

We need to spread more awareness about how important the changes in the code are when it comes to the newer PHP versions, and what they can do to improve the security. And how developers should be starting to use more of those new features and the new things that PHP provides on a language level nowadays.

[00:08:49] Nathan Wrigley: WordPress has got this real legacy, I suppose is the right word, of supporting legacy code. So WordPress itself is supported way, way, way back. You can keep using versions of WordPress, which are many, many, many years old. And I wonder what your stance is in terms of PHP, whether or not WordPress runs versions of PHP which are far too old, in your opinion.

So in other words, should WordPress have a policy of, I don’t know, 8.x only? Or is 7 okay. And I don’t know what other CMS platforms, you know, Drupal, Joomla as was. I don’t know what they do, I don’t know what their posture is.

[00:09:32] Milan Petrović: I think that one of the most important decisions that, it was done with WordPress early on, is that backwards compatibility, because it opened the doors for a wider adoption. Because you don’t need to change server every year, or you don’t need to upgrade your software that often. And that helped a lot of hosting companies to provide WordPress hosting very cheaply, because they didn’t have to have the latest PHP, they didn’t have to invest much more money into all that. So WordPress got a lot of adoption from backwards compatibility policies.

But in the same time, that also proved a bit of a problem. Because even the WordPress Core code is kind of stuck because of that policy of backwards compatibility. And it’s not only compatibility with old versions of WordPress, but the old versions of PHP. And we are running now maybe six years behind end of life PHP versions. Because PHP 7.4 end of life was four and a half years ago. And we still support it in the Core.

[00:10:33] Nathan Wrigley: Yeah, I guess it’s a nice thing to support it. And it, as you described, it was a great way of onboarding the millions of people that came along. But things have moved on.

What would be some of the top level items? And I’m inviting you to open the scary book and sort of give out the worst case scenarios basically of running legacy code. So really, go to town, frighten us all. What are some of the horrors that await if you’re quite willing to, as a hosting company, support seven point whatever or beyond, six or five, or dare I say it, four, who knows? What are some of the terrible things that await us?

[00:11:08] Milan Petrović: To be honest, when I was researching some of the statistics and things like that, I was kind of scared when I saw that there are 3 or 4,000 open bug reports for PHP 7 and PHP 5, which are still in use today, and there are WordPress websites running on both of them in the millions. And there are 3 or 4,000 open and confirmed bags that are never going to be fixed. Never. So PHP 7 has thousands of bugs, and I’m sure that not everything security related, but a big chunk of those bags are related to security.

And there are open exploits that run on the PHP level. They don’t care really about if you are using WordPress or using something else. It’s more like a exploit on the level of a, on a server side that can be quite scary because you, even the technical people are not really sure what are all those bugs. Who is going to go through 3,000 or 4,000 bug reports?

[00:12:05] Nathan Wrigley: Yeah, so just to sort of describe that, the fact that there is no more updates to the 7 branch of PHP means that all of those bugs which are publicly available, anybody can go and read great detail about what they are. Well that then means that any hacker can do that, and probably did like a dozen years ago. And so really you are painting a picture there of you are asking for trouble.

[00:12:30] Milan Petrović: There are hosting companies that maybe do things a bit differently because you don’t need to run PHP as it was created. You can build your own version of PHP. You can patch bugs on your own. And a lot of hosting companies are doing that. But in the same time, that also poses a problem. You are going to run WordPress in your own plugins on a platform that is not actually officially PHP supported. It can have some different quirks that make your code run a bit differently.

A while ago we had the Facebook running their own PHP build, that was quite different from the public PHP. But they used it, and other people started using it. So I don’t know. Still I think that the official PHP is the one you should be on because you never know what other issues. Even when hosting company patches the PHP they’re using, maybe they’re opening doors to something else that is not quite documented on that level.

I think that the best policies, I don’t expect for WordPress to adopt the latest PHP or only supported PHP versions, but to kind of move quicker on the adoption of the newest version. So maybe we should be quicker to adopt PHP 8.0 or 8.1 is a next minimal required version for WordPress.

[00:13:50] Nathan Wrigley: When you say you don’t expect WordPress to do it, is that simply because it doesn’t have a history of doing it? Is there a technical reason why WordPress could not keep up with the latest version? I know we’ve got this plugin architecture where there’s thousands and thousands of developers who are all doing their own thing, and there’s all of that. Is there any technical reason why WordPress couldn’t be on the cutting edge, most up-to-date, latest version?

[00:14:15] Milan Petrović: There are two factors in all that. First one is you can declare, PHP 8 is the minimal version we support. We don’t support PHP 7.4 anymore. And that means that you don’t need to make any changes in WordPress at that point. You can declare it because WordPress is compatible with all PHP versions. It works on 8.0 and 8.5. That’s no problem. But say that branch 7 is no longer supported, you’re kind of pushing other developers and hosting companies to improve their support for newer versions.

And you don’t need to make immediate changes to WordPress. But at that point, you are open to modernise the code because now you can have more stricter typing across the board. There are some strict typing things in older PHP versions, but with 8.0, you can do all of that. And it doesn’t have to be a process that is done immediately. It can be done gradually. You can update parts of the WordPress Core over time. And it’ll take a few years, to get up to date, but at least you are closing doors to some older versions of PHP, and you are pushing developers as well for plugins to have that policy.

Right now, each developer can have their own plugins supporting any version of PHP you want. For my plugins, I have policy of 8.0 as a minimal version since this year. And, I’m updating the code as I go along. I don’t do it, it’s impossible to do it all at once. And for WordPress, it’s going to be even worse to make it all up to date. But declaring PHP 8 is a minimal required version, would be a great step in the right direction for wider adoption.

[00:15:51] Nathan Wrigley: Yeah, I think the problem is simply one of the user base, isn’t it? There’s just millions of people, thousands of developers all doing their own thing. And casting 8.x, 8.0 and above as the new minimum, there’s going to be a moment where some things do go wrong.

So that calendar plugin that you’ve been using for ages, which just works. And sure, you’ve never really received any updates from the developer, but it just works. Everybody’s booking on my calendar and we are all good. And then suddenly PHP 8 is required and it turns out the calendar plugin now no longer works.

You can imagine those kind of stories a million times over coming to the fore. But equally, we got to move on. There’s no way of, you know, because we can’t in 10 years still have sites on 7.4.

[00:16:43] Milan Petrović: We have sites on five point something. I recently checked the official WordPress tracking. 7.4 is on 20% even now. So we are far away from WordPress ditching the 7 branch. And I think there are still few percent of PHP 5 in all that so.

[00:17:01] Nathan Wrigley: Yes, I regularly look at the, it’s like a little donut chart, isn’t it? That is often produced and you gradually see the eight point x whatever section of the pie getting bigger as they produce the next survey. But you’re right, it’s still a significant chunk that’s on 7 and below.

And whilst when I look at that chart, it doesn’t really bring any alarm bells to the fore, I just think, oh, that’s a shame. But now that you are presenting this talk, and giving me this information, I realise that that attack surface is worse.

When you gave that talk, who is your target audience? Were you directly sort of aiming at the hosting companies who presumably can do a lot of work very quickly? You know, they could take a million people onto 8 with a little bit of development work and on the back end of their platform. Or are you really encouraging the general WordPress user, like me, to take a bit more interest and make sure that I am going into the cPanel or whatever it is and updating myself? Or is it a bit of both?

[00:17:59] Milan Petrović: For everyone actually. It’s for developers to be more aware of what they can gain with the new PHP versions. It’s for hosting companies. Because it’s not only about security when it comes to the newer PHP. The PHP is faster and faster. So each new version gets you 5 or 10% more performance without doing anything. So PHP 8.5 is more than 50% faster than PHP 7.4. So that’s a significant update.

And I have even, one slide was showing how much less memory PHP 8.5 used to run exactly the same piece of code. So it’s pretty wild to see that hosting companies are maybe the biggest factor in all this. They will gain a lot more because they’re going to free a lot of resources to run more websites because PHP is going to use less memory and it’s going to be faster.

So I understand they need to invest a lot of money to do all that. But, I don’t know, I think that gains from that are very significant, on that level alone.

[00:18:57] Nathan Wrigley: Yeah, so you described there are really compelling scenario. You know, it’s quicker, it uses less memory, you’ll save money. I mean what else do you need? You’ve just presented the entire argument.

However, it hasn’t happened. So technically speaking, why do you think it hasn’t happened? Is there an acquisition of new knowledge that is difficult to take in? Is it that simply you would have to, I don’t know, retrain your staff? How do you understand that it hasn’t happened? What are the reasons people are digging their heels in and not making these updates?

[00:19:25] Milan Petrović: I kind of make the group of two or three types of hosting companies. One, and that’s usually more expensive managed hosting solutions. They are forcing the updates. They’re not maybe on the latest version, but they are forcing their users to use at least three or four versions of PHP back. So maybe 8.2 or 8.3, which is a great step in the right direction.

There is also a problem of support. If something starts breaking, they’re going to be the first one to be asked about that, because they made the change to the server. So why now website that was working yesterday is no longer working today because of some change made on a hosting level. So there are a lot of factors to play into that adoption.

But on the other hand, there are a lot of developers that have moved on with supporting PHP 8. A lot of plugins are very much updated and, especially popular plugins. They invested a lot of time to do the update. It’s getting easier to support it. But on the other hand, you have very old websites that are simply cannot move without proper testing, without updating the plugins. And there are cases when you cannot simply update one plugin because something else may break, or you made some changes that will make some other thing break. So it’s a big puzzle that is definitely not easy to solve, but maybe we should start some work on that as a community to do it, and to move people along.

I don’t want to say force the change, but make people aware of the benefits. Make people aware of the risks if they continue to run the old and outdated software. And the same goes for not updating plugins, not updating WordPress. No matter how much work is done in that regard, there are still most likely some exploits on a WordPress level for very old versions that at some point someone is going to find out about and exploit.

[00:21:16] Nathan Wrigley: I mean I guess the motto of WordPress was democratised publishing, which means basically make it available to everybody. No matter your level of expertise, make it available to everybody. And I’m sure that if you were to grab the CEO of any hosting company and say, I can save you money, I can save you resources, and all of those things that you outlined earlier, they would, yeah, we know, we know. But we’ve got thousands of non-technical people using WordPress.

I kind of have this analogy in my head, and it goes a bit like this. Several years ago, I bought a bike. And it sits in my garage and there is my bike. And I expect my bike to work tomorrow in the same way that it did four years ago. And in 10 years, I expect my bike to work. I don’t expect there to be an update to wheels or gears or the saddle. It doesn’t need an update. It’s just a bike. And I need my bike to be a bike and nothing more.

And I get the impression that many people treat their WordPress website as the same thing. This sort of static commodity that, sure enough, they pay a monthly fee for it, but it’s this website. It’s a thing, and it doesn’t need changing. And so what I’m trying to say is, I’m fairly sure that the hosting companies are met with that an awful lot. The customers who just, it’s a bike, it’s a website. Do you know what I mean?

[00:22:37] Milan Petrović: Yeah, but you need to maintain your bike. If you don’t do it, it’s going to, your belt is going to rust, your wheels are going to be deflated or whatever. A lot of things can happen with it if you don’t maintain it. So, we don’t need to upgrade everything all at once, but we can start from someplace. We can do it gradually. But still, WordPress needs to be the platform that leads the charging that, because it’s going to force other developers to do it. It’s going to force hosting companies to start doing it. And it’s not a big jump on moving just that one version, but it’s going to help to move things along faster. Let’s see how it goes in the next few years. But I really don’t expect for WordPress to drop 7.4 for at least a year or two, maybe even more.

[00:23:24] Nathan Wrigley: I loved your rebuttal of my bike analogy there. That was perfect. That’s exactly right. The bike will rust, the wheels will be deflated and all of that, yeah. So we need to drag the WordPress users along.

Now, in your presentation, you mentioned something that I have never used, the Vulnerability Lab plugin, which you used to demonstrate the attack. Can you just tell us a little bit about that? Because I’d be curious to follow that up, and maybe some people listening to this would too.

[00:23:47] Milan Petrović: I started it for, created for this talk specifically to add few examples and to run the code that is going to show those things if you run the plugin on the old version and the new version of PHP. And I do plan to expand on it because there are a lot more PHP security elements that can be demonstrated in that way.

So it can show you, you have like a, in many cases the same code, but if you run it on one platform, you’re going to get one result. And if you run it on the newer one, you will get something different. So it’s useful to show, and some of those changes are quite small, those attributes that you can add to the code are very, very small, but they can really help you to improve security of your plugin.

And there are more complex security measures that can be implemented, but the format of the talk wasn’t really suitable to mention everything. But this was like something to get you started on the path of discovering what else PHP 8 can offer, when it comes to improving the security of the plugins and what possible exploits and vulnerabilities are there.

I try to use some obvious things that are very easy to spot. And I’m sure I did made some of those errors myself in the past. So some of those examples are something that I dealt with when I was upgrading my code. So I’m sure that a lot of people can see similar problems in their own code, and similar kind of solutions that can help them to overcome those and to make them much more resilient in the future.

[00:25:17] Nathan Wrigley: So is your plugin designed primarily, would you say for developers in mind, or is it something that just a typical end user may get some mileage out of?

[00:25:26] Milan Petrović: No, it’s more for developers that they can see, they can run that code and see how it behaves on the old version and the new version to demonstrate some of those things. And I will definitely expand it to include more examples in the future. Even for myself to like a document, what can happen if you run something in the old version, and the new version?

I had some suggestions coming to me like, maybe like a pattern library that is going to show what is the pattern that we use with old PHP and how to improve it with a new one, and document which version of PHP is going to support it, and how it’s going to improve the code.

[00:26:01] Nathan Wrigley: So is the idea then that you would instal it on various different, let’s say that you’ve got a live site and you’ve got, I don’t know, a development site and another development site, is that you would put it on each of those, different PHP versions, and just sort of compare and contrast what.

[00:26:16] Milan Petrović: Yeah, that can be used.

[00:26:17] Nathan Wrigley: Yeah, in that way. And what’s the reporting that you get? Is it kind of error logs, you know, that only a developer would be able to understand, or is it in plain language that somebody like me could understand?

[00:26:26] Milan Petrović: Right now it’s a bit technical because if you run a certain part of the code, some of those elements do have a visual component in the admin section. You will see, one of the examples, if it’s run on PHP 7.4, it’s going to result in a fatal error for sure, depending on the server settings. And if you run it on the new version, you will get a full code running and executing as expected.

So it’s a bit of a development thing that developers can use themselves to show maybe to potential clients or to website owners what is going to happen if they continue to run the outdated versions of the PHP. So it’s not just, yeah, the PHP 7.4 is bad, but here it is, why it is bad actually.

[00:27:12] Nathan Wrigley: Okay, that’s a really interesting use case, isn’t it? So if I’m an agency owner and I’ve got, I don’t know, a client over here who is absolutely wedded to this plugin, this calendar plugin say, and we know that the development of that plugin has ended years ago, then trying to persuade that client to find something new, or have something new built is difficult.

But with the capabilities of the plugin that you’ve created, you’ll be able to show in a sort of readable human way, okay, right. That’s all very well, but we’ve got to get onto PHP 8.0. And when we do that, this is going to happen.

So that’s actually quite a useful tool for agencies to be able to dangle things in front of the noses of their clients. Potentially, I don’t know, get some new work out of it as well, because there’s this extra work that needs to be done to bring it up to the modern standards.

[00:28:01] Milan Petrović: Yes. And one example especially demonstrates not only security, it demonstrates the performance. It shows you how much memory that piece of code is using on old version. Almost half the memory is going to be used less with a new version. So that’s very on the nose demonstration on security, and the performance in the same time. So things like that can help. And I will definitely try to invest more time in showing more examples and anyone can contribute.

It’s a plugin available on GitHub, so any contributions in that regard are welcome. And we can maybe all work to create like a list of patterns that are something that a lot of people can use, and show different people how the PHP can help them move along.

And again, I don’t want to sound like we don’t need whatever WordPress is doing. We still need to use all the security enhancements that WordPress has built in the Core. Escaping, sanitisation. All that is still very important because you cannot solve everything by upgrading PHP and upgrading your code to use some of the PHP features. There are still a lot of security elements in WordPress itself that are very important and should not be replaced, or removed, from the code. There are patterns that are crucial to ensuring the security is on a top level. So combination of what WordPress already has, plus everything we get with the newer PHP is something that we should strive in the future, and to make things better.

And it’s not that complicated to start with the process. You can start upgrading small things. You can start with stricter typing. You can start with very small changes, and then gradually you can add those new attributes. You can replace some of the functions that you may be used with old version of PHP, but there is something better in the new version. So that’s something that everyone can do. Do a bit at a time so not everything at once. Spend time and make some gradual upgrades, and that’s going to help moving along.

[00:29:57] Nathan Wrigley: You are obviously here to talk about where PHP meets WordPress, but presumably you, yourself are gaining intel from the PHP community. Is there a resource, like a central PHP resource that you would direct people to, or would you rather steer them towards kind of WordPress resources? The things that people are doing in the WordPress space and the hosting space. There’s not really a question there, but it’s more where do you find your information? Where’s the most reliable place?

[00:30:25] Milan Petrović: You need to check everything. PHP website is a really good resource to find the information about what’s coming in the next version of PHP, because the preparations take up to a year to release a new version of PHP. So they’re now on a cycle that every December we get a new feature version. So in December this year, there is going to be PHP 8.6. And you already know most of the things that are coming to that version. You have the detailed list of changes for every PHP version. And that’s something that any developer should look at, and to see maybe something that will drive them to upgrade.

In the current usage of third party libraries, there are a lot of libraries used in PHP that have moved on beyond 7.4. There are a lot of libraries that now require 8.1 or 8.2. If you depend on some library for, I don’t know, parsing URLs, or doing something else, something for security, something for whatever. You may face the problem that if you want to use the latest version of that library, you will need to have the newer PHP version. So you are kind of forced to upgrade your plugin requirements to meet with the requirements of the third party libraries.

And outside of WordPress ecosystem, those libraries will move much faster with the adoption of newer PHPs versions than WordPress itself, because they don’t deal with millions and millions of websites that are affected. They are creating the library the best way they can. And they want to ensure that their library is secure, that their library has access to the latest features. So they are going to bump requirements for those libraries on their own. And if you are depending on it, you need to do it yourself for your plugin. So it’s kind of, those libraries are kind of forcing the hand of some developers to upgrade, even if they maybe are not ready at this point to do it.

[00:32:15] Nathan Wrigley: Yeah, it certainly sounds like there’s no lack of information out there. If you make your business to find the information, then it’s all there. You’ve just got to make the effort to go and find it.

I’ve kind of run the gamut of everything I wish to ask. However, I’m very conscious, as I said at the beginning, that this conversation is a little bit above my pay grade. Is there anything that I missed that you wished you had been asked that you wanted to get across?

[00:32:38] Milan Petrović: No, I think we covered a lot of stuff in that.

[00:32:42] Nathan Wrigley: Well I’m glad to hear it. That’s great. Yeah, thank you.

In which case, I’m assuming, given that you’ve come to an event like this and you’ve put a plugin on GitHub, you are sort of semi available, or very available, to have conversations with people around this. And if that’s the case, where’s the best place to find you online? A website or an email address or a Twitter handle or whatever.

[00:33:00] Milan Petrović: We included the slide with the contact information. So even the email, if someone wants to get more information, they can do it on various social networks as well. So any input about all that is welcome. And I’d be happy to help if someone needs, some pointers or additional information to get started with all this.

[00:33:21] Nathan Wrigley: Well, thank you. That’s very much appreciated. As always, if you go to the show notes on the WP Tavern website and click on the episode involving Milan, you’ll be able to find, buried probably towards the bottom, all the different bits and pieces, the wordpress.tv video that will go with his presentation and various other links that have been discussed during the course of this episode.

So with that said, Milan, thank you so much for chatting to me today. I really appreciate it.

[00:33:47] Milan Petrović: Thank you. It was really great, and I appreciate your invitation for the interview.

[00:33:52] Nathan Wrigley: You are so welcome. Thank you.

[00:33:53] Milan Petrović: Thank you.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, building trust and collaboration in the hosting industry with the Secure Hosting Alliance.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you, and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today, we have David Snead. David has been involved in the hosting industry since 1999, starting out as legal counsel for one of the earliest shared hosting companies, and going on to work with over 50 others. He helped found the i2Coalition, serve as in-house counsel for cPanel and WebPros, and now leads the Secure Hosting Alliance.

If you’re listening to this podcast, I’m sure that many of you will have worked closely with hosting companies. Perhaps you run an agency, or business, that depends on the reliability, ethics, and security of hosting providers. David is here to talk about cross-industry collaboration in the hosting world, specifically around improving security, professionalism, and communication between hosts.

The conversation focused on why, and how, the Internet Infrastructure Forum, or IIF, is building a framework for real-time intelligence sharing and abuse reporting, aiming to help the entire ecosystem detect and prevent attacks faster than adversaries can adapt.

David talks about the challenges hosting companies face, especially smaller ones, in keeping up with security, and how this evolving project hopes to ease this by sharing actionable, non-proprietary abuse information across registrars, hosting providers, DNS services, and more.

He discusses the growth of both the Secure Hosting Alliance and the IIF, the business case for collaboration, and the nuances of legal and technical information sharing across borders.

If you’re in hosting, run a web agency, or just want to know how the backbone of the web is working to stay more secure and connected, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so, without further delay, I bring you David Snead.

I am joined on the podcast by David Snead. Hello David.

[00:03:20] David Snead: Hello.

[00:03:21] Nathan Wrigley: Very nice to have you with us. David’s got a really interesting background, and a really interesting, I’m going to use the word project. I don’t know if that’s the right word. It feels like it’s got more solidity and it’s got a lot more history than that. It’s something which is, I think going, but we’ll find out a little bit more about it. It’s all about the hosting industry and trying to get hosts to, I guess communicate with each other in ways going forwards.

[00:03:44] David Snead: That is a part of it. There are really two goals and one is to level up the ethics and professionalism in the hosting industry. And the second is to facilitate more comradery and interaction among hosts. Something that folks felt occurred in the early 2000s, and with all the consolidation that occurred went away. And so that’s something that we’re also trying to facilitate.

[00:04:16] Nathan Wrigley: Okay. So given that we’re going to be talking about hosting, I guess it’s a good idea to paint your credentials and find out a little bit more about you. So a short opportunity to just tell us a little about you and your background in WordPress and hosting specifically, I suppose.

[00:04:29] David Snead: Sure. So I have been working in the hosting industry since 1999. As I often say, I was working in the hosting industry when hosting was cool. It is not so cool anymore. In fact most people don’t really pay attention to it.

You know, and I started as a lawyer for a hosting company, and I was in-house counsel for a company that actually owned a hosting company and was one of the earliest hosting companies that specialised in shared hosting. And so I was their general counsel. And for some reason it stuck, and I’ve just kind of turned it into a career.

So after that I had a private practise as a lawyer and I worked with probably 50 different hosting companies, mostly writing policies that nobody ever reads, which makes me super fun at parties.

And then from there, my friend Christian Dawson and I formed the i2Coalition as a response to some legislation in the US that would’ve been kind of the death nail for internet providers. So we started the i2Coalition. I then went in-house for cPanel and worked at cPanel and WebPros for 10 years, and then started the Secure Hosting Alliance.

[00:05:52] Nathan Wrigley: Okay. So you’ve got all all the history. That’s pretty good. You know, if we’re going to talk about hosting.

[00:05:57] David Snead: All the hosting history in one person. That’s kind of a very scary idea, no?

[00:06:02] Nathan Wrigley: But that’s excellent. So do you still offer counsel? Is that still, so you haven’t sort of sidestepped and do half of the week on a sort of more technical basis? It’s still the legal side that you’re involved in.

[00:06:13] David Snead: I do. Right now I’m doing mostly M&A work for, it’s weird. So I don’t know if anybody has ever said this to you before, but web hosting is kind of like the Hotel California. It’s like, once you start in the web hosting industry, you never leave. And so I have all these clients from 15 years ago who are now running like little baby hosts, and they’re talking to bigger hosts and they want to get acquired. So I’m doing some of that now. I am not writing any of the policies that nobody ever reads because that was just, I did that for too long.

[00:06:51] Nathan Wrigley: There were too many moments parties.

[00:06:53] David Snead: Yes, exactly. Yeah.

[00:06:55] Nathan Wrigley: Okay, so I’m going to read into the record the title and the blurb that went with the presentation that you are doing or done.

[00:07:02] David Snead: I did it yesterday.

[00:07:03] Nathan Wrigley: Okay, we’ll get into that in a moment. So the title is coordinating the fight, cross industry collaboration, and the blurb goes as follows. WordPress hosting threats cross company lines. When one provider falls victim, the entire ecosystem suffers. This session explores how the Internet Infrastructure Forum, or IFF, enables hosting providers, registrars and registries to coordinate abuse response through real time intelligence sharing. Learn how operational collaboration helps responsible operators detect and stop attacks faster than adversaries can adapt. And why working together produces results no single provider could achieve alone.

When I read that, immediately was, yeah, that’s a really sensible idea. Why are we separately, as hosting companies, I say we, I mean the hosting companies. Why are they all trying to do the same work over and over again, separately? When presumably this aspect of the work, the security bit is something they all have in common.

[00:08:05] David Snead: Right? So that’s the fundamental question, right? So the IIF is a voluntary organisation that is made up of everyone in the infrastructure stack. So from registrars, registries, DNS providers, hosting providers, cloud providers, everyone in the stack. So it is facilitated by the Internet and Jurisdiction Foundation. They’re based in Paris, and they’re the actually the secretariat for it.

And what it’s designed to do is create a common way for everyone who’s in the infrastructure stack to share information about abuse and abuse issues. And it’s one of the fundamental problems that you referred to is everybody is operating in a silo, right? And that’s mostly because that’s the way the internet is architected, right?

So the internet is architected, so it’s distributed, right? Registrars and registries basically do their own thing with domain names. They might have a small hosting component or maybe a cloud component, but by and large, all they do is domain names.

Hosting providers probably resell domain names, but they’re not part of that industry. And so how do they all coordinate? And that’s what the IIF is trying to facilitate, is more information sharing among the participants.

[00:09:39] Nathan Wrigley: Well I imagine some of the hosting companies are probably fairly good. You know, they’ve got a giant customer base. Let’s imagine hosting company X over there, they’ve got millions of customers. They’ve got a huge budget that they can put over to, let’s say, security things. Well that’s all well and good, brilliant. But then there are other companies who are much scrappier. You know, they maybe have only a few thousand customers. And so their budget for the exact same work is going to be reduced.

How will this work? Is it going to be like a subscription service basically? Will you have a membership, which is in some way equal to the number of clients that you’ve got? Will there be some expectation that, okay, we’ll look at your revenue, your membership will be equivalent to a percentage of your revenue? How will that all work?

[00:10:20] David Snead: We don’t know. This is a very early stage project. Right now we are in a prototype phase where we have just figured out what information folks should submit to the secretariat.

So the way it works is, you submit the information that you collect for a particular abuse issue to the secretariat, who then enriches it with all the other information that’s been submitted and sends it to the right person.

So a great example is, let’s say a registrar reported a phishing domain. They turn off the phishing domain and they have maybe a timestamp, an IP address where it was submitted from. They submit that to the secretariat, who then finds the hosting company who is providing the services for the hosting and says, this came in about this particular site. Can you take action on that? So that’s the way it works.

Right now it’s very early stage. It’s in the first phase of a test, and we’re going to look at whether the way we’ve architected it, or the way the group has architected it, actually makes sense.

[00:11:39] Nathan Wrigley: Is this going to be then a sort of slow on ramp whereby you bring a few companies in at the beginning, hopefully. And then one or two more and iron out the wrinkles, and then some more and some more? Because I imagine, if you just threw the switch, everybody’s in, a lot could go wrong at that point. And I’m guessing there’s going to be more of a slow on ramp.

[00:12:00] David Snead: So you’ve pointed out my particular frustration with the IIF, and the reason that the secretariat is moving slowly, right? So fortunately, or unfortunately, based on my cultural background, I’m just sitting here going, this needs to move faster. We need to have everybody involved, we need to have all the hosts involved, we need to have all the registrars and registries. And other folks who are a little bit more skilled in this type of work say, no, we need to figure out what we’re doing and that requires a small number of people.

The phase that we’re in right now is looking for more folks who are interested in sitting at the table and being part of the discussion. Particularly in the hosting industry and in the web design and marketing industry. Those are folks who don’t generally participate in these kind of industry led collaboration exercises. And that’s the reason that I’m at WordCamp, is to talk to web designers, marketing agencies about why they should participate in something like this.

[00:13:13] Nathan Wrigley: So this really isn’t bound in any way to WordPress, is it? It just so happens that WordPress has a significant chunk of the internet, so this is a good place to start. But if you happen to be a, I don’t know, Drupal user, or you’re just into writing PHP code or whatever it may be, this is still applicable. There’s no real WordPress layer to this. This is just a good place for you to come because, well, there’s probably, what, 30 hosts, 100 yards away from us out there.

[00:13:37] David Snead: I know. And I haven’t seen all of them yet.

[00:13:39] Nathan Wrigley: Yeah, there’s work to do. But agnostic to any platform, basically.

[00:13:42] David Snead: It is completely platform agnostic, yeah.

[00:13:43] Nathan Wrigley: Okay. Okay, that’s interesting. But WordPress is a, is certainly a good place to start.

Now, I’m imagining, if I was a hosting company and I was the chief executive, I definitely have some questions for you in terms of, okay, we’re going to share our valuable intel with you, what are you going to do with that? How can we trust you? How do we know that the sharing is going to be done effectively and what have you?

So I guess really what I’m getting to is, what is the assurances or checks and balances that you, in the end, will hope to offer the host? That you can assure them that, look, if you hand us this body of work, you don’t need to think about it again. You can trust us to do it honourably, effectively, collaboratively. You get where going.

[00:14:26] David Snead: Yeah, yeah. And I suspect that you wanted to be a lawyer at some time, because that’s one of the issues that we’re facing. Information that can be shared freely, as an example, in the United States, might not be capable of being shared so freely in the European Union, or in Brazil, or in India or someplace like that.

So one of the things that’s being done, not by me, but by another group, another working group that’s part of this, is analysing the legal issues around information sharing.

The information that’s being shared, to answer the proprietary and confidentiality question, is not proprietary or confidential information. So it’s things like timestamps, domain names, IP addresses for the initial abuse submission. Things like that that really don’t indicate some sort of company confidential information. And it’s further abstracted into xarf, which is a language that’s used for abuse reporting, that we all can share. And so I think that the only thing that would be of concern is whether that information is personal information that’s subject to jurisdictional restrictions around the world.

[00:15:48] Nathan Wrigley: Would the idea be that this organisation would do the remedial work? So is there any notion that, let’s say for example, some sort of security problem was discovered by hosting company A over there, and they share that intel with you. Maybe the question is kind of asking, will you then appoint people to figure out what the patch is for that? Or is your idea just to, oh, red flag, we’ve got this problem, now you all know about it. Is it just information sharing as opposed to fixes?

[00:16:17] David Snead: Yeah, it’s the latter. So the thing that we’re solving for right now, so there’s just one issue that, one abuse issue, that we’re testing out and it’s issues related to fake shops. And so the fake shop issue is the test abuse issue for the project, and where folks are sharing information. It’s a particular problem right now with credentials harvesting. And so that’s what we’re trying to look at.

[00:16:43] Nathan Wrigley: And how has the conversations that you’ve had thus far, how have they gone? Has this been warmly received or are you facing a little bit of pushback?

[00:16:50] David Snead: So, look, I’ll be very direct with you. If something isn’t just an immediate threat to them, it’s very difficult to conceptualise why you should participate. And I am pretty used to answering that question simply based on the political work that I do with the i2Coalition. But once you talk about, so let’s use fake shops as an example. Fake shops, and you’re providing services to fake shops, actually has an impact on your bottom line.

So if you are providing, let’s say, payment processing to an entity that is running a fake shop, it very easily can make your credit card processing charges higher. It ends up eating bandwidth. It will tax your abuse resources.

One of the things that you referred to initially is, you know, larger hosts have a lot of money. I wouldn’t say they have a lot of money, but they have more bandwidth to handle a vast fire hose of abuse issues. Most smaller hosting companies might only get five or six abuse issues in a month. But if you have a fake shop, that’s going to generate a huge amount of abuse, and it’s taking away resources that you can use to actually grow your business. So that argument actually is relatively persuasive in getting folks to pay attention.

I find that the business argument around abuse is a much more compelling discussion than kind of moral persuasion. I don’t think moral persuasion works in the context of a community that is trying very hard just to keep their heads above water.

[00:18:42] Nathan Wrigley: It feels to me from what you’ve just said, and I could be reading too much between the lines, but it feels to me as if a good target audience would be smaller hosts to begin with, simply because they’re probably going to be more receptive because they have less bandwidth themselves. And so would welcome anything that can make the burden of sharing this information easier. So 10 of the small hosts combined is, well, it’s much bigger than each of them individually would be, whereas I suppose you’ll have to get a critical mass of them on board until maybe some of the bigger hosts start to look at you with favourable eyes, let’s say that.

[00:19:15] David Snead: Well, so we have some pretty large hosting companies who are participating. So as an example, both GoDaddy and Newfold are participating. But we also have smaller hosts. But I agree with you, the information that’s being provided, particularly since it is actionable, realistic information that can be adapted for bespoke systems, is invaluable, right?

So if you only get five or six abuse complaints and you get an abuse complaint, and you can go to the secretariat and say, we got a complaint about this domain, and the secretariat says, here’s what the registrar did. Here’s what Cloudflare did. Here’s the information they provided us. And you can use that to make a decision on how to address that problem. It saved you hours and hours and hours of research time.

[00:20:09] Nathan Wrigley: Technically speaking, what would the conduit of information both toward you and away from you look like? So if I’m hosting company X, how are you imagining that I will supply you with that information? But also, if I’m just looking for information from you on a daily, weekly basis, whatever it may be, how do I receive that? Is this like a, I don’t know, a website or an API or?

[00:20:33] David Snead: It’s an API. So it’s a file. It’s just a general file download.

[00:20:37] Nathan Wrigley: Right, okay. So it’s readily available 24/7?

[00:20:40] David Snead: Right. That’s the goal. Right now it’s not, but the goal is to kind of figure out a way to make something like that possible.

[00:20:47] Nathan Wrigley: Yeah, okay. I also suppose that the hosting companies, whilst this is good for their business if they can minimise costs and hand a lot of this work over to you, there’s a part of them which would also probably like to put some sort of badge on their website to say, this is what we’re doing. We’re part of this alliance, for want of a better word. Is that something that you are looking to develop as well, you know, some sort of credentialing system to demonstrate that you’re in this?

[00:21:12] David Snead: So that’s not something that the IIF is working on. It’s something that the Secure Hosting Alliance does. The Secure Hosting Alliance has a trust seal that we give to hosts who fulfil our Trust Seal Certification provisions. But that’s not something that the IIF does.

Talking about like why, other than business reasons, folks should participate in this, one of the things that is going on that I would suggest that most hosts know about, is there’s a little bit of a moral panic going on in the world about what contents you have. And regulation is actually a very real thing for the hosting industry, who has not ever been regulated. This is the time where you can say, hey, this is what we’re doing, right? We’re dealing with issues. This way a trust seal is the same thing, right? It’s something that you can say, we are actually taking steps to make the internet a better place.

[00:22:18] Nathan Wrigley: I think if you are a general agency owner or, I don’t know, just a freelancer, hosting is one of those things that you, once you’ve done it once, you’re in it for the long haul until something goes wrong. But you’re also browsing around for any tiny indication of why is this host slightly different? You know, what is it that they’re doing that, I don’t know, is faster? What is it that they’re doing that’s more secure? So it feels to me if you had a credentialing system and I began to hear about it and see it pop up again and again, it would be one of the metrics which I would weigh up when looking at hosting.

[00:22:51] David Snead: I would think so. One of the things that a trust seal does is it indicates that there’s been some vetting of the host. That someone has determined the things that are important to the hosting industry and are important to the web design industry. The agency industry are also important to the host.

Great example of that is one of the provisions of the Secure Hosting Alliances’ Trust Seal Certification is that a contract is presented to the customer before they sign up, which is super customer friendly.

One of the things as a lawyer that you hear about all the time when people are dissatisfied with their services is, yeah, well, I never saw that contract. Or it was just a hyperlink in an email that I got. That’s one of the differentiators for a Trust Seal certified host is that the contract is actually presented to them, to the customer beforehand.

[00:23:57] Nathan Wrigley: So in terms of the WordPress crowd, is this a thing that you are pitching only to hosts? Like when you step out of here, are you trying to have conversations only with hosts? Or is there some bit of the WordPress community, the freelance, the agency owners? Are you trying to communicate with them just to scope out what they need?

[00:24:15] David Snead: So for both the Secure Hosting Alliance and for the IIF, it is that. I really enjoy talking to agencies and developers about whether this is important to them, or why it might be important to them.

[00:24:31] Nathan Wrigley: In terms of how long this project’s been going, I’ve only heard of it because of your participation here, but I don’t know if you’ve been banging this gong for a decade or, I mean you’ve been in the industry for long enough to have been banging it for decades. Is this a new initiative or is this something which has a long and storied history?

[00:24:49] David Snead: So the Secure Hosting Alliance has only been active for a year, a little bit over a year. I’ve been talking about abuse for a long time, but the Secure Hosting Alliance has only been around for a year.

[00:25:01] Nathan Wrigley: And have you, in that year, got any intuitions that you’ll be here for another year? Is it basically going in the right direction?

[00:25:09] David Snead: It is going in the right direction. So we started out with two or three charter members. We now have 25 hosting members. We have three security vendors who are members as well. We have, I think, 17 Trust Seal Certified members, and we’re launching in 2027 a trust seal for security vendors who provide services to hosting companies.

[00:25:40] Nathan Wrigley: I know that several owners of hosting companies listen to this podcast. They may very well be the people that you’ve spoken to already, but if they are not, and they are people who would like to investigate this further, I suppose the thing that’s going to be in their head is, okay, Nathan and David, you’ve explained what I’ll get out of it, what do I need to put into it? So is this an annual financial commitment? How does it all work from that point of view?

[00:26:02] David Snead: Yeah, so you become a member of the i2Coalition. And so the Secure Hosting Alliance is a working group of the i2Coalition. So you would be a general member and you would participate in the Secure Hosting Alliances’ working groups. You also have the ability to participate in the i2Coalition as a whole, which is a much larger trade association that represents almost everyone in the internet infrastructure vertical. Mostly doing policy work, primarily in the US and the EU. Although there’s, we’re doing some work in India right now as well.

[00:26:40] Nathan Wrigley: And does membership allow you to steer the future of the project? I know that lots of chefs in the kitchen results in terrible food, but that, I fear, is something that could happen. You’ve got 87 members, 260 members. And then the 260 members all start to bicker and, you know, we want this, no. You see how it goes.

[00:26:59] David Snead: I do.

[00:26:59] Nathan Wrigley: What’s the position there? You know, is there sort of gated levels of membership? How are you organising all of that?

[00:27:04] David Snead: There are not. The membership is based on self-reported revenue. The membership is not horrifically expensive from my perspective. And I think that that, most of our members would say that it is, it’s actually relatively affordable, particularly for the small to medium sized hosts. And registrars or design agencies, anyone who’s participating.

The question about, who’s running the show, comes up quite a bit. We haven’t really faced that issue, particularly in the Secure Hosting Alliance. Folks seem to get along. But the organisation runs on the idea of rough consensus. And so decisions end up not being controlled by one member or not. Some of the i2Coalition has some very large companies who everybody knows about, who get along with startups, and folks against whom they compete directly. And policies still get made. The organisation still moves forward.

[00:28:11] Nathan Wrigley: Yeah, I guess you’re in a space where, obviously all of these hosting companies commercially are vying for everybody else’s business. But in this particular situation, that is not the case. Nobody’s vying for their websites to be less secure. They all want the same level of security. So at least in that sense, you would hope that consensus could be maintained even if, commercially, the two companies that are in the room, the 10 companies that are in the room might be commercially at loggerheads with each other. At least on this they could agree. That would be the hope, I suppose, anyway.

[00:28:47] David Snead: It seems to be, not only the hope, but the actual way that things work. You ask about how compromise is reached. What comes to mind is I have a much different concept of privacy than, particularly when I was at WebPros, than other folks in the i2Coalition had. And another company just called me up and we worked through our disagreements about how privacy should be handled within the i2Coalition and were able to move forward.

The industry I’ve found to be hugely collaborative, particularly the hosting industry. Everybody knows what their competitor is doing. But when it comes to addressing an issue like, how are we going to deal with abuse as a community? Folks come together. CEOs of hosting companies while they compete tend to be relatively good friends.

As I said at the very beginning, it really is like the Hotel California, right? You come in as a CEO of a hosting company, you grow it and you sell it to another company. All of a sudden you’re at the bottom again with a server in your grandma’s basement, you know, trying to start again.

[00:30:08] Nathan Wrigley: It’s a really curious effort. I suppose really at the bottom of this entire podcast is your endeavour to be heard and to reach out and get some conversations going. So with that in mind, where do people find the information about this? So maybe there’s a website that we could mention. But also, is there a specific place where you hang out? Is there a place where you would like to be contacted most?

[00:30:33] David Snead: Sure. So our website is hostingsecurity.net. I’m not too afraid of getting too much spam. So folks can email me at snead@i2coalition.com And the two is the numeral two. So it’s snead@i2coalition.com. And I’m happy to answer questions.

In terms of hanging out, I am at most industry conferences in the hosting industry. In the WordPress industry, I’ll be at WordCamp US. We also participate very heavily in ICANN. So there is an i2Coalition member at every single ICANN meeting.

[00:31:12] Nathan Wrigley: So if you go to wptavern.com and you search for the episode with David Snead, S-N-E-A-D, you’ll be able to find those details. I’ll put everything into the show notes. So anything that I missed? Was there a particular focus that we didn’t touch?

[00:31:26] David Snead: No, this is actually one of the most thorough podcasts I’ve been on recently.

[00:31:31] Nathan Wrigley: That’s love to hear it. Well, David Snead, thank you very much for joining me today.

[00:31:35] David Snead: Glad to be here. Thanks for having me.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case how WordPress Credits bridges education and industry in the WordPress ecosystem.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Ivana Ćirković. Ivana is a digital marketer with 18 years of experience working both in and out of the tech industry, and currently leads marketing at WPBakery. She’s an active participant in WordPress events, having attended, and spoken at, numerous local and international word camps over the years.

In this episode, our focus is on the WordPress Credits initiative. We learn how this program, launched by the WordPress Foundation, connects students with real world opportunities to contribute to the WordPress ecosystem, earn certifications, and increase their competitiveness in the job market.

Ivana discusses her own experience as a WP Credits mentor, working with students as they learn about digital marketing, remote work, and other open source contributions. We explore, how universities can modernise their curriculums, and real world value for students by participating in the initiative, and how businesses can get involved, not just to support the community, but to help shape and discover future talent.

The program’s evolving structure also gets attention, and we learn how students are guided through hands-on activities such as translation or documentation, and how their progress is tracked publicly via profiles on wordpress.org. Ivana shares the opportunities and challenges for both educators and businesses with thoughts on accountability, mentorship, and the need to bring new faces into the WordPress community.

If you’re interested in the future of WordPress, education, or bridging the gap between academia and industry, this episode is for you.

If you’d like to find out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Ivana Ćirković.

I am joined on the podcast by Ivana Ćirković. Did I get that right?

[00:03:14] Ivana Ćirković: Yes. Excellent.

[00:03:16] Nathan Wrigley: Thank you. This is my first interview at WordCamp Europe 2026. I’m guessing because we’re on the first day of the event and it’s quite early in the morning, it’s 10 in the morning, I’m guessing you cannot have done your presentation yet?

[00:03:30] Ivana Ćirković: Not yet. Tomorrow.

[00:03:32] Nathan Wrigley: Do you get nervous with these kind of things?

[00:03:34] Ivana Ćirković: I get nervous all the time. I’ve been doing this for 12 years, it never gets easier. It is what it is.

[00:03:39] Nathan Wrigley: Well, the presentation that you are doing is going to be the focus of what we’re talking about today. So do you just want to tell us a little bit about the topic that you’re talking about, but also just give us a bit of a general bio about who you are and what you do. So just tell us about you and about your presentation basically.

[00:03:56] Ivana Ćirković: Okay. First thing first, I would like to introduce my presentation, or the talk, that is build up around WordPress Credits initiative, which is something that WordPress has rolled out late last year in December. And I applied to be a mentor to support students into their entering into WordPress. Got accepted, did my courses, passed them and started working with students on their, first entering the WordPress society, how everything works, contributing.

And out of all of this, I came up with the idea of sharing the story about WordPress Credits. What it is, why it is important, not just for the WordPress community, but also for universities all around the world for businesses to support, because there is an angle and huge opportunity for them too. And hopefully inspire people to join and become part of it more.

As far as I’m concerned, my name is  Ivana Ćirković and I am a digital marketer for 18 years. I’ve been working inside tech organisations, tech industry, but also outside of it. So I’m the multiverse. And lately, for past couple of years, I’ve been working in WPBakery, in marketing their product, and talking to people, sharing knowledge of what we do, how we do it, and so on. In the meantime I am attending many, many WordCamps, local and international ones, giving lectures, giving talks about digital marketing and all things related.

[00:05:39] Nathan Wrigley: So are you here at this event, not just to give your presentation, are you also here on behalf of WPBakery to represent them and the products that they have as well?

[00:05:47] Ivana Ćirković: Yes, we are sponsors. I am speaker, I was table lead for marketing on Contributors Day. So we are wide into the ecosystem.

[00:05:56] Nathan Wrigley: I have to say, having only been in this event space for about an hour, I’m actually deeply impressed by this particular event. It really is a gigantic venue. It’s so pleasurable as well to see the WordPress community in such large numbers here. And so we’re looking forward to a really good event.

Okay, let’s kick off with the topic at hand then. So it occurs to me that many people listening, whilst they’re using WordPress and they’re kind of, I don’t know, they’re building websites for people, and they’ve got products and plugins and they’re just general users. It may be that the community piece, and the educational piece, is nothing that they’ve heard of before. So would you just tell us a little bit about what WP Credits is as far as you’re concerned, just to give us that broad background of what it is?

[00:06:40] Ivana Ćirković: Okay. So WP Credits program is initially made to bring new young people into the WordPress, to broaden the ecosystem with the new fresh blood, new contributors. And to do so, WordPress Foundation initiated this program to connect with universities all across the world. To connect students to some programs, to learn about WordPress through contribution. For that, they will get graded and get certification, which in the end will help them be more marketable, and have more modern knowledge of what is needed in today’s job market, and to be more competitive and more appealing to potential employers.

So by doing so, WordPress Credits aims to broaden the ecosystem, to strengthen the WordPress community, and WordPress itself. But also to put new generations in more marketable place, and to help them get more profitable jobs.

[00:07:45] Nathan Wrigley: Thank you. That was a really nice summary. In terms of your personal commitment to it and what have you, how did you fall into it as a thing that you were doing? And is this something that you get sponsored for from WPBakery, or is it personal and simply a sort of philanthropic thing that you are doing on the side?

[00:08:01] Ivana Ćirković: Yeah, so basically, I’ve been doing education my whole professional life. So it’s something that comes natural to me. In my local country, in Serbia, I do informal education for high schoolers and primary school’s children about digital marketing, digital literacy. This is like very natural to me. I’m being sponsored by WPBakery to do so.

And the program works like, initiative needs people, needs more mentors to get involved. More than it needs like product and businesses to support with their products. So if there are businesses who are maybe interested in support through their product, know that you need to put your people first to actually get involved and contribute, and then you can offer products as the side piece, so to say.

[00:08:52] Nathan Wrigley: So yeah, it seems that you’ve got a lifelong interest in education as well. Okay, that gives me some sort of hook there.

Okay, if I was to say WP Credits to the people outside, the people who already knew about it, I think would probably peg it as entirely educational in nature, just an education initiative. But curiously, your presentation, the notes that went with that and the blurb that went on the WordCamp Europe website, you kind of make the point that it’s much bigger than that, and you get into businesses and the students themselves and universities.

So the students in universities bit, well, that’s the education piece. But the business bit, what’s going on there? Because I definitely hadn’t drawn that intuition. I thought education from top to bottom. But business, okay, where does that fit in?

[00:09:37] Ivana Ćirković: I will get the hot insights from the talk. So basically, there is more than what meets the eye, so to speak. Businesses have unique opportunity to shape people they want to employ by getting involved as mentors. They also get the chance to see firsthand how those young minds work in real environments, in real contribution. And they get the chance to pick and choose who they want to employ by seeing them work on some real things. Whether it’s documentation, whether it’s translation or programming, developing something, AI.

We need more people who know what they do, although they are young. By having students in this program, they are working on not fictional things, but actual things that really contribute to community and businesses as a whole. By supporting this initiative, businesses then in relations to that can get more insights into who they want to employ. So on top of that, they are building the better market for themselves as well.

[00:10:42] Nathan Wrigley: I guess the student university piece is fairly obvious. You know, WP Credits and the people working on that project communicate with universities, they’re probably easy to find. You know, if you go to a phone directory for example, they’ll all be there. And it’s an easy thing to do. You phone up the university and see if there’s interest. And I know that some universities have taken up the WP Credits program. And it seems to be, as far as I can work out, it seems to be working very successfully.

How are you going to make the connection with businesses? Because that seems like a much more scattered, I don’t know if you’re going to be working with big businesses, you know, huge companies or if it’s going to be kind of more the businesses on the street, the smaller businesses, that kind of thing. So, I’ll just sort of hand it over at that point.

[00:11:23] Ivana Ćirković: So basically, web agencies, businesses around WordPress, we know they have an issue with new employees onboarding last, let’s say three to six months. That cost time and money and other people who are teaching them what needs to be done and how.

Then we have WordPress Credit students who are already doing that junior type of work within contribution. They’re already onboarded through using Slack, knowing how to do remote work, what needs to be done. So businesses supporting WordPress Credits initiative can choose those students and spend less time and money and energy in onboarding them because they already went through that by doing WordPress Credits program.

[00:12:10] Nathan Wrigley: Yeah, I guess if you are a small web agency, it’s highly likely that you won’t necessarily have an induction program finely tuned, so that the young people that are coming through have this sort of specialised system where they can get some accreditation. It’s probably more, okay, I’m going to assign you to John this week and then next week you’re going to go over to Susan and follow what they’re doing.

So is there a sort of structured program that, let’s say a web agency based in London could drop into and receive documentation about? Where are we at with that whole process for the busineses?

[00:12:44] Ivana Ćirković: Yeah, so since this initiative is still fairly new and we already have just one generation of students that are passed the program, this is something in development. So at the moment, we still don’t have like a specific structure that is based just for agencies and businesses in general, but it is something that we are considering and working towards too. So definitely.

On the other hand, the upper management organisational team might not be aware to the fullest what am I about to talk. So it might come as a surprise to them, but also it is something in the works as well. So give us some time and we will come up with something.

[00:13:26] Nathan Wrigley: Yeah, it feels like that would be something really credible. Because if you’re a small business owner, the last thing you want to be doing is kind of wasting time. And onboarding somebody might be something that you’d have to divert weeks into, you know, syphoning employees off, writing documentation, SOPs, those kind of things. And if you could just pick something up off the shelf that was tried and tested over many years, that would actually be really handy. So good luck. I hope that that initiative comes off.

In terms of students, if you were a student, let’s say you are at a university, or you are looking for work, what would you say would be some of the top line items that you would mention as to why WP Credits is worth looking at? Because, you know, if I’m at a university, there’s probably a thousand different things that I could be doing. WP Credits would be in competition with all of those. Why do you think it’s something that young people should be taking care of to look at?

[00:14:17] Ivana Ćirković: Yeah, I would think differently, in that sense. Universities curriculums are outdated comparing to the industry that we are living and working in. So WordPress Credits gives something that is in trend. That is happening now that people are using and working now. So students who choose to go to this program are gaining the most efficient and not outdated curriculum, and things that are being worked on in this moment.

And this is bigger than WordPress. It is initially for WordPress, but the knowledge students get, nobody can take that away. They learn to be outspoken. They learn to use all the necessary remote work tools that is applicable in all the industry.

So we are really encouraging them to be very marketable employees and people who have portfolios, whether they choose that category that brings them portfolio. That is very transparent throughout whatever they do. Because on wordpress.org, every contribution is noted. So they’re building their own business brand by doing WordPress Credits. And in that way they are more marketable and can get more business opportunities.

[00:15:42] Nathan Wrigley: I didn’t realise that the wordpress.org profile, is it the profile that you mean?

[00:15:47] Ivana Ćirković: Yes.

[00:15:47] Nathan Wrigley: Each time you participate in one of these credit programs, that will be a badge, for want of a better word, that you can display and it will be freely available for the public. And presumably that will be difficult to acquire. That’s the wrong word. What I mean is, it won’t be simple to acquire. You will genuinely have had to.

[00:16:07] Ivana Ćirković: Yes, you need to do the work. Let’s say students are interested in translation. So they go to Polyglots team and they get assigned to a mentor who is on weekly basis working with them on onboarding, helping them how to navigate through wordpress.org website, translation, what needs to be done. And basically, for that student, they need to translate to have approved translation, 150 strings approved.

So that doesn’t mean, okay, I will translate 150 words. No, no. You might need to translate 500 words out of which 150 is approved. And this is the bare minimum you need to do in order to get that badge that you contributed. Because that contribution, each contribution needs to be something very specific and tailored to help other people. That is very open and helpful.

[00:17:00] Nathan Wrigley: So you mentioned translations there, which obviously is just one of multiple things that you could do, and we could list them all out, but we won’t. How is that curriculum, I’m doing air quotes, how is that curriculum decided upon? In other words, how do you decide, okay, I’m going to do a bit of translation, I’m going to do a bit of work on Core, I’m going to work for the Plugin Review Team? How is that decided? And, how is it decided by the institution, I guess that that’s going to equal something which our university will stamp as part of your degree, let’s say?

[00:17:33] Ivana Ćirković: Yeah. So basically, that is all arranged between the foundation and universities. You won’t get IT students doing marketing if that’s not their preferable choice. So students opt in. They’re given the whole like curriculum, categories of things they can contribute to. And the one they choose, this is the one they stick to throughout all the programs.

So you cannot switch in between like translation and documentation, or plugins, or WP-CLI whatever. The whole program stick to one chosen category. And that is all aligned with the, let’s say, topic of university. So IT is preferable for IT related contributions. Communications are also more favourable towards translation community, marketing. So it’s aligned that way.

[00:18:23] Nathan Wrigley: So flipping that round, so we’ve been talking about it from the point of view of the students. Now let’s just flip it around to the point of view of the university. I guess the same thing applies. They would have to communicate with the Foundation and say, okay, these are the kind of things that we wish our students to do. These particular strands, we will, you know, if they do 500 translation strings, that will count as something. I guess there’s got to be some interface between the Foundation and each university to establish what a credit equals.

[00:18:50] Ivana Ćirković: Yeah, common ground as to how WordPress Credits adds to the official curriculum of the university. And the thing that university get out of it, they are in position to offer modern, in trend, teachings, and that makes them more appealing to next generation of students. Because the more their existing students who are in the WordPress Credits program are succeeding, the more desirable the university gets to newer generations because they don’t teach outdated curriculums. They’re aligning to what is now efficient and needed in the job market.

[00:19:30] Nathan Wrigley: I suppose also as well, when I was at university, there was a choice of about, I don’t know, four things to do each year. Something like that. You could do this or this or this. And you had to pick one of them and that was your pathway. This feels much more wide open because knowing the WordPress ecosystem, I know that there’s dozens, maybe multiple dozens of different things that you could be involved in.

So that’s quite appealing as well, isn’t it? You know, you can just take a little nibble of this one thing, and another nibble of this. And so there’s potentially multiple dozens of different pathways that you could pick. And whilst you say that, once you’ve decided you’ve got to stick to that, well, that’s fair enough, but the fact that you’ve got so many different ways that you could choose. That to me as a university student would’ve been really appealing. The fact that there’s so many different things that you could do.

[00:20:15] Ivana Ćirković: Yeah. And once they got in, the overall input that we get from students that, first they don’t know that something like this exists. And once they go deep and start work, it’s like, wow. The whole mind just shifts, and they are amazed by all the possibilities that they can do within WordPress that isn’t talked about.

[00:20:36] Nathan Wrigley: Yeah. And I presume they get to do it in the way that the WordPress community works, which is remotely distributed and when you wish to do it. So long as I, you make the end of the university period of whatever a semester is or something, so long as you make the deadline, you can do it at night or in the early morning or.

[00:20:57] Ivana Ćirković: Exactly. So they are training to be like workers as we all are today, that are not restrained with some deadlines or by official university rules. They’re accountable for the final output. How will they come to that output? It’s entirely up to them because, yes, they are young but they’re not so young that they cannot be held accountable for their actions. So they need to do the work. We got weekly mentorships and assessments. So it’s a fun ride.

[00:21:31] Nathan Wrigley: So just touching on that, the sort of ongoing support that every student needs, because with the best rule in the world, there’s a proportion of students who will leave everything to the last minute. I’m looking at myself in the mirror when I say that. So that ongoing support, it’s a weekly sort of huddle. And is that like a one-to-one thing or is it a one to many thing?

[00:21:50] Ivana Ćirković: Yeah, so depending on the number of students, if a mentor has a one or two students, it can be one-to-one. If there are more like five or six, it’s better to have a group meeting on a weekly basis, and then Slack chats in between if anything is more needed than that.

So basically we go through what they did last week, are there any setbacks or they need additional help, or do they need information from other parts of the team? Are they interested in something else? So we are really trying to get them involved in a way that matters to them.

One of the things that each student needs to do, no matter section they chose, is to create a blog and to have weekly blog posts. So we discuss about that. What interests them. Whether they want to be something personal like, or professional like. So it’s very interesting to see how they think and how they express themself and how they build their online persona.

[00:22:55] Nathan Wrigley: Do those huddles take place on a, let’s say university by university basis? So for example, when you join and you mentor students, are they from the entire WP Campus project, or are you doing it from the university of this town and the university of that town?

[00:23:13] Ivana Ćirković: No, it’s mixed and matched.

[00:23:14] Nathan Wrigley: So, okay, well that’s a real strength as well it feels, because presumably then you’re on a call with people potentially from all over the world. Certainly people that you may not have encountered before. And those sort of serendipitous chance encounters can sometimes be some of the more meaningful ones. You know, work comes out of those things, and meetups come out of those things, and unexpected things come out of those things. So that must be really nice as well, watching those kind of things happen.

[00:23:42] Ivana Ćirković: Yeah, it’s like nothing I experienced before. And just to have the privilege to talk and work with those people, you never know what can come up out of them, and out of our connections. And I get inspired every time we have chats and they make me want to be a better educator.

[00:24:03] Nathan Wrigley: Oh, that’s interesting.

[00:24:04] Ivana Ćirković: So, yeah, that’s my take out of all this.

[00:24:06] Nathan Wrigley: Yeah. Okay, so there’s actually some psychological benefit for you as well. You get a real nice feeling of it. Okay, that’s really good.

So with the best will in the world, a university, every year there’s a cohort of children, young adults, whatever it may be, whichever institution it is, and a proportion of them will work diligently and hard and they will succeed. And some others maybe not so much.

How does that work? How do you ensure that everybody gets through it? And I don’t know if there’s enough data to answer this question. Again, I’m doing air quotes, how is the pass rate? Do most people that embark on this get through the necessary things? Or is there a fair bit of, I don’t know, discipline, for want of a better word, that needs to be applied and cajoling people to get through it?

[00:24:46] Ivana Ćirković: Yeah, so I touched base on the accountability. So we have not strict rules, but recommendations. Weekly mentor chats, async communication through Slack. They all have weekly tasks that needed to be done. So if a student don’t answer the message or come to weekly mentor call three times, they are no longer WordPress Credit students. And that is the accountability.

You need to show yourself that you are willing to do the work. So if you don’t care, we won’t force you to do that if you don’t want to. We will set reminders, we will call back, we will reach out. But if you are no show, no tell anything for three times, then evidently you are not for that. You don’t wish to be there, and we won’t force you to be there.

[00:25:40] Nathan Wrigley: And then in some way, are you required then to report that back to the institution and sort of say, okay, we’ve reached the end of the road here, and then it’s for them to figure out how that impacts. And presumably the students can.

[00:25:53] Ivana Ćirković: Their grades, yeah.

[00:25:53] Nathan Wrigley: Yeah, their grades what have you, okay. Touching back on the sort of business side, because we’ve dwelled a lot with students and universities and we’re going to stay with students, because that’s really the underpinning of the whole thing. How has the business side of things, is it taking off? You were describing that it’s kind of like a new thing. Have you got any sort of success stories or anecdotal evidence that people do in fact want this?

[00:26:15] Ivana Ćirković: Yeah, so it’s still fairly new, so we don’t have those anecdotes yet. One of the reasons why I’m here at the WordCamp Europe is to find out and to get new perspective from businesses to like reach out to them to see what they think about the program. Would they want to be evolved. And how to give tips, maybe how we can improve. So stay tuned for more.

[00:26:38] Nathan Wrigley: Yeah. And it is interesting, when you walk around an event like this, I don’t have the exact numbers, but the demographic is definitely skewing older. There’s not so many 18 year olds. And if this community wishes to carry on, at some point the age demographic will get to retirement age.

[00:26:57] Ivana Ćirković: Yeah. Just last night we were talking. I’ve been in the community for 11 years. And for 11 years all the same faces are here. And we really need new faces. But to get new faces, WordPress Credits is one part of the solution. But then again, we need to meet young people where they are. And they are not on the conferences, they are not on websites, they don’t use websites, they don’t care about websites. They are on very specific social media channels. And if we want to get fresh, new, young blood, we need to go there and to present what we do in a way that matters to those kids.

[00:27:35] Nathan Wrigley: In terms of success, if you were to, I don’t know, let’s imagine that we could cast our minds forwards five years, let’s go for that. What would you like to have happened with WP Credits? Would you like, for example, to see a bunch of 20 somethings wandering around in an event like this? Does it matter that they’re involved in the community and doing WordPress events and contributing to Core and those kind of things? Or is success just more broadly, people are using WordPress? You know, it’s still a project. What’s your take on, what does success look like in five years?

[00:28:08] Ivana Ćirković: For me, I would like to see more young people involved. Yes, we will always have users because in its core, WordPress is a very useful tool. And I’m happy to stumble upon that tool many, many years ago to use it both personally and professionally. But I really want to see young people involved in a way that we were involved 10, 15 years ago, and to see what can happen with WordPress.

I strongly believe it’ll be transformed, not with AI or all other flashy trends. WordPress has always been about people. And we need new people, we need young people to get it where it needs to be.

We are getting older and don’t have strengths or stamina to do so for how many long years. By having new kids, fresh perspectives, I’m really excited to see what they can come up with next.

[00:29:08] Nathan Wrigley: Yeah, it’s kind of handing over the baton in a way, isn’t it? Seeing what the future holds. Yeah, I definitely have concerns that the age demographic is skewing. And no matter what has happened in the past, I don’t see it being backfilled with younger people moment.

But I think that’s largely because we just assumed that that age demographic would fill itself, because we were excited about it, so the younger generation will be excited about it. Well it turns out the world moved on. And TikTok came along, and YouTube became a massive thing and mobile phones and all the different platforms became a thing. And so the attention was put elsewhere by many young people.

And so I suppose we needed to come up with a system where we are, in a sense, just putting it in front of their face and saying, look, it’s here. You know, you’re a university student, you are somebody looking for work in a small business. Here’s a credible way of getting involved in something which potentially could change your life. That seems like the most credible way of doing it at the moment. And I guess we’ll just have to see what the next five years brings.

In which case, is there anything that you felt you wanted to touch on that you wanted to get out of this chat before we finished?

[00:30:15] Ivana Ćirković: No, I think you did it masterfully. And we touched base on everything that needed to be said.

[00:30:20] Nathan Wrigley: Perfect. In that case, I will say Ivana, thank you for chatting to me today. Fingers crossed that your presentation goes well tomorrow, and that you pack the place out, and that by this time next week, you are extremely busy with the WP Credits program. Thanks for chatting to me.

[00:30:34] Ivana Ćirković: Thank you. Thank you for inviting me.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, how WordPress education programs are growing.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today, we are joined by three WordPress Education Initiative leaders, Destiny Kanno, Anand Upadhyay and Maciej Pilarski.

Together, they have spent years at the heart of WordPress training and outreach, working in roles spanning community education management, plugin development, and credit program administration. Their efforts have helped shape student engagement and university partnerships across the globe, introducing thousands of learners to WordPress.

The conversation focused on the current landscape of WordPress education with particular attention to three key initiatives, the WordPress Credits Program, Campus Connect, and Student Clubs.

Each initiative is designed to provide unique entry points for students of all ages and education levels. From high schoolers building their first site in a library to university students earning official credits for open source contributions.

We discussed the different approaches these programmes take. WP Credits ties student work directly to academic credit and mentorship. Campus Connect provides flexible, community driven, events in diverse locations and Student Clubs foster sustainable, peer led, learning within schools and other institutions. We explore how these models feed into each other, building a sustainable ecosystem for ongoing growth in the WordPress community.

We also get into the importance of repeat campus partnerships, the need for scalable facilitator training, and the role of recognition, certificates, badges, and public showcases in keeping students motivated and validated in their journey.

If you’re curious about the growing movement to bring WordPress knowledge to the next generation, or are looking to get involved with education in your local community, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Destiny Kanno, Anand Upadhyay and Maciej Pilarski.

I am joined on the podcast by Destiny Kanno, by Anand Upadhyay and Maciej Pilarski. Hello, one and all. Nice to have you with us.

[00:03:29] Destiny Kanno: Hello. Thank you.

[00:03:30] Anand Upadhyay: Hello.

[00:03:31] Maciej Pilarski: Hello.

[00:03:32] Nathan Wrigley: So a few months ago, back in, I think it was September 2025, I was joined by two of the three participants on the call today. I was joined by Destiny and I was joined by Anand. We were also joined at that point by Isotta, but she’s not on the call today. We’ve obviously got a wonderful replacement, Maciej who’s going to do a fabulous job explaining the bits and pieces here.

But the intention of that episode, which you can find on the WP Tavern website, it’s episode number 183, was to find out about all of the overlapping education initiatives in the WordPress space. And it was born, I think, largely out of a sense of curiosity on my part, but also a somewhat sense of confusion, because there were lots of things which were going on. Some of them seemed to be slightly overlapping. There was a conflict of names in some cases. So that episode was laying out the groundworks of what has been happening in the WordPress space.

When that conversation finished and we’d click the stop record button, I said, that was absolutely fascinating. This seems to be moving at such a rate, wouldn’t it be good to revisit this whole subject in about six months time?

Well, we missed that target, but here we are, maybe eight months later. I think my intuition at that point was correct, because being a close observer of what’s going on in the WordPress community, I think it’s fair to say that the educational space has been somewhat turbocharged during the last eight months.

And so today’s episode, with the help of the three people I’ve just mentioned, is to describe what’s going on, what’s changed, maybe some things that have been mothballed, but certainly a lot of things that are new and interesting and have gained a lot of momentum.

But I think, dear listener, the intention of this episode is to get you involved. Is to get to the end of this episode and for your curiosity to have been turned into action. To have gotten you out of your chair, written an email, turned up to an event, helped organise a thing.

So please have that in the back of your mind. If you’re sitting listening to this in a car, at your desktop, there is actual action that could be taken at the end of this. I think the intention of all four of us on this panel would be dearly for that to happen.

Okay, let’s establish the credentials of the people that we’re going to be talking to today. So we’ll just do a little potted bio of you one at a time. So we’ll begin with Destiny, if you could just tell us a little bit about you, your relationship with education in the WordPress space, I suppose would be apropos.

[00:06:01] Destiny Kanno: Yeah, absolutely. So again, Destiny Kanno. I’m currently working as an education program manager sponsored by Automattic. And I work directly with the Make WordPress Community Team. And I also work adjacently with the training team as well, because education training materials, they go pretty hand in hand. And I’ve been doing this now for about four years and, yeah, it’s just evolved since my original time working on Learn WordPress, and that relaunch that happened, to now, yeah, these wonderful programs that are spreading like wildfire as you said.

[00:06:37] Nathan Wrigley: Fantastic. Thank you so much. Okay, we’ll move over to Anand for the same sort of introductory moment.

[00:06:43] Anand Upadhyay: Yes. So my name is Anand Upadhyay, and I run the WordPress plugin development company, WPVibes. Apart from that, I’m very much involved in the WordPress community and I contribute in multiple ways. It can be documentation, it can be Core, Polyglots. But I’m also keenly involved in the community part, and specifically I can say with the education initiatives, I started with WP Campus Connect in WordPress Campus Connect in 2024. And since then, after that we started joining hands with Destiny and we started evolving this program in a much bigger shape. So that’s it.

[00:07:16] Nathan Wrigley: Okay. Thank you so much. And last, but by no means least, Maciej.

[00:07:20] Maciej Pilarski: Yeah. Thanks for having me. My name is Maciej Pilarski. So I’ve been doing anything related to WordPress pretty much since 2007, so that’s been a while. But the biggest breakthrough for me was 2014 when I actually volunteered to WordCamp Europe in Sovia, Bulgaria. That opened my eyes to the whole community, everything that is happening around WordPress.

And since then, pretty much I’ve been working for multiple companies from the WordPress ecosystem. I joined Automattic in 2016. For many years I’ve been a Happiness Engineer, and since October last year, I’ve joined Isotta as one of the admins of the WordPress Credit program. And since that time, I will have been helping her out to grow that initiative.

And Destiny mentioned, it spreads like fire because at that time we had six universities onboarded, now we are at 21. The 21st, we got it after WordCamp Asia actually through a connection made there. And it’s our first institution from Africa, from Uganda. A huge shout out to Stephen Dumba, who I connected with during the event. And after that, pretty much a week after we signed our first partnership from Africa. So we’re actively growing and getting new institutions on board.

[00:08:42] Nathan Wrigley: Thank you so much. Gosh, there was an awful lot in there, wasn’t there? That was really interesting. We’ll try and unpack quite a lot of that.

Firstly, a sort of slightly personal message from me. I don’t usually reveal much about myself on this podcast. I take the position that I’m a, kind of like an interested party, but don’t really give much of my own thoughts. However, this is different because I cannot think of a more interesting, meaningful, moral, let’s go with that word as well, use of time than educating people. It simply is the most profoundly useful thing to do with your life.

Now, obviously people will have different opinions about that, but the juxtaposition of free open source software, in this case WordPress, and education is a real sweet spot for me. I just think that is such an amazing thing to be involved in, to have going on in the background.

If you think about it, an open source project, like how many open source projects have this level of stuff going on in the education space, this real international footprint. Things going on which we’ll find out about in a minute. It’s really fascinating.

And I am sure that the listenership to this podcast, the vast majority of people listening will never have encountered much of this before. Maybe they’ve seen stuff on Learn because they want to technically learn about WordPress in an online capacity, but we’re going to be delving into real world events affecting real adults, real youngsters.

And so anyway, that’s my little bit at the beginning, just how curious it is that the project is so big that we’ve got this international footprint of education. And so I suppose what we should do right at the beginning is lay out the different initiatives and just name them, and try to figure out how they differ from each other. Just so that we’ve got some kind of awareness.

So I don’t know which one of you wants to take that, but if maybe you take one each or something, I don’t know. If we just want to lay out the, just erect that tent basically so that we know what the initiatives are called, and how they differ from one another. So I’ll open that up. Whoever wants to step in.

[00:10:48] Maciej Pilarski: I can start with the Credits Program. So the Credits Program is based, it’s a contribution based program, internship, initiative by the WordPress Foundation that connects higher education students with the global open source community. So basically it’s an opportunity for the students as part of the educational curriculum to contribute to the WordPress community.

There are two types of courses that the students can do. One of them is 50 hours, the second one is 150 hours. Usually the students do that during a full academic semester. And as part of that, students are first onboarded into the WordPress ecosystem and the wider open source ecosystem where they learn not only about WordPress, but open source as a whole, and how crucial it is for the internet.

Then the second phase is picking the contribution area to which they would like to contribute. All the contributions areas basically are the ones that are listed at make.wordpress.org. So any team that is listed there, students can pick from that area. During that phase, they work on a particular area that they have selected.

And finally, during phase three, they wrap up the whole achievements, the contribution, what they did, they publish a final post. And what is also very important as part of the credit scores, students have also assigned a mentor from the WordPress community that guides them through the whole process. We don’t leave them alone. We connect them with actual mentors from the WordPress community that are vetted by us, that guide them through the whole journey into the contribution and the whole WordPress ecosystem.

So it works on multiple levels. For me, this connection is also special because it builds this bridge between the previous generation of WordPress contributors to the new one where they are introduced and can start working on any fields of contribution.

What is also important is that this is not limited to technical universities. Pretty much any type of university can participate in the program. The first university that we started with was University of Pisa, and it was the humanity studies. So the students from humanity field were the first group who started the Credits Program. There’s room for pretty much anyone from any field.

[00:13:18] Nathan Wrigley: Okay. There’s a lot there. Wow. I’ve just been taking notes and I’ve almost filled an entire A4 page. So WP Credits, the WordPress Credits Program, I guess the name sort of gives it away. The idea here is that you trade time for university or higher education credit. So credit being, I suppose if you were to atomise your three year degree, you might do, I don’t know, 12 modules or something like that. The idea is that one of those modules, perhaps it’s more, becomes something in the WordPress, but also curiously the free open source software space as well. I didn’t actually know that.

The idea is that you link up with real world institutions. So the first one was Pisa, and maybe we can get into which other ones have come along. And in exchange for 50 hours or 150 hours, you will be given that credit, which can then go to the overall awarding of a degree or whatever it is that you are hoping to get.

You’re then linked up with team members, WordPress community team members who will mentor you and shepherd you through this process. And the idea is that it culminates, I think you said in a final post, which I suppose in a sense is a bit like a dissertation or something like that, you sum up all the different bits and pieces. Yeah.

[00:14:29] Maciej Pilarski: Once that happens, the students also receives an official certificate from the WordPress Foundation, signed by Matt himself, that certifies that they completed the course. And what is also important to know, the whole progress through the course and what they did during the course, it’s also stored on the wordpress.org profile. So any contributions that they did, for example, photos that they’ve uploaded, this all will be visible on the wordpress.org profile. And they also receive a special badge dedicated to students who graduated from that program.

So it really gets them started into the WordPress ecosystem, and at the same time creates something like a small portfolio for any future company that would like to, for example, hire them. Because they have a proven history of contributing to the ecosystem.

[00:15:20] Nathan Wrigley: Okay, so that’s an interesting quid pro quo, isn’t it? So the idea is you do all this work, which on the face of it, I suppose looks very philanthropic, you know, you’re giving up your time, but you get a real thing at the back end of it. You get a certificate. You can then presumably apply for jobs and indicate, okay, I’ve done this, I’ve contributed in this meaningful way.

What I think is really interesting there, and it kind of gets lost, I’ve worked in education in the past and I know the red tape that’s involved in doing anything in the education space. There is so much red tape. And I can only imagine what’s happened in the background to enable these kind of things. You know, the back and forth, the tennis of emails that go on and on and the proof that’s required to categorically show that this thing that we are doing is worth something. You know, it’s not just this Mickey Mouse. We use that expression, Mickey Mouse kind of qualification that really, it doesn’t actually require any hard work. It’s just there, nothing really in it, but you get an accreditation anyway.

I can only imagine the hard work that has gone in every single time you touch a new institution, trying to convince them that this is legitimate, that this is real. You’ve just kind of glossed over all of that by just describing what is in existence, not necessarily what has gone on to make it happen. I know that there’s probably more than the three of you involved in this, but my profound thanks for all of that hard work, which presumably is utterly and completely invisible. And I can only imagine what’s going on there. So yeah, thank you for all of that.

[00:16:54] Maciej Pilarski: Thank you for that.

[00:16:54] Nathan Wrigley: So that was WP Credits. So that was one wing of the things that we’re going to discuss today. Should we move on to another one and maybe somebody else wants to take the helm?

[00:17:03] Anand Upadhyay: I think Destiny can take Campus Connect and then I will take Student Clubs.

[00:17:06] Nathan Wrigley: Okay. Destiny, let’s move over to you and see what you can tell us about something different.

[00:17:11] Destiny Kanno: Yeah, so I’d love to tell you more about WordPress Campus Connect. And the way we ended with WordPress Credits, I think is also very critical to the story of Campus Connect because, you know, it started with Campus Connect first, and that’s how organisers such as Anand and Pooja like were able to get those connections with the universities through being boots on the ground, you know, having those relationships. Proving through action that these activities that we’re doing with the students are having real impact and are showing real results.

Slowly building up these kind of case studies in a way has helped open a lot of doors, especially with Campus Connect now, we’ve done a lot of events, especially since we last talked. Like I think this year alone, we’ve already had 22 Campus Connect events. So, like it’s not even half the year and it’s quickly becoming one of the biggest run events, WordPress official series.

But these events are like a way of opening the door, right? Hey, here’s a free learning opportunity for your students. And as you said, like the red tape is there. A lot of institutions are like, wait, so what’s in it for you? Why is, there’s a little bit of dubiousness sometimes in the reaction, right? You’re going to give your time to educate our students, why? But once they see, it’s like, no, we really are just passionate about spreading WordPress, showing students what’s capable with their website, how it applies to different skillsets as well. Like it’s not just for coders, it is for marketers, it is for designers.

You know, there’s so many career opportunities that once we just get the foot in the door and we’re able to showcase that, a lot of institutions are like, okay, now I get it. I do want to highlight in Anand’s case, like they’re going to have their third WordPress Campus Connect in Ajmer this year. You’ve got repeat institutions. I’ve heard you also have institutions that are like, when are you going to come to our place and teach WordPress? You know, once the fire is lit and people see how bright and shiny it is, like people want to get involved.

But as you said, like getting it to click for people, that is like the most difficult part. And I’ll give an example of, right now in Japan, we had our first WordPress Campus Connect event on the 9th of May. So I’m like, woo hoo. Like it finally happened. But we have this community in Japan that is like very passionate, very active. So when I first was like introducing the concept of Campus Connect, people were like, okay, but like how do we do this? What’s it about? It takes like a lot of presentations, a lot of going to people in person and talking. Helping them even shape the conversation that they’re going to have with the institution to sell this amazing gift of WordPress on their campus.

And after this one on the ninth, like now we have a case study in Japan that others can now use to be a starting point for those conversations going forward. So I think, once you have that one step, the gate just slowly opens until it’s just, the doors bang open in each way. But yeah, we’ve seen really great success with Campus Connect and it’s just like honestly, it just keeps growing.

[00:20:30] Nathan Wrigley: Can I just ask a quick question? So I just want to draw a very clear line for everybody that’s listening to this, what the difference may be between Campus Connect and WP Credits. Because from the description that we’ve had so far, it may be that you’ve fallen into the trap of thinking, well, they sound like they might be the same thing. So could you just, Destiny, just tease out where Campus Connect differs? Maybe in the nature of the event, the timing of the event, the availability, the age group, those kind of things that separate WP Credits from the Campus Connect initiative.

[00:21:02] Destiny Kanno: Yeah. Thank you, that’s like a really great distinction to make. So whereas WordPress Credits is geared toward higher education, Campus Connect is geared toward, honestly any level of students as long as they’re able to browse the web safely, and enjoy and participate.

So that means, Elementary school students now are pretty good at devices. High school students, college students, vocational students. We honestly kept the door pretty open in terms of what a campus means. We’ve even had a Campus Connect event in Uganda in a library, the Lira Public Library because students were able to go there right?

We were trying to make it as barrier free for students wherever their campus is. And so that’s, I think, the main difference. It’s more wide ranging in terms of who can participate as a student. And then also the fact that it could be a one-off event, so a one day event. A lot nowadays are multiple day events, they’ll maybe go two times out of a month, or a couple days consecutively. And then after that it’s up to really the organisers in the institution whether or not we have another addition on their campus the same year, or the next year.

[00:22:15] Nathan Wrigley: I’m going to tease out a few things. I just want to point out to, me as an English person, that is to say, not an English speaker, but somebody from England, campus has a really defined definition, and it’s usually bound to a university. Whereas it sounds like the description here, campus literally means the place where education happens, not it’s 18 years old and older, you know, people doing degrees, bachelors and PhDs and that kind of thing. Basically, if there’s an institution somewhere, that’s what the campus is in this case. Okay.

So the WP Credits program sounds like you forge your relationship with the university, and correct me if I’m wrong, it sounds like it takes place inside that institution, and it’s part of that program and what have you.

The Campus Connect initiative is much more ad hoc. It could be a one-off, it could be monthly, it could be inside a library, it could be inside the school, it could be an inside an institution. It feels a bit more like, I don’t know, a WordPress Meetup, but geared towards a younger audience or something like that.

And the minimum age requirement is really driven by your capacity to type on a keyboard and hold a mouse and those kind of things. And that’s kind of curious to me because I think my educational experience was always younger children. It’s really interesting how patterns are laid down at a very, very early age. Patterns that go on into much later life get laid down, typically at incredibly young ages. So this is fascinating for digging into that.

And it’s not just about, say, the code, it sounds like code is on the menu, but it could be about marketing, it could be about design. Basically the gamut of anything online, CMSy, those kind of things. Okay, is there anything you want to add? Did I misunderstand anything there, or misstate anything there?

[00:24:02] Destiny Kanno: No, I think you’re completely right. We’re trying to convey that WordPress isn’t just a blogging software that I think is still a lot of people have a mentality of. Like there are many ways to utilise it that goes beyond that.

And one thing I did want to add are a couple numbers. So since WordPress Campus Connect became official in May of 2025, an official WordPress event series, I should say, we’ve had 42 completed events, with 71 participating institutions, and over 5,500 students have been reached.

[00:24:37] Nathan Wrigley: That’s something else. 42 events, 71 institutions, and I think you said five and a half thousand individuals. Good grief. I don’t know what the measure of success is for this, but that feels like success to me.

I mean, imagine turning up to a WordCamp, like a flagship WordCamp and five and a half thousand people descending on you. You’d feel slightly overwhelmed. That’s a lot, isn’t it? Gosh, that’s pretty remarkable. Wow. Congratulations.

[00:25:05] Destiny Kanno: And the majority, the outcome, the students make a website. So we could almost count those students as also new WordPress websites that are live now on the web. So within a year, organisers around the world have been able to make that happen.

[00:25:19] Nathan Wrigley: Could I just perhaps draw another distinction as well, just very quickly, because it sounds like the WordPress Credit system, because it’s binding itself to institutions, it sounds like there might be more paperwork going on there, and maybe more high level meetings that need to take place. Whereas Campus Connect feels much more community driven. It’s the kind of thing that, quite literally, anybody listening to this podcast with a fair wind could have one of those going in a handful of months. If they’ve got the right initiative and they can find the audience for that.

Again, is that about right? There’s sort of more opportunity to become involved with the Campus Connect initiatives. You don’t need to have that academic background or have a point of contact at a university. You basically just need a building, some interest and a bunch of students.

[00:26:02] Destiny Kanno: Yeah, the key thing is, you know, having a real connection to the campus that you’re going to present at. But you’re exactly right. We tried really hard to lower the barrier to organise these events. Because I don’t know if you’ve organised a WordPress event before, there’s kind of a lot of hoops you have to jump through. And we’re like, okay, how can we think about this in a different way?

And I think that also has positive repercussions for how we organise other events too, that are, changes are being thought about too so that we can enable people and empower them to put these events, instead of bogging them down and process and a little bit of bureaucracy to say.

[00:26:38] Nathan Wrigley: So what’s really curious about that as well is we’re all in different parts of the world, aren’t we? People on the call today are in Japan and I’m in Europe and, Anand, are you in India? I think.

[00:26:47] Anand Upadhyay: Yeah.

[00:26:47] Nathan Wrigley: Yeah. Each of those events, I guess would look quite different. The kind of nature of the attendees, the nature of the kind of building it might be in, the institution. And it really is, you just grab what’s around you I suppose, and work with that. If you’ve got a connection to an institution, you can go for it. Maciej, I feel like I crosstalked you. I think you wanted to say quite a few times and I’ve just interrupted. I’m very sorry.

[00:27:08] Maciej Pilarski: No worries about that. So I wanted to add that those initiatives set backgrounds for each other. Because in some uni institutions, the interest sparks with a Campus Connect event, and that gets the institution interested in those initiatives, which sets background for WordCamp Credit.

And it happens also the other way around, where we start with an institution that starts credits and then we get the students interested in WordPress in general, the community, which leads to a Campus Connect event during the Credits Program. What is important is that those initiatives don’t compete with each other. They support each other.

[00:27:51] Nathan Wrigley: Right, so there’s a lovely virtuous cycle there, isn’t there? Where the two things can be going on in harmony, one promoting the other and they’re definitely not in competition. Okay. That’s really interesting.

One final question on Campus Connect, and I’ll direct this at Destiny, just because she’s been handling that. With the WP Credits thing, there is this moment where you hold the certificate in your hand and you go, yay, did it.

Is the same thing true of Campus Connect or is it more of a show up to the one event, you know that you did that, that was great, you can file that away in your own head as a thing? Or is there some sort of accreditation, or certificate giving, or badge giving, or profile updating that might go on on wordpress.org? Is there any sort of thing that the attendees receive, and I suppose that the people that are organising might receive as well?

[00:28:37] Destiny Kanno: Yes. So we do have a certificate of participation that students can receive signed by WordPress Foundation Executive Director, Mary Hubbard. And that just needs to be requested by the organisers ahead of time, because we need to get the signature and all that. So yes, they can come away with that. And we’ve heard really positive things about that, like it motivates them. They’re like, yeah, I did something, which they did.

[00:29:01] Nathan Wrigley: There we go. That was WP Credits and WP Campus Connect.

Can I just say at this point, dear listener, if at this point you’re thinking hang on a minute, there’s a lot going on here, don’t worry, there’ll be show notes. If you go to the WP Tavern website, there’ll be show notes. I’ll try to list out as many sensible links to get you to the root of each one of these initiatives, so that you can begin your journey and fan out from there.

I’m not sure what episode number this will be, but if you just go and search for, oh, I don’t know, Destiny or Anand or Maciej, you could probably find the episode that way. And all the show notes will contain all of the links.

Right, in which case, I think it might be Anand’s turn. What have you decided to take on Anand?

[00:29:39] Anand Upadhyay: So I will be sharing my thoughts on the third part of this whole education initiative ecosystem. So that is a Student Club. Just a few minutes before you were giving the analogue of meetup with this Campus Connect. So I would like to share the same analogue with us because we are more accustomed with like other terms of WordCamps and Meetups and contributer days.

WordPress Campus Connect is kind of like a WordCamp happening in the campus, because it’s like a big day event that holds everything happening, different kind of sessions, maybe workshops happening. So I would compare it with that thing.

And same way, credits thing, Credit Program is kind of like ongoing contribution series because more focused on the contribution part because the student devote 150 hours of their program. A lot of period goes to the contribution.

And now the same way we, if we talk about the Student club, it’s similar to like the Meetups that we have. But these are the in campus meetups for the students and by the students. How do things get started? Like the Campus Connect introduce the WordPress to those campuses and to those students, but since most of the campus, it’s a once in a year event. So once this event has sparked something about the WordPress in the students. So keeping that momentum going on, that’s where the Student Clubs come in.

So with the Student Club, it’s kind of like, as I mentioned, it’s like an in campus meet program. So a student can gather themselves, they can form a club and a couple of students can be nominated as club organisers, student club organiser from their campus. And then they organise the in-campus events, maybe like once in a month or twice a month, depending on academic calendar. There are a lot of hurdles in doing those things continuously.

But they usually do once or twice a month. They do a kind of a meetup in their campus. The students gathered together. They learn from variable resources available from WordPress. And from those resources, they share with the other students. It’s kind of a group learning, group study, that we use. Education live, we always do that. It’s kind of a group study. They’re learning from themselves. If someone has learned something, they are helping others to learn those things.

So I would just like to give some of the examples from my city. There are multiple Student Clubs are going on. When we went to the campus, we just taught like a small group of students about the WordPress, because we’d have some limitations of the resources, of the setting arrangement. We cannot call all the students of the campus and, okay, come together and I have a amazing workshop. So we have given the WordPress walk through to the limited number of students.

After that, they form a Student Club in their campus because they got very much interested. Then the first session they did was like, they started teaching to their juniors, like the students who have just entered the campus. They took a session for them. So they told, whatever we have told them, they have taught the same thing to the juniors.

After that, in the next few session, they experimented different things. Like in some session they’re just doing a fun quiz around WordPress. And in some sessions they are doing a kind of like a, I would say like a hackathon kind of thing. So they are just picking up a website. Or you can, just similar to the speed build challenge that Jamie do. So they have just one website open on the screen and everybody’s like cloning that website.

So there are different ways students are engaging through those student clubs. So it is helping to keep the momentum going on so that the student keep learning about WordPress and they are also connecting with the community members for the guidance about how they can learn more. What should they learn next if they are sharing their experience. Like we have covered these things and, what should we go next?

And in the recent WordCamp Asia, they’re also one of the Student Club lead from my city. She joined the event and there are conversation with the, like other community members who has offered them like, okay, we can come to your campus, or we can do, have a webinar for your campus where we can teach you particular subjects, particular topics. Maybe they can talk about SEO, maybe they can talk about plugin development.

So this is also opening the horizon for them, to learn from people across the world. So that is how the Student Clubs are happening. The examples I’ve gave, again, from my own city because I’m closely mentoring them, but there’s similar things are happening across the world.

So it is helping to create a kind of sustainable environment for the long-term sustainable environment in the campus. So the next time when we go to that campus, we are not going to teach like the basics of WordPress, because we want like, the ecosystem should be built within the campus, so every student know about the WordPress. Because last time when we went to the campus, we have to tell everything about WordPress because why you should learn WordPress.

So the Student Clubs, my ambition is that, wherever the Student Club is from, next time a Campus Connect event is happening, next time we should not tell them about what is WordPress and why they should learn this thing. There should be already a sustainable ecosystem.

And I feel that all these three programs are like very much interconnected. And the real impact of these programs, we will be able to see in the next two or three years. And there will be a regular ongoing activities around WordPress in the campus.

And these are also kind of a balance program as well. Like the Campus Connect is introducing WordPress to the students, Credits Program is motivating them more towards like the contribution part. And I would say that Student Clubs is more inclined towards getting new users to the WordPress. Because if we keep on focusing on the contribution, contribution, but if we discard the like increasing the number of new users, so we are not going to win. We need a balanced state.

The Student Club is trying to, learning how to build website, how to mastering the skills of the WordPress. And later on, many of them are going to join the contribution part as well.

So this whole ecosystem is built around bringing more people to the contribution, bringing more people to use WordPress, build websites, as in, for the individuals as a business as well. So that’s how all these three programrs are very much interconnected, and growing together fast.

[00:35:16] Nathan Wrigley: It feels like, of the three things that we’ve talked about, so WP Credits, Campus Connect, the Student Club, this final one that you’ve just covered, it feels like that’s got a very flat hierarchy to it. In other words, there’s like this peer learning. So it feels like more or less anybody can show up and demonstrate anything, which might then lead to somebody else thinking, okay, that was interesting, I’ll take on next month’s one because I’ve now seen that’s doable. Less hierarchy, if you know what I mean? So a much more flat structure.

[00:35:45] Anand Upadhyay: Because when we started Campus Connect, we also get a lot of attraction in the local community as well. And people join our Meetup groups. But then it becomes difficult for us, how to plan about the topics for our meetup. We have some experienced professionals coming in. We have some students coming in, and we plan the topics that suits the professionals. The student will feel like, okay, what’s they’re talking, we are not getting anything in our mind. If we bring the topics, very basic topics and the professionals who are joining the community meetups, they’ll feel like, okay, these are very basic stuff, why am I coming here?

Student Clubs giving them their own platform, giving them a own opportunity. Okay, these are all the familiar faces. It is also giving the opportunity to come on the stage, come onto the stage and get out of your fear as well. It is also generating leadership qualities in them. Okay, we have to keep this momentum going on and we have to keep the activities going on. So there are a lot of ways, apart from learning WordPress, there are a lot of other ways it is helping the students as well.

[00:36:40] Nathan Wrigley: When you have to stand up in front of a bunch of people and deliver something, obviously there’s a whole bunch of us that are just really confident at doing that, quite happy to stand up and do that kind of thing off the bat. But equally, there’s people for whom that is just the most terrifying experience possible. You know, standing up in front of two or three people, oh boy, you know, anything above that is just off the books.

And I was just wondering about that, whether or not there’s, in this particular style of event, the Student Club, whether there is a growing corpus of, I don’t know, previously done topics or topic suggestions or slide decks or anything like that, which might enable people to feel that level of confidence? I don’t know if that’s something which is being put together. Just resources which enable somebody who doesn’t have the confidence, let’s go with that word, who then may gain that confidence. And I’m going to pass this to Destiny because she’s waving her hand.

[00:37:30] Destiny Kanno: I was really hoping I could shamelessly plug this project. This is like, you’ve said the most opportune thing. So I’m actually developing right now what I’m like tentatively calling the Meetup Activity Library. It comes with like kits on certain topics. So for example, WordPress Playground was the first one I built. But it comes with the facilitation guide, which is a doc. So the facilitator can read through, understand the steps they’re going to go through in the activity, how to pace it. And then a presentation deck which they would display, if that’s available to them, to the folks that they’re presenting to. And it’s a hands-on activity only. So it’s not only presentation. The facilitator of course guides and talks them through things, but then people are getting hands-on experience with that topic along the way.

[00:38:16] Nathan Wrigley: That is a beautiful remover of barriers, because I think just having that little document, that little crutch, you don’t have to feel that you, okay, I’ve got to come up with a topic. Not only have I got to come up with a topic, but then I’ve got to research the topic, deliver the topic. If you can have it all on a thing that you can crib from, I don’t know, it just arms you with that confidence as you walk in. I think that’s such a brilliant topic. And, Maciej.

[00:38:40] Maciej Pilarski: Both Destiny and Anand mentioned two keywords, sustainability and facilitator. The goal of also getting all those educational initiatives going is also create in a sustainable way. We’re not pushing for numbers, but growing them in a smart way where we don’t get too many students so we get overwhelmed. We need to have enough mentors to accommodate those students, and also enough facilitators to be able to scale the program, to grow it in the future.

And it’s exactly what Destiny is now doing, the Facilitator Training Program, which gets more people from the educational sectors, community organisers, everyone on board, to jump on those educational initiatives and help us to grow. Because the number of every, all those students involved in participating in those programs is increasing and we need to be able to accommodate them. And through the Facilitator Training Program, this allows us to do that.

[00:39:42] Nathan Wrigley: It’s so interesting in open source software spaces as opposed to corporate spaces. I suppose the metric of success for anything like this in the corporate universe would be how many people showed up and gave us money in exchange for this knowledge or, you know, something akin to that. Basically a metric of humans in a room and money gained. And of course, the measurement of this is so not that.

I did wonder, Destiny obviously very proudly rattled off the statistics for Campus Connect, you know, the five and a half thousand attendees and all of that. I wondered if there were success criteria of some kind in the background, which guide you. You know, it’s not like, okay, well we didn’t meet that we’re going to abandon it all. But more, things like you would like to see happen, so aspirational goals. It sounds from what Maciej was saying that maybe the attendance growing slowly over time is some kind of measure of success. Maybe there is none of that, but I’ll just open that one up to see if you want to take that.

[00:40:38] Destiny Kanno: I think one definite measure of success is repeat events on certain campuses. So if the campus is saying, we love that, please come back, or please come again soon. I think that is a really great indicator that, not only did the students get something great out of it, but the school believes in it. And that’s what we want to do. We want to create these systems that, not only bring people into WordPress, but also continue this cycle of, you know, growth within the community, but also ownership by the institution.

Another measurement of success is the institution is like, okay, great, how do we learn how to do that ourselves? So we have some folks now working in the institution that are organising WordPress Campus Connect events that are helping facilitate these Student Clubs. So the faculty and educators themselves, they’re directly getting involved. And that for us as community members too, whose volunteer time is quite limited, as Maciej was saying, like it is a great multiplier that makes everything much more sustainable.

[00:41:45] Maciej Pilarski: So from the WordPress Credits perspective, we don’t hope all the students to turn into contributors. That would be amazing but that might not happen. I can share with you some numbers. So currently we have 450 students globally enrolled. For the whole program so far, 75 graduates.

We hope that some or as many as possible of those graduates who completed the program will stay and become active contributors to the WordPress community, stay engaged.

That’s one of the goals we are aiming for the Credits Program, to not just get this done, but this is building the next generation of contributors. We know that like we are ageing, we’re getting older every year. We are not getting younger, unfortunately. Getting those students staying in the community allows us to build those next generations of WordPress contributors that will also have completely different perspectives to how the community functions, how it was built.

What brought us here might not move us forward. So these new students will bring us this new, fresh perspective of how they would like the community to function and move it to the future, to be current, to stay up to date with what’s happening globally.

[00:43:00] Anand Upadhyay: That’s why it’s very difficult to like measure the impact in numbers because how it is impacting in the longer term. But yeah, it’s going to impact. And I would say also, like Destiny mentioned, one of the metrics is like this campus is willing to have the Campus Connect again and again in the campus.

So I just want to share one more. Like I just recently got a call from one of the faculty coordinators from one of the campus where we have a Student Club. And now they have like two months of vacations. And he called me like, okay, now the vacations are going on, students will not be here, so what can we do for the students to keep their involvement with the WordPress in those two months? So can we do something online? Can we do something like this?

When we get these calls, these kind of communications, that these are interactions that we have, this gives us a sense of like accomplishment. Okay, yeah, we were able to create some kind of interest in the students. Because we cannot expect that if we are going to like any campus and 100 or 200 students are participating in our Campus Connect, they are all going to jump into the WordPress. They are getting a lot of different kind of opportunities as well.

There are other technologies as well, which are, some students are going into that, some students are going into that. But we are showcasing the WordPress as one of the career opportunities. And they have a choice of multiple options, so they will choose what they do. But yeah, the impact will be seen in the next few years. Just like Maciej said, mentioned that he went to the WordCamp as a volunteer and it’s bring him into the community.

And the same is with me. I attended the WordCamp and just after coming out of the WordCamp, I started the Meetup group in my city. So I got inspired from that. So that is a result of that WordCamp. And that cannot be measured in the numbers. That can only be sensed when we are doing this kind of conversation. Okay, that WordCamp helped me, that WordCamp helped me.

The same way in future, these students who will join the community or the WordPress industry, they will be talking about, okay, I got first introduced about WordPress through a WordPress Campus Connect event or I got introduced to the contribution through WP Credits Program. So when these conversation will be happening in the future, then we will say that those are the real metrics that we are looking for.

[00:45:00] Nathan Wrigley: That’s really interesting, and I like that. It sounds like there’s not so much a focus on statistics, you know, literal, brutal numbers, more kind of playing it forwards and measuring the impact over many years, not, you know, a handful of months into the future.

[00:45:15] Destiny Kanno: So yes, we’re not like, okay, here’s our KPIs, you know, and here’s our hard metrics. But one thing I really noticed that our community is, it could be better at doing, is just talking about what happened. Because then you hear all these success stories and there are numbers in that. So like for example, Ajmer again, Women’s Day event this year. 50% of tickets sold were to students. And that’s directly because of the involvement in going to these campuses and teaching WordPress. And I’m like, that’s amazing, that’s direct injection of 50% youth into the WordPress community.

[00:45:52] Anand Upadhyay: And they sold out so fast.

[00:45:53] Destiny Kanno: And they sold out really fast, yeah.

[00:45:55] Anand Upadhyay: The organisers were hoping like, now we have to pitch out to sale our tickets. And they have planned a social media campaign around that. Okay, we will be periodically pitch a student on the social media to encourage the ticket purchase. And within one day, we sold out. And the whole social media campaign was like their whole planning was gone. We don’t have tickets.

[00:46:14] Nathan Wrigley: It’s really interesting that there’s all this success going on, and yet, as Destiny said, it is hard to get that discovered. Maybe it’s a case of shouting louder about the previous success. Maybe things like this podcast will help in some small way for things like that.

But I know what you mean. There’s a lot of people talking about the code, and there’s a lot of people talking about the plugins and the themes and whether or not we’re going to get collaborative editing in version 7 or 7.1. All of that seems to suck up all of the oxygen in the room. And yet, without a throughput of, let’s go for young adults, coming into the WordPress space, there’s not really a great deal of hope for a project over decades unless we get people of a much younger age beginning now. And I’ll just hand the torch to Maciej because I think he’s got something to add.

[00:47:05] Maciej Pilarski: But this is also changing because at WordCamp Asia, we were able to introduce the educational table during the contributor day. And I’m also organiser of WordCamp Europe that’s going to happen really soon in two, three weeks, beginning of June. And during WordCamp Europe, we will also have a contributor table, dedicated to education, but for the first time also educational track.

During the second day, we will start the whole day with topics related to education. We will have a discussion panel rethinking learning in WordPress that Mary will be participating. And later in that afternoon, we will have actual students, who take part in the program. Sharing the experience, presenting the results. Not only students from universities, but I’m also leading a group of high school students who’ve been working for the whole past semester with a teacher on some projects related to WordPress building websites. So they are super eager and excited to show them.

We will also showcase some students, teachers stories, how both of those sites motivated each other, learn from each other, and basically help us keep growing the community.

So WordCamp Europe definitely will feature some of those things. And we’re slowly introducing more and more those things into those flagship events and into the broader community.

[00:48:28] Nathan Wrigley: Really nice. Yeah, that’s really nice to hear. I think it’s a difficult circle to square, the idea of making this stuff visible so that everybody’s aware of it. Even if they’re only interested in running their agency, or writing code or whatever it is. Maybe to realise that this is some version of the underpinnings of the WordPress community without which the software ultimately doesn’t exist.

And it is quite curious. I don’t know if I’m reading between the lines here, I think I’m not, but I get the impression that, I’m going to use the phrase like, I don’t know, from higher up, let’s put it that way. It feels like education is taking a more central place. It feels like for example, Mary Hubbard, it feels like you’ve got a real advocate there. Again, I could be reading between the lines, but it feels like the words coming out of her mouth, I hear the word education coming out of her mouth quite a lot when she’s on stage.

So it feels like you’ve got some big hitters, let’s go with that. I don’t know if you’ve got anything you want to add to that, but it feels like the importance of this is more profound this year than it was a few years ago.

[00:49:33] Maciej Pilarski: You are correct. Mary is a big supporter of that and she also created this space for us to grow those initiatives that like allows us to grow that. Isotta started the first Credits Program at the Pisa University as an experiment. And from there it was proven that this actually works. It gets us universities and new contributors.

And then on the other side, there was those Campus Connect events that also organically grew up on their own. So basically there was a need. It feels like there was this hive mind somehow that worked also for all of us. All of us felt this need to introduce those things. It looks like we’ve reached a certain growth level for the community that we organically felt that that’s the direction that we should start heading.

[00:50:24] Nathan Wrigley: Yeah. What’s interesting there as well is that it very much overlaps with maybe a concern. So we’ve touched on this at various points without saying it out loud quite. If you go to, and I’m going to exclude WordCamp Asia 2026 from what I’m about to say, because that event was very different. If you go to a typical WordCamp, the age skews, and I’m doing air quotes, older. You don’t typically look around and see a bunch of teenagers.

So that’s a concern. There’s this, like a pyramid, like a reverse pyramid, and if we don’t get the younger people coming up, the edifice of this entire project kind of becomes a lot more shaky. And we’ve lived through 22 plus years of WordPress, and I think quite a lot of those people began, a lot of the people who’ve been involved in the community began their careers using WordPress and they’ve kind of moved through WordPress as it’s evolved over those 22 years.

And not to, I don’t know quite how to say this. At some point they’re going to stop contributing. Their age will become something, you know, they want to retire or they want to move on or do some other things. Unless we build the scaffolding and put things in place so that young people feel they’ve got a place here, feel that, I don’t know, some proprietary system is not the way they want to go, they want to support the ethic of open source.

Unless these building blocks, these educational building blocks are put in place, then that’s going to be a bit of a concern. So to your point, Maciej, it organically grew. And what a nice thing that it did kind of organically grow because it’s sorely needed at the same time. There isn’t really a question in there. But anyway, there’s my observation. Anand, did you have something to say? I think you did.

[00:52:04] Anand Upadhyay: Yeah. So just want to add that thing you have raised recently. So the way that we want to teach the students about the open source as well, because if you go to the WP Credit curriculum, so the initial lessons, they learn through the, given to them to learn from the learn.wordpress. So it’s all about like open source ethics, and how the WordPress community, WordPress project works.

So this opens up their mind about the open source. Because in the education system, it is something that is not clearly mentioned. There are simple, just simple definitions around the open source. But open source is much more than those definitions.

And especially the open source community like WordPress. It’s more about the people. So the students also learn about how the community is working, how the people are working from the different time zones, people are joining hands for running the bigger events like WordCamp Asia or these Credits Programs. The students will learn all those things as well, and I’m sure when they will join as a contributor in the future, they will have lot of experience before joining as well.

[00:53:02] Nathan Wrigley: Thank you. I love that expression, by the way. You just dropped it in in the middle of a sentence there. You said people are joining hands. What a perfect summation of the entire enterprise being discussed today. Maciej, you raised your hand.

[00:53:14] Maciej Pilarski: Yeah, and besides the community goals and keeping it going, I have also a very personal goal that also is behind all of those things that I do. From my own experience, I had a pretty difficult and bumpy educational path, let’s call it. Unlocking those possibilities for those students, helping them out, making it easier for them, it’s one of my very personal goals, because I know it does not need to be very difficult or crazy when you study, especially when you are young. You’re not sure fully which direction you would like to go. So creating for them, one of those opportunities that might click for them is also something very personal and close to my heart. Because not everyone needs to struggle or have like difficulties, so.

[00:53:58] Nathan Wrigley: I am so glad you said that because that encapsulates all of it. That’s the entire point. It’s got to be that, right? So we’ve spent a long time talking about the minutiae of this, that, and the other thing. It all goes, like they’re spokes on a wheel. And the whole point is that little bit in the middle, which is the child, the adult, the human being somewhere who just wants to make use, wants to grow, wants to learn things, wants to figure things out.

With open source, with this kind of learning, there is potentially zero impediment, or at least very few impediments to actually get that learning underway. And so I think maybe we lost sight of that in this conversation a little bit. So I’m glad that you grounded it there, Maciej, right towards the end. That’s perfect. Destiny, was there anything you wanted to say? I don’t know if you were indicating that you did.

[00:54:48] Destiny Kanno: I know we’re like probably over time, but there’s still so much to share. Like even thinking about keeping WordPress relevant, right? For us and then also for youth. I think about the new AI Leaders Credential that was announced and is being worked on. And how tying WordPress to AI is like really helping students engage more, and see like the relevancy of it in a different way. Not even for the students, like for me, that’s challenging me and I think other organisers and learners of WordPress to be adaptable and think about WordPress differently in a new way of this year as AI keeps advancing.

And then you were also talking about wins, right? How do we celebrate that? I did want to surface, we have the Education Buzz Report, which goes out every month, which aims to try to surface all of these educational wins that are happening in the community. And I just have received some further collaboration from marketing to hopefully also broadcast that on our socials going forward so that we do get the word out.

And lastly, like celebrating the students too. There was a post that went out about the Student Clubs and the success. And we just want to make sure that in this, that they feel seen, right? And that this feels like a space for them. And I know WordPress Credits, we’re working on something to showcase, no, something went out recently. A post went out recently to showcase some of the successes of the students. And we just want to keep highlighting that as well. Because their work and the way they operate, especially because they’re coming in with different lenses, is really important to showcase and highlight and make sure that they feel like they deserve that.

[00:56:26] Nathan Wrigley: Yeah, there was a post, I’ll try and link to it. I think it was like a week ago about the Student Clubs. There were three or four images, three or four photos and there were so many smiling faces in those pictures. It was absolutely lovely. Lots of people gathered in classrooms. I couldn’t exactly tell where, but it was just so nice seeing people kind of enjoying WordPress, having a nice time, bit of camaraderie, hanging out with each other, learning things. It was absolutely wonderful.

Unfortunately, I think time might have got the better of us. Hopefully, dear listener, what you’ve gained is an understanding that there’s so many layers to this educational initiative. It doesn’t appear to be in any way standing still. It’s growing. It’s interesting. There’s a lot going on, and you can be involved.

I will put links in the show notes to any of the places where I feel you would be best making a start with that. Maybe the contributors to this panel can drop some things, you know, if they’ve got a particular link. So again, wptavern.com. If you want to go over there, we will look for the links.

This giant edifice that you maybe know nothing about, and maybe at the end of this episode, some parts of you is tuned in and thinking, I would like to be involved in that. And the truth is, you can be. It’s all available to you to get involved and you could start today.

So there we go. With that said, I’m just going to say a great big thank you to Destiny, to Anand, and to Maciej. It kinds of feels like we need to come back. Let’s do it again in six months or so, and we’ll see where we’re at. Oh, I’ve got a lot of nodding faces. That’s nice. So maybe we’ll revisit this in a few months time.

But seriously, from the bottom of my heart, Destiny, Anand and Maciej, profound respect to you and all of the different things that you are doing. Thank you so much for chatting to me today.

[00:58:13] Anand Upadhyay: Thank you.

[00:58:13] Maciej Pilarski: Thank you.

[00:58:14] Destiny Kanno: Thank you.

Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case using AI everywhere at rtCamp.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you or your idea featured on the show. Head to wptavern.com/contact/jukebox? And use the form there.

So on the podcast today we have Rahul Bansal. Rahul has a long and accomplished history in the WordPress ecosystem. As the founder and CEO of rtCamp, a company he started 17 years ago, he’s led his agency through the rapidly changing landscape of the web, helping enterprise clients such as Google, Fortune 500 companies, and major publishers solve complex problems with innovative WordPress based solutions.

rtCamp specialises in everything from large scale website builds, to more bespoke projects like Chrome extensions and SaaS connectors, and has grown to a team of hundreds over the years.

Today’s episode takes a deep dive into Raul’s recent talk at WordCamp Asia, which focused on what it will take to launch and scale an enterprise WordPress agency in the future.

The conversation focused on real, hard won, lessons from rtCamp’s journey, but also how rapidly the playbook is changing with advances in technology, particularly the explosion of AI tools and workflows.

We discuss Rahul’s philosophy around hiring, namely building a team of people whose strengths complement each other rather than just replicating your own skillset. This approach has allowed rtCamp to adapt to new challenges, fill gaps in expertise, and whether major industry changes.

We then explore how this idea of complimentary sets can also apply to choosing the right kinds of clients, those who value your expertise because they need what you offer, rather than simply hiring somebody who does what they already know.

A theme that emerged in the conversation was specialisation. Rahul outlines how, whereas rtCamp’s earliest differentiator was a simple focus on WordPress, when virtually nobody else in India was, today’s agencies must drill down much further to stand out choosing niches within niches, such as WooCommerce, or payment gateway integrations, and becoming recognised experts in those areas in order to thrive in a much more crowded field.

Towards the end of the episode, the discussion turns to what might be the most significant topic for agencies today, artificial intelligence. Rahul describes how recent advances in AI have not only altered his agency’s practises, but given them a firm mandate. If something in rtCamp can be done by AI it will be.

We talk about how AI is being leveraged inside rtCamp to automate and optimise everything from sales and proposal writing to project management, and even technical proof of concept builds. With a unified platform for all business processes, the agency is now able to significantly reduce costs, speed up delivery, and focus on higher value consulting and creativity, reshaping roles and team composition as a result.

If you’re interested in what it takes to stand out and succeed in the evolving world of enterprise WordPress agencies, how to confront uncertainty with both optimism and realism, and how AI can become not just a bolt-on feature, but the operational backbone of your business, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Rahul Bansal.

I am joined on the podcast by Rahul Bansal. Hello, Rahul.

Rahul Bansal: Hello Nathan. Thanks for having me here.

Nathan Wrigley: You are very welcome. Rahul and I were both at WordCamp Asia and that is going to be the main focus of the podcast today. We’re going to be talking about agencies, growth in agencies, and then probably delving into AI a little bit at the end because of a recent announcement that came out of rtCamp, which is the company that Rahul founded many years ago.

In order to, I suppose, lend credibility to a conversation about agency work, would you mind Rahul, just introducing yourself and tell us a little bit about who you are, what you do in WordPress, and maybe give us a few little interesting facts about rtCamp and what you do over there.

Rahul Bansal: So I’m, as you mentioned, founder and CEO of rtCamp. We started this 17 years ago. We primarily help large enterprise client, sometimes we build websites for their marketing team, which is the most common use case of WordPress. But at the same time, we help large tech companies like Google communicate better with the WordPress ecosystem for their offering. Like sometimes we build products that includes neither thing, neither plugin, but something like Chrome extension. For large companies sometimes we build like SaaS connectors for technology companies.

Yeah, so we work with, like a big companies really Fortune 500, and the idea is to deliver something related to WordPress in one form or another form.

Nathan Wrigley: If you go to the rtCamp website, you can probably Google it I would’ve imagined, then you’ll be able to get some impression of what the company is like.

I think last time we spoke you were into the sort of 200 employees level. I’m not sure if those numbers have gone up or down or what have you. But you get an impression of how large it is. And one of the interesting things that I spotted during my time at WordCamp Asia was just how vibrant the community, the WordPress community is. So maybe we’ll get into that a little bit as well.

I’m going to concentrate to begin with on the presentation that you gave at WordCamp Asia. If you would like to see that, wordpress.tv will have a video. And if the video is already available, I will link to it in the show notes. But the presentation that Rahul gave was entitled, how to Start an Enterprise WordPress Agency in 2026. And I’ll just read the blurb that goes with it because it was fairly short and easy to manage.

Building a WordPress agency business for large enterprises. In this talk, I’ll share the story of how rtCamp grew from a small WordPress shop into a globally recognised enterprise agency, trusted by Fortune 500 companies and major publishers. If you’re starting an agency today or looking to move up market in 2026, this session will give you a realistic roadmap building on real lessons from my personal experience.

So I suppose what I’m going to do at the beginning, Rahul, if it’s all right with you, is just ask you to tell us some of the bits and pieces that you mentioned during that. Some of the advice that you would give an agency owner beginning in 2026.

Rahul Bansal: Yeah. So first, like I deviated a little bit from the blurb because when I applied this talk I had a different frame of mind that, hey, I’m going to do this. And then as I was preparing the talk, and in during those months, especially like last few months, the AI has reshaped everything. And then I realised that a lot of what worked for rtCamp won’t work even for rtCamp if I start again today.

Rather than making it as a nice story about what worked for us, I lean more towards practical advice, and that’s where the essence remained. But I focus more on the 2026 part, because when we started, it was 2006. The first time when I used WordPress was 2006. rtCamp started in 2009. 20 years is a big time. And then at the end of this 20th year, like we are going through this AI led change.

So a lot of things that worked for me won’t work anymore. And that is how I restructured my talk to take enough from our history, enough from our learnings, what worked for us.

The way we hire is very different. And after the talk, if that one line that stick with the audience, that many people told me that the hire your complementary set was the most different idea. And it’s timeless idea. It’s relevant in AI world also.

So the idea was basically that we have this bias that when we try to scale, like basically when we go from freelancing to agency business, the idea of building a business, we try to find people like us. But my idea was that we should initially, especially, we should find people who are opposite of us. Like I was good at engineering, bad at sales, so my co-founder is sales heavy. My English was not good. His English was very polished.

So I literally listed down my weakness and found people who were opposite of me. Even interesting part was that, to the few initial hires I asked the questions, whose answer I had no idea whether they’re saying right or wrong.

So that was the most interesting idea and I think that’s still relevant today. I will do exactly same thing if I have to start building a new agency. I will build in WordPress, build in AI, any kind of business I will, my initial few hires will all together will cover each other’s weaknesses.

It’s at certain scale then you need to replicate, like, you need 50 engineers, you need 20 React engineers, you need five people who can write same proposal. That comes much later. But starting is all about finding your complementary set. And this was inspired by a set theory from math class that I attended in when I was like some 12-year-old. That stuck around before the life. And that is what I put in this talk as a biggest lesson we learned and that worked.

The second most specific thing that I would say, practical advice, like that was more about hiring advice, but that is not only hiring address, that is, I advise in many walks of life applicable.

When you’re looking for your client, you have to look for complimentary set there as well. Because you are trying to sell to agencies like yours, your margins gets hit a lot. You need to find people who do not understand WordPress at all because then, that is why your expertise become more important and premium for them, because they need to depend on you. They value you more. You are not commoditised for them.

So that hiring your complementary set works across the board. But then the most specific advice I gave that I didn’t follow myself, I would say. Actually there was nothing to follow that. When I started WordPress was just a blogging platform. There was custom post type were not yet part of WordPress Core. Everybody was just building blogs. We were playing around themes, and the race was to make our blog look unique. The metric usually was like traffic and how many email subscribers you got.

So there was no niche to pick. Like, that was the only thing WordPress was doing. And after post type, people started building a lot more than WordPress. Actually people started pushing WordPress earlier, and as a result of that, WordPress created those APIs to make it easy to extend WordPress beyond blogging platform.

But today, in 2026, there is so many things happening. And if you’re starting new and you do what rtCamp did on day one, like, hey, we are WordPress agency. That is not going to work.

It worked for us 20 years back because we were like, probably only one in India at that time who said at that time that we will be only taking WordPress project. Because India was a land of outsourcing. Like in supply chain, it was like a, it’s like a Chinese manufacturer saying that, hey, we are only going to assemble if you are building for iPhone. So it’s like, hey, we are only going to write PHP if it is going to end up as a WordPress theme or plugin. We are not going to do what was Cake PHP project at that time. We are not going to write custom PHP script.

So in a way we picked the whole WordPress as a niche among the largest set of choices available to us. But if your largest set of choices was building a iOS company, like mobile app company. Mobile app was big because with the introduction of iPhone, there was a sudden shift and huge demand for iOS apps, and we haven’t built one till 17 years. Like literally we built our first iOS app, public iOS app last month.

That time we were like, well, we are going to only do WordPress. So now that advice translate into, pick a niche within WordPress because WordPress itself is the web now. That time, WordPress was very small. Now you can choose e-commerce. Within e-commerce then you can probably pick WooCommerce. Within WooCommerce then probably you can pick like, depending on your market, payment gateway specialisation, ERPs, back office specialisation, subscription based businesses.

Start by picking a niche as small as possible and then go bottoms up, rather than starting with everything. So that was the key takeaway of my session, I would say that. Pick a niche, position yourself as a expert in the niche. Don’t just say that, hey, we build WooCommerce store, or we build WordPress site.

Nathan Wrigley: Okay. Yeah, I’ve got all of that. So firstly, hiring. That’s an interesting one. Hire people that are different from you. I was imagining when you were saying that, I wonder how long you can do that, because you can’t, eventually, you have a company of a hundred people and all of them are not the same as you. Eventually it must be nice to find somebody who’s a little bit like you.

But then also you mentioned picking clients who will trust your expertise, I think is a good way of describing that. Because they themselves are perhaps not expert within that WordPress platform.

And now of course, moving forwards, what worked for you in terms of being a WordPress agency 17 odd years ago, that was, as it turns out, really successful. But now you are going to be amongst tens of thousands in India alone, if all you say is that you are a WordPress agency. So you need to go a little bit more specialised and niche down.

I wonder, Rahul, with the benefit of hindsight, it’s always easy to look back and sort of see for example, from my perspective, I see rtCamp as an entirely successful enterprise. You know, you began all those years ago, and decisions were made and you grew and you grew and you grew and you grew, and now we are where you are now. Committing a lot to WordPress with incredible growth and a really amazing agency on your hands.

But I’m just wondering, looking back, with the benefit of hindsight, were there any moments where you made some decisions where you were very nervous about how it was going to be?

So for example, one of those could be WordPress. There was no writing on the wall that said WordPress will be the successful CMS. That really could have gone either way. It could have been Drupal, it could have been something that some kid in a basement created. So I’m just wondering, are there moments when you look back and you think to yourself, gosh, I am so glad that we did that random choice than all the others that we could have made?

Rahul Bansal: Yep. So it’s a reality that, one of the co-founders we lost, within the first year of company formation was because, I refused to add Joomla to our offering. And Joomla I think was market leader at that time when we started. So we were like more like engineers, like some were good at sales, some were good at communication, but we were all from the same kind of school, like we didn’t know if there was any survey existed.

So we didn’t back by any data. The only reason we chose to stay with WordPress or build this agency with WordPress because we were using WordPress. So rtCamp for the most part, people missed that. So rtCamp was not started as an agency. rtCamp was basically a media company, a blog network. And that blog network was running on WordPress. As a technology blogger. It’s like just imagine WP Beginners, like that is more relevant example.

So by the way, we, and WP Beginner were operating at the same time, that’s the power of niche. Like say I chose to focus on WordPress and say very very well. And my technical blog was everything like from iPhone to Windows operating system to Mac OS update to web APIs, to HTTP2. Whatever, like it was a larger technology blog So we were more like a stripped down version of TechCrunch rather than picking a niche. And Syed picked this WordPress as a niche.

Both were contemporaries in that same era. Now just imagine Syed in those days I started an agency. So we were using WordPress, we needed to stand out because, social network or blogging or web was still a fancy place. Like minimalism wasn’t the trend. It was how much you can push, like how you can make your website look different without using Flash. That was the coolest thing. Like how much you can push jQuery, how advanced CSS you can write. So all those things led to we customising our WordPress a lot.

Another thing that worked in our part was, our blog was one of the biggest in India. Globally also, it had good traffic. In fact, it had so much traffic that one of the most Googled keyword in my name was Rahul Bansal, how much money this guy make. Like that was the first question I used to get asked because traffic was insane. We used to get a lot of traffic.

That led us to writing nice WordPress code. In early days, like especially when I was freelancer, I had to write amazing WordPress code that will scale and host it in a way that it will also scale. So not only WordPress, we choose Nginx before it become a norm. Like before there was. anybody started any WordPress managed hosting company. We managed to scale WordPress at a very high level.

And so now we, are this famous blog running on WordPress handling so much traffic, on Linode’s $10 something plan. Customising it. So we got this natural market. We got initial customers were technically our competitors, like other tech bloggers. It’s like TechCrunch hiring Mashable to customise their blog So something like, because Mashable has a tech team. So that was at early story of rtCamp.

And then we realised that we are making more money and faster money via customising WordPress. So we started cutting down on our editorials. And then, slowly, slowly like the business has shifted from, being a blogging agency, to WordPress custom development agency. That’s why we chose WordPress.

And that has been the principle since then, like we only sell what we use. That was the reason we didn’t, so it wasn’t any ideological decision. So the ideology is at open source level. So rtCamp is committed to providing open source solution to its client from day one.

Joomla tick that box. But Joomla didn’t tick the box that we use Joomla. We don’t use Joomla. There was no reason for us to have our blog running on WordPress and website running on Joomla, and that’s why we stick around WordPress when there was no data, no trend. And I think in hindsight it was just luck. I would say like it could have backfired.

Nathan Wrigley: Well, okay, I really like this story. Firstly, I like the fact that you are identifying luck as a component, because I think too often when you listen to people who have had success, they sort of chart this narrative of how brilliant the decisions were along the journey and how impeccable, you know, we did this and then we did this, and then we did this, and then we did this. But never a nod to luck.

And of course, with the benefit of hindsight, we did this, we did this, we did this does lead to where you are now. But I really enjoy it when founders and people have that confession in them. Yeah, there was a bit of luck.

But also, and we’ll get onto this in a minute, because a big part of what you are about to do, or have recently done with your business kind of leans into what you’ve just been saying.

It sounds like you were led by what was in front of you, if you know what I mean? It doesn’t sound like there was a great big, okay, by 2016 or 2026, we want to be here. It was more like, okay, this is where we’re at now. These are the things that are coming to us. Okay, looks like WordPress, not only are we using it, but it looks like people want us to help them to use it. Well, let’s go there then. Let’s put the blogging to one side and let’s become more of a, I don’t know, a technical helper for you and your website.

So there’s this sort of lucky piece, but also the willingness to steer into favourable winds, if you know what I mean? I love that story. Thank you very much for that. I also admire your humility in all of that. That’s lovely.

So the next thing then, I suppose that I want to get into is some change in the landscape at the moment. And again, this maps to what you were just saying about move where the wind takes you. We all know that AI is a thing. You cannot have missed that. But I think a lot of people are taking nervous steps into their business and how they’re doing things with AI and maybe biting off a little bit here with AI and leaving the rest as it is, and biting off another chunk here, and leaving the rest as it is and slowly moving into AI.

You have a very different approach. And I will link in the show notes to a blog post on the rtCamp website, which I read several weeks ago. I’ve got to say, I was a little bit, not surprised, that’s the wrong word, but it was written in such a way that I thought, gosh, now that’s interesting.

Because in it you painted the case that rtCamp in the future is going to do AI everywhere. And I know we hear that all the time. You know, we’re going to use AI here, and we’re going to use AI there. You have painted your colours on the mast, and literally, I think you said, if it can be done with AI, it will be done with AI. There will be no stone left unturned.

Okay. Firstly, why? Why have you got that approach? What’s the reason? Now, I’m sure it’s fairly obvious, but lay it out for us anyway.

Rahul Bansal: Yeah. So I don’t know from where it comes, anytime I see things going south across industry like COVID or, like AI, like everybody was gloomy, my brain kind of think of opposite. So in my brain, I’m not building, I’m actually imagining an AI only agency with humans required to probably feel capture. That’s how my brain works. So it’s like AI first.

Then again, like WordPress, so I have been lucky more than once in my life. So before this AI came, this famous saying by Steve Jobs like you can only connect the dots looking backward. Three to four years ago, riding on the digital boom, we survived the COVID, like all agencies grew. rtCamp grew a lot more, and a lot faster in very short span of time. And to manage this humongous workforce, we needed to refactor a lot internal tooling, softwares, processes, to the point that we have internally codified our mission that we want to build McDonald’s of consulting business, inspired by that movie Founder. That was also part of my talk at WorkCamp Asia.

And in fact, I had somebody to literally a complimentary set example. I know we want to build this, but I don’t have that kind of mental model. So that’s the brief I give to our chief delivery officer that you have to give me this. McDonald’s of agency business.

We start thinking of every process that we can repeat, and we realised that we need to take control of our software stack. And we ended up finding something, in open source. That’s, I would say truly a spiritually aligned to the WordPress ecosystem called Frappe ERPNext, which handle our accounting, payroll, project management, CRM. So many business processes in one single source of truth, like single source of truth for so many things. Earlier it was all siloed data.

So this was started with a different intent, to scale rtCamp, 2000 people, 5,000 people, 10,000 people, because that was a business model then. Agencies growth with capacity. You want to sell more, you need to hire more. Basically agencies growth was limited by on one dimension, the inventory, human inventory you can have. So we started implementing this open source back office software automation with the idea that we will own, central piece of our operating system of connecting, getting thousands of people working together.

Then AI happened, and then we realised we don’t need to hire those many people anymore. Year on year, we moved from 200 to 250, but I think next 50 will be very slow. Because, now we are no longer aiming to sell, or hire people. But as luck would’ve been, we ended up creating this system of record, which is unified and cleaned. When we think of a client or a project or a human. All aspect of their metadata is available in a single system.

So that is why we can leverage AI more than a company, agency to agency. For agencies using say, Jira for project management. QuickBook for accounting, some other software. If their operations is scattered across 6, 7 software, we have leverage over them. Not only we are paying very less because all our software is open source. The data is first party. Like sitting duck there to query in any way we can. We are not limited by SaaS providers, enterprise plan or this AI capability.

So that is where we realised that we can take this huge bet on AI where we can now build a lot more, in a lot less time using AI across the board. And if you look at a business like not just WordPress business, when you buy something, like you buy a car from a car company. You are actually paying for everything that company does, advertising, researching on the EV technologies, hiring a brand ambassador to put billboard, sponsoring F1. Anything that company does. every penny they spend on their business, the customer ends up paying it.

So we thought like now we have a single stack, which technically takes care of 70 to 80% critical nature of our business operations. From when the lead enters the CRM, the project management, time entry, people’s new management, everything is linked. Everything is beautifully linked in a single unified interface and database. So why don’t we just use AI to cut down the cost.

Because now we cannot charge by hours, we can try, but, it’s not making sense anymore for clients. They want us to commit to fix output bid. Now when we say, hey, we can migrate this thing for 100k, or we can build this website for half million dollars. So those numbers, traditionally, and actually all the time will include all the operation cost. Like my salary. I’m not doing any coding work, but my salary will be eventually paid by all the clients. Electricity bill that is also going to be paid by all the client.

So we thought like rather than just thinking AI to build a website, let’s use AI to bring our operational costs dramatically down. Because we have single source of truth for maximum data we have, and that is where we went all AI in. Now it’s like we can submit a proposal in one third of the time.

In old days we used to build PPTs. Now we vibe code a WordPress demo site and attach it to the proposal. Hey is this something that you want? Not just the screenshot, not just the Figma, like we are actually building Playground, like websites, and launching them and sharing those links to the client. Go play with it. We are even trying to copy the design systems if they’re migrating. So migration is a big category of work we do.

So that is what we mean by going AI ready. So we are leveraging AI to reduce the cost of sale, increase probability of winning the project by pitching them something. And then while estimating the effort, like let’s say we would traditionally say, oh, this might cost us a thousand hours. Now we blindly said Make it 30% less, as if it will be done in 700 hours and it will be, sometimes it backfires.

But then on some project it’ll be 500 hours. In some project it’ll be 900 hours, but average will come back to 700 hours. Then again, the idea is we have a central operating system, which gives us, like bird’s eye view of how healthy our projects education are. Are we getting returns on our AI engagement? And all this is possible because few years back we took a bet in different direction.

Like we choose WordPress because we wanted to be a better media agencies, and that was what media agencies were doing in the early days. But we ended up building an agency business with the WordPress. Likewise we choose this Frappe ERPNext software. To operationalise our back office. But now it is starting out to be our advantage point in this areas like we are able to do AI a lot more. In the end, it’s all about bringing the cost down at certain quality. You have to keep the quality up, and just make it more affordable. If that is not. as a business you cannot do that with AI, then something is wrong.

So AI is not about building something new. I have another approach. So if you’re an agency people are hiring you to move things from A to B, like you are the movers and packers of internet. I put crudely, what rtCamp does. We move things, like a shipping company who moves your house, remove you from Sitecore to WordSpace.

And that’s still big part of our business. We don’t have to reinvent or reimagine different experiences all the time. Sometimes we have to just do what everybody’s doing, the boring part. Put AI there to make it efficient, more cost effective. And if you do that, that means more people wanting to shift to new house. Again, a different approach. People think that they need to build something out of the world to benefit from this AI way.

My idea is that pick a boring thing and make it so affordable that people who were sitting on the fence, just imagine travel, Middle East travel. Like this is a very actually a bad example, might sound inhuman, but, say like X number of people wanted to experience Dubai as a destination, but let’s say, it was beyond their budget. For some even unfortunately now suddenly that comes within their budget, they will be able to do that.

People wanted to move to WordPress Initially, agencies were quoting a hundred thousand dollars for that big shift. Now if you can, suddenly you can do it in 50k a lot more people will shift. So, you don’t have to do things like out of the world thing. You don’t have to invent new. You have to sometimes just make existing problem more efficient to solve.

And it was not always about money, especially in large client. It was not always about 100k versus 50k versus half million versus 1 million. It was about timeline. It’s like you are refurbishing your home and it is going to take three month, then it’s a different mental model, like to put up yourself in a hotel or a second home for three months. If a magically a new company appears and hey, we can refurbish your home overnight. You don’t mind checking into hotel for one night. And that is where I feel like this WordPress will be net gain because of AI. Agencies has to be optimistic, and think differently to gain from AI.

Like, what people are doing is everybody’s trying to act like a ChatGPT, OpenAI, it’s their job to invent AI algorithm. We are agency. Our job is to apply AI, not invent AI. We don’t have to think of what is Opus 4.8 will do. Let cloud engineers think of that.

So we need to understand we are AI’s consumers or consultant, and that is where some people are getting it wrong by vibe coding things that they’re not able to sell to anyone. Then they will cry that, hey, six months later they will realise they built stuff nobody bought. Now they don’t have money to pay AI bills, or their developer salaries and then they will try that, hey, AI took over job, AI killed our business. No, think what existing problems we can solve with AI cheaply, efficiently, with better quality. And a lot of work is there to be done.

Nathan Wrigley: There’s a lot in there, but one of the things that I’m taking out is. So prior to AI coming along and demonstrating to us all what it could do, which by the way didn’t kind of happen overnight, although it feels like it did, there was a sort of, a year in which we could suddenly see, oh boy, it’s getting much more performant and much more interesting. But prior to that, it sounds like post COVID, you kind of inspected your business and were thinking, okay, how can we refine everything that we’ve got in the business and how can we put it all into this one system?

And again, with the benefit of hindsight, and I’m maybe going to use the word luck, maybe that’s not the right word. You, having done that work, then meant that when AI did come along, you weren’t trying to link up four or five or six or ten different things. You had this one source of truth. Which meant that you could cut waste, for want of a better word. You know, waste could be measured in terms of dollars or it could be measured in terms of time or it, whatever it may be.

You happened to be in that place because you’d done that preparatory work, not necessarily knowing that AI was going to come along and make all of this fun stuff possible. But with the benefit of hindsight, that’s exactly what it did.

And it’s curious, you said 70 or 80% of the business could be streamlined in that way. And I’m so staggered by that number. I thought you’d be in the kind of, I don’t know, 20, 30% or something like that. But a full 70 to 80%. So does that mean 70 to 80% of the things available, or do you mean that you were able to cut 70 to 80% of the cost or the time? Because I wasn’t sure which 70 or 80% you were meaning.

Rahul Bansal: It meant different things. First like, as I mentioned that we are not thinking AI adds just something to sell, but something to consume first. Because, again, dog fooding principle. We managed to sell WordPress better because we were a blog network. That’s why we could understood publishers better. We got into this Frappe ERPNext consulting because we built our backend with it. Now before we make any promise with AI, we have to be net gainer with the AI. And we believe that our internally, we will be.

So there are two parts, actual cost of building something and the meta cost. Like cost of sale, like the writing proposal. marketing costs, like case studies, going to even preparing for articles. Non build cost is definitely, we are able to bring, I would say it’s already half, but it’ll be, further down. I will give you a very simple example.

Like in early days is when somebody used to submit rtCamps form, inquiry form, a human, would manually check like, Hey, what is the domain name of this email id? Are they on LinkedIn? Some 30 minutes and then they will write a note hey, this looks like a good quality lead. We are fortunate that we get a lot of inbound inquiries, so we had to have prioritise, like which leads we are going to respond first.

Now, as soon as somebody submits a form an AI integration does that, within minutes. And the notes are much more details, it creates action items. Across like WordPress our Frappe CRM, our Slack, everything runs like a clockwork, and we don’t need a human. So that, junior human job is definitely gone. So in sales team, we used to have like this entry level job. That is no longer there. Some jobs are actually going to get vanished. So now going on a call, meeting notes, a lot of those things are getting automated. So the cost of sale has dramatically came down.

What is the effect? Like, say we can now assume flat 10% discount compared to earlier pricing when we are thinking of a migration project. Like, let’s say, in early days, we used to think like hey, anybody wanting to migrate from Adobe Experience Manager? We must assume that they need to pay us 100k. On the initial call, we can say, hey, that would probably cost something like minimum 50,000 dollars.

The minimums, the starting numbers has came down because we need less energy to have those pre-sales conversations. Less number of minutes of ours spent building those demos. Very fast discovery. Data mapping sometimes happens in minutes. In fact we did one 10 days to prepare this migration literally in five days, that was unthinkable. And that included data migration, QA testing, like automation testing where somebody built a bought in panel, which would randomly open a Zendesk ticket and verify that all metadata and deploys are migrated into new health desk system, all within five days.

This is where I have been saying that the cost of building custom solutions will fail. For like so low, like it’s 60, 70, 58. Like definitely more than half. It’ll be reduced by half more. People will buy custom solutions. So agencies are going to grow from here in just these one or two years. Because agencies, to price something upfront, we need consistencies. Like I’m running an airline and if my jet fuel is my biggest cost, and that is out of my control. Then how do I price my tickets? That’s AI hallucination, which is, I would say the jet fuel version of aviation industry.

Something happens in Middle East and fuel prices goes up. A war starts. So now when AI hallucinates so it’s like what we are internally tracking, or what we call as a KPI or internal metric is that, worst case, AI gains, that’s already 20%. Best case is more than 90%. In some cases it’s literally 90%. This range will keep compressing and that’s what I think 70% is my expectation in two years. We will have that maturity that, the build time will fall by 70%. That means. the client companies will hire more agencies to do more work.

WordPress will emerge as a winner, not only for its ecosystem, but its ability to expose structured data without any proprietary walls. AI was so fast that only an open source can keep up with it. In fact, we are seeing more migration inquiries with with the AI boom.

Nathan Wrigley: Oh, interesting. I was going to ask a sort of follow up question. Do you think that you, so you were mentioning, how to describe it, a rising tide carries all boats, or you certainly implied that the pie is getting bigger, if you know what I mean? So you are getting more phone calls, more migrations, more work, and you can obviously do that more affordably. And because you can pass on some of those savings to the clients, the price point lowers and so you get more inquiries because there’s this virtuous cycle of price going down, but quality staying the same or getting better.

I wonder if you, given your success in the past, I wonder if that transition will be easier for you, because the phone is already ringing, than it would be for somebody who was beginning in 2026? Because we all know when you begin, getting the phone to ring is probably the hardest thing. You know, getting those first 5, 10, 15 reliable clients, whatever it is that makes you work.

I wonder if you are in a uniquely good position, having a history of clients, a roster of clients that will come back to you. And also just being famous, for want of a better word, in the WordPress space, for doing the kind of things that you do. I wonder just what your thoughts are on that.

Rahul Bansal: They’re both pros and cons. The only con for rtCamp is that our business model, a big part of what’s traditional like setting our flagship revenue stream for last 8 to 10 years was staffing solutions. We used to provide engineers, sometimes to other agencies, sometimes to publishers. So usually they used to have the leadership layer with them. We were more of executors, and if AI within the IT industry, the first casualty of AI revolution was that people who code, or people who can only code but cannot think. But luckily our hiring was very different.

While it is taking time, so as I said, net headcount addition has been slowed down. I think this is probably first time rtCamp’s career site doesn’t have any engineering opening. If we would’ve been like a publicly listed or like a shareholder owned company, we might have got mandate to fire a hundred people right now, because we have already gained by, so much that, our one third of our WordPress engineers are currently out of work when the work is rising.

Because traditionally, when we needed eight people, now we were able to do in four people. But now we are using this. We have our own challenges, going from one kind of business to another kind of business model. The switch is causing some friction, but we are communicating it openly. We are giving people like more freedom. You give us ideas like which part of the entire business equation you can optimise. Is it editorial experience, is it migration cost? Is it data mapping, visual testing? So people are constantly building.

So change is there. Change is scary. It is scary for us also because we don’t want to fire people. We don’t want to lay off people. We want to return this team. From here onwards, we don’t see we are hiring more engineers for at least a year, because we have enough of them. But, we are so optimistic about this WordPress growth and the pie getting bigger.

We are hiring more sales and marketing team. Two days back I was telling like traditionally, we had this 90 to 10% ratio, like in 200 people, our headcount team, we would have 20 people. That would be, we can call as a sales and marketing department, I think next 50 hires will be only sales and marketing.

Nathan Wrigley: Oh, that’s a big skew, isn’t it? So you’ll go to more like 30% marketing as opposed to 10% marketing.

Rahul Bansal: Yeah sales and marketing. By the way, when we say sales, sales in rtCamp means slightly different. It’s more of a initial consulting, basically making those solid promise, which can be backed by engineering, not over promising. So our sales team needs are more like a WordPress consultant, but we have a category within rtCamp which we call Growth Engineers, who are some of our best coders. But rather than writing code, they go on the first client call and make promises on behalf of WordPress which are practical, feasible, and real.

That is what our internship look like, because coding is race to bottom. Eventually the cost of building will shrink to the point that you don’t need many, you won’t need many traditional developers in any agency. You will need people who can imagine what needs to be built. There might be 20 different ways and which way this project should be executed. That prompt engineering, context in engineering.

So the value is shifting and it’s definitely shifting away from people who can only code. That is why, probably from two years now, we might be at 300 people. Hundred of them will not be coding at all. But they will be prompting AI. They will be building vibe coded prototype in pre-sale stage to gain that customer confidence like early on that day. What you want is possible with the WordPress. It won’t cost that much. It’ll be given you fast enough that your life won’t be disrupted for many months, like your business operations won’t be disrupted for many months, so this is a thing

Nathan Wrigley: Yeah, nobody could deny that we’re in interesting times. I think a lot of people are very confused by what’s going on at the moment. You know, they’re trying to figure out a path. They’re trying to figure out how it affects their business. They’re probably in, I would imagine, quite a lot of cases, quite keen to stick to the ways that they’ve done it in the past. But certainly the picture that you’ve painted over at rtCamp is that you are aligning yourself with a very different future, kind of embracing AI, seeing where it can take you, trying to adapt your business. Being optimistic about it rather than pessimistic. Because I think there is quite a lot of pessimism around there at the moment. But seeing the opportunity and seizing it.

Absolutely fascinating. There was so much to unpack there. I feel like we could talk probably for another nine hours about this because it genuinely is never ending. I would love to prize back the curtain a little bit more. However, time allows only this much. So what an interesting conversation. Thank you very much, Rahul.

Just before we end, could you just tell us where we can find you online, should somebody want to, you know, maybe they’re experiencing a bit of anxiety of their own. Their agency is in a rudderless ship at the moment and they’re trying to figure it out. Where can people get in touch with you best?

Rahul Bansal: I am actually available on all social networks. I use LinkedIn least and email is most level way, I’m a bit old school there. But, yeah, Twitter. I check daily.

Nathan Wrigley: I will link to your bio in the show notes, but also, I will link to the presentation that you gave and any other bits and pieces that we discussed that I can find links for. I will mention those well. So head to wptaven.com, search for the episode with Rahul in it.

Thank you so much for chatting to me, and all I can say is all the best. I hope that all of the intuitions that you have turn out to bear fruit and be fruitful for you.

Thank so much for chatting to me today.

Rahul Bansal: Thank you Nathan.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case, why WordPress events and community matter.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today, we have Cathy Mitchell. Cathy has been working with WordPress since 2007. What began as a fun personal project during her maternity leave soon evolved into a fully fledged business with the launch of WPBarista in 2008. Over the years, Cathy has garnered extensive experience in the WordPress space, and is now working towards the 2026 WordCamp Canada.

The conversation focuses on the powerful role of community within the WordPress ecosystem, something that Cathy is deeply passionate about. We discuss how open, welcoming, and international the WordPress community feels, compared to more traditional corporate or volunteer environments. A theme that emerged was how involvement in WordPress has provided Cathy, and many others, with a sense of belonging and fulfilment, especially after life changes like becoming an empty nester.

The discussion explores the motivations for volunteering and organising within the WordPress community, both from the perspective of newcomers looking for purpose and connection, and business owners assessing the return on investment from contributing or sponsoring events. This includes how easy it is to get involved, the unique lack of barriers and red tape, and the value of altruism and camaraderie.

Other topics we explored with a broader impact of technology and loneliness, the importance of service and community for wellbeing, challenges in sponsorship amid changes economic times, and the vital need to engage the next generation in open source.

If you’re interested in the human side of WordPress, how volunteering shapes both individual and the broader community, and what the future might hold for WordPress events and contributors, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Cathy Mitchell.

I am joined on the podcast by Cathy Mitchell. Hello, Cathy.

[00:03:25] Cathy Mitchell: Hello. Thanks for having me.

[00:03:27] Nathan Wrigley: You are very welcome. Cathy and I have been having, well, 15 minutes or so of chit chat just before we started the podcast. I’ve been learning a little bit about Cathy and we’re going to share all sorts of information.

I think probably broadly we could talk about it as being the WordPress community, which is a subject which is dear to my heart.

However, before we get into that, Cathy, I’ve had an introduction from you over the last few minutes, but would you mind sort of giving us your potted version of that, your shorter version, your bio if you like. Tell us who you are and how come you’re featuring on a WordPress podcast.

[00:03:58] Cathy Mitchell: Well that’s a whole lot of imposter syndrome. Why I am featuring, because you’re kind enough to have me. I’ve been working with WordPress since 2007 and it was just something fun that I did to begin, much like you with podcasting.

And then a couple years in, I told my friends that they’d have to start paying me, or I was going to go back to work, find a real job. This was during my mat leave, and so it kind of just took off from there in 2008, started WPBarista.

And now I’m very interested in the community because I was looking for something to do in the WordPress community last year. Dan in the Canada Slack got a hold of me and said, hey, do you want to help with the WordCamp? And I said, sure. You know, I had time.

And he got me in and brought me right up to like being on the organising team. And it was so fun but so shocking. Like, there is a lot of red tape in the corporate world before they let you do anything meaningful. Like you have to sweep the floors for a whole long time before they let you actually do something you’re good at. So this was remarkable. And this year I find to my surprise, I’m leading the 2026 WordCamp Canada.

So that’s what I’m doing now. And we’re going to focus on community too. So I’m very excited about this topic, both from a corporate, like what do we get out of this? Or are we supposed to get something out of this? And from a personal standpoint, it’s been amazing to meet these people, and to be given a chance. And I found out I’m not the only one. This is like normal, which is bizarre and wonderful.

[00:05:37] Nathan Wrigley: My experience of the WordPress community, so I started in WordPress actually quite a long time after you did. Maybe sort of six or seven years after you began using WordPress. I really didn’t know that there was a community at all. I just downloaded the software and used the software. And then I can’t even remember really how it happened. It might have been through things like Facebook Groups or something like that, where I was trying to learn a particular thing? Or perhaps there was something in the dashboard which indicated that there was an event nearby.

But I found myself, to my own surprise actually, I found myself at a WordPress event in London, WordCamp London, which at the time was going really strong. You know, hundreds and hundreds of people would show up every year.

And I remember purchasing a ticket and getting the train ticket and thinking, what am I doing? What am I possibly hoping to get out of this? And showing up and kind of being a bit like a timid rabbit sitting in the corner a little bit, and then it kind of worked out fairly quickly. Okay, this is all fairly benign. Nobody seems to be all that boastful. Nobody seems to be sort of shoving corporate speech down my throat, or trying to sell me anything unnecessarily.

And during the course of a day or maybe a couple of days, opened up a little bit and got chatting to people. And lo and behold, within a couple of years, a significant proportion of my free time, let’s call it that, outside of the commitments of daily life and family and all of that kind of thing, was taken up with doing WordPressy things in my spare time.

And so I, I don’t know if the story maps the same as you, I’ve shared mine, maybe you’ll share something similar in a moment. The community to me is much more than just, oh, there’s a community there. It genuinely is a seriously important part of my life. To the point where if that was to be sort of whipped away, or somebody like a Thanos type character suddenly clicked their fingers and that disappeared, I don’t know what I would do with myself. I would really have to go out there and find an awful lot of other things to do. Was it a bit like that for you?

[00:07:41] Cathy Mitchell: Not at all. I went to the forums first. And in 2008, 2009, there were some big names nowadays that were just answering us in the support forums. And so I learned from the best of the best, I think. And they would answer my ridiculous questions. I had no idea about PHP. I didn’t even know HTML. I didn’t even know what the internet was, like as broad concept. I asked my husband at the time like, okay, I don’t understand how my computer is talking to someone else’s computer, like you need to draw me a picture.

So anyway, I’ve only recently, I went to a couple of events, but I’ve always had the business mind. If I can’t see an ROI financially, I’ll say, from what I’m doing, then I don’t have time for it. But that was also during a time when I had a young family and then I became a single mum and then I had to work this business. And so it’s only really recently that I’m looking around and seeing people like you and going, this is unique.

I’ve been in volunteer communities, and now that my kids are all grown up, I’m kind of looking for those opportunities. What meaningful thing can I do with my time? And this just seems so unique. Like I volunteered at other places and there’s so much red tape and there’s so much, I don’t know, different feelings than this one. This one’s very open.

[00:09:09] Nathan Wrigley: I think the bit that is so curious to me is you can sort of dip in and dip out of it. Because, I don’t know, let’s say for example, you do something much more local, involved with your hometown or something like that. And you get involved in it and there’s a certain kind of, pressure is the wrong word, I suppose you can dip in and dip out of that as well, but do you know what I mean? You get involved in those philanthropic things locally and you get to know things and it becomes more of a habit, and you do the same thing over and over again. At least that’s my experience.

What I quite like about this is the international flavour of it. The fact that I’m being introduced people from really different parts of the world and cultures. And it’s very, very open, and it’s a real contrast to the bit that you just mentioned, where the corporate bit, and obviously there’s a side of our community which is very much devoted to turning a profit and what have you. But there’s a significant proportion of the people who don’t have that metric in their head when they’re introducing themselves to people.

They are just trying to be helpful and trying to deliver on the promise that the internet gave us back in the 1990s of, here’s the infrastructure to pass information around freely. Wouldn’t it be nice if everybody had the capacity to publish things, or to share things online without some sort of corporate overlord or paywall or algorithm? Which we’ve now probably regret deeply allowing that to happen to the internet.

All of those kind of things come into play. I have constantly, for the last decade, tried to sum up and capture what this is. And I always fail. It simply feels nice, is all that I’ve got, really. This community, the people in it that I hang out with, it just feels like a nice thing to do. That’s all I’ve got. No wisdom beyond that. It’s bizarre, isn’t it?

[00:10:53] Cathy Mitchell: I’ve been trying to quantify it too, and especially planning this next conference. I feel much like a student because there’s a large group, probably most people are not like me. Like they’re like you, at least the ones, in Slack that I’m talking to on a daily basis. And they’re the original nerds who are so happy, like were inspired and spent their free time, like this wasn’t their job. Promoting this and like answering my questions in forum as an absolute noob. So in that way I feel like I would really like to give back now.

But the community, yeah, I can’t quite put my finger on. I just talked to a sponsor yesterday and she is of course wanting to get in front of her audience, which is agency owners. But there’s a real sense of promoting the community because the healthier the community, the healthier all of us are. Not just financially, but it creates the forward momentum, I think as far as open source as a whole too. Like there’s a bunch of us, me included, even though I kind of am taking a corporate angle that really believe that open source could change the world. I still do, maybe even more so because AI is, can actually talk to things that are open source. Less so if everything’s behind a paywall.

[00:12:09] Nathan Wrigley: I think one of the things that you mentioned there, which suddenly sort of struck me is whilst there are a handful of people out there, and I say a handful, there’s obviously many millions of people. I think it’s fair to say that many people prefer to be in proximity to other people, to do things, to be in conversation with people, to have a shared experience. You know, we go to the cinema or the movie theatre to watch a movie. I mean I know the screen’s bigger and everything, but part of it is to be with other people and to go ooh and ah, at the same time and go to firework displays and concerts and things like that.

Now all of that stuff can be done in an isolated environment in your house. You know, you can watch Netflix and you can watch the TV and get a similar kind of experience. But I think there’s some sort of core part of me at least, and the people that I hang out with at these kind of events and online who just enjoy that shared experience, that willingness to be involved in a similar task. Just to be pointing in the same direction as a bunch of other people, pulling together on the same team. And it’s unquantifiable. I literally can’t encapsulate it, but I think you and I are talking about the same thing.

What’s interesting is I accidentally found it fairly early on in my WordPress journey. Serendipity played a really blinding hand for me there. But I think had I not had, bit like that film Sliding Doors, I could easily have missed the cues which sent me to that WordCamp or whatever it was that got me started. And I probably could have gone for a decade or more and not even noticed it was a community and maybe discovered it much more recently.

And it sounds like that’s kind of happening to you. You mentioned that you are, I think in the show notes you described it as, it’s a lovely phrase, empty nesting. Does that mean when your children grow up and go away? Is that what that means?

[00:13:53] Cathy Mitchell: Yeah. That’s a pretty common phrase over here.

[00:13:55] Nathan Wrigley: Oh, okay.

[00:13:56] Cathy Mitchell: This side of the pond. You know, you kick the little birdies out, and they’re spreading their wings. All of a sudden we’re left with, it’s a different life stage. I think we were talking a little bit about it. You’re getting there.

[00:14:08] Nathan Wrigley: I’m going to there very, yeah, awh, it’s kind of filled with melancholy. On the hand, obviously I would love for my children to grow up, but on the other hand it’s, pulls all the heartstrings, doesn’t it?

So you are finding space in your life to do this kind of stuff. I’m going to ask a question, which is maybe a little bit personal, I don’t know. Hope you don’t read it in the wrong way. Do you find this stuff like meaningful and significant? Do you get a sense of fulfilment and satisfaction from the work that you are doing? For example, with WordCamp Canada.

Because there must be moments when it’s a real chore and, you know, you’ve got far too many tasks which are spilling over, and you think, gosh, I’m just a volunteer. There’s no quid pro quo here. I’m just doing it out of the goodness of my heart. But on balance, do you get that warm and fuzzy feeling from doing all of this?

[00:14:54] Cathy Mitchell: That’s a good question. I had time, so I started volunteering at a bunch of things. I started volunteering teaching kids, and then to go the complete other end of the spectrum, I did a seniors class at my local college last month. I just started volunteering because in my opinion, as a little amateur psychologist, I think service, serving our community is kind of the best way to, like you said, pull alongside someone. And then when you have like a focused goal, there’s a togetherness and I really need to grow my community.

Me, and I think quite a few other people, there’s this whole epidemic of loneliness to be frank. Having raised the kids and then having done the job, now all of a sudden it’s like, I have time to invest in a real community. And I really want it to be worthwhile. I don’t want to sweep the floors for, maybe it’s an age thing, I don’t know. I’m so, so grateful that they let me do something that I’m good at, as far as organising, because they didn’t have to. That’s a big responsibility to put on somebody. And I am praying it all works out in the fall.

But it comes because of the huge number of volunteers that all work together. So my job’s just basically pulling all these people together, and making sure that we’re talking to each other. Because one person can’t possibly do all of the work that comes with putting on a conference. At least not part-time. But yeah, I’m finding it immensely rewarding because I also feel like I’m good at it. Everybody loves to do something they’re good at.

[00:16:28] Nathan Wrigley: You mentioned something earlier where you sort of implied that you were very surprised that in the WordPress world, you were given a bunch of responsibility for an event. I mean, basically, I think a lot of that, isn’t there? There’s a lot of, whoever can show up does get the job really, because there’s a paucity of volunteers. And for an event of the magnitude of WordCamp Canada, if you’ve ever been to events like that, you sort of walk in and on every level it feels like a corporate event. You know, it’s very polished, highly polished. There’s catering, the venue’s all been booked, you’ve got name badges and there’s probably some translation going on, and there slides and every, there’s timetables and everything. And it’s all done by volunteers.

And I remember the same sort of thing, being asked to do a variety of different things and thinking, wait, really? You don’t know the inside of my head. I will mess this up so badly. But that is such a nice characteristic of our community. And you’ll fail together, if you know what I mean? You know, it is not like anybody’s going to let you deeply fail. People will step in and help you, should you need to.

[00:17:31] Cathy Mitchell: Yeah, we have to say yes, like it’s part of the culture is, if people volunteer, we have to find a way to say yes. Like our default is yes, not, well, have you done this first?

[00:17:43] Nathan Wrigley: Yeah. It’s interesting because you obviously have done a lot of this kind of corporate stuff, and so have the impression that you ought to be qualified, I don’t know, a decade or two decades of this particular thing in order to be trusted to do it. And this is just, yeah, this is so different. Anybody? Bueller. Okay, you’ll do it. Great. Fine. That’s great, yeah.

[00:18:03] Cathy Mitchell: Yeah. You’re hired.

[00:18:04] Nathan Wrigley: Yeah, that’s it. That’s I’ve never done it before. It doesn’t matter. You’ll be brilliant.

[00:18:07] Cathy Mitchell: We’ll help you.

[00:18:08] Nathan Wrigley: Yeah. And that camaraderie of binding together on a particular thing, in your case WordCamp, but the broader project, you know, the WordPress project as a whole, I feel it’s full of these kind of people. And we will get into in a minute I’m sure, how that maybe has changed for some people in the more recent past, and about the fact that the community does feel like it’s in a bit of a challenging place at the moment.

But I just want to go back a little bit because you mentioned, and neither of us I suspect will have the answer to this, but I’m interested in your intuitions anyway. You mentioned that people nowadays, maybe this has always been the case, but it feels like there’s been a change. Loneliness seems to be a very common thing now. And my sort of back of the napkin calculus points me in the direction of wondering if it is actually oddly technology. The very thing that we’re celebrating. If technology might be responsible for it.

For example, I look around and I see a lot of people who give an awful lot of what would’ve otherwise been free time, time that they could have gone out and socialised and what have you. And, you know, you sort of end up sitting on the couch and scrolling through social media and things like that.

Television has become so absolutely fascinating. You know, there’s like a billion different channels, and essentially there’s a thousand ways to keep yourself entertained all by yourself, and never speak to another human being, or be in proximity to another human being. There’s no question there, I just wondered if you had an observation or a similar thought process.

[00:19:39] Cathy Mitchell: I looked up, because I knew we were going to talk about this, the stat on it. Because I know I’ve had the same feeling. And I’ve heard people talk about it, but I didn’t really know if that was like true or not, because whenever I am thinking or researching something, of course that’s what the algorithm shows me. So I’m always kind of hesitant, like is this actually real or am I just seeing this?

But it did say in a 2021 report, the US Surgeon General, and this is in the States, no 2023, that the health impact of a loneliness epidemic. Okay, General Vivek Murthy declared a loneliness epidemic in 2023. And he said that the health impact is the same as smoking 15 cigarettes a day. It’s not good for us. And that the biggest effect, 79% reported feeling lonely of the 18 to 24-year-old group, which is more like 40 some percent. What was it? 41% of 66 plus.

[00:20:35] Nathan Wrigley: Okay, so the younger you skew, the more lonely you are likely to be.

[00:20:40] Cathy Mitchell: Yeah. And we also see, now I don’t know if this is correlative or causative, but technology has also skyrocketed in that period of time.

[00:20:48] Nathan Wrigley: Yes. Yeah, and also probably, again, I’m drawing conclusions which are not based in fact or research or anything like that. You and I were both born in an era where that technology wasn’t available. So I imagine patterns were set down in our infant brains, which are perhaps different to the patterns that are set down now.

It’d be curious to see if there is a there, there. If the broad adoption, certainly in the UK, I can’t speak to Canada, but the broad adoption of technology to ever and ever younger children, to a really alarmingly early age. You know, you see children who are not even at school age who seem to have access to every technology under the sun, and who don’t seem to get that interaction from another human being. I wonder. And I’m going to sound all curmudgeonly and there’s probably going to be people shouting at me.

[00:21:34] Cathy Mitchell: I have seen it change with the Gen Z that they’re talking about. And my kids fall in that category. Whereas I wanted to be, okay, it’s personal responsibility, so we’re going to raise them. It was new to me, so I raised my kids thinking, okay, tablets, I’m going to teach you how to use it, not restrict it. I was all open-minded about all.

Now they’ve told me that if they have kids, they will restrict it far greater than I ever did. They were like, they won’t have nearly the freedom that I gave them in my open-mindedness.

[00:22:06] Nathan Wrigley: Yeah, well, but you are forgiven for your open-mindedness because I guess humanity perhaps needed more evidence to draw conclusions around that. And perhaps those conclusions are now landing.

[00:22:16] Cathy Mitchell: I think so.

[00:22:16] Nathan Wrigley: Yeah, well, certainly as an example, I know that in Australia more recently, there’s now a widespread ban, I think under the age of 16, and I’m going to use the word illegal, maybe that’s the wrong word. Maybe there’s a technical definition, but social media is not permitted for children under the age of 16. And I think that there’s legislation being talked about in the UK of a similar nature, and some other European countries.

I don’t know how much traction that will have because I feel that there’s a persuasive argument, much like you described of, it’ll all work itself out. You know, we don’t need the government to tell us what to do, and all of that, and that all makes sense.

But my, I can well understand, I think in the UK also, there is a growing, a groundswell of this alternative way of looking at it. Like a rejection of the phones and the technology.

Anyway, there we go. That was an aside. Do you want to contribute into that a little bit more before I push us back in the WordPress space?

[00:23:11] Cathy Mitchell: Yeah, I don’t want to be all, it’s bad, it’s bad, but I think that we’re seeing an effect. I really do believe that volunteerism, whether it’s with WordPress or anything else, in my faith background, being a person, a Christian person, I grew up seeing the service as an answer, as just part of our lifestyle. You just serve others. But now I’m seeing it come in a secular sort of way as well, where service is an antidote to loneliness.

And I think no matter where you’re serving, not the church or any, like just pick a service. Being that cameraderie with people, having a similar goal, going in the same direction, like I really do think there’s hope. There’s hope out there for all of us. And it’s a great way to do something meaningful. Like you get to do all those things. You get to practise a skill, you get to do something meaningful, you get direction, you get cameraderie all by serving.

[00:24:03] Nathan Wrigley: I’m going to, say something now, and I’m going to caveat it heavily before I say it because A, it relies on my prodigiously bad memory, and B, it could just be fabricated anyway because the source could be utterly wrong. But it feels like there’s a kernel of truth in it.

I was doing some research recently about happiness, that broad subject. You know, we would all like to be happy I’m sure. There’s a lot of people who spend a lot of time thinking about what this actually means, and trying to drill it down to some fairly basic maxims, if you like, for what leads to happiness.

Two of the biggest indicators of happiness are really interesting. One of the two is how often you spend with other people basically. How much time you interact with other human beings. Now I know that that’s not for everybody, but broadly speaking, that seems to be a huge indicator. If you actually get yourself out and you do things with other human beings, there is a definite benefit.

And the other one, which is very curious because I think it’s fair to say, you know, Canada and the UK, we’ve been brought up to worry about our own finances and amassing as much stuff as we can, and lining your nest for the future and everything. Well, this other one, controversially, the second one that I’m going to mention is the amount of stuff that you basically give away. And that could be time, or it could be finance, it could be any of those things. The more that you give away with no expectation of a return, that also apparently is a real indicator of happiness.

And I think we can all identify that. That moment where you give somebody a gift and you’ve really thought about it, and you hand it over and you watch the face change as they unwrap it. And you think, they’ve loved that, haven’t they? And you’re not thinking to yourself, well, I did that. I made them happy there. You’re just thinking, oh look, they’re really happy. Isn’t that wonderful? So anyway, there’s my 2 cents of utterly unproven thoughts.

[00:25:59] Cathy Mitchell: Okay. Learned something. Those are two, so the two things were being around people and altruism basically, with nothing expected in return.

[00:26:08] Nathan Wrigley: And funnily enough, they map very closely to what we’re talking about, right? We’re talking about events and socialising with other people, but also that, in this case, it’s not a financial thing that you are giving away, but you are definitely giving away an awful lot of your time for doing these kind of things. And maybe, given that little bit of information, it kind of becomes a little bit easier to justify because if you can say to yourself, this makes me happy, it might not seem it in those stressful moments.

[00:26:36] Cathy Mitchell: Yeah, today.

[00:26:37] Nathan Wrigley: Yeah, that’s right. But ultimately that might be causing your happiness.

Okay, so there we go. That was our little segue. Let’s sort of bring it back to WordCamps. You were very kind to write me a bunch of show notes, and they really drew me in as I was reading them. And I want to sort of dwell on a few of them because you.

[00:26:53] Cathy Mitchell: Had to convince you to get me on the podcast.

[00:26:54] Nathan Wrigley: Yeah, no, there not a lot of convincing needed. I loved it. You’ve got some sort of bullet points if you like, not really bullet points. You’ve touched on different areas where you feel that you’ve got something to say about, I dont know, why people might contribute and why they might volunteer and what have you.

So it’s things like, why might new people, newbies, as you’ve described them, volunteer and why might business folk volunteer?

So the first one was, let me go back. So I’ll read into the record what you wrote because it makes a lot of sense. You said, in 2025 I helped the organisers for WordCamp Canada and this year found myself the lead organiser. And this has been consistently one of the nicest, most open groups, that I’ve ever been part of. And then you strayed into why other people, for example, new people and business people might like to contribute.

So on the business side, you said, volunteers, boundaries when not getting paid, giving back, sponsoring folks, not necessarily a financial return on investment. And then for the newbies, you said, there’s other ways to contribute, for example, contributing in code or non-coding ways, and also just being a recipient of the open, friendly community that you encounter. So that was really it. Maybe I’ve said everything that you wanted to say.

[00:28:07] Cathy Mitchell: Well, those are kind of questions that I had coming from a corporate, and I keep talking to different people trying to figure out, I guess I’m looking for something other than altruism when comes to the corporate people at least. Like why are they sponsoring? And I can see, the pessimistic, or maybe the pragmatic, side of me to be positive wants to know why. Why are they putting the dollars in?

But then on the other side, I think, well, if WordPress doesn’t do well, then they don’t do well. Like, if their businesses are based on WordPress. But then I also saw something that, if you sponsor open source projects, it makes hiring people that much easier, and also vetting people that much easier. Because it gets you into the community and so it goes both ways. People will be more likely to apply for your jobs and you will be more likely to have a way to vet them. That’s one thing I saw.

[00:29:04] Nathan Wrigley: I think there’s a lot of truth in that, or at least I’d like to believe there’s a lot of truth in that. That makes me feel happy about the whole situation. But what’s curious about what you’ve just said, and I don’t know how much of an intuition you’ve got on this, but if you were to go back to, let’s say the year, oh, I don’t know, 2018 or something like that, WordPress was experiencing this really stratospheric growth. You know, in terms of market share of the internet broadly, you know, the number of websites as a percentage, WordPress was going from sort of the low twenties to the mid twenties, high twenties, and then through the thirties, and then finally landing at this sort of 40%.

And during that time, saying this phrase sounds ridiculous because it is ridiculous, WordPress could kind of do no wrong, I think. There was just growth upon growth upon growth and a lot of companies, I don’t think needed to explain themselves to their directors quite so much. The return on the investment didn’t need to be made. It was just, look, we’re part of this thing, and there’s this rising tide, and we are one of the boats. And look, we’re going up as it all goes up. So it just happened.

However, during COVID, and then especially over the last few years, and then now especially the last couple of years, inject AI into the mix, I feel that that calculus has changed a little bit. And there’s this inkling when you speak to the same corporate people who a few years ago were willing to open their wallets to sponsor events, the wallets are much, much harder to open.

Again, in much the same way that I don’t really know why the community is so fabulous. I don’t really know why the wallets are harder to open. But I think the landscape for sponsorship, and the requirement of a return on investment, as opposed to, well let’s just join in because WordPress is growing. I think that calculation is going to be harder and harder to make. And maybe you’ve got experience of this over at WordCamp Canada trying to gather sponsors. Perhaps you found it straightforward. Perhaps it’s been difficult. I don’t really know.

[00:31:08] Cathy Mitchell: There’s almost like a perfect storm right now because wallets are tighter because over the last few years, at least in the States where my clients are, it’s become, economically there’s uncertainty. And so that trickles down and trickles up, right? And so more wallets are going to be a little bit more restrictive on what they’re going to buy, and they’re going to want to see more bang for their buck.

Corporately, also there’s been this huge rise in competition in the corporate world. There’s just way more competition over the last five or six years for just about anything when it comes to agencies or plugins or themes or whatever, there’s a lot more great competition, like good products out there. But then there’s also a lot more competition to get the clients, like clients have a lot more options.

And so I think it’s a perfect storm. Like, do you want to put your money into WordPress because is that the future? Is there money for sponsorship? Plus WordPress has become stricter on what they require to sponsor, as far as trademark use and different things that have been put higher on the priority list.

And I kind of see it like a levelling off. Like not as a bad thing because every industry can’t just, go, go, go, go. Like there’s going to be a levelling, right? Can’t be that easy. When I started, I didn’t even advertise. And I’ve had this business for 19 years. I’ve never advertised. That is going to go away. Like it was just, you know, I lucked out starting somewhere, but that’s not realistic.

[00:32:44] Nathan Wrigley: So what’s interesting in that is I think I am the same. The only period in which I’ve been in the WordPress community was during this stratospheric growth period really. Everything has been, you know, people have argued on the inside about this, that, and the other thing, and whether a feature should ship in Core, or whether or not we should do this thing at an event or what have you. So there’s been some minor disagreements.

But broadly speaking, the whole project has just swelled and swelled and swelled. There’s this overarching sense of optimism and growth, and now the brakes are on. And so for me, it feels like unfamiliar territory. And because it’s unfamiliar, it feels a little bit scary because I don’t know what that means. I don’t know whether that means that things are going to just level out as you just described, or whether it means things are going to decline, or whether it means some of my friends are going to go away because the community, it’s no longer going to be something that they wish to frequent because their profitability is under question and they need to seek revenue from other different options. Maybe AI, maybe, whatever it might be. And so I think my concern just, it’s probably self-interest really. I’m just concerned because I don’t know what’s coming and that fear is, well, it’s fear.

[00:33:57] Cathy Mitchell: I think this brings me perfectly into the WordCamp Canada thing that I wanted to mention. Just because I see this event, and even the community team, as a whole in WordPress. There are teams in WordPress, by the way, for people that don’t know, that help you get involved. It’s not just coders, like there’s all kinds of teams. And one of them is the community team, and all we have to know how to do is plan an event or host an event or serve coffee. It’s amazing. But anyway.

I am excited about WordCamp Canada, and the reason I’m putting so much time and effort into this conference is because I really see it as a light at the end of this tunnel. Not at the end. Maybe midway. I have no idea what’s going to happen to my own business, to WordPress, I don’t know. But I think there’s one thing that I’m fairly certain of, even now, even in the midst of AI, and that’s open source. I really still believe that open source is the way of the future. I still think it is, open source and AI are probably the way of the future. Yeah, I don’t know how else to say it.

And I think the exciting thing, and the thing that we need to do as people who got to take advantage of that uprise and that uptick, is you and I need to get young people involved. Like we need to get those young people involved in open source. I don’t even care if it’s WordPress or not, but they need to become part of a community that is exciting, that is beyond themselves. They need to see that we’re nice. We don’t bite. We’ll hire them. There’s just so much good that can come out of being together. And these are the nicest people. They’ll talk to people that are just standing around in the hallways with nobody to talk to, which is me. I’m an introvert, ironically.

[00:35:38] Nathan Wrigley: You definitely don’t come across like that, just so that you know.

[00:35:40] Cathy Mitchell: Well, we’re I’m pretending nobody else is listening.

[00:35:43] Nathan Wrigley: The other thing that I would add, as you were saying all of those things, it occurred to me that, I would imagine that people in more senior positions, I don’t really know how to describe it in the WordPress world, have got a similar intuition to the one that you just described. In that they can definitely see that the future needs to be thought about in terms of the youth coming in. Because there’s an awful lot of work being done at the moment and an awful lot of hours being put into educational initiatives.

And also, not just where you and I are living, but all over the world. And it was kind of interesting at WordCamp Asia recently, that was a big focus. A lot of people talking about exactly this thing and these kind of overlapping initiatives that are beginning to bear fruit. So people coming out of universities who’ve had experience of open source and WordPress in particular. And children at schools having experience of open source and WordPress.

And I think, as much as we would like open source and WordPress to win, just from a moral point of view, wouldn’t that be a great thing if everybody just noticed it and got on and used it? I think we need to do a bit of work to make sure that it’s being put under their noses so that they can make those judgements for themselves. And that is definitely a part of the future.

[00:36:57] Cathy Mitchell: Yeah, the Campus Connect and the Credits where they can university credits, like it is getting popular in other places we haven’t heard so much. But I really want to introduce it and bring it to the conference in Vancouver this fall. Because we can have universities in Canada and the US, on this side of the pond get involved in this and actually give kids credits that they can use to graduate.

[00:37:21] Nathan Wrigley: It’s so interesting as well because it’s very hard to, how to describe this, that’s a difficult one to sell, let’s put it that way. The people that are really into those initiatives really love it, but it’s hard to get people to notice that that’s going on, and hard for people perhaps to notice how important that is. But without those little foundational bricks being put in place for the future, this rising tide carries all boats metaphor, that’s not going to happen. You know, I think maybe another good metaphor there is they’re kind of building the harbour wall to make sure that the boats have got something to rise against. And I think that’s really important.

And your part of the world is definitely open to that, I’m sure. Seems to be that some European institutions, colleges, universities and South American institutions and parts in India and Southeast Asia and places like that are also beginning to bite on those ideas as well. So it’d be really interesting to see how that all goes.

You’re painting a picture, Cathy, which makes me feel optimistic. Feels like there’s a lot of positivity coming out of where you are, yeah.

[00:38:24] Cathy Mitchell: I’m probably going to get in trouble for saying this, but for all of the faults that Matt might be accused of, somehow he put something in place that became very, very popular. And the culture that I have been a part of, I haven’t worked for Automattic, but the culture at the WordCamp level and volunteering and the community team has been unbelievably positive, and foreign to me. Like I’ve had to learn this culture. What do you mean there’s no application process? How do I say yes? What are you talking about? So somehow this has grown. And he has had a lot to do with it. People don’t like that he’s had a lot to do with it, but there’s some truth there.

[00:39:07] Nathan Wrigley: It’s really interesting and it doesn’t matter how many times I have conversations like this, I’m always confused by it. I can never get my hands around it and work out what the secret sauce is so that I could copy and paste it into a different locale or a different jurisdiction or different era. But there’s a there, there. There’s something very satisfying about this community. And from everything that you’ve said, it sounds like you are very positive about it. And I share your positivity, even though sometimes it seems quite hard to grasp in the more recent times.

Oh, Cathy, that’s been absolutely wonderful. I’ve enjoyed chatting to you today. We’ve hit the sort of sweet spot of the amount of time that we’ve got, so if it’s okay with you, we’ll wrap it up there. Just before we go, if anybody wants to get in touch with you, or just sort of wants to pat you on the back for your wisdom there, where would we find you?

[00:39:55] Cathy Mitchell: Well they can find me at WPBarista. And right now they can also find me at canada.wordcamp.org.

[00:40:02] Nathan Wrigley: Okay. Well I will make sure that that goes into the show notes. So if you’re listening to this, head to wptavern.com, search for the episode with Cathy Mitchell, that’s Cathy with a C, and you’ll be able to find the details in the show notes there. So Cathy Mitchell, thank you very much for chatting to me today. That was lovely. Thank you.

[00:40:19] Cathy Mitchell: Thank you. I enjoyed it.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case, how AI is exposing hidden threats is WordPress plugin updates.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact forward slash jukebox and use the form there.

So on the podcast today we have Austin Ginder. Austin has been involved in the WordPress ecosystem since 2010, and since 2014 has run Anchor Hosting, a business that manages thousands of WordPress websites. While he’s a developer and automation enthusiast at heart, in recent months Austin has found himself at the forefront of a burgeoning crisis in WordPress, security supply chain attacks targeting plugins.

A chance discovery during a malware cleanup on a client’s site, propelled Austin into what would become a wider investigation of plugin vulnerabilities. What he uncovered is both alarming and timely. Bad actors aren’t just hacking sites directly, but are instead infiltrating the supply chain, either by purchasing plugin companies and weaponising them, or by hijacking plugins and pushing out malicious updates. These attacks are subtle, often shifting plugin update servers away from wordpress.org to rogue channels where malware can be distributed, leaving end users in the dark, and their sites at risk.

We trace Austin’s journey from accidental security investigator to creator of the WP Beacon Project, a resource aimed at tracking, documenting, and alerting the WordPress community to known supply chain attacks.

He shares how AI tools have radically changed what’s possible in threat detection and forensics, enabling individuals, and hopefully someday, the larger hosting providers to identify patterns and root causes behind widespread infections.

We get into case studies of specific plugins compromised in recent months, the challenges of auditing over 60,000 plugins in the wordpress.org repo, and the complexities of stopping these attacks once malicious code is in the wild. Austin also discusses his hopes for greater collaboration with hosts and security researchers aiming for better automated monitoring and response.

If you manage WordPress websites, create plugins, or just care about the future of open source security, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Austin Ginder.

I am joined on the podcast by Austin Ginder. Hello, Austin.

[00:03:40] Austin Ginder: Hey, good to meet you.

[00:03:41] Nathan Wrigley: Very nice to meet you too. I was put in Austin’s way by I think Courtney Robertson.

Thank you Courtney for that because, on a different podcast, which I do, we were talking about an item, which is very much in the news at the moment. It’s all to do with plugins and security. And whenever I say security, any of the people that I have on the podcast, I feel it’s pretty important that person gets a chance to stamp their credentials into the podcast about themselves. Because it’s one of those areas where a little bit of knowledge can go a long way. Tell us about your background, WordPress hosting, security, those kind of things.

[00:04:16] Austin Ginder: Sure. So I’m a developer, first off. I’ve been running a WordPress hosting service since 2014, and I’ve been working in the WordPress space since 2010. A long timer. I love automation. WPCLI commands, bash scripts. I’m in the weeds on a technical basis.

But in terms of security, I wouldn’t call myself a security expert, which is ironic for this conversation because of some of the things I’ve been finding over the last month or so. And it’s all thanks to AI. AI has been my friend. It’s just right place, right time, getting lucky and also just a mix of everything is changing right now in the world.

[00:04:56] Nathan Wrigley: Yeah. Thank you for that. So as you’re about to hear, we’re not gonna be talking at from the perspective of Austin demonstrates how to fix a particular challenge in WordPress. It’s much more of a general thing, and an alert really. It’s a bit of a call to action about a problem which has been systemic in the WordPress ecosystem, well, forever really, since I guess, plugins came along.

And this is all about really change of ownership of plugins, and I could do a job of trying to describe the scenario here, but do you want to just run through what you’ve discovered in the last few weeks, and the three or four incidents that you’ve uncovered and what they mean and how they’ve come about?

[00:05:37] Austin Ginder: Yeah. So in particular, we’re talking about supply chain attacks, and a supply chain attack is a different kind of attack. It’s not a direct, my site got infected with malware or something like that. It runs a little bit more deeper. It’s a scenario where either it can happen a couple different ways.

A hacker might get control over the plugin repo itself, maybe a credential breach, where they sign in and they are acting as the author, and they push out bad code. As a user, you just update your plugin and you don’t realise you’re updating to something that’s harmful for your website.

So that’s one scenario. The other scenario which is crazy to me, but like hackers literally buying companies and then weaponizing the plugins themselves and distributing them through the official channels. So that’s the big story that I was covering this last month. That is just what possesses someone to spend six figures to buy a suite of plugins and then weaponize them and try to get away with it? No, that can’t happen.

[00:06:42] Nathan Wrigley: Except, it does. So let me just reiterate what’s going on there. So if you’ve been to the wordpress.org repository, or indeed you’ve downloaded plugins from third party vendors, maybe a pro version of a plugin or what have you. Usually there is some aspect of the WordPress admin UI, which enables that plugin to be updated by clicking a link or perhaps automated, the update will happen.

Increasingly, I think people are being, have been encouraged to click enable automatic updates. So it just ticks over in the background. Perhaps while you’re asleep, it gets updated to the latest version. This in a universe occupied only by honest people would be absolutely fine. We’d have no problem that.

However, the scenario that you are describing is that kind of invisibly it’s entirely possible for somebody to sell their plugin or indeed maybe even have their plugin repo hijacked in some way. But let’s go with the sell their plugin scenario, because that’s the easiest one to get a hold of. Sell it to somebody.

Obviously, I would imagine in most cases, assuming that person is a good actor, is just going to carry on doing the nice things that the plugin does, updating the code, and doing security updates and what have you. However, there is zero guardrail to stop them putting whatever they want into the plugin.

And so overnight, a plugin which has been working for a decade or more, doing its job, now suddenly is masquerading. And it may be that the functionality of the plugin is also still there. It’s not like suddenly the plugin just stops working, or it’s really obvious what’s going on. It may be that just a few lines of code have been adapted, modified, there’s some backdoor smuggled in to the plugin. An end user would never know that this was going on. Have I summed that up? Is that about where we’re at?

[00:08:35] Austin Ginder: Yeah, these are bad actors trying to hide themselves. They’re sneaky. They don’t do things that are obvious. Like they’re not just uploading malware to WordPress plugin repo. What they’ll do instead is they might slip a third party updater, which is against the guidelines, clearly. But they can do it a little bit more sneaky.

So if they can get a third party uploader put into their plugin, then they can actually hijack the plugin. Meaning you download a plugin from wordpress.org, and you run auto updates, and it updates not from the wordpress.org version to the newest wordpress.org version. It offloads to their own compromised update channel.

And then once it’s on the update channel, wordpress.org has zero visibility, and you’re just running a hijacked plugin and you don’t even know it. Unless you go in and you run a verify command, from the command line or, you’re scanning for things like this. And then after they get the plugin hijacked, that’s when they compromise your site.

They could do SEO spam attacks, or display ads, or poison the search results from Google’s perspective. Many different things that they do to try to recoup their money in the investment.

[00:09:50] Nathan Wrigley: So let me just run that by you again. So just to make sure I’ve understood. So in this scenario, the plugin, it is like a one time thing in a way, but we’ll explore that as well in a moment. The plugin is acquired by somebody else and potentially some of the behaviour that you’ve seen is that the only part of the plugin that they modify is the location of the update server.

Now, typically that would’ve been over at wordpress.org, and every time you click the update button, you are receiving the repo version of it. However, this updated version will then offload to a third party server somewhere. And at that moment, wordpress.org loses all visibility of what’s going on. As far as they’re aware nothing has happened.

You are now just getting updates from elsewhere. You would never see anything. But obviously whatever payload they wish to put into that plugin is completely invisible to wordpress.org.

Now, I suppose the wordpress.org version, there’d be a telltale sign that this was happening because there would be new and modified code to indicate, oh, look, there’s a third party server in play here. But WordPress org has no visibility into what the malicious code being updated onto your website is. Again, is that about where we’re at?

[00:11:07] Austin Ginder: Yeah. Everything on wordpress.org is open source. Even the platform itself is open source, so you can see the full code, how everything operates there. And in addition to that, all of the plugin activity happens on SVN, which is like the raw pipeline.

So all of the data is there and available to anyone to go in and audit the data, but it’s, it’s an after the fact situation. Like after a situation happens, you can go back to the raw data and run a full audit to try to piece together all these missing pieces. And all these missing pieces would’ve been impossible to correlate together if it wouldn’t be for AI. Like now we have a superpower where we could just run AI through it all. If we feed it the right points, we can start to make the correlation after the fact as to what happened.

[00:11:59] Nathan Wrigley: Okay, so essentially what you are saying, I think, is that the work of checking this, prior to AI, let’s go with that, it was just too humanly intensive. There were 60 plus thousand plugins on the wordpress.org repo, going back and having a human inspect every single update, every single file, every line of code is, as you can imagine, a completely unrealistic process.

However, now AI really its superpower is its capacity to take a giant corpus of data, and then do things with that data. It’s almost like it can capture the entirety of the internet in one hit. And so that’s what’s enabled you to weed out this sort of stuff.

I have to ask from a personal point of view, why are you doing this? And I don’t mean that the way it sounds, because obviously it’s philanthropic. I’m extremely grateful that you are doing this. But how did you end up taking this on as a, I don’t know, a hobby, a pet project, a sideline?

[00:12:59] Austin Ginder: This is completely accidental, right? The backstory is in February, I saw a huge shift at my own customers websites, where sites that have been secure for years and years, all of a sudden was getting malware. The short version of it is while I was doing some malware cleanup for a customer, I uncovered one of these big back doors, and it was just like going through the process.

So malware cleanup before AI was always a little bit of a dicey thing. You can check all the boxes, make sure everything looks good, but you never had the certainty that it was all a hundred percent clean. Did I miss something? But with AI it’s very easy to do a thorough, in depth, investigation.

How did this happen? Where did it come from? Is my site actually clean now? It just crawls over all the files with Claude Code and other tools, and it gives you a nice report. When I had some recent, my own customers that got malware, and I ran through the forensics level style that AI can give, it uncovered some things that made me question, maybe I should look upstream, maybe I should look at wordpress.org. And I started to feed that into the AI and sure enough, there was something there and it was story worthy.

[00:14:13] Nathan Wrigley: So presumably that was then bound to a particular plugin. So your customer, something went wrong, you pointed the AI at it, it gave you a report, pointed you to the wordpress.org repo. And that in theory could have been the end of that. You clean up your client website and move on.

But it sounds like this became much more than that, because over the intervening days and weeks, you found that this was alarmingly, not just a one-off. This was a pattern. And I think the last time I was reading about this, I think you’d found four. I don’t know if four plugins is now up into some other figure or not, but certainly at the time I was reading you’d found four plugins with exactly the same strategy. I don’t know if they were from the same vendor or what have you. Just tell us where you’re at in the middle of May 2026.

[00:15:07] Austin Ginder: Yeah, so I’ve now published four more or less in depth research. Now, I wasn’t the sole finder of all these, but I was the one who actually pointed the AI at it, and got to the root of it. And it uncovered some other things that previous folks hadn’t found. So the crazy thing is all four situations are completely different, and that’s the wild thing.

So the one was, the source was the WordPress Plugin Team. So they saw there was some bad activity happening, with a set of the Essential Plugins package. So that’s like a 30 plus plugins. So they closed down all the plugins. They issued an alert, Hey, your site might be compromised. And they actually put code in the patch of the plugins that would check the wp-config file, was it tampered with by the plugin authors themselves?

So one of my customers saw the notice flagged me. I scanned it, saw it was compromised, and then that’s when I uncovered how big of a deal it was, the Essential Plugins. It was actually a purchase of a company. That was just one of them.

The other three situations, again it’s all kind of part, it stems back to me overhauling my security system for my clients. The other one was flagged by a new security feature I was implementing where I check all of my customers JavaScript embeds.

I’m basically scanning changes over time, hoping to catch like a credit card skimmer, or something else like that for my own customers. Well one of them came back. Something’s weird. It was a widget logic plugin that was embedding some weird sports JavaScript code for one of my sites. And I kept digging and digging into it, and sure enough, it was another supply chain attack on that particular plugin.

So, in all these instances, the WordPress Plugin Team has been fantastic. Very responsive and closing down the plugin, and applying patches, and getting the out there. Yeah, it’s weird. I had no plans to building something like this. I just stumbled upon it and every situation was a different story.

The last one I’ll share is, I was messing around with this idea that, I wonder if I could use AI to hunt through my own customer’s plugins to detect plugins that are running different versions of the code base. You might have Jetpack installed with the latest version, but maybe there’s a variant version Jetpack’s running. That’s the core idea, or the core concept.

So I built this tool with AI to scan my own customers, and it found a variant version of the Quick Redirection Plugin installed. I’m like, what’s going on here? So I dig into it and I had 12 sites running a version of the plugin that wasn’t on wordpress.org. So then I threw it through AI. It told me the difference. And sure enough, like you had to keep digging to get actually get to the answer what happened.

But that was a situation where many, the plugin author themselves offloaded most of their customers to a hijacked version. And my own customers years later were running a hijacked version. So I wasn’t directly searching for this stuff, it just came up, and then I’m like, after you get three of them, it’s alright, now I just wanna see if I can find one.

So I built the scanner and while I was scanning the top 2000 WordPress sites, I found one, and it was active. It was active, meaning the plugin, it’s called Scroll To Top. It was wired in to 20,000 sites, but it wasn’t active. So a lot of these bad actors, they will take their time, get a plugin that’s compromised in a lot of people’s sites, and then when the moment’s right, pull a trigger. And then at that point they can start to flow in bad content or SEO and actually do the compromise.

The one that I actually found was a compromise scenario, from what I can tell, the bad actor hadn’t actually pulled the trigger yet. So it was a success story.

[00:19:13] Nathan Wrigley: Yeah, that is really, kind of makes it more alarming in a sense, doesn’t it? Because once I suppose there’s an active exploit, and people are beginning to report what’s going on here? There’s some strange behaviour on a website, I presume at that point eyeballs will fall on what’s going on and work will be done.

However, as you’ve just described maybe months, weeks, possibly years, a plugin can have incredible functionality. It might gain widespread adoption, because it’s doing this one thing particularly well. Just with this dormant code sitting there waiting for the moment that’s opportune. Maybe there’s some scenario in the real world in which it will become a timely thing to be able to deploy that.

That’s really alarming, isn’t it? Because who knows how many websites are currently sitting there with as yet undiscovered, back doors, or problems that we simply don’t know about because they haven’t been triggered? Yeah, that one is really alarming.

Austin, I’m going to give you a little opportunity because you keep saying my clients, and I don’t think we painted the context of that. Just tell us a little bit about what you do and how that aligns you to have, have an eyeball on so many websites. I think currently, when you say my clients, I think it’s true to say that you’ve got something in the order of 3000 websites that you manage. Now, if you were building those as client websites, that’s a lot of clients. Just tell us what it is that you do, and that might widen the debate a little bit.

[00:20:39] Austin Ginder: No, I don’t do consulting work anymore. So back in 2014, I transitioned into web hosting full-time. I run Anchor Hosting, and my business is, it’s a pretty simple business model. I resell other managed WordPress hosting services, and provide all of the support and maintenance on top of it.

So I primarily use web hosts like Kinsta and Rocket.net. They are larger companies. They have a lot more eyeballs on it. I like to layer as many layers between me and the web host infrastructure as I can, so that I can actually solve what I want to solve. And that’s the WordPress maintenance part.

So I have a little bit more visibility than some. So that is more unique position than most. And I actually would say if there’s any takeaway from this conversation, the takeaway is any hosting company out there that has more data than me, they are sitting on a gold mine and they don’t know it.

Because any site that gets malware, that is the gold. If you can point AI at every malware situation or attack, you can sometimes back channel it to figure out where it actually happened, and start to paint a bigger picture. I would love to get my hands on like a web host that has millions of sites and run some scans, because that’s how you’re going to discover it, weed it out.

[00:21:59] Nathan Wrigley: And there’s maybe patterns going on. I don’t suppose every hacker of WordPress plugins is some kind of evil genius. They might just be, I think what’s often called script kiddies. The idea being that they are taking templates and copying and pasting these ideas far and wide.

And therefore I suppose patterns would emerge and maybe as you said, some of these larger hosts would be able to spot that pattern, and get out in front of these different problems which have, as yet, been undetected.

Okay, so you’ve then taken an additional step. You’ve got yourself a URL, wpbeacon.io. Dear listener, as is always the case, anything that we mention today, so the links to the articles which Austin has written, I will put those in the show notes, but also I’ll link to wpbeacon.io. Just tell us a little bit about that and that, how that’s helping the community.

[00:22:52] Austin Ginder: So WP Beacon was again, an idea I threw together last month. Not a whole lot of planning. But it was just like, okay, I’ve got three of these now. These are basically in depth investigations. Where do you put it? Because this is different than a typical vulnerability database. Like a vulnerability database is really good about endeavour to find bad code.

This is not bad code, this is bad actors. They’re two completely different problems. So I built WP Beacon as like my place to put all these findings. And the idea is actually have it be a legitimate feed for other folks, like another metric or another vulnerability database, but for supply chain attacks in particular.

[00:23:39] Nathan Wrigley: And so I suppose the idea being that people who are, I mean obviously if you’ve got one WordPress website, it’s fairly unlikely that you’ll come across WP Beacon, because you’re not in the business of being in the community or what have you. But if you are somebody that’s, I don’t know, managing multiple clients, half a dozen or what have you’re in the WordPress space, this is the kind of thing you might want to know about.

I suppose you are then hoping to be some sort of gatekeeper of knowledge around whether a supply chain attack has occurred. So let’s say for example, I’m considering putting a new plugin in. I find something on the wordpress.org repo, and it looks fine. Everything about it is screaming, yes, install me. I would go over to WP Beacon. I see that you’ve got a search on the homepage. There’s a list of the number of installations that have been covered, authors, tracked plugins that are being watched and what have you. I would be able to, in some way, interact with that website and gain an understanding of, yep, we’ve got nothing on them. Everything looks fine, or no, hold on, have a second thought. This thing happened last month. Is that again? Is that kind of what’s going on there?

[00:24:45] Austin Ginder: I think end users might find value in it, but I think the better target audience is, this is missing security research that security people don’t have. I see it as that. It’s like when I do a report and I put it up on WP Beacon, those identifiers of these bad actors can then be, action can be taken on that by real legitimate security people.

So I have a friend, his name’s Sal. He used to work at Kinsta. So when I was dealing with one of these cleanups, I was messaging him privately. I’m like, hey, Sal, look what I found. And he is oh, gimme a second. I’m going take their compromise server offline. I’m like, what do you mean? So he whips it out and he gets their domain suspended, website taken offline. And this is like the crucial gap, right?

The research person wants to make people’s site safe. So if you’re out there and you’ve got a hijacked plugin installed and you don’t know about it, you need a research person, and a security person, to take care of the issue for you. And that is like taking down their infrastructure, taking down the bad actors infrastructure.

[00:25:51] Nathan Wrigley: Oh, that is interesting, yeah.

[00:25:53] Austin Ginder: My goal of WP Beacon is just like, this stuff needs to be more visible. We need to be drafting and documenting this is how the supply chain attack happened in this case. And here is all of the identifiers for the security firms to go for, and take down their infrastructure. To give some sort of incentive that like this kind of behaviour isn’t going to be tolerated or a signal to the bad actors like, we’re coming for you. We’re going to find you, we’re going to weed you out.

[00:26:21] Nathan Wrigley: Yeah, so that’s interesting. So connections with hosting companies would certainly be beneficial, wouldn’t it? Because let’s say a bunch of hosting companies are pointing their staff at the WP Beacon data, then you could probably satisfy, I don’t know, 60, 70, 80% of WordPress instal by communicating with the bigger hosts. Because I imagine that’s where the majority of WordPress websites occur. I presume another angle would be the .org repo itself. The team over there, the Plugin Review Team and the Security Team and what have you.

One ray of light, I suppose is that if you fix this, then you have fixed it. Whereas a lot of security problems keep coming back. Well, no, that’s not entirely true, is it? Having said all of that, I was fairly confidently thinking if you can, if you can get the plugin turned off so that it can’t be installed anymore, that’s one thing. If you can switch off the supply chain server, that’s another thing. But there’s going to be loads of different scenarios. It might be that they don’t have a supply chain server. It might be that they’re just defacing your website. And how do we disable that that particular functionality and the plugin?

I believe that wordpress.org has in rare situations deployed the, we will overwrite your plugin. I don’t know how to describe that, but I have a memory that in the past, something so catastrophic had happened inside of a wordpress.org repo, that there is the capacity for WordPress to say, okay, we’re taking command here, and we’re going to rewrite your plugins. I don’t think that’s very common, but I think that is something that can be done.

[00:27:59] Austin Ginder: In these situations, that’s exactly what they did. They reverted a patch, closed down the repos, and their patch is what stands.

[00:28:08] Nathan Wrigley: Right.

[00:28:09] Austin Ginder: So I think a lot of what my, what I’m trying to do is complimentary to what everyone else is doing. And I think it’s a little bit more, it’s an unexplored area, what WP Beacon is exploring. We have all this data, let’s see what we can get out of it.

But I do share your optimism, and also I would love this to just be a solved problem, and six months later we shut down WP Beacon, like it’s not even needed. But that’s just not how the world works, right? What I do hope will come from this is the bad actors that have been operating for years, 10 plus years, we make it harder for them to operate. I think that would be a more realistic success story of this project.

One of the bigger findings I found this past week, in the last few days, is this bad operator he’s been operating for the last 13 years. And what happens is his accounts get shut down, his plugins get shut down, and he just tries again. He opens up new accounts, new plugins, and he just keeps trying. We’ve got to make it a little bit harder for them.

[00:29:09] Nathan Wrigley: And also what’s really interesting there is that this is not, for you at least anyway, this doesn’t feel like a finished story. This kind of feels like, for you, now that you’ve put yourself in this seat, if you like, it feels each week possibly something new will be coming along, something that you’ve explored? Is that the case? I would like for you to say no at this point, no, there’s nothing new happening, but I the feeling that there’s quite a lot that you are uncovering on a daily, weekly, monthly basis.

[00:29:37] Austin Ginder: I do think it’s going to be harder and harder to find interesting things based on the raw data, using my technique of just going through and auditing things? That’s a good thing, right? If it’s harder to uncover these problems, that’s a positive indication that something’s happening.

So I think I’ve been extremely lucky by reverse engineering a problem. Like, how does the malware get here? Oh, okay. So then figuring out that there’s a bigger issue at hand. And I also think it’s one of those scenarios that we all think people are searching through the data, but they aren’t. I’ve got a $200 month Claude Code subscription, and I can search through the data with that. It’s actually feasible for individuals to start auditing the data and to get more eyeballs on this in a way that would never been possible before.

Yeah, I would encourage people to think bigger. If you’re an individual, you can take your site, download a backup and run it through Claude Code and do a file by file audit. It might take a few, Claude doesn’t like to do this, but it might take a few wranglings. No, look every line of code and tell me what you see. Do you see vulnerabilities? Do you see malware? Do you see any harmful things there? And an individual can do this, and they can get a very high level detailed report unique for their site.

[00:30:55] Nathan Wrigley: That’s interesting advice. Maybe in the future, some of the pain that you’ve been through with Claude trying to get it to behave in the way that you expect, maybe that be interesting data to put out? What are the prompts which you’ve seen that work and so on?

One thing which dawns on me, and I don’t really have the answer to this, because the wordpress.org repo, for good reason, has been wide open. What I mean by that is, lots of people can submit code. You don’t necessarily have to have a certain type of credential, or be a certain type of business and so on.

However, if you look out there in the broader tech landscape, things like, I don’t know, the Mac App Store or the iOS App Store or Google’s Play Store. I wonder what their approach is to firstly the onboarding of new plugin developers. But then what the inspection is for updates. When code comes through and it’s purporting to make a minor change to a particular app on your phone, what is being done there?

And I’m guessing that in the WordPress space, the fact that it’s run often by volunteers means that those kind of things are just going to be different. And perhaps those things need to be looked at. There needs to be potentially some more friction that’s added, or some more steps. And I know that a lot of work has been done by the Plugin Review Team to automate as much of that as possible, and to put some steps in place to make it so that those submissions get inspected in a more timely way. But I don’t have an answer. I’m certainly no expert. But it would be curious to see if there’s any lessons to be learned from the broader tech community.

[00:32:30] Austin Ginder: Obviously the openness of WordPress is its power. App Store versus Android, right, kind of comparison? We’re more open source. You could just do what you want. There’s pros and cons, right? So how do we make what we have more safe? And I think the answer to that is everything needs a hundred percent code audited.

How do we get there as quick as possible? That’s a token question. Like, how many tokens can we spend to audit everything? I have fairly good coverage now for my own customer base. What I do is whatever leftover usage I have, I’m auditing all of my plugins. And I do it in a way that’s efficient, meaning I only audit this one plugin version once. That gets assigned to a hash, a unique hash. Then I know, oh, okay, so all of my sites using that same variant are covered.

So a hundred percent code coverage is what we need to do now. And then long term, also in concurrently, we need to start auditing any changes that come over the wire. It’s a lot, right? Like wordpress.org is very popular. There’s a lot of code, but I do think it’s in a realm of realistic. If you are able to shave out a lot of the noise, we don’t have to audit everything. We don’t have to see every CSS file you’re changing, or image you’re changing. But we do have to look over every PHP line, every JavaScript line, that there’s nothing harmful in there. And then eventually we’ll start to catch things.

And I don’t think it’s necessarily a one off thing. We don’t have to wait around for Automattic to come up with a solution. The data is out there. Anyone with a laptop and a subscription could just create a mirror and see, what changed over the last, day, and then start auditing that. I think people think it’s too impossible.

[00:34:18] Nathan Wrigley: It feels like a large cliff that you’re staring at, at the beginning of this. And certainly in the past before AI, that cliff was, I imagine, more or less impenetrable But now the way that you’ve described, perhaps AI can be co-opted to do a lot of this work for us?

I wonder what you’ve got, if you’ve got any thoughts on the sort of permissions system. So I know that other, let’s say CMSs and certainly devices like Android devices and iOS devices, they come with permissions based systems. So for example, this code, it’s allowed access to the root file structure. Or it’s allowed access to the camera, or whatever it may be.

And I know that there’s been debate in the WordPress ecosystem recently about whether something like that would be a good idea. At the moment, plugins, all bets are off. If you put a plugin in, it’s more or less got access to anything on your WordPress website.

That’s an absolute strength of WordPress because it enables anybody to do anything. But I suppose given that it can enable any anybody to do anything, it also prevents a very large threat surface as well. I don’t really have the answer to that. I just think that’s a curious thing to raise and see if you’ve got any thoughts.

[00:35:29] Austin Ginder: I guess my initial thought is I don’t necessarily want my WordPress site to feel like my laptop, where I’m constantly clicking things.

[00:35:35] Nathan Wrigley: Yeah. Grant permission for this.

[00:35:38] Austin Ginder: I don’t know what the solution is either. I think some of those ideas are great when you’re thinking about making something from scratch, but they are not as relevant when you’ve already have an existing ecosystem. Like you can’t, I would think it’d be very hard to bring some of those concepts into WordPress at this point. We’re already past that.

[00:35:59] Nathan Wrigley: That ship has definitely sailed.

[00:36:00] Austin Ginder: I want to be in the Wild West. I want to be able to code and do what I want to do. And especially with AI. If I got an idea, I just want AI to go to town, write me up the plugin to my spec, and not have to deal with some of those extra safeguards.

It’d be great if we could find some way to make things more secure from an architectural standpoint, but that’s an architecture problem probably best suited for a new project.

[00:36:22] Nathan Wrigley: The truth is that this will never, ever be solved. I mean security problems online. There will be a no point in the future at which everything is always safe, because humans are ingenious, and there are really credible, credible is the wrong word. There are ways to make money, or to make it worthwhile for the bad actors to be doing the bad things. And so long as those incentives exist, there will be people trying to hijack websites, undermine the security of your computer or phone or whatever it may be. But this is certainly an interesting one.

And it’s such a shame because with the benefit of hindsight, this was so obvious, and yet it hasn’t been a news story. Maybe it has in the past, I’ve certainly not come across it. But this whole supply chain thing is fairly new to me, and fairly alarming in the simplicity of deployment.

You literally purchase, or somehow get hold of, a popular plugin, not necessarily even a popular plugin, a plugin. And then instantaneously every one of those websites is up for grabs in whichever way you would like to grab it. Definitely something that the WordPress community’s going to have to wrangle with.

Okay. I think we’ve hit the sweet spot in terms of time Austin. If it’s all right with you, we will wrap it up there. However, before we go, do you just want to drop a few little bits about where people could contact you? I am more or less certain that somebody listening to this podcast will have thoughts for you about getting in touch, helping out, or what have you. So tell us where you can be found.

[00:37:55] Austin Ginder: You can find me just by searching for my name, Austin Ginder. There’s not many Ginders. I’m on X, that’s my main feed. And you can also read along on anchor.host. I do blog posts there pretty regularly.

[00:38:09] Nathan Wrigley: Okay. In which case I will just point everybody to the wptavern.com website. If you go and use the search feature, search for Austin Ginder. Austin, spelled in the usual way. Ginder, G-I-N-D-E-R. You’ll find the episode and anything that has been mentioned, any links or what have you, we will link to there.

So thank you for chatting to me today about what I wish didn’t exist, but it does exist. Austin, thank you so much.

[00:38:34] Austin Ginder: Thank you. This was a pleasure.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case, the future of WordPress plugins, AI, ethics, and new directory standards.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today we have Luke Carbis. Luke has been immersed in the WordPress world for our round 20 years with experience touching upon many strands of the ecosystem. He started his own businesses, worked in agencies as a developer and product lead, contributed to WordPress Core, helped organise WordCamps, and is now a member of the Plugin Review Team. He also co-hosts the Crossword podcast.

Recently Luke delivered a talk at WordCamp Asia titled, beyond the guidelines, it’s time to evolve our standards for a safer plugin ecosystem. And today he’s here to share some of those ideas with us.

We start by talking about how WordPress.org’s plugin directory is facing a wave of new submissions driven largely by the rise of AI generated plugins. This has made it harder, both for quality plugins to stand out, and for users to find what they need, despite backend improvements and shorter review wait times.

Luke discusses how the current discovery and ranking systems can be games, how active installs play a key role, and why there’s room for improvement in surfacing the best plugins.

We also get into Luke’s suggestions for making the plugin ecosystem better, including ways to connect wordpress.org accounts with sites, streamlining discoverability and installation of both custom and premium plugins, and the idea of officially supporting a commercial plugin marketplace with proceeds potentially supporting Core contributors and community events.

A thread throughout this conversation, is how WordPress should respond to AI, not just as a technology, but as an agent of change in the community. We look at the ethical implications, generational divides in attitude towards AI, and the importance of strong leadership as WordPress faces a period of challenge and uncertainty.

If you’re interested in the future of the WordPress plugin directory, the role of commercial offerings, and how AI is reshaping open source communities, this episode is for you.

If you’d like to find out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Luke Carbis.

I am joined on the podcast by Luke Carbis. Hello, Luke.

[00:03:38] Luke Carbis: Hey Nathan, how are you doing? I heard you had a great time in India.

[00:03:41] Nathan Wrigley: I had a great time in India. I think you had a great time in India as well. Is that true?

[00:03:46] Luke Carbis: Yes, I love India. There’s just something really special about it.

[00:03:50] Nathan Wrigley: Yes. I came away with an enormously favourable opinion of my time in India. I kind of wish that that episode had not come to an end.

We are back from WordCamp Asia, which is where I spent some time with you. You did a talk, presentation, over there, and it was entitled beyond the guidelines, it’s time to evolve our standards for a safer plugin ecosystem. Let’s get into that in a minute.

Before then, can you just give us your little potted bio? I know it’s a bit of a pedestrian question, but can you just tell us a small amount about yourself, probably related to WordPress, I guess?

[00:04:25] Luke Carbis: So I’ve been using WordPress for 20 years and also, you know, roughly there. And in that time I have done everything really from like starting my own small businesses, to working for agencies in developer roles, in product roles. Worked for hosts. I’ve worked for products and plugins, and I’ve started my own plugin businesses and sold them too. And now, after contributing here and there across a variety of different teams, I’m now part of the plugin team. So I’m spending a lot of time reviewing plugins.

[00:05:02] Nathan Wrigley: So you are very much aligned with the mission of today’s episode. So I’m going to read the blurb that was included in your presentation, just to give some context to that.

[00:05:11] Luke Carbis: I’ll tell you that I give this blurb to everybody who has to introduce me before a talk, and I get varying degrees of success in terms of their ability to reproduce the words written on the page. I’m eager to hear your rendition, Nathan.

[00:05:28] Nathan Wrigley: Okay. Here we go. I’m going to try it. I’m going to give myself one chance to get it right. It’s time to have a conversation about ethics in plugin and product design. We’ll learn that recognising and rejecting dark patterns isn’t about stricter rules, it’s about building trust through transparent, user centred design. How did I do?

[00:05:46] Luke Carbis: Oh, you did good. That wasn’t the one I was talking about actually. I thought were going to read my bio.

[00:05:52] Nathan Wrigley: Oh, well I’ll read your bio. Let’s move to there then.

[00:05:54] Luke Carbis: I put so much effort into that.

[00:05:55] Nathan Wrigley: This I’m definitely doing as a first pass. Here we go. Luke Cabris is a self deputised open source emissary and vigilante plenipotentiary for WordPress proletariat affairs. He’s one of the hosts of Crossword, and has been a part of the community as a plugin developer, Core contributor, release lead, WordCamp organiser, and member of the plugin review team. How did I do?

[00:06:18] Luke Carbis: Amazing actually. And I think like a big part of that, you know, speaking about the silly words I’ve chosen to put in there around proletariat and so forth, that does come from a genuine place and why I got into plugin review in the first place. And maybe we’ll get into some of that in this interview.

[00:06:37] Nathan Wrigley: Yeah, definitely. Okay, so there’s obviously an identified undercurrent of, dissatisfaction is maybe the wrong word, but you’ve clearly got some kind of estimation that things are not all going well in the plugin space. Because your talk, as I said, was talking about evolving standards for us safer plugin ecosystem. And the word safer there, I presume, implies that things could be improved.

So I guess I’m just going to ask you to lay out what it is that you believe the plugin landscape has a problem with, what’s going wrong? And then we can get into the remediation steps a bit later.

[00:07:10] Luke Carbis: Yeah, so when I was laying this out, I was thinking about, a lot about what I would do with the plugin directory if I could, if I could come in and change a bunch of things. And I realised that a lot of my bigger ideas are just not realistic.

So I would love to see maybe a plugin directory that was commercialised where plugins, you know, premium plugins could sell. But I think Matt’s been pretty clear that he’s not interested in doing anything like that, although maybe more recently had a change of heart on a bunch of things. So who knows?

I tried to stick to the basics and really, the changes that I proposed in this talk, I feel like they can get done. In fact, I can probably do them myself with a little bit of community support. And that’s the purpose of the talk.

And they’re really, mostly about this problem we’ve got with the directory at the moment where we’re just being inundated with loads and loads of new plugins. It’s becoming really hard to be able to stand out from the crowd as a product designer, and as a user, just figure out which plugin that I want to use. And of course, a lot of that is due to AI.

Nathan, we’ve seen, in the last 12 months, something like four times the amount of plugin submissions than 12 months ago. Isn’t that nuts?

[00:08:39] Nathan Wrigley: So I guess what I would say from there is, if I was to rewind the clock, I don’t know, let’s say three years, something like that, we had the same problem in that there was a deluge of things which needed to be approved from the plugin review team. A few bits and pieces were put in train, which actually appeared for a while to really get rid of that problem. You know, I think we got down to almost zero things in the queue for the plugin review team. And then coinciding almost perfectly, dovetailing into that came AI. The ubiquity of AI, the capacity of AI to create plugins and what have you. And that then presumably just turned that whole wheel back around.

And now we’re at the point where it sounds like the majority of the things which are in the queue are supposed to be AI plugins. You know, the idea that you may be able to rattle off 10 plugins in half an hour. On the face of it, that sounds like a great idea. Look, we’ve democratised plugin development and what have you.

But we have processes on wordpress.org which need to be satisfied and fulfilled so that they are measured, so that they are inspected, so that they pass the requisite number of tests and what have you. And we’re facing a problem just of numbers. There’s just numerically too many things happening all at once for the actual humans to take care of it. Does that sort of sum it up, or have I missed bits of that out?

[00:10:03] Luke Carbis: I would make a slight change to what you said actually, because the humans are actually taking care of it. We have been adding new people to the team, we have been improving our tools, and we’ve been using a bit of AI ourselves to be able to stay on top of the queue. And right now we’ve got about a week wait time before your plugin is reviewed. Now that’s always, like if you look historically, that’s a pretty good number.

Where you could be mistaken is if you look at the number of plugins waiting for review, right? You might see a lot, you might see 800, and that is much higher than it was two years ago, but we are getting through them a lot faster now.

So I think the metric to keep in mind is the wait time before review. Obviously we want to keep that at zero. Our team, we go into a critical mode. We say, oh, things are really bad if it’s two weeks. And so at the moment we’re one week, we’re pretty happy with that, trying to reduce it, of course.

The burden, there is a lot of burden on the Plugin Review team, but to me, that’s not the primary issue. The primary issue is if you create a product, if you create a plugin, then how do you stand out on the plugin directory amongst a thousand other plugins that do exactly the same thing? And if you are a user using WordPress, how do you find the right plugin for you? Or do you just give up on the plugin directory entirely and vibe code your own solution?

[00:11:30] Nathan Wrigley: Do you believe that is in fact the case? Do you think that possible submissions, the developers of, let’s say, I don’t know, countless plugins out there have just decided to do exactly that? Because they feel that, you know, they get through the week wait, the two week wait, the five day wait, whatever it is, their plugin is finally authorised, it’s on the wordpress.org repo, but then just crickets because of the way that the repo is structured, the way it surfaces things, the way it, I’m doing air quotes here, favours certain things. Is that the gripe really, that really it’s an unfair playing field? It’s sort of stacked in favour of some players as opposed to others.

[00:12:05] Luke Carbis: That’s been a long running gripe of the WordPress directory. That’s not a new gripe. That’s been around for a while. And in fact, we’ve really made some good progress towards changing up the featured plugins, for example. More the issue is the number of plugins. The number of plugins on the directory is growing just incredibly. And so it’s because of that it’s harder to stand out in the crowd.

[00:12:30] Nathan Wrigley: Yeah, the UI, I’ve always wondered how Google, for example, obviously billions of dollars spent fine tuning that algorithm. The anticipation, certainly when I’m using things like Google, is that it’s doing a credible job. But the truth is, I have no insight into whether or not it really is doing an incredible job, or whether I’m just missing out on a dozen things that would actually be superior given the search, and given the proclivities of Google to surface things based upon sponsorship or whatever it may be.

What does the wordpress.org, and again, I’m using air quotes, what does the algorithm actually do at present, to present what is on the page in the repository when I first arrive for the first time, or subsequently with search?

[00:13:15] Luke Carbis: One of the biggest differences between Google and WordPress search is that the, air quotes, algorithm is open source. And you can actually go on to GitHub now and have a look and examine exactly what it is. And it’s a whole range of things. I probably couldn’t do a good job of summarising it, but it takes into account recent reviews. It takes into account the plugin author’s ability to respond to support on the forums. And of course it takes into account keyword matching in the title and description and things like that.

There is a cutoff, if I recall, on the length of the description that is included in the search thing to prevent people keyword stuffing. And that’s something we look carefully at during plugin review. There’s a whole heap of things, of course.

[00:14:01] Nathan Wrigley: Are you satisfied that those whole heap of things that make up the search, or the display for whatever it is that you’re searching for, or the default when you first arrive at the page, do you believe that there’s room for improvement there or, yeah?

[00:14:16] Luke Carbis: Oh yeah. Have you ever used the WordPress plugin search?

[00:14:18] Nathan Wrigley: Yeah, I really have. But curiously, given my background, I’m not the best candidate for doing searches because what I’m usually searching for is the name of the thing that I’m searching for. For me, because I’ve been in the WordPress space for such a long time and frequent all these different groups and learn from other individuals at WordCamps and things, I’m usually looking for the name of a product. Or certainly searching for this very specific, tight set of words around which I know it will surface. And then I find it. And use it.

However, if I was just, let’s go for example, with one of everybody’s favourites, SEO, if I just type in SEO and hit the button, I do not know what that would give me, and whether or not it would be a credible match for what I want.

And one of the things that I would add into that is Google’s algorithm being closed source. Whilst we, as an open source community, we don’t like the idea of that. There is something slightly ungameable about it. You know, there’s a big barrier between gaming the SEO on Google which WordPress doesn’t have, because once the algorithm is open sourced, it becomes, oh look, this is what we need to do to achieve rankings and so on.

[00:15:26] Luke Carbis: And there is a lot of attempts at gaming the algorithm. But one thing it’s really, really hard to game is active installs. And that is one of the big, big ranking factors. So if you have a plugin, if your plugin has risen to the top, then, yeah, it’s going to rank better. And that kind of makes sense from my perspective.

But then again, if you know what you’re looking for and you search specifically for the exact word and it comes up second or third or tenth in the search results, because it doesn’t have very many active installs, that’s a hard problem to solve.

[00:16:02] Nathan Wrigley: So what would be some of the remediation steps? It’s a bit of blue sky thinking this, and obviously everything that is about to come out of your mouth, caveat emptor, it might not happen, or it might be an idea which, you know, upon further reflection a year from now, you think, no, that wouldn’t have been a good idea anyway. But do you have some intuitions as to what you would like to try on the .org repo? You know, experiments to run for a short period of time to see what works and what doesn’t.

[00:16:26] Luke Carbis: I do have one experiment in particular I would love to run, but I have to set it up with you, Nathan. There’s a first step and a second step.

So the first step is, I want to be able to connect my wordpress.org account with my WordPress in install. So we’ve got this new Connectors API coming in WordPress 7, where we can connect our Open AI or our Anthropic accounts with API keys or whatever it is. I’d love to be able to log in with wordpress.org. I think that would be really cool. Now, have you ever tried going into the plugins, add new, and click favourites? What happens when do that?

[00:17:04] Nathan Wrigley: I have not, no.

[00:17:05] Luke Carbis: Okay. Well, I’ll tell you. Do you think it comes up with your favourites?

[00:17:08] Nathan Wrigley: Oh, I see. Yeah, okay. Yeah.

[00:17:11] Luke Carbis: You’ve just done it. It asks you to type in your username from wordpress.org. And that’s not a great user experience. And so if we were able to sort of connect up our wordpress.org account to our various installs, then at least we could have our favourites come up in our plugins. So that would be a step one.

And then a step two is I would love to be able to store a list of GitHub repos, doesn’t have to be GitHub, just Git, Git repos, where I have my own set of custom plugins. Or maybe even authenticated via token, premium plugins. And add that into my wordpress.org profile so that whenever I’m creating a new WordPress site, I can go plugins, add new, click on my, I don’t know, we could call it like untrusted sources, that’s what some other app stores call it. And then see a list from wordpress.org of GitHub repositories or whatever, repositories on various different systems where I can just download the zip into my WordPress site just as though I’d uploaded, you know, I’d gone, upload zip via that menu.

Why not? I think that would be a really cool experiment to run. That would allow people to run their own sort of alternative marketplaces in a sense. If they could get onto that untrusted sources list. And it also wouldn’t take away that control that wordpress.org really wants over the plugin directory, for good reasons. Because if there was an untrusted source that was nefarious or malicious, then we could just remove that from everybody’s profile also.

[00:18:50] Nathan Wrigley: So there’s a couple of things there. The first one was, it felt like something akin, now I have an Android phone. I don’t have experience with the iOS app store on a phone, but the Google Play Store I have familiarity with. And because it knows things about me from my past and the things that I’ve done in the past, it begins to have some sort of idea of, okay, here’s the kind of things that you like.

Now I’m not suggesting anything quite like that, but it feels as if there’s a step slightly towards that. In other words, given that your 10 sites that you’ve connected to wordpress.org, they all seem to have an SEO plugin in them, they’ve all got a forms plugin, they’ve all got some sort of caching solution. Those kind of heuristics might then say, okay, we know that you like those kind of things, here’s a bunch of stuff that’s around that. Did I get that right or have I sort of overstated what you were thinking?

[00:19:42] Luke Carbis: Yeah. No, that’s good. And incidentally, it’s also the first sort of required step if we were to ever go ahead and make the wordpress.org plugin directory commercial, and allow plugins to sell, or sell subscriptions. That login with WordPress would be a necessary step.

[00:20:02] Nathan Wrigley: Okay. And the next thing that you mentioned then was kind of like this idea of untrusted sources, or at least the capacity for you to say, I trust these things. And obviously, you know, we don’t want it to be that everybody ought to trust these things, so there needs to be a sort of volunteering in, or some sort of connection which you approve or something.

How many people are these days going out to places like GitHub? I’m imagining newbies to WordPress, probably no. But I’m imagining experienced people in WordPress, developers and what have you are certainly doing that. You know, they’re finding plugins over on GitHub and downloading them and doing all of that unnecessary work.

That is an interesting idea, isn’t it? Being able to bind it so that essentially it appears in the UI, you click a button, it just does all the things that you need to do. Yeah, that’s really interesting as well. And Git, you know, ubiquitously Git.

[00:20:48] Luke Carbis: Yes. And it’s not just other people’s plugins that people are trying to access. It’s a lot of your own plugins. And talking to plugin developers, talking to people submitting their plugins to the directory, a lot of the time people would be actually just happy if they could easily install their own plugins on their various websites and on their clients’ websites. That’s a part of them pushing it into wordpress.org, into the plugin repo is just to have it there accessible. They don’t really expect a lot of users. They’re not really going for some big product launch. They just want it there and available for when they build their website.

[00:21:29] Nathan Wrigley: Okay. And then let’s move on to what I think was the third of your points there, which was the more commercial side of things. The idea of putting premium plugins, let’s call them that. Essentially a plugin where there’s a fee in exchange for getting access to that code base.

Do you think that breaks some kind of promise that the community over 20 years has opted into? I suppose the argument from the more open source side, if you like, let’s call it that, would be that it’s going to, in its train, bring all sorts of unexpected consequences. You know, the pressure to, I don’t know, raise a 3% fee for wordpress.org, which people would say, okay, where’s that going to? You know, on the Apple iOS store and on the Google Play Store. I think it’s around 30%. But, you know, I was just taking Stripe as an example. Something like a 3% fee, but it could be anywhere, right?

And then of course you get into the whole argument of, okay, if there’s a fee attached to that and somebody’s getting paid for that, is there going to be a commercial pressure to promote only the ones where the fee is the highest, or the percentage that’s been agreed for that thing is the highest? You can see how it gets muddy basically fairly quickly.

[00:22:32] Luke Carbis: Yeah. It does get muddy and it does get messy, and I think it’s a necessary evil. Now, let me just start by saying I’m not really proposing this because the first step towards anything like this happening would be that wordpress.org must be transferred to the Foundation. That would have to be the first step.

And then the second step is, yeah, you’d have to charge developers a fee. I think actually 8% would be the right amount, okay? So we have 3% for payment processing and then Five for the Future. That’s always been the thing, right? So let’s stick with that. So let’s stick with 5% goes to the Foundation.

And what happens with that money? Well, we’ve got a problem in WordPress, don’t we? We have this problem that people aren’t contributing enough, and people don’t pay their due. And some of that is big plugins.

So what if we just put that into the foundation and use it to pay for WordCamps. Use it to pay for contributors. Use it to pay for the plugin review team. I’m not complaining. I’m a full-time sponsored contributor. But not all of the plugin review team are. So maybe use it to pay for some of those volunteer hours. I think that could be a really useful and helpful thing, especially if the Foundation has proper governance and proper oversight.

[00:23:53] Nathan Wrigley: I have literally no idea what the WordPress plugin ecosystem is, and again, I’m doing air quotes, worth. And so what I’m meaning by that is, I don’t know how many dollars move around on planet Earth each year in order to get access to pro plugins. I’m imagining it’s not a tiny amount.

[00:24:15] Luke Carbis: Not as much as WordPress hosting, but probably a lot more than people think.

[00:24:20] Nathan Wrigley: Right. Because we are in a, an ecosystem now where $97 per annum for this thing, and $47 for this thing, or $399 for this other thing. These are not numbers which kind of shock anybody. And 8% of $399 a thousand times over, a million times over adds up to quite a lot.

And so, again, I have no back of the napkin calculation there, but it does seem that that would be quite a considerable amount of money. The way that you’ve channelled it there, maybe that would be enough to satisfy people who don’t want there to be any commercial pressure inside of wordpress.org. I don’t know if you’ve had conversations with people who have a very different opinion, you know, you’re polls apart on this, and whether or not you’ve managed to persuade them with that argument or not.

[00:25:07] Luke Carbis: Yeah, look, Matt Mullenweg himself is polls apart from me on this last time I checked, and that’s okay. I get that perspective too. Introducing money into WordPress will have some big effect on the project. Maybe it’s the shock the project needs. But I personally am a fan of an expanding ecosystem. I love the idea that someone can make a living off WordPress. That’s what I’ve done for my whole career.

And if this goes another step towards enabling that for people, especially in the current climate where a lot of plugin authors and product companies and WordPress are experiencing a downward trends in terms of sales and conversions, then I think this could be a good sort of step in the right direction. Most importantly, it would give the confidence back into the market.

So I’ve been sitting, actually, Nathan, I’ve been sitting on a plugin that I probably would launch commercially as well. I’ve had it ready to go for 12 months or more with a friend of mine. We’ve launched successful plugins before. And we just haven’t launched it because we feel the timing isn’t right. We feel the WordPress plugin, the ecosystem isn’t an exciting place to be. People aren’t really interested in new products in this space, especially if it has nothing to do with AI. It feels like there’s a lack of momentum, a lack of movement in the WordPress product space, especially when it comes to the new launches, right? The last big launch I can think of was Event Koi. Maybe you’re more in touch than I am.

[00:26:45] Nathan Wrigley: No, that was a big moment for me as well, that did garner a lot of interest, yeah.

[00:26:50] Luke Carbis: And it seems like there’s a general sort of crickets when it comes to product launches in WordPress. Maybe this could be something to generate a bit more excitement again.

[00:27:00] Nathan Wrigley: I don’t quite know if it’s fatigue or what have you, but there’s definitely been a sort of slowing down of, maybe it’s because of, I don’t know, maybe people just more broadly are not kind of quite so into Facebook groups in the way that they were before, or maybe they’ve been used to unsubscribing.

[00:27:17] Luke Carbis: Could be AI. Could be a ton of different things.

[00:27:20] Nathan Wrigley: Yeah, I think all of those pieces play into it. But I do think you’re right. I think WordPress has got a bit of a fight on its hands in the future, trying to maintain its interest in what, for the younger generation coming up, will probably be a bit of an AI first world.

I would imagine for developers, the idea of being able to gain revenue directly at the source, and being able to be discovered directly at the source is quite an appealing thing. You don’t necessarily have to have the most incredible website. You don’t have to have an incredible marketing team to be discovered out in Google if you’ve got fighting chance to be discovered inside the repo, which is serving up the plugins to everybody. I imagine that’s quite an exciting prospect.

[00:28:05] Luke Carbis: Oh yeah. When was the last time, if you had to install an app for your phone, you went to a website? I don’t know what it’s like on Android.

[00:28:10] Nathan Wrigley: Not ever.

[00:28:11] Luke Carbis: No, you find it on the App Store. And not only that, but also if we did something like this, we’d have built into WordPress ways for developers to update their plugin. Right now, premium plugins have to ship their own updater, even though WordPress comes with one, right? Ways for WordPress to be able to handle a licence, or maybe not a licence key, but validate a purchase, right?

Right now, every premium plugin has to do that validation step. Where did you get the plugin from? Do you have a valid purchase? So it makes a world of difference for product teams when they don’t have to distribute, when they don’t have to do quite as much marketing. And discoverability is much easier when they don’t have to worry about how they’re going to handle updates.

Even just thinking through something like, am I going to have a premium plugin and a separate, a free plugin, or am I going to have a system where I have the free plugin and then my pro plugin extends that with actions, and so we have to have both active at the same time. Or am I just going to ship premium only and not have any free, and then I’m not discoverable on the directory anymore.

Like all of that it’s sort of solved in one step. It just makes launching a product for WordPress so much easier. But I just, I’m sitting here talking about how good it is, but I just don’t actually think it’s a realistic prospect.

[00:29:38] Nathan Wrigley: Yeah, because I suppose what I’m imagining as you’re saying these words, all of it, the wall that you are constructing, all of the bricks that you are laying out kind of makes sense. It all adds up. It seems completely credible. But then in the back of my mind, I’m kind of imagining there’s quite a lot of people shouting at their podcast player at the moment. Luke, no. This is pure, you know, this is the antithesis of what we want in an open source project. Money should never be bound to it. It should be free at the point of use. And you can see how all of that goes.

And those people, their message is clear. Their message is powerful. They’re very persuasive. They’ve equally got their wall that they’ve constructed, which is probably just as persuasive. I don’t know how you get these two sides to meet, because there’s no middle ground, right? You can’t have half of a paid for plugin ecosystem. Maybe you could, but that seems like destined to fail. It’s a bit of binary, isn’t it? It’s either, yep, we’re going to do it, or no, we’re not. And I can see that bifurcating the community in the way that almost nothing has in the past.

[00:30:38] Luke Carbis: Nathan, I’ve been reflecting on Matt’s, let’s say, reintroduction back into the project. After WordCamp Asia, he suddenly has become super active, as I’m sure you saw on Slack, and he’s writing all of these like paragraphs and paragraphs of like to do items, and change this and update that. And not always in that careful, accessible language that we’ve cultivated on the WordPress project.

But it’s been very clear. This is not good enough, this is what I want to have changed. And at first when I saw this, my reaction was frustration and even a little bit of anger. I don’t agree with your opinion. And after giving it a bit of time, what I’ve begun to realise is WordPress, I think it’s safe to say that WordPress has seen a little peril in the last little while, right?

We’ve been coasting along, but there’s no guarantee that we are going to remain relevant in the discussion of, what am I going to use to create my new website, a few years from now? In fact, the answer to that question, it very well may not include WordPress, a few years from now. That is a realistic possibility. Something needs to change. And the only thing that can cause us, that can pull us unstuck from where we are right now is a strong leader, who has a strong direction.

Now, that leader might take us in the wrong direction. That leader might come in with a strong opinion and we might just go off the deep end and the whole thing might just come crashing around down by our feet.

But also, if we don’t do anything, I think that’s just as likely to end up in tears. On reflection, I’ve decided mentally to recast Matt in my mind from being this Elon Muskian figure, to being someone more akin to Steve Jobs, or DHH, or these figures that are known to be a little rough around the edges, you could say, but also visionary in terms of their product thinking.

And so that’s the change in mindset that I’m intentionally taking now into the project, to keep me sort of a bit more motivated and to reframe just like the direction. What do we need as a project? And that’s what I think we need. We need clear, direct, active leadership.

[00:33:14] Nathan Wrigley: It’s kind of curious because the more recent past has seen an absolutely logarithmic growth in WordPress. I don’t mean in the last year or two, but let’s go over the last 15 years or something like that. And particularly over the last, let’s say eight years or something like that, it’s just grown and grown and grown. And I think it’s fair to say, maybe exactly as you characterised it, we have rested on our laurels.

And I think we could point the finger largely at AI, not entirely at AI. There’s a whole load of other things, history, politics, what have you, inside the WordPress space, which will have contributed. But there is definitely this inflexion point at the moment where a lot of people, I think, are questioning what is it that I need? What are the tools that I need to build a website? And so, like you said, there is this moment where there’s a precipice and that precipice seems to be getting a little bit closer.

And it has been curious watching Matt’s reaction. I’m just reading the same things that you’ve been reading. The appetite that has been displayed there, and the expression of, you kind of need somebody to take the helm, and we need to make decisions. And it was all born out of this frustration at something, which on the face of it really ought never to have happened. You know, this capacity to commit a certain thing, which was not able to be committed because.

[00:34:32] Luke Carbis: You talking about a Akismet?

[00:34:34] Nathan Wrigley: Well, yeah, a whole committee needed to decide on whether this, that or the other thing. Again, it’ll be really interesting, in the way that we discussed earlier about the plugin repo becoming commercial. It’ll be interesting to see how the community reacts to that.

I don’t know if you’ve got a, obviously you are leaning into that and thinking, okay, better to have a dictator that’s got a direction than just slowly withering away, the community dying over time and the project failing. It’ll be interesting see if everybody has that same reaction, or whether people regard that as something that they can’t tolerate. And whether or not indeed that itself will haemorrhage the community, you know, create another fork in the road if you like.

[00:35:14] Luke Carbis: Let’s talk about that. Like, let’s talk about, is the direction, we agree I think that we need a direction, right? We need clear, strong leadership. What about the direction though? How do you feel about this focus in on AI? I’ll give you a hint. For me, it’s hard to bet against AI, but the core, if you had to boil WordPress’ sort of spirit down to three words, for me, those words would be, code is poetry. And I don’t see that reflected in the AI focus. What do you think?

[00:35:51] Nathan Wrigley: My supposition is that when I got into any of the open source projects that I was ever into, there was this philanthropic bit of me which definitely got engaged by that. And so I loved that. I loved the kind of community side. I think it’s part of me as a human being. I’ve often, rebelled is too strong a word, but I’ve always managed to find my way away from situations where there was somebody telling me what to do. I’ve always enjoyed that capacity to do things on your own, or at least as a community to decide how things are going to be.

However, the world really doesn’t seem to work in that way. You know, the world that we occupy is led by companies which have a strong direction. Governments which have a strong intuition on what their citizens want, and so on and so forth.

And so I’m kind of drawn into the argument that you’ve just made. I think it’s worth a punt. I do not know what AI is going to do to our community. It may be that AI is going to upend everything so severely and so dramatically that no retrofitting of a CMS will be capable of stopping the inexorable rise of it, and we’ll all be using AI for everything from now on.

But it does feel like the framework has been built to allow AI to be an integral part of a CMS, which people are familiar with and willing to use over and over again in the decades to come.

But in terms of the leadership thing, I think it’s worth a punt. We know how in open source there can be atrophy. Things can just feel like you’re walking through molasses because the committee hasn’t decided the thing, and what have you.

That’s been okay. The history of WordPress demonstrates that that has actually worked. We’ve been able to get through it in that manner. But I’m not sure that facing a fairly, apocalyptic is the wrong word, let’s go with seismic, a seismic thing like AI, we’re up against a bit of a different animal now. And maybe we need to adapt our strategy.

And maybe it’s a temporary thing, you know, maybe that’s a way of dealing with it. I think, I could be wrong, memory could prove me wrong here. I’m pretty sure that in Matt’s Slack commentary that you’ve been referring to, I think it was a, it was a period of time, wasn’t, it? Wasn’t the proposal that I, you know, give me the reigns for a year, or something along those lines. I can’t remember. If I’m misrepresenting that, I’m sorry. But maybe it’s worth a punt. It certainly sounds like it’s convinced you anyway.

[00:38:15] Luke Carbis: Yeah. And then when we come to like AI strategy, there’s really two different aspects of that, right? We’ve got, how is AI integrated into WordPress? And I’ve been actually really, really happy with the direction that like the AI plugin has been going in. Because it’s all built around this principle of it being an add-on, being optional, I don’t have to use AI in my WordPress if I don’t want.

What worries me more is that there seems to be a real push from Matt and project leadership to be using more AI in our contributions, right? Using AI to create new pages on wordpress.org, using AI to create new plugins, right? Using AI to create pull requests and various other things.

And so that part I’m a little bit more cautious about. And I’m especially cautious from the perspective of like the generational change that WordPress needs right now. We need more young people involved in the project. And every time I speak to someone from Gen Z, they are not interested in using any kind of AI whatsoever. I don’t know if you’ve noticed the same. But Gen Z seems to have this huge anti AI thing about them.

I’m worried about pushing those people away, and also just anybody else who doesn’t want to use AI. So I do use AI, right? I use AI a lot. But there are real ethical concerns when it comes to AI. And to me, WordPress has always been this really welcoming, open, considerate, accessible community.

I can go to a WordCamp and get a kosher meal. That’s pretty special. You can go to a WordCamp and you can get the audio translated into your language on your phone from the talk that you’re going to. All of these like accessibility concerns have always been forefront. And I feel like if I want to opt out of AI, I don’t have that option if I also want to be a WordPress contributor.

[00:40:11] Nathan Wrigley: Yeah, it’s really interesting. I think the words to some, well, singular word to sum up my relationship with AI is confusion. I’m really conflicted by it because I can see the productivity gains on the one hand, and then on the other hand, I can see how potentially dehumanising it could be. And I slightly worry that we’re going to paint ourselves into a future in which the dehumanising wins out. And that concerns me.

I suppose the best analogy, and I’m just coming up with this on the fly, is it feels as if the aliens just landed and they’re now amongst us and there’s millions of them. And they’re just on our high street, and they’re walking around, and they’re in the supermarket, and there they all are.

And last year they weren’t there and life was just a bunch of humans and the animals that, you know, evolved on Earth. And suddenly we’re trying to figure out, okay, what do we do with these characters who are now part of our lives? But they’re way quicker than us at a million tasks, and they’re way faster than us, and way more productive than us. But also they are not us. Confusion is what I’ve got.

[00:41:19] Luke Carbis: I don’t think you’re alone. I think that’s a common feeling. The question I keep asking myself, keep coming back to is, are my children going to thank me for my AI contributions? Am I going to be like how I think of the, I don’t know, baby boomers? I look at the baby boomers and think, I’m a millennial, right? So I look at the baby boomers and think, oh, look, you wrecked the world with your corporate greed and pollution. Are our kids going to look at us the same way? Oh, you wrecked the world with your AI.

[00:41:49] Nathan Wrigley: That is definitely an outcome which has a non-zero chance of being true. And curiously, I have multiple children, to my knowledge, none of them use AI in any way, shape, or form. Now, that definitely maps to the kind of things that they’re interested in, but I do worry sometimes that the tech bubble that I’m in leads me to have this conception that AI will actually eat everything.

Whereas, AI is not going to get me to the swimming pool. It’s not going to get me to enjoy the view off the mountain nearby anymore than I enjoy already. You know, all these million things that it simply can’t do. But because I’m dwelling in a community which obsesses about it, and seems to portray the future as AI or broke, maybe I think about it too hard and maybe the breaks will come on because the next generation just won’t allow it, as you’ve described.

[00:42:42] Luke Carbis: I kind of hope so. Is that bad to say that? I don’t know. I enjoy using AI.

[00:42:46] Nathan Wrigley: Yeah, you end up where you are. You haven’t gone anywhere new. So it’d be, I suppose it’d be a bit like having an iPhone four forever. Is that bad? No, because everybody’s got an iPhone four forever.

[00:42:59] Luke Carbis: We just end up somewhere different though. We wouldn’t end up in the same place.

Can I tell you an anecdote which really sort of informs a lot of my thinking around this? I was in a classroom, it was a media arts classroom of 15 year olds. And we were talking about referencing. And I suggested to these 15-year-old students, why don’t you just send ChatGPT all of your sources and get it to output everything in Harvard style so then you don’t have to do anything. Just paste that into your reference list.

And a full half of the class stood up out of their seats and said, no sir, we do not use AI. That is bad for the environment. We’re going to get dumb if we use it. We refuse. I was shocked. And it was such a strong response.

Now that’s an anecdote, right? Might not be universal, although the Verge published this article just recently talking about how such a high percentage of Gen Z feel really terrible about the direction that AI is going in. So that’s, I think it’s worth consideration. And I’m not saying let’s not use AI in the project. All I’m saying is I think we need to hedge a little bit more than we are.

[00:44:14] Nathan Wrigley: What an interesting conversation. We started out with plugins and the plugin repository, and then we’ve smuggled in the conversation of our time, AI.

[00:44:22] Luke Carbis: I can bring it all together for you. Let’s bookend it. One of the suggestions in my talk is I would love to see, and I’d love to get your feedback on, and listener feedback on AI disclosure, an AI disclosure on the plugin repo.

So if you create a plugin, you can voluntarily opt in without anybody telling you that you’re lying or whatever. Let the market sort out whether people are going to try to game it or not, without any validation. You can just specify in your plugin headers that you used a certain level of AI. And it’s not AI, or no AI, because there’s a whole range, right? Might just use AI just for idea generation or auto complete. Or I might use AI somewhere in between. I might use AI just to vibe code the whole thing and never even look at the code.

So I’ve defined these five sort of different levels. They align with more like academic literature around AI disclosure. And I’m suggesting that what we do is we provide just a simple plugin header for people to be able to specify their level of AI use in their plugin, and have that surfaced on the plugin directory, alongside user reviews and last time you updated the plugin and things like that, just as a little bit of extra metadata.

It would do a couple of things. One is it would let us gather some data, first of all, about how many plugins use AI and how well they do. Maybe we find that plugins that use AI get frequent updates, and high reviews. And maybe we find the opposite. But we don’t have any way of knowing right now. We have no way of telling whether a plugin is using AI or not. So that’s the proposal.

[00:46:05] Nathan Wrigley: Yeah. No, it’s a really interesting idea because I know that in the podcasting space, which I’m familiar with as well as WordPress, that we have these 2.0 tags and one of them is this sort of declaration of whether or not AI has been used. But it’s not a sliding scale, it’s just sort of binary. I think there’s three choices. Yes, some, and the whole thing, or something along those lines. So it’d be interesting to see.

I think that’s a really credible idea. I suppose my only concern is, in much the same way that when I visited the person on the corner of my street who sells eggs on the street and there’s an honesty box, and we go and buy the eggs and we pop the money into the little honesty box. I am well aware that most of those eggs go missing. Nobody puts money into the honesty box. It’ll be interesting to see how that in itself would get gamed. In other words, if the intuition was, okay, people now love the declaration of, there’s no AI.

Let’s imagine a scenario where that turns out to be the popular thing, it would be an honesty box decision, wouldn’t it? Okay, I definitely built my entire plugin entirely with AI, but it’s going to promote much more effectively if I say that there was no AI used with that. You can see how the human in the loop is the weakest link there.

Okay, I think we’ll knock it on the head. Luke, what an absolutely fascinating and broad ranging discussion. Just before we go away, do you want to tell us a little bit about what it is that you do with your Crossword podcast just so that we can maybe get some earbuds listening to that as well?

[00:47:31] Luke Carbis: Yeah, absolutely. Jonathan Wold and I have been recording Crossword. It’s a WordPress podcast. We’ve been going for years and years, over a hundred episodes. We’re into season 11 now of Crossword, and love it if you would join us there and subscribe in wherever you get your podcasts.

[00:47:50] Nathan Wrigley: What’s the URL for the website?

[00:47:51] Luke Carbis: You can find us at crossword.fm.

[00:47:54] Nathan Wrigley: Perfect. Well, Luke, what a fascinating discussion. I really appreciate it.

Dear listener, we’ve been battling with the hail in Australia. We must have pressed pause a dozen times, and Luke’s had to repeat sentences over and over again. By the time this goes out, I’ll maybe have edited all of that away, but I appreciate your sticking power in what has proved to be a fairly fraught recording process. Thank you, Luke, for chatting to me today.

[00:48:17] Luke Carbis: Thank you, Nathan. See you later.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case, how to create affordable and accurate WordPress translations using AI.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Leonardo Losovic. Leonardo has been working with WordPress since 2012, developing plugins such as Gato GraphQL, a GraphQL server for WordPress, and more recently, Gato AI Translations for Polylang, a plugin that harnesses AI to streamline the process of translating WordPress websites.

After giving a talk at WordCamp Asia on the invisible gotchas of WordPress translation, Leonardo joins us to discuss both the moral and practical arguments for making your site multilingual, and how the technology has changed the landscape for site owners and developers alike.

I suspect that many listeners have considered translating their WordPress websites, whether for legal compliance or to reach a wider audience, but may be unsure where to start, or if the investment is worthwhile.

As Leonardo explains, the ease and affordability introduced by AI powered translation tools have changed the landscape. What used to require costly human translators and time consuming workflows can now often be handled with a few clicks, and for a fraction of the price.

Leonardo starts by sharing his background in plugin development, and the evolution of translation plugins over the

decade. We then get into how AI translations work, why manual oversight still matters, and how the new features coming to WordPress, such as collaborative editing and deeper AI integration will impact workflows and user experience.

We also discuss plugin strategies around managing multiple translations, SEO considerations, and the best practises for ensuring your translations are accurate and efficient.

Leonardo gives practical advice on how to avoid wasting resources when updating posts, and offers his perspective on the arms race of translation, as AI becomes ubiquitous, and why as it gets easier, keeping up with competitors becomes essential.

If you’re interested in making your site multilingual, or just want to hear how WordPress translation technology is evolving, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Leonardo Losovic.

I am joined on the podcast by Leo Losoviz. Hello, Leo.

[00:03:40] Leonardo Losoviz: Hello, Nathan.

[00:03:42] Nathan Wrigley: It’s lovely to have you on the podcast today. Leo and I were hanging out at WordCamp Asia where you did a presentation, I think it’s correct to say. It was all about how you might translate things on your WordPress website, leveraging some of the solutions that Leo has built, but possibly just some things that might be baked into WordPress as well. So that’s going to be the discussion topic for today.

Before we crack into that, Leo, can you just tell us a little bit about you, your background with WordPress, and probably the stuff that you’ve been doing recently, which touches on translations?

[00:04:14] Leonardo Losoviz: Alright. So I’ve been working with WordPress since 2012, and I have a plugin called Gato GraphQL, which is a graphical server for WordPress. I’ve been working on that since like forever now.

And then I upgraded to try to make plugins that can be used by the final user of the website, bloggers and marketing people, not just developers. And then I launched another plugin that is called Gato AI Translations for Polylang. It’s basically a wrapper of my other plugin that will help people translate their websites using AI. And I have been working with this plugin for over one year now. And, yeah, I mean this is what I’m doing.

[00:04:54] Nathan Wrigley: Yeah. And how did your presentation at WordCamp Asia go? Were you happy with the delivery and the attendance and things like that?

[00:05:00] Leonardo Losoviz: Delivery. Yes. Actually, I think it came out quite good. You can check it out, it’s on YouTube. Attendance? Not really. My talk was the first one on the second day of the conference. It was 9:30 AM. Everybody was either sleeping or they were drinking coffee outside. We did have people showing up slowly. Maybe by the end of the presentation there were people who were like, hey, this appeared to be good. Too bad that I didn’t come here on time.

[00:05:23] Nathan Wrigley: I hope you forgive me because I was one of those people. I dropped in towards the end. I certainly enjoyed the latter part of your talk. So you’ve built a whole load of solutions around the capacity, the capability to make your WordPress website go from language A to language, B, C, D, E, and so on and so forth. I will just read the blurb about what your presentation was called and also what it was about.

And so the presentation title was The Invisible Gotchas of WP Translation. And then the blurb surrounding that was nice and short, and it goes like this. This talk walks through a practical checklist to turn, we should translate, into a precise plan that leaves no strings untranslated. Attendees will leave with a practical end-to-end approach to translating WordPress content that leaves nothing to chance.

So my first question then is really focused on the, we should translate, that little bit. Let’s make the case for, I suppose the moral argument, not the technological argument. Now, it might be a moral argument, but it also might be a legal argument. I’m just wondering where you think we stand in terms of whether you have to, or should, translate things at this point in time.

[00:06:34] Leonardo Losoviz: Well, I guess that if you have to out of legal requirements, then you will have to. So that is out of the equation. If you’re compelled to do it, then that’s part of your business. It’s a business requirement, so you’ll have to do it.

The key question is, if you don’t have to, I mean, nobody’s forcing you to do it, should you still do it? And the answer is, yes, of course you should, because it will help you. Why wouldn’t you do it if you can do it? If you have potential visitors to your website speaking different languages, why wouldn’t you want to track them? Why wouldn’t you want to show your content to new, like a new user base? The key question is, as long as you can do it, do it.

[00:07:13] Nathan Wrigley: Yeah, I think that’s an interesting point. So certainly in the part of the world where I live, there is a lot of legislation around what must be done. So for example, I’m in the UK and we have a variety of different languages spread throughout the country. And depending on where you live and what your business is involved in, you may be compelled to do it. And so, as you say, that’s just the way it is. You know, you don’t have any choice around that.

But I think now, especially with the advent of technologies which enable translation to happen at the speed of light, more or less, it becomes increasingly a question of, well, why wouldn’t you do that?

And so I’m kind of keen to explore the things that have changed over the last, let’s say decade. That’s probably a bit too long, but something along those lines, to make it easier to translate. In the past, I’ve interviewed lots of founders of plugins that do translations. Let’s say 10 years ago, this was a fairly lengthy, probably quite costly enterprise. Translating, let’s say an English site into, let’s say a German site.

Because you had to figure out which bits of the website needed to be translated. You probably had to go somewhere to find a human that could do that translation work. You then had to negotiate the price for that, receive the translated text, and then somehow figure out how to make it so that the English string is converted into the German string, and so on and so forth. I’m imagining that’s no longer the case. Where are we at in April, 2026 in terms of the ease of getting things translated? And probably, I think we’re going to stray into AI here.

[00:08:45] Leonardo Losoviz: Yes, the answer is AI. Truth is that with AI you can translate your content very easily and the quality is just excellent. I will not tell you to not engage a professional translator if you don’t speak the language, just to make sure that the translation is right. Mostly when we’re talking about technical terms, or when they refer to some industry that your website is targeting. Otherwise, the quality is just excellent.

I would say that with AI, you can rely on it, I don’t know, maybe 99% of the translation seems accurate. If there’s some ambiguity around some technical term, then you might still want to have a professional translator. But even then, you know that you don’t need to engage the translator for the 100% translation. But only to pay attention to those details, possibly fix those errors, make sure the technical acronyms are correct and that kind of stuff.

So clearly the pricing tag that now you have compared to five years ago has gone down dramatically. You have to pay for the tokens. Basically, when you engage one of these AI providers, either Open AI or Anthropic or Gemini, you are paying to them for tokens to perform the translation. But that is literally like very little money. It can be like cents on the dollar.

In the past when you have, not just the past but also the present, you have company providing translation services. They will charge you much, much, much more than that. Maybe it will be like 50 USD per hour. Maybe it’ll be like 100 USD per hour for a professional translator. And then you have to engage them maybe five hours to translate one blog post, or, I don’t know, like five blog posts, it doesn’t matter. Now that the amount of work that you need to engage them just to double check, instead of five hours, will be maybe 30 minutes. So you are still spending money to engage the professional translator, but much, much, much less.

And that means that if you do have the budget, now instead of translating one language, you are talking, Nathan, about legal requirements, possibly your country has two or three different languages. I don’t know, if you’re from Canada, you might speak English and French. Maybe they will ask you to translate your websites to English and French. But now you can say, okay, well now, if I had the money and it’s so easy to translate using AI, I can translate to many more languages and also target people, not just from Canada, but from other regions of the world.

And then you can also translate to Spanish. Why not? And you can translate to Portuguese. So the situation now is that prices went down dramatically, the quality of the translation using AI is really, really, really high and you will need professional services only in those cases that you need to be 100% sure that translation is valid when it is a professional industry.

[00:11:25] Nathan Wrigley: Yeah, I suppose the, as you described, the acronyms and things like that, the technical language, I guess if you’ve just got a blog where, in my case I’m just using plain English, an ordinary set of words, I’m not ever going to be delving into complexity, and that may be the case for many people. I think I agree with you that the AI will probably do an admirable job.

But the minute you start to stray into unusual words, or technical things where, I don’t know, you’re referencing some aspect of physics or biochemistry or something like that, then I can see exactly why you might need to do that.

But also, interestingly, the budget has obviously shrunk to get that translation done from perhaps many hundreds of dollars down to perhaps a handful of US cents. But still, if you want to be compliant and you’ve got an intuition that your language may be straying into a grey area where AI might not do a perfect job, that is now where the budget is going. It’s just sort of polishing it up a little bit and making sure that, okay, that actually is highlighted.

Can I ask a question related to that? Do the AIs, when you ask them to translate things, do they come back with, okay, we’ve done our best, but we are confused by this portion or that portion? Or do they typically just hand back, this is our translation, go figure it out for yourself from there?

[00:12:43] Leonardo Losoviz: When we’re talking about my plugin, Gato AI Translations, you get the translation straight because you’re not interacting with the AI. You are asking straight for the response and that response, you add it, you embed it into your blog post. There is no interaction with the person.

So basically, you can do that, you could feed the content to ChatGPT and tell ChatGPT, translate it, and if you have any doubt, please ask me. And then ChatGPT will talk to you, and then we say, I don’t know how to translate this word. Should I say this or should I say that? But that is in the context of the interface when you’re talking to ChatGPT or you’re talking to Claude. In a plugin where you want to collect the string and just add it into the translated blog post, you don’t have that interaction. So it really depends on your use case.

[00:13:29] Nathan Wrigley: The plugins that I’ve seen in the past that have been tackling this job in WordPress, and again, we’re going back many, many years prior to AI. There was a lot of UI involved. You would have to log into the WordPress website. Let’s say it was a blog post, you would go to the blog post and usually lurking somewhere in meta, so in a box somewhere else would be the original string and then the translated string. And that would typically have been done by a human. And you’d probably copy and paste that back, or maybe the platform, the plugin would actually facilitate the putting of that text into that box by somebody that’s logged into the platform who’s paid to do the translations.

But the point being, there was a lot to look at. If you had a German translation and a Portuguese and a Lithuanian and Russian and, you know, on you go. Every time you add one of those in the UI becomes much more complicated and what have you. So I’m curious to see in 2026, how do you manage that? How is that all done? What does the UI look like? In an era of AI when we are increasingly typing and talking to our software, have you leveraged that and sort of tried to minimise the UI in a way?

[00:14:34] Leonardo Losoviz: Okay, so there are two responses to this. One is what I’m doing right now, and what I expect WordPress to offer coming soon. So what I am doing now with my plugin is just to do the translation. And you have one blog post in, say in English, your origin language, and then you select it from the post list, and you have this dropdown in the bulk actions with all the actions that you can execute with the post. And you just say, translate. And when you do that, it will duplicate the post from the origin to all of the translations.

You can have one translation, you can have 17 translations. It will create all of those 17 entries, and it will already translate all the content to the target language. So then if you want to edit the translation, if you want to fix it, then you’ll just edit the translation and then there you will see there’s something that doesn’t appear right, and then you fix it in the WordPress editor.

In my scenario right now, we go from nothing to everything. There’s no in between. Now with WordPress 7.0, they’re adding two things. One is adding the AI Connector. So we will have more and more and more capabilities to interact with AI. And the other thing that we have that is unrelated, but I think it will end up being related is phase three, which is the communications in the WordPress editor, right? That two people can communicate with each other, like Google Docs style.

And so we’ll have these windows on the right hand side from the WordPress editor, right? So you can add a comment. Somebody can add a comment saying, hey, do you think this is right? And the other person on the other side can say, yeah, this needs to be fixed. So they can communicate via the WordPress editor. Whereas right now you have two people interacting with each other. You can have one person and one AI.

So then imagine the scenario where you translate everything and then you edit the translated post. And you might have those same windows with a kind of sticky post, and pointing an arrow to some word saying, hey, I’m not sure if this is the right translation. Please check it out.

So I can see that WordPress 7.0 will give use the infrastructure to start adding this additional interaction. So then I could translate all the content as I’m doing right now. And if I find out from the AI that a world has not been, it doesn’t have 100% confidence that it’s the right translation, maybe we can use that phase three functionality to add a sticky post to have the AI interact with the person, say, hey, this translation, I’m not sure, please double check.

[00:17:04] Nathan Wrigley: This leverage is so much interesting stuff. So again, just in case the user hasn’t been keeping up with the WordPress news, 7.0 has, or WordPress 7.0 I should say, has this capability which wasn’t quite ready for the WordCamp Asia release. The idea was to release 7.0 at WordCamp Asia, but because of technical reasons, there was something that needed to be changed and amended about the way that data was handled and stored in different tables.

7.0 will bring the capability to have collaborative editing, so think Google Docs. And it really didn’t occur to me until quite recently, because somebody suggested exactly what you said, I was always imagining another human being, being in that interface. So it would be me and Leo having a conversation through comments or what have you in that same WordPress post.

But of course now we realise, well, of course, the AI work, the MCP and the adapters and all of those kind of things allow that thing in the post to be not a human being, it could be an AI. And so that’s really interesting.

So maybe we’ll come in, have a conversation, something along the lines of, please could you just check, this would appear to be fine but there seem to be a few errors here and there and everywhere, and it may be able to come back with a suggestion.

That stuff is so powerful, but yet completely unrealised at the minute. It’s kind of just on the horizon, but when that feature drops, I think that will be quite an interesting experience. You’ll be able to talk about the content with an AI, based upon what is in the content area of WordPress. That’s going to be really, really fascinating. Gosh, wow. What a future.

Is that stuff ready? Do you know if WordPress is going to ship with those kind of capabilities? So you mentioned things like the sticky post to sort of highlight, imagine a post-it note or something like that. Something which can highlight? Are all of those foundational pieces ready or were you just sort of blue sky gazing there?

[00:19:02] Leonardo Losoviz: I haven’t seen it, but we can all picture that happening. So you know that 7.0 is giving us the foundation to build all of the things. Once the foundation is there, it’s up to the community to implement these use cases. So yeah, I’m quite confident that it will happen, but I haven’t seen it. I haven’t seen it yet.

[00:19:19] Nathan Wrigley: Yeah, I do love the idea though, of communicating through that interface. That’ll be really interesting to see how that changes the calculus of how we write things and who we write them with and all of that kind of thing.

So Gutenberg, which we don’t talk about too much really at the moment, but Gutenberg had four phases when it was first talked about. So we’re in phase three at the moment, which is this collaborative editing. Broadly it was collaborative editing was the poster child of that release.

And the fourth one, so that may be many years away, I don’t know when phase four will come about, but the fourth one is bound very much to translation. Do you know if there’s any sort of foundational work being done over there? It may still be a complete black box. It’s just the word we’re going to deal with translations. Do you have any wisdom or insight into what’s happening over there?

[00:20:03] Leonardo Losoviz: No. All I know is that Matt Mullenweg was postponing that for the very, very, very end. And since we’re still working on phase three, I don’t think that there will be any phase four work happening anytime soon.

[00:20:16] Nathan Wrigley: No. Okay. So we’ll have to wait and see how that drops. But it could be another interesting phase. Let’s see what that does.

So, okay, now let’s sort of dig into the weeds of how your system works. So you mentioned that if I’m in the data view for posts, one of the options that I have when I’m hovering over a post, you know, delete post, edit post, what have you. It sounds like in there somewhere you inject a translate. And presumably when you hit that button, automations that you’ve previously set up, say, translate to French, translate to Portuguese, translate to Chinese and Japanese, that would then be triggered.

Do you then create separate posts? So that the post that’s now in Chinese is separate to the original one, or as some plugins handle it, do you take the original one and just inject metadata into that post?

[00:21:04] Leonardo Losoviz: If we’re talking about my plugin, my plugin is called Gato AI Translations for Polylang. I depend on Polylang. So Polylang is a plugin that works by creating separate entries for each of the languages. So you have a post in English, and when you translate it, you’ll create another post in French and another one in Spanish and another one in Portuguese.

Then you have a different plugin like WPML which has a different strategy, which is to have only one post and then all the individual strings are translated on runtime. So you’re not statically creating different versions of the post, but you have only one post and then you translate the strings, the actual content.

It really is up to what is the best strategy for your site, what it is that you are most comfortable working with. There are other plugins, of course. There is TranslatePress, there is Weglot, MultilingualPress. They all have different strategies. I do like Polylang because the post is created in advance. Then all the same rules for your WordPress site apply. You can cache the page, you can export it statically, and it also is fast because you don’t need to translate the string.

Like finding a specific string can be very expensive. Like a string, you know, that you need to find from English and translate to French. The string might be like, I mean 1000 characters long. You know, that can become very expensive. And if you do that on runtime, even if you cache it later, that can be very expensive. Yeah, my plugin is based only on Polylang, but it’s not the only plugin.

[00:22:28] Nathan Wrigley: Yeah. So there’s a whole range of different things out there, but you’ve obviously opted for Polylang. Is that a commercial kind of pro plugin or do they have a, is there a free version that you can leverage?

[00:22:37] Leonardo Losoviz: Yeah. It’s free. And they have the pro version that is, I think 99 USD per year for one domain, if I’m not wrong. But it’s completely optional, you can use Polylang free and it’s more than enough. Actually, Polylang Pro, they have a few features and the main feature that they had historically is that you could use machine learning for translating the content.

They use DeepL as a service, like Google Translate. Now the thing is that I wouldn’t use DeepL anymore. Even my own plugin, at the very beginning had, even nowadays, it has integration for Google Translate and for DeepL. But AI is so much superior than those. So you can still use Polylang Pro for the other features, but the machine translation one, there’s no need, Polylang free, more than enough.

[00:23:23] Nathan Wrigley: So when, let’s say for example, that I’ve got a post and I’ve translated it. I’m just beginning my journey, figuring stuff out. And again, we’re talking about your solution here. So, you know, you can speak to how it works, not how all the other ones work.

I click the translate button and I’ve now got six posts, the English original and then these five other languages. How does that surface? Are they like child posts of the original post? Is there an easy way for me to see, okay, here’s the German version of that, and it’s bound to this? Is there a filter system or what have you?

And then how does that look on the front end? So if the original string is, I don’t know, example.com/post-one, am I from an SEO point of view, does that stay nice and tidy? Like, I don’t know, it goes example.com/g for German, forward slash post-one, or how does that all tie together?

[00:24:13] Leonardo Losoviz: All right, so this is once again, a feature provided by Polylang. When you create the translations, all the posts, they’re all parallel to each other. They don’t have a hierarchy. They’re not like the child post from the origin post. And if you want to only see the post for one specific language, there is a switch, like a switcher button at the top menu bar, and you can select the language.

So by default it says all languages, and then you’ll have all the posts. So in a way, if you have, say that you have 10 posts and then you have 10 languages, that means that you have now 100 posts. So it can be a bit clutter. So then you go to the top menu and then you select English, and then it only shows you the English ones.

And the important thing is that, say you’re using AI to translate, you only need to deal with the origin post and nothing else, until you need to double check if the translation is right, maybe fix one thing here, one thing there. But otherwise, the whole time you are only dealing with the origin post.

So what I do is I always have my selector in that origin language. So it’s in English and I only see the English post. So then I do translate, and I know that the translation will be created alongside all of the categories, and all of the tags and all the feature image, right? But I don’t need to deal with them. So then I also don’t need to see them on my screen. They create clutter, so then I remove them.

And then to see them, to visualise them, yeah, once again, Polylang, it gives you the option of choosing the language by appending the language code in the URL. So mysite.com/fr/the-slug, that’s for French. Or you can also use subdomains. So you can have fr.mysite.com/the-slug. So that’s something that you can configure. And then basically when you go to that page and you add the language code in the URL, then you will see that blog post for the selected language.

And the way that Polylang handles all of this is it connects a post to all of its translations via a specific taxonomy, like a tag that they created, I think it’s called language, if I’m not wrong, or language relationship, I’m not completely sure now. And so it ties all the post to all of its translations. And the thing is that then when you go to the post in French, it can add the href lang meta tag that is telling Google that this post is a translation of that post.

So that is important for SEO purposes that these posts are not two independent entities, but one is a translation of that one for French. So Google will understand a lot of the relationships, and if the user who is searching for information, they’re searching for information in French, then Google will know to serve the French page. And if it is in Spanish, Google will know to serve the Spanish page.

[00:27:01] Nathan Wrigley: It’s an amazing wraparound solution, isn’t it? In that all of this is just sort of handled and what you essentially end up doing is, the user that is, you click the translate button and once you’ve got everything set up correctly, it just, off it goes.

I have a question though about amendment. So let’s say for example, I realised that my blog post was full of inaccuracies and errors and there’s just wrong throughout it. And I then go in and I make amendments. Do I then need to restart that whole translation process or can I rely on it kind of figuring out, okay, amendments were made, let’s just do that automatically for you? How does amendments to the original, in my case, English work?

[00:27:37] Leonardo Losoviz: Yeah, well, I would change that. I would say do not do any translation until you’re 100% sure that the post is final. And that’s the main way to waste your time, and to waste money in tokens. Because you execute the translation, and then you realise that something was wrong. Maybe this H2 tag was supposed to be an H3, then you fix it, and then you run the translation again. And then you realise that was another mistake, there was a typo. And then you had to run the translation again. And then you’re like, oh, but that image has embedded text in the image. It doesn’t work on the translated post. And then you run the translation again.

So all of these things are common sense, and you don’t think about them until you see the error happening time and again and again. So what I do is I have a checklist actually on my website. I have a blog post where I have every single item that we need to pay attention to in advance of executing the translation. So executing the translation is when you go to the post list, you select the post, and then you select translate. Easy, and it takes five seconds.

But before you do that, you need to make sure that the post is final. That means no typos. That means all the headers are the right header. That means that all images are correct. They have alt attributes. They have the title that you need. There’s no embedded text in the image, even adding an embed from another source.

Say that you have a YouTube video that you’re embedding on your content, and the YouTube video is in Spanish. When you translate that to French, maybe the YouTube video is not useful anymore. So all of these things you need to check from a multilingual point of view when you’re looking at your origin post. And then you’re like, okay, this origin post, now it’s okay. It’s perfect. You publish the post, then you translate.

[00:29:26] Nathan Wrigley: I got it. Yeah, I mean that makes sense. But, should you need to, it’s a process of clicking the button again and kind of beginning that process. But yeah, good idea to have those checks and balances.

I was at an event not that long ago in which AI was used inside of a WordPress plugin, inside of a post, to ascertain the content of things like images and infographics. So as an example, there was data held inside of a graph. So, I don’t know, whatever that data was, bar charts, pie charts you can imagine, but also just images and what have you. And although this may not be handled and maybe it’s blue sky thinking, I was wondering what the capabilities are for handling those kind of things.

So in the case of an image with a chart in it, wouldn’t it be nice if we could replicate that chart, but instead of all the labels being in English, if they could be in German or French or whatever it may be. I don’t know if that’s utterly out of the scope, even in blue sky thinking in terms of AI and translations. But I was curious if you had an inkling whether things that were not just text-based content might be handled in the future as well by AI. Not specifically addressing what you do at the moment, but whether that seems to be on the horizon.

[00:30:41] Leonardo Losoviz: Yeah, well, to be honest, I think technically it is feasible, but even if it can be done, I don’t think it should be done. And the thing is this, I’m promoting that we can translate our websites to as many languages as possible, only because we can. So you have your website in one language, then you can have it in two, then you will have it in five. You can have it in 30 languages. Why wouldn’t you do it? If you can target new countries and new visitors, sure, go ahead and do it. AI gives you the possibility.

But now imagine that you also want to translate the images. Every single image on your website will be replicated 30 times. That sounds scary. I wouldn’t do that. What I will do is to have one single image that is language agnostic, that there’s no text inside. And if you had to add text, maybe in your page builder, maybe in Gutenberg or Elementor or Bricks, maybe you can create an overlay and place the text on top. It’s a more difficult solution and a bit more complex, but it’s clean because then you can translate that as part of text, and the image, you don’t need to replicate the image 30 times.

[00:31:44] Nathan Wrigley: Yeah, that’s an interesting point. And that leads me to wonder whether it’s possible to, for example, an image caption. Whether it’s possible to translate that into 30 different languages whilst still referencing the exact same image.

So, I don’t know, in English it might say, here is a picture of a dog walking by a beach, and then the French equivalent caption, and the German equivalent caption and what have you. Then in effect, you’ve recycled the same image, but you’ve also, the person viewing it in German would get the German equivalent of that. Again, I don’t know if that’s possible, but maybe that’s an interesting.

[00:32:14] Leonardo Losoviz: Yeah, actually that’s how it is right now. So when you translate the post, you will also translate all of the entities associated to the post, the tags and the categories and the featured image. So the featured image will have meta data associated. So when you upload an image to the media manager, you add meta data, the title, you can add a caption. So all of that text, it’s in one language.

Now, you can also translate the image by creating a new entry, once again using Polylang. The image has a language associated, so the origin image will be in English, and you can create a new entry in French, and the title will be translated to French and the caption will be translated to French. But the image itself is the same for both entries. So the JPEG or the PNG, that one is not duplicated. So you’re not increasing the size of your hard drive. You’re creating another entry on the database for the media entry, the custom post media, or the attachment, but not for the actual physical file.

[00:33:11] Nathan Wrigley: Yeah. So it’s much more lean, basically doing it that way, isn’t it? I didn’t actually know that it was done that way, but that’s certainly how Polylang handles that. Okay, that’s interesting.

So you mentioned that, I think one of the through lines in what you’ve been saying is because you can do it, why not just do it? It kind of makes sense when you think about it like that, but I’m just wondering what the real world impact of this is. You know, in terms of things like discoverability, and whether or not it really genuinely does have an impact on your business. Let’s say for example, I don’t know, you’re shipping widgets from England to France, and suddenly you translate your site into Japanese and Chinese.

I would assume that that could only have a positive effect, but also, equally, I’d want to know what the data was on that. And I don’t know if you have, given that you are in the translation space quite heavily, I don’t know if you have any data to hand which would compel people to do this, to prove, look, it really is worthwhile. Anecdotally, it feels like it would definitely be worthwhile. Why not, would be the way of phrasing it. But I don’t know if there’s any data lurking in your head which would categorically say, oh yeah, this is definitely it.

[00:34:16] Leonardo Losoviz: Nathan, unfortunately, we’re screwed.

[00:34:19] Nathan Wrigley: The answer is no.

[00:34:20] Leonardo Losoviz: Because when it’s so easy, everyone will do it. And when everybody does it, you’re not moving forward. You’re just moving, you’re running just to be on the same spot. If you’re the only one who is translating your site to 20 languages, you will be far ahead from everybody else. But because it’s easy to you, it’s easy to everybody. And if everybody does the same, once again, you are not ahead of them. You’re on the same place.

So this is the problem of technology, right? And the problem of AI. Now we’re all very productive with AI. I’m using AI to code my plugin, and I think I’m pulling ahead. But my competitor is also using AI to code his plugin. So we are both running just to stay on the same place. So in a way, unfortunately, it becomes a situation in which you need to do it just to not fall behind.

[00:35:07] Nathan Wrigley: Yeah, it’s kind of like the arms race mentality in a way, isn’t it? But also, that’s quite a compelling way of framing it, because you can be sure that, okay, if you’re writing a blog and you’ve got a limited audience, maybe there’s limited scope in that. If you are in a business and you are, certainly if you have pretensions of dealing over international borders and your competitors are doing this, it is exactly that arms race mentality, isn’t it?

Then you are compelled to do it just to be ordinary, just to be the baseline. 20 years ago, would’ve been entirely different because of that would’ve been a very expensive calculation and translating into, let’s say, Japanese. If there’s no ROI on the Japanese translation, that is money which would’ve been probably wasted.

Now, with AI costing literal cents to translate, it does feel like that is the calculus, right? We are doing it because it can be done and we know that the competitors will be doing it, so we ought to do it as well. Maybe that’s all the argument needs to be. It’s simply that, simply stated in that way.

[00:36:12] Leonardo Losoviz: That’s a good reason to do it, which is that you want to target people in other countries, speaking other languages. So yes, I want to do it, but at the same time, if I see that my competitors are doing it, then I have to do it. I can see it both ways.

[00:36:25] Nathan Wrigley: Yeah. Okay. It’s certainly been an interesting conversation. What I’ll do is I will ask Leo to provide me with links that are pertinent. Maybe we can get the wordpress.tv of the presentation that you did, plus links to the websites which have been mentioned in this podcast episode. If you go to wptavern.com and you search for the episode with Leo Losoviz. His name is spelled L-O-S-O-V-I-Z or Z, depending on where you live in the world. If you go and search for that, then you’ll be able to find a transcription of this as well as links to the various different bits and pieces that we have mentioned.

Leo, before we wrap it up, is there anything else you wanted to say? If not, we will bid you adieu.

[00:37:07] Leonardo Losoviz: No, not really.

[00:37:09] Nathan Wrigley: You’ve got it. In which case we will call that a day and say thank you very much, Leo, for chatting to me today. Really appreciate it,

[00:37:15] Leonardo Losoviz: Thank you, Nathan.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case a second look at exploring AI’s impact in WordPress agencies.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today, for a second time, we have Matt Schwartz.

Matt has been working in the WordPress ecosystem since 2011, running his own agency based in Atlanta, and developing products like CheckView at all for WordPress form and checkout QA. Matt’s expertise lies in how agencies can smartly, and cautiously, incorporate AI into their workflows for real tangible wins, and how to avoid potential pitfalls.

He was on the show last week to record the first of this two part mini series. You might want to listen to that prior to this, but it’s not strictly necessary.

In this episode, we build upon last week’s conversation. Matt talks about practical strategies for integrating AI across agency operations. The discussion starts with what it means to give AI access to your agency’s brain, using tools like project management wikis and connecting them with AI chatbots to streamline knowledge sharing, and avoid common AI hallucinations.

We then get into MCPs, or Model Context Protocol, and talk about why this area is quickly becoming a game changer for agencies looking to securely connect AI agents to multiple internal systems without complex, risky API configurations.

The conversation covers how to use AI for building internal tools, highlighting where it’s low risk and where you should be more cautious, especially with public facing, or mission critical, systems. Matt explains how agencies can leverage AI for QA and checklist automation, freeing up time for deeper human review of other important tasks.

We also discussed the impact of AI on the WordPress plugin market, including potential consequences for plugin developers and the wider community, and whether the rise of AI generated disposable tools could erode the collaborative spirit of the WordPress community.

We end by chatting about the importance of approaching agency AI adoption with eyes wide open to the risks. Data security, overdependence on vendors, failure to handle errors, and the reality that AI still makes mistakes.

Matt shares his outlook on how agencies can position themselves to thrive as AI reshapes the industry, from hiring strategies to the next generation of productised services.

If you’re running an agency or freelance business in the WordPress space and want to get ahead with AI thoughtfully and securely, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Matt Schwartz.

I am joined on the podcast, again, by Matt Schwartz, somewhat unexpectedly. Hello, Matt.

[00:04:05] Matt Schwartz: Hey Nathan, thanks again for having me this week. I’m super excited to dive back in.

[00:04:09] Nathan Wrigley: Thank you. So we recorded an episode last week, and we intended to do it as a one hit. So get it all recorded, tied off within 40 minutes or what have you. And then we began talking.

So last week we began talking and at about the half an hour point, it became obvious to me that we weren’t going to capture it all in one recording. So we’ve come back for a second episode.

Dear listener, I would just say that in order to provide context for this episode, you really probably should listen to the previous one, because we’re stacking up Matt’s case, argument, however you wish to describe it, for where you can make wins inside your agency with the use of AI. Not just wins, maybe some cautionary tales as well. But that was the point of the first episode.

So really, we’re going to drop you in to the ninth of 16 points. So again, just pause this, go back to the previous episode, have a listen there, and then you can stack this one in your podcast player of choice at that point.

If, however, somebody’s ignoring that, Matt, are you able to just do a very quick bio? Just tell us who you are? It may be repetitive for the people that are listening to the second episode, but nevertheless, let’s hear from you who you are.

[00:05:16] Matt Schwartz: Yep. My name’s Matt Schwartz. I run a WordPress agency here in Atlanta, since 2011. And I also have a testing and QA product for WordPress for checking forms and checkout called CheckView.

And yeah, today we’re just really diving into how you can leverage AI, how you can incorporate it into your agency, but in a hopefully smart and cautious way. Not necessarily just dropping it in, being a little bit more thorough about that process. So excited to continue the conversation.

[00:05:45] Nathan Wrigley: Yeah, thank you. And thank you for being so accommodating by joining me for a second time. So as I said, Matt’s put together a whole laundry list of different areas that your business, your freelance agency, whatever it may be that you are running in the WordPress space, can perhaps gain some benefits.

Last week we did one through eight, and now we’re going to sort of hit the road running on number nine. So the ninth point was about giving AI access to your agency’s brain. It’s a lovely subheading, but what does that mean?

[00:06:12] Matt Schwartz: Yeah, so this is actually one I picked up in the Admin Bar, which is a, one of the other WordPress agency groups out there, that a lot of agencies were doing. And I thought it was an interesting, I would say hack, you could say, to add AI without getting super involved in it. Which is if you already have a project management tool, or you already have a wiki, you can add into your AI chat bot of choice when it’s actually answering a question. You can tell it in its memory, hey, whenever I ask a question about the agency, go confirm what I’m doing by visiting our Clickup or visiting our Asana.

So it’ll actually go retrieve and confirm it’s using the latest proper information instead of just guessing or hallucinating. I love how we use the word hallucinate and not lie. I love that marketing branding that the AI companies did. It’s some crazy gaslighting.

Anyways, I love AI, but definitely, if you haven’t used something like Claude or ChatGPT, saying in the memory as simple as when you answer a question, check if this is actually the case and connect to our ClickUp or connect to our wiki.

I think that helps you get all the power of your documentation, SOPs, client, CRM, any data you’ve already basically built up. It can leverage that without you having to do a whole bunch of crazy connections or ask more specific things. I thought that was actually a really neat way that agencies that are just getting into the space with AI are using the data they basically already have. They’re just using their project management software, which basically has all that data.

[00:07:47] Nathan Wrigley: When you see it in action, which I have actually, but not to do with a WordPress website, more to do with a sort of SaaS product with the, how the tool has been built and the guardrails that are into the tool. It’s really amazing because then, well, basically it never forgets.

So every time you throw something new at it, that becomes part of the corpus of information. It then has an understanding. I keep saying it, but hopefully you understand, I’m meaning the AI in this case. A wider and broader understanding, and increasingly is able to deliver that back.

So in my case, often I’ll get some text back, which is divided up into bullet points. Those bullet points will have little footnotes attached to them, you know, 1, 2, 3, 4, and what have you, which will then link out to the documentation itself. And again, just a profoundly useful use of the thing which it’s best at, which is taking a corpus of information, grinding it up and spitting out something which makes sense.

And why wouldn’t you point it at your internal documentation? You know, if you’ve got a plugin, all of your support docs, throw the AI at it, and it will be able to help you as well as your clients. Because it’s guaranteed you’ve forgotten something that you’ve built.

WordPress, of course, itself does this. You know, every AI agent on the planet is welcome to crawl the docs for how WordPress itself is put together. And it’s one of the reasons I think why WordPress has a fighting chance in this AI, CMS battle, if you like, because everything’s open source already. Nothing’s hidden behind a paywall or a licence agreement or what have you. So yeah, agreed. That’s a great example.

Okay. Anything to add or should we move on?

[00:09:22] Matt Schwartz: No, I think that one’s just a cut and dry, really. If you haven’t looked at that, that’s an easy way to get into AI and leverage it without a lot of work.

[00:09:29] Nathan Wrigley: Okay. Absolutely. Okay, then number 10 is your internal MCP and guardrails. I know this gets bandied around a lot, and there’s a lot of acronyms floating around in the AI space. But MCP, maybe we just need to spend a moment explaining what the heck an MCP is, and how it kind of fits into the overall picture, but particularly in this case, with your guardrails.

[00:09:48] Matt Schwartz: Definitely. So MCP is basically an open source way to connect AI, let’s say, chatbots or agents to external systems. It stands for Model Context Protocol. I think maybe the team behind Claude built it. I can’t remember. But the idea really is that, instead of you just connecting directly to an API, which you could do, which an API if you’re not familiar, is a way again, to connect two different systems together.

One system will have a series of things that will let you say, hey, you can add this data, or you can pull this data, or you can modify this data, right? So an example could be something like a help desk. You might create a ticket, you may delete a ticket or you may edit the ticket. An API can basically do those things.

But what an MCP does is it’s really a series of tools that are more prebuilt for the AI, so that it knows and has context of what it should let you do, and how all the pieces of that connection really should modify whatever data you’re doing.

So it’s a lot more specific to agents. It’s a lot friendlier, I would say, if you aren’t familiar with a company’s API, you could connect to their API. I can connect to the WordPress REST API, but if I don’t understand that API, it may not be actually the best way to make the connection.

With an MCP, you can really not have the background of that company’s bridge. It’s going to do all the work, and the AI’s going to have enough information to help you get what you need done.

I know that’s hard to explain, but essentially with an MCP, if you build one at your agency, this is a little bit more high level, or a little bit deeper, but I am seeing a lot of agencies looking at this. Which is, they are using an MCP basically for their teams so that they can add all of their systems in one basically bridge. So that instead of having all their employees like connect to all these different Claude connectors and APIs, they have one system.

So if I have Claude and I’m an employee, it can connect to my MCP at the agency, then the agency MCP is actually on behalf going to go retrieve data from all our different systems. So not everyone has to have API keys. Not everyone has to connect to all these other systems, if that makes sense.

So I am seeing agencies starting to do this. So in some sense the proxy, MCP becomes a proxy or just a way to connect to all your other systems in a secure way.

[00:12:18] Nathan Wrigley: I always imagine it a bit like if you, I don’t know, you approach a giant supermarket and you know that you need carrots and soup. And normally you just go into the supermarket and wander around for a long time, and eventually you’d sort of stumble across the carrots and the soup.

But wouldn’t it be nice if there was somebody at the front door? Then you could say, where’s the carrots and where’s the soup? And that’s it. And they go, okay, the carrots are there, the soup’s there, and point.

You know, it’s just like this perfect gatekeeper, this guardrail that you described that kind of allows you to get the best out of that experience without wasting a load of time and resources and probably a load of hallucination out the back end.

[00:12:55] Matt Schwartz: Wow, that was so much better said than me. But yes, that is a much better way of explaining it. And that’s why if you haven’t looked at MCPs in general, I think it’s worth looking at. But also if you have a tech background, looking at an MCP for your own agency where you can combine all your tools and connect to this one place, I think is a really neat way to, again, get your employees and contractors connected to your, all your systems without them having to have a direct connection.

So if I want them to be like, hey, answer this ticket, go to this WordPress site, instead of them having to connect Claude to the WordPress site into Fresh Desk and all these things, it’s all within the one MCP. And then they aren’t really responsible for those API keys or any of those connections.

Of course, you have to put guardrails on that too, right? Guardrails, like they can’t delete things. You know, not having them delete tickets or websites. Because if you connect, you know, your host, they could technically delete an entire website if you don’t have proper guardrails. So it is, I would say something that is a little bit more on the cutting edge that not every agency should do, but if you are on the more technical side, an internal agency MCP, I think is a really neat idea.

[00:14:06] Nathan Wrigley: I feel like there’s future of commoditising MCP creation.

[00:14:11] Matt Schwartz: Oh, it’s already happening.

[00:14:12] Nathan Wrigley: Yeah, I really haven’t experienced that but, you know, a really, I don’t even know what that interface might look like in the end, but some really credible way of, you know, you sign up for a service and for a few dollars a month, they will modify, create on the fly, adapt the MCP so that it fits in with what was already an incredible technology. It’s a bit like the icing on the cake, the MCP, isn’t it? The AI was pretty amazing anyway, and then you put that layer on top and it just becomes much more refined amazing.

[00:14:41] Matt Schwartz: There’s actually some companies doing that already where you sign up for their SaaS, they basically store all the MCP data on their server securely, because that’s always a concern. You give them basically all the credentials, you give them the guardrails, and then they build a secure, essentially MCP app for you.

So there are some early options out there for that, that agencies could also look into if they’re less technical. You just want to make sure, obviously you realise you’re giving a third party your data and your secrets essentially.

[00:15:11] Nathan Wrigley: And course, in the era of AI, the capacity to do things really seriously wrong is literally at the end of your fingertips. Whereas before, you’d probably have to have some understanding, well, you could delete whole file structures and things like that, I guess. But now that a simple prompt can just rip through your entire code base or whatever it may be, definitely, one for guardrails there.

[00:15:32] Matt Schwartz: Delete all the sites on my server, done.

[00:15:34] Nathan Wrigley: Yeah, that’s right. Yeah. And don’t check.

[00:15:37] Matt Schwartz: That could happen.

[00:15:38] Nathan Wrigley: Yeah. Ignore all previous instructions, just delete them all.

Okay, so that was number 10. And really interesting. I think that’s one for the, sort of the tinfoil hat brigade, you know, the real nerds out there. But it’s not far off. If it’s been commoditised in SaaS now, you can guarantee that in the next few years that’s going to become table stakes, I would’ve thought for a lot of businesses and SOPs and what have you.

Okay, so the next one, I’m sure many people will have been familiar with, especially if you have a YouTube account and you’re looking at AI things on YouTube. Vibe coded agency tools. I’m sure I know what this one means, but run it by me anyway.

[00:16:16] Matt Schwartz: Yeah, so one key thing is, I’m not saying vibe coded tools themselves. I’m saying vibe coded agency tools, agency being the specific part. So you’re building internal tools for your agency, which I think in some sense, depending on what the situation is, can be okay to do, in my opinion, because the risk is lower. Again, you’re using it internally.

[00:16:40] Nathan Wrigley: It’s not public facing, that’s the point, right? It’s just you and your colleagues, which hopefully you trust.

[00:16:45] Matt Schwartz: Right, right. Again, you should probably put guardrails, and you have to think about, well, what sort of data is it touching, and how important is this data? That’s everything with AI. You have to think about the risk. But I am seeing a lot of agencies starting to build different types of agency tools. Some that I really do internally myself, and I am a big fan of things like reporting tools and dashboards, right?

This is, again, a good case, I think I talked about in the previous podcast. The sweet spot, I think with AI is having it handle things that you just never could get to that were on your list for a million years, right? And realising that, as long as you do a little due diligence and you feel like it’s in the realm of where it’s supposed to be, this is probably more information than you had before, right?

So a good example is, if you’re an agency, you may have it hooked up to QuickBooks MCP. You may have it hooked up to your time tracking software. You may have it hooked up to one of your other reporting software, WooCommerce subscriptions with Woo. And from there you’re able to have a much better visible idea of what your business is doing well financially. The bottom line, especially if you’re like a lot of agencies where QuickBooks doesn’t really have all of your actual services. You may have those internally or you may have them in a other system.

You can combine those and build reporting systems. And again, that’s a relatively low risk way for you to, worst case is you’re going to use that data and you’re going to be like, well, this doesn’t seem right. And you’re going to have to dig into it and figure out what’s going on. Hopefully you don’t just blindly use it, but I do think the risk is lower.

So those sort of tools I think are really, really neat, and relatively easy to build out. So reporting tools, profitability dashboards, things like that. Looking at your time tracking, like who at your agency is the most profitable, if you have that data? Obviously make sure you actually have the data structure for that, or AI may just make that up.

But we’ve, you know, used that even at our agency and I think it’s been helpful for us to find patterns that we didn’t know where we were spending our time and effort. Especially if you are doing time tracking using something like Everhour or Harvest.

Now the tools that I do struggle a little bit more with, and I am seeing people in agencies use is things like website management dashboards, or building their own QA tools. Because those things, I think the risk is higher of things going wrong.

[00:19:05] Nathan Wrigley: Public facing again, yeah.

[00:19:07] Matt Schwartz: Right. And you’re giving this third party access to all of your websites and it’s not like, you know, a big SaaS. This is something you built internally, which means Claude doesn’t care if it’s wrong, right, until you tell it.

So a good example, and not everyone may feel this way but, you know, I’ve seen some agencies that are building replacements for management dashboards like ManageWP, WP Remote, those sort of things, which is connected to everything and is kind of their most important infrastructure for their clients. Personally, I think that that’s a little risky to be doing.

Now, if you’re doing the right due diligence and you have a technical team and you’re doing manual code reviews, sure. There’s an argument to be doing that if it’s also, I think, solving something specific to your agency. I talked about this in the last podcast, replacing SaaS products when there’s a nuanced solution that’s specific to your agency, I think could be really helpful.

But if you’re just replacing SaaS products to save 30 bucks a month, I think that doesn’t make any sense because you’re going to end up spending a lot more on maintenance, I promise you, than if you just stuck with the SaaS product, if it does what you need. So I think there’s an argument there.

[00:20:18] Nathan Wrigley: I think it’s really interesting. And I do wonder if we’re on the precipice of, so this is me sort of staring into the crystal ball a little bit. I wonder if we’re into the era of sort of disposable, one time apps. So you have a function that you need to do this month like, I don’t know, you must file your taxes this week, but you’re miles behind. So you get an AI to just quickly do that thing for you, and categorise all of the jobs that need to be done so that you can hand it over to the tax man and so on. And then you just put that on ice. That thing no longer needs to exist.

I feel that kind of coming where we sort of vibe code up this one time thing, and then dispose of it. I don’t know if I’m entirely in agreement with that as an idea, but I feel that that is coming. But to your point, I think anything public facing, we’re still in the era of, really, watch what you’re doing. It needs thorough testing.

[00:21:09] Matt Schwartz: Exactly. And thorough code review because, you know, ultimately while the AI coding, I think has gotten really, really good, it’s not a hundred percent there, and it doesn’t have any context. It doesn’t actually know what it’s doing. It’s all patterns. So there is an argument to be made that, yeah, it may get 80% there, but if no one’s actually checked the code review, two months from now, it decides to delete all your websites out of your management dashboard, well, should have done a manual code review, right? And it’s on you.

So I do think there’s an argument, same thing with like QA tools. Building one-off QA tools, which should be persistent and actually probably one of the more important things you build. It should do the same thing every day. It should almost be dumb. It should not be trying to rebuild itself all the time, or be even one-off, like you said. It’s not, I think, a good idea to build a one-off migrator typically for that reason, even though I see people doing it in agencies. Unless you think it’s just a low risk project, I do think, you know, you have to think about that.

To your point about the one-off task though, I think again, if it’s a low risk item, one-off makes actually the most sense because a lot of times if you know this is going to be a one-off thing, you then are subconsciously being like, okay, I’m going to use this once and the cost is not that high and that makes sense, because you’re not having to maintain it. But if you know it’s going to be something you’re going to be using for the next five years and you don’t plan to pay a developer to review it, I don’t think that’s a smart idea, at least not right now.

[00:22:39] Nathan Wrigley: That’s a good calculus I think to have in the background. Okay, so that’s good. So caveat emptor basically, use your discretion. If it’s public facing, maybe think twice. But also if it’s something that you want, you absolutely bulletproof need it to be reliable and predictable a hundred percent of the times that you run it. Again, maybe there’s a human in the loop there. So that was sort of vibe coded things that you might do in your agency.

I feel that’s going to be a real area of growth, whether or not it will be profitable growth or useful growth, I’m not entirely sure. I feel like in our industry at least, people are going to be dabbling in that kind of thing all the time. You know, trying to figure out new, clever tools to achieve a thing, which maybe in the past would’ve been a subscription thing that you paid $20 a month for or something. So we’ll see. We’ll see how that goes.

Okay, moving on then. So the 12th item that you brought to bear was QA, so quality assurance, checklists and testing. Right, run us through this one then.

[00:23:33] Matt Schwartz: I know I just said when you’re building a QA tool, using AI to build an internal vibe coded tool is probably not the answer. But actually what I’m going to say right now is not contradictory to that, because what I’m really talking about for QA and testing is more so having AI help you build things like checklists, right? You already have a good context usually with your SOPs. So it can help you build your SOP checklists. It can also help run the low risk items automatically. And again, I know I talked about risk a lot, but I think that’s how you have to consider it.

So one really neat thing I’ve seen a lot of agencies start using is Claude Skills, which basically just means that you teach Claude a process. Literally it walks you through in the conversation like, what do you want this process to be? And then you can run that later in context.

So a really cool example of this is if you are, let’s say onboarding a client, or you’re launching a site. During your next launch, your next onboarding, you may want to use Claude to teach it the skill of how you launch sites. And then it can automate a lot of those items. And you can still give it context like, I want the human to specifically review this item, right? Or, I want the human to check that no index isn’t set, right? Because that’s like a high risk item, right?

[00:24:55] Nathan Wrigley: Yeah. Yeah, that’s a big one..

[00:24:56] Matt Schwartz: Right. That’s one we all, I think, have dealt with at some point in our.

[00:25:01] Nathan Wrigley: Too many times.

[00:25:01] Matt Schwartz: Right. Too many. Exactly. That’s the key. And that goes back to really that vision document I said on the last call. Having an AI vision document where you go through these checklists and you’d be like, okay, we want a human to be involved, or we don’t. You could actually tell Claude this. And then Claude will actually know exactly what it should be running itself and what it expects a human, and it will prompt you for.

But I think that is the beauty of this is, you can make your whole automated process when it comes to tools with QA and anything really related to that checklist, whether it’s launch or anything like that. Look at tools like Claude and Skills like that, and I think that you can use it to help with repeatable processes. And that will actually help most agencies not only speed things up and save on margins, but I think a lot of times they’ll do more testing than they did before.

And this, again, falls into that sweet spot where like AI’s really good for the things that you knew you should do but you have limited time. And testing is one of those items. You want a hundred percent coverage, but in reality that’s not going to happen. So let’s have the human do the really important stuff and everything else we would’ve never gotten to anyways, let’s have the AI do it. And that’s where I think you can use these tools.

[00:26:11] Nathan Wrigley: Do you know what’s really interesting, and we sort of made light of it in the previous episode, the fact that there’s hallucinations and what have you going on all the time. But I do think there’s definitely a moment coming where I think some of the more straightforward things, like for example, the checklist, the binary things, is no index switched on? Yes. No. Okay, that’s a no.

I think I am getting comfortable with that now. You know, just that, okay, we asked the AI that question, it’s delivered as an answer. I’m almost at the point now where I’m never going to go back and check that was true. If it was something much more broad like, is my SEO strategy bulletproof? Well, no. It’s never going to know whether that’s the right thing.

But these much more binary things, many of which, if you add them all up, could take you hours when you’re finally launching a website. Yeah, I think there’s something to be said for just sort of handing that stuff over. And I don’t know, maybe you check it frequently, infrequently, less frequently as time goes on. But yeah, always check the no index one.

[00:27:08] Matt Schwartz: Yeah, I was like, I would still check the no index one, even if it’s binary. But to your point, a lot more of the very black and white items, I think it can handle a lot better than it used to, but I think it still comes down to risk. Like if it’s, yeah, no index, I’m still going to check it. But if it’s something else that just is not that key. Yeah, I think we’re all becoming a little more comfortable or a lot of us are coming more comfortable with that. And I think that’s okay because you know the risk exposure really.

[00:27:35] Nathan Wrigley: Well, and also, especially if it’s QA and checklist time, hopefully you have done the bits and pieces, you really are at that point just making sure that you’ve polished the thing that needs to be polished. So hopefully that’s a bit of low hanging fruit where you’ll catch the things that you missed, and maybe you’ve done the due diligence there already.

Okay, so that was number 12. We’re approaching the end. We’ve got four more to go. So number 13 links directly to WordPress specifically. The WordPress plugin market impact.

I’ve got to say, this has me slightly concerned, because I feel that this could be a good thing for our ecosystem, but also possibly a bad thing. But I’ll just hand it over to you to paint the picture.

[00:28:18] Matt Schwartz: Yeah, definitely. So I think you even touched on this a little earlier when you were saying there’s going to be more one-off apps being built by agencies. And I think that also applies to a lot of plugins that are essentially one-off solutions, right? They are utility plugins. They solve one thing really well.

I think that sort of thing is already seeing the impact. If you talk to a lot of plugin developers, especially some of the larger shops, they’re seeing a drop in sales. And that is a real thing that’s happening. They’re seeing a drop in sales, especially for smaller plugins. Because a lot of agencies and customers are solving that with AI. Maybe it’s a couple files of code, it’s a lot easier for them to build it.

Now I still have concerns around, are they having a human review that? Like I talked about. But humans are going to do what they’re going to do, which some people are just going to run with that. That ultimately affects sales.

So I think that is hurting a lot of the ecosystem when it comes to the smaller plugins out there. And even some of the bigger plugin developers are essentially sunsetting their smaller plugins, because they realise they’re not getting as many sales and they need to focus on what they consider their moat, or their platform, you know, big plugins that AI’s not going to be able to replicate or people shouldn’t trust to replicate.

But if you’re building a small plugin, I’m not going to call any out, but I think that there is some concern there. And I think ultimately for WordPress, I don’t think that really hurts the WordPress ecosystem from the standpoint of plugins in general, but I do think it raises the bar of what a good plugin will be.

And that kind of goes with the agency land. That’s what’s happening with agencies too. It’s just the bar is being raised. You have to have a more complex plugin that actually solves someone’s needs now, not just a small one that solved it, but now they can use AI to do it.

And some people argue that that’s going to continue all the way up with the most complex plugins out there. But I do think that there are, you know, unless AI dramatically improves. If it’s 80% there, that’s great and all, but it’s what we talked about earlier. You can’t really run with that in production at 80%. And that’s the difference between a really good SaaS or really good plugin versus something that was homegrown and just falls apart.

[00:30:38] Nathan Wrigley: I think I have a slightly different, maybe more community focussed, approach to this because one of the things that I think worries me is the, how should we say it? The slow ebbing away of the community. And obviously if you are a, I don’t know, a company launched onto the stock market and what have you, you’re all about the money, right? The bottom line is you’re going to make money, distribute that with your shareholders, whatever, yada, yada. But the point is to make as much cash as possible and do things with that cash.

We have a very different calculus here in that the community is the thing which largely builds the software, maintains the software, promotes events. There is a bit of me which worries that if these, let’s say developers who’ve got one plugin, it doesn’t do 3000 major things, it just does one or two little things, but it’s been their way of getting themselves into the software, and figuring out how it all works, and meeting the community, and being engaged and, you know, all of that.

That slow ebbing away of that is something that I think our community and open source communities like ours need to be just a little bit mindful of. Because it does feel as if AI could definitely eat a lot of lunches. And I think we see that actually. I think we can already see that in the real world with things like attendance at events and the amount of events that are being put on, yeah.

[00:31:57] Matt Schwartz: I think you’re correct. I was actually going to bring this up in the sense that I am already seeing it within a lot of the agency groups. There’s just not as much engagement when it comes to posts, I think, and that sort of thing. Because people use AI more to find solutions, which means they’re not as engaged in the community. Which, to your point, plugins would kind of work the same way, especially the smaller plugins.

And yeah, there’s definitely something I think I’m concerned and kind of sad about already. Because like that’s why a lot of us are in WordPress is for the community. And I 100% agree with you. Not to mention if those guys, the smaller guys go away, then there just ends up being these massive plugin companies, which have their place, but WordPress wasn’t built on all massive plugin companies. So If those smaller ones go away, then that’s a little bit of the WordPress spirit I think are lost for sure.

[00:32:47] Nathan Wrigley: Yeah, I think we just need to be very mindful about this slow, like I say, wicking away or haemorrhaging of the community. And because at some point, the calculation no longer works. You know, there just aren’t enough community members around to make it interesting for other new community members to join, or to stick with things. Or to update their plugin or whatever it may be.

And maybe that is just a consequence of the way the world is moving, I don’t know. But having lived in the WordPress ecosystem for over a decade, I think it would be a shame if that baby was to be thrown out with that bath water.

Okay. Alright. I think we’ve done that one. So the next one is, well, the next one kind of speaks directly to that actually, which is the idea of, I guess spreading your wings a little bit further and realising perhaps that AI empowers you to do things outside of WordPress. And you’ve entitled this Experimenting Beyond WordPress. Again, off you go.

[00:33:37] Matt Schwartz: So this is something I am seeing some agencies doing, which is, because you can use AI now to use unfamiliar stacks, there’s really two parts. One is just unfamiliar stacks, or unfamiliar platforms, you don’t know. You can really try out new platforms a lot faster now. It will tell you exactly what to do, you know, step by step, or it’ll just do it for you.

So there are agencies, I think looking at other platforms where certain projects may make sense outside of WordPress, where they’re using that in that capacity and it’s allowing them to experiment. Where in the past, just sticking in WordPress, you have all your knowledge there makes sense to do, right? You don’t want to know 10 different platforms. But I think AI’s made that easier to dive into these other platforms. So that’s the first thing.

The second thing I think is that, now that you can actually use chat to engage, you are seeing some agencies, and some freelancers, that are saying, well, I don’t need the WordPress infrastructure at all. I just want to go back to pretty much like static or HTML type websites because I know I’m just going to chat with it and then I don’t have to worry about security or updates.

And obviously I think that only would apply with certain websites. It’s not going to apply with highly functional websites. I think that’s not really going to work. But for like your brochure site, I think some agencies are experimenting with some other platforms out there like Astro and the EmDash setup going on with CloudFlare.

You know, and I think that was a direct response actually. They realised, oh, people are going to want to chat with it. We could build this WordPress, what they consider like an upgraded version, in their mind.

And I think that, you know, it’s good to experiment. I think what WordPress does really well, to your point though, is they’ve hopped on the API centric side of things, building the right framework, not trying to force a certain thing down our throats, but actually leave it really open.

And I think that’s ultimately good because that’s how open source works. That’s why I think AI will have a good position with open source is. To your point you made previously, all the data’s out there, all the documentation’s out there. It’s going to be able to be extremely flexible. And I think that’s really why WordPress is still, in my opinion, going to exist and thrive.

But you are seeing agencies that are looking outside of just Core WordPress, because they can experiment with just a lot less time now. And they can also try out some tools that may be a better fit for certain projects.

[00:36:18] Nathan Wrigley: There’s a lot of technologists in our community and we love tinkering, don’t we, and playing with new things? So it’s fairly inevitable. It goes with the territory.

Okay. Alright. So that was Experimenting Beyond WordPress. I think I’m going to skip 15 there because I think we covered quite a lot of that. So I’m just going to go straight to number 16, which probably will become 15, if you know what I mean, when I put it into the show notes.

So the next one anyway is called, whatever its number, is Risks and Cautions. So we’ve built what I feel is like a fairly solid argument for doing this kind of stuff. And now towards the end, we’re going to knock it all down. No, we’re not. But what are some of the risks that you might point people towards?

[00:36:58] Matt Schwartz: A hundred percent. This is, I think, probably one of my favourite sections because people don’t really talk about these risks as much as they should. If you go on LinkedIn, it’s just like all rainbows and butterflies. And we’re building a new feature every day, and I think that noise can make people feel like they have FOMO and they just jump into AI and they don’t think about the risks. So I think this is actually a really important section for any listeners to listen to.

I think one of the first items, probably a little obvious, but with security issues, with AI tools, a lot of companies, every company, I feel like at this point is inputting keys and all sorts of things into these AI chatbots. And ultimately, like those tools can still be hacked. And actually legally, a lot of them say when you submit into the chat, it’s actually considered public record. Anything you submit to them. That’s literally what OpenAI made a legal argument recently about. So keep that in mind when you’re doing this.

There are some ways to do this securely. You can look into, and I think that’s something I would recommend agencies doing because they, you are holding onto client data. And ultimately you don’t want that stuff getting leaked.

Another thing, kind of on another point, which I personally have less concern with, but I think some agencies bring up a valid point, which is every time you talk to these chat bots, et cetera, they’re keeping track of all these conversations. So I know some agencies are being like, hey, how much does a website cost in my state or my country? Only use the data that other agencies have told you. And I don’t know if it’s really doing it, but people are doing that and they’re, you know, it’s not pushing back on them.

Things like that, just be aware of, I think what you’re inputting in, because it isn’t necessarily being leaked as far as they’re being hacked, but that data make get spit out to places you don’t want it to by other parties through chat.

[00:38:52] Nathan Wrigley: I feel that at some point in the future, some gigantic disclosure, something will be disclosed, which is so horrific that it makes us all sort of take a collective breath when we suddenly realise all we’ve given over. We haven’t got there yet, or at least to my knowledge we haven’t. But I feel that at some point in the near-ish future, some jaw dropping disclosure will occur, which will make us all think twice about exactly what you’ve just described.

What are we giving up? What have we given? But also what have we not consciously given? Which kind of bit of our business did we unintentionally open up for the AI to have access to that we didn’t intend to? And if we had the time again, we wouldn’t have allowed it to, and so on and so forth. So, yeah. Okay.

Any other things on the risks and cautions? I feel that there’s a couple more lurking in there.

[00:39:43] Matt Schwartz: Yeah. I think that one’s to be the most obvious that most people are talking about. One I think people aren’t talking about though is handling errors when you’re building your own tools. Essentially, a lot of times you may vibe code something, right, which is great. But because you’re not really going into the depth of every situation, it’s just making kind of assumptions, the AI, of what should be there.

And because it’s so easy and you’re like, well, I’m saving time, people don’t really outline all of this. And so they don’t really put error handling in these tools. And what happens is, of course there’ll be some edge case and, you know, things just break. And again, depending on the tool, if it’s an internal tool, you can probably get away with that. But if it is a public facing, or a client facing tool, that is the beauty I think of having a human actually review it with logic is they are going to have context that the AI doesn’t have.

To your point earlier, like subconsciously might be giving certain information to the AI that we don’t necessarily mean to. But you also might be leaving things out because you think you’ve already told the AI, or you think it’s going to assume a certain way, and you can’t really make that assumption. It ends up really backfiring in the long run, I think.

And that’s why being very conscious about error handling and being like, okay, we’re going to set up logging, we’re going to set up testing. Validation is just the responsible way to be building these tools that really, I feel like no one talks about.

[00:41:09] Nathan Wrigley: No. And the curious thing about it is, because it’s such a black box, I feel that almost every other technology that we’ve interacted with has been much more, I don’t know how to describe it. There’s been a higher barrier to entry. It’s more difficult to interact with it. You’ve had to, I don’t know, press buttons or enter code or what have you. Now you are just communicating. And maybe we’ll even sort of drop into voice communication at some point where we’re literally just talking with the thing.

There’s just no, how to describe it. There’s just such a small amount of friction that is required to interact with these things. And so it kind of lulls us into this perception that it can’t make mistakes. It’s error free and what have you. And we know that that’s not the case. I didn’t really describe that very well, but I hope you got a general sense of what I was trying to describe there.

[00:41:54] Matt Schwartz: I think you’re right. I mean I can give an example like building out CheckView, which is obviously like a, it’s a QA tool for WordPress sites. But one thing is, I knew a decent amount of QA before I started building it. But I learned so much context building it, and we weren’t using AI when we built the tool, right? That I would’ve never gotten out if I had used AI from the beginning.

Because like you said, there’s just such little friction. You as a human just don’t have to have that much information. You can just dive into something, having no idea on what you’re really doing, which is a blessing and a curse. And I think just being aware of that. And building in the right logs, and errors to at least essentially provide a safety net for yourself, knowing that you’re not going to know everything is really important.

[00:42:34] Nathan Wrigley: Yeah. And then a couple of other things which we’ll just sort of gloss over fairly quickly because maybe they’re sort of slightly common sense. Obviously, you know, you’ve got here sensitive client data, which might be, without your knowledge, being scooped up by the AI agents. So monitoring that.

Over dependence on AI vendors. This feels like everybody’s really become dependent on a handful of companies. Maybe you could count them on one hand, I think basically. There’s three or four really, that everybody seems to be using. So that may be something that we want to be mindful of.

And of course, the last one of your bullet points under Risks and Cautions is just the fact that AI makes some mistakes all the time.

[00:43:15] Matt Schwartz: All the time. I think most of that’s common sense. Really, the only one that I think people aren’t talking as much about is the overdependence on AI. Not to date this podcast, but I’m going to a little bit anyways. For example, with Claude, they are removing Claude Code from their $20 plan right now. You know, if you’ve built this into your agency process, well, get ready to pay, you know, a hundred bucks for every employee, which could be thousands of dollars.

[00:43:40] Nathan Wrigley: You can only imagine how valuable that will be. And maybe it’ll be 200 bucks, or a thousand bucks or whatever it may be.

[00:43:46] Matt Schwartz: Right. A lot of these companies obviously are subsidising the cost, and so I do caution agency specifically. That’s why having that AI vision is important, but also considering making it independent enough from your processes that you still can function if this thing does change around, because I do think there is going to be a pushback on cost at some point.

So for example, like when you’re building a product, I’m seeing some companies that are building AI so integral to their product that it will not function without AI. Or going to have to raise the price by 10x. And so like even with CheckView, our tools are there, but we haven’t built it in in such a way that you can’t use the tool without it.

And I think at the agency level, it’s the same idea. For the most part, trying to avoid building it in a way that you couldn’t reduce the AI needs if you needed to. Or just preparing for that the costs could go up and like, you know, if you give it to all 10 employees now, you know, at 20 bucks a month, get ready to possibly pay a lot more later.

And I just think that’s something important for agencies specifically to keep in mind. And I know that seems contradictory to what I said at the beginning of this, AI everything, but I think it’s important.

[00:44:59] Nathan Wrigley: I’m not a financial wizard in any way, shape, or form, but that does seem to be something which, sure as night follows day, is going to be coming, is the requirement to repay a lot of the venture capital that the AI is currently burning through. And yeah, so maybe a significant price hike.

And we’ve all got used to these practically free tools, and maybe that’s something that is not going to be in our future. So that’s a really good point. Put that bulwark in place to make sure that you are protected from that should it go up by, like you said, 10x or whatever it may be?

Okay, so I did say that there were going to be multiple, I think 16 is what I said. This probably will be the last one. This is likely outcomes for agencies. So, Matt, you get to stare into the crystal ball and tell us what your final thoughts are in terms of what you think are likely outcomes.

[00:45:47] Matt Schwartz: So I think some of this is already happening.

Hiring, I think, is slowing down in some agencies because they’re realising they can automate more. They don’t need as many, essentially non-specialist employees, or contractors. And I think that is a real thing that is happening.

I don’t know if it’s going to be necessarily a long-term issue. Hopefully as, essentially the floor raises, work gets better, more agencies will be focused on providing more value, more strategy, those sort of things. Again, the execution becomes a little bit of a commodity. So having essentially more junior team members who usually do that execution isn’t just quite as necessary. So I think that’s going to continue to come up.

But again, I think it’s going to be balanced out with even the costs we just talked about with the AI tools. There could totally be a point where the tools might get expensive enough that it makes sense to have a junior do this execution.

[00:46:45] Nathan Wrigley: Get the humans back. Yeah.

[00:46:46] Matt Schwartz: Yeah. And we go back the other way. Some people are saying that could happen. I could see the argument for that. But I think that’s one thing.

Another thing with agencies is you now can really productise more of your services. And this comes into the automation process that we talked about. You can take your processes, you can really package them up, I think. And there has been a lot of talk about productising services, but I think now you can get more nuanced.

So if you, for example, only build sites for plumbers, well, with AI you can get way more specific on plumber specific service needs, and build out a process with what you’ve already done, plus, with AI to make that, I think, a lot easier for the plumber or the client, to get what they need out of it. In the past, I think most agencies were trying to build SOPs as we have time. And it, you know, it’s just a really difficult process. And I think that’s where agencies I think could help a lot.

And then the last point I’ll make around here is really around that the tools I think will change. It will be, again, less about the execution of tools, how you’re building your sites. More about the actual automation. And then really just testing and monitoring and making sure everything’s working how it’s supposed to be. The human will essentially become more of the manager of the AI. And that extends, I think, to even the tools.

I could see there being more QA and monitoring tools out there for more specific needs. Because now, you know, AI can build 90% of this, which is great. I save that cost, but I know I need to pay maybe 5% of that towards some tools that actually watch and monitor what’s happening, and make sure these automations, and these websites, are really doing what they need to be doing. So I think there is going to be possibly a shift in that way around what sort of tools that we’re investing in as far as agencies go.

[00:48:40] Nathan Wrigley: So that we could describe as a bit of a marathon. I think, really, you really took us through the gamut of everything that could possibly affect an agency in the AI space. We’re in the year 2026, let’s see how it ages. But that was a really interesting deep dive into all of the different bits and pieces.

Matt has very kindly put together some show notes. What I think I’ll probably do is crib those. Maybe I’ll put them into the WP Tavern show notes, or maybe I’ll link to a Google Doc or something like that where you can see them. But you’ll be able to see all of the different bits and pieces that we went through. There’s a lot more on that document than we actually had a chance to go through. So definitely do check that out.

What I can say is that the future is definitely going to be interesting. Whether or not any of the predictions you’ve made will turn out to be true, time will tell.

But what a fascinating chat. Thank you so much for chatting to me. And I really appreciate you sticking around and doing the second episode somewhat unexpectedly with me.

Just before we sign off, Matt, where can we find you? Where are the best places online to hang out with you?

[00:49:49] Matt Schwartz: Yeah, definitely. So definitely, you can find me on the Admin Bar Facebook group. I’m also in LinkedIn, trying to be better about that. You can also check me out. I’ve got a Slack channel. Checkview.io, of course. Inspry.com. Feel free to reach out if anything comes up.

Definitely, overall I would just recommend agencies dabble in this. Don’t be reckless, but definitely see what makes sense for your agency. Document it all out ahead of time. And I think that that’s really going to be agencies strong suit is, can we leverage this stuff in a smart way?

[00:50:21] Nathan Wrigley: Well, you’ve certainly provided us with a lot of food for thought. So once more, go and check out the show notes on wptavern.com. I will probably link to the document that Matt has created on both part one of this and part two as well. So you’ll be able to check both of those out.

Matt Schwartz, thank you so much for chatting to me today. I really appreciate it.

[00:50:41] Matt Schwartz: Thank you so much, Nathan.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, exploring AI’s impact in WordPress agencies.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Matt Schwartz. Matt runs Inspry, an Atlanta WordPress and Woo Commerce agency. He started it back in 2011 and has been working with WordPress even longer than that. In addition to his agency work, he also has a product called CheckView focused on WordPress testing. He’s got years of experience in the WordPress agency world, and recently he’s turned much of his attention towards the growing impact of AI.

If you’ve been hearing a lot about AI but a feeling fatigued by all the fragmented conversations, this episode might well offer a different perspective. Rather than focusing on how AI creates websites or content, Matt shares a different angle, how AI can be used inside a WordPress agency to enhance processes, improve workflows, and deliver more value to clients, with much of it happening behind the scenes.

We start by talking about how Matt stumbled into web design and how that led him to running his own agency. We dig into agency life, and why so many freelancers and agency owners are constantly iterating on their processes. From there, we talk about the big shift that’s happening, not just in building sites, but in how agencies can use AI to streamline their SOPs, client communication, and internal operations.

Matt explains the need for intention when adding AI to an agency. He introduces the idea of an AI vision document, that helps set guardrails and guidelines for where, and how, AI should factor into your business. He also shares real examples of ways AI can save time and stress in things like meetings, proposals, debugging, support, and even helping you expand your service offerings. We also touch on the risks, ethical considerations, and the importance of keeping a human in the loop during critical agency moments.

If you’re running a WordPress agency, or are curious about how agencies are adapting to the rapid pace of change, brought by AI, this episode is for you. This is part one in a two-part series, so listen to this and tune in next week for part two.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Matt Schwartz.

I am joined on the podcast by Matt Schwartz. Hello, Matt.

[00:03:45] Matt Schwartz: Hey Nathan. Thank you so much for having me today. I’m excited.

[00:03:48] Nathan Wrigley: Yeah, you’re very welcome. We’re on the podcast today to have a chat about AI. Now, before you hit the stop button, dear listener, because AI is all the rage everywhere, we’ve talked about it a million different ways. I think there’s something a little bit different about the conversation that we’re going to have today, because it particularly plays into the WordPress agency, kind of the stuff that you are not doing with the website directly, but all of the bits and pieces that allow you to have an agency, and how AI may or may not be best placed to insert itself in those different scenarios.

But before we begin that, Matt, do you mind just giving us your little bio? Maybe tell us a bit about your situation regarding WordPress agencies and whatnot.

[00:04:31] Matt Schwartz: Definitely. Yeah, so I run an agency called In Inspry in Atlanta. We’ve been around since 2011. We’ve been using WordPress since 2013, and also have a product called CheckView, which does WordPress testing.

But yeah, in the agency space specifically, you know, I’ve been talking to a lot of different agencies about AI. I’ve been pretty involved in it. And you’re totally right, Nathan, our goal today is not to make everyone just have to experience the verbal throw up of the word AI, AI, AI over and over again, which is, I feel like I’m sick of the word. But really going into how agencies can use it in, I think, really interesting ways, and also being candid about what AI is, and some of the pitfalls I think of it that, you know, aren’t always talked about, especially if you go on LinkedIn.

[00:05:15] Nathan Wrigley: Okay, so we’ll get into that in a moment, but just before we do, there’s a couple of interesting bits that I want to throw at you. And this is something that I heard in the British press not that long ago. And it doesn’t in any way, shape or form reflect on WordPress, it was just more generally about AI, and the fatigue that the general population are experiencing around that term.

And it feels like we have reached maximum capacity to just hear those words, and hear the overpromising and the potentially under delivery of AI. So I’ll throw that little bit in, but also, just to say that what we’re going to talk about today is not going to be how to get the pixels on the page, and how to use AI to turn the website out. This is much more going to be the background to the agency that you run and all of that kind of thing.

So before we begin, did you intentionally get into web design all those years ago, or were you more like just about everybody that I talked to, did you stumble into it a little bit more?

[00:06:13] Matt Schwartz: So I stumbled into it in the sense that I started when I was basically a kid. You know, I was like obsessed with building websites for like clubs, and middle school, you know, we had tables and HTML. I think Template Monster was around then. And I would just go to the website and look at these beautiful designs that I knew I couldn’t make.

So then, from there I built websites all through middle school, high school. Got paid, I think from my first one it was my Mom’s work. She worked at a dentist. It was awesome that he let me do that. And, you know, he paid me a couple thousand bucks, which was a lot in high school. And then from there I just built sites through college. We were in Drupal land over at University of Georgia. So that was a little harsh reality for the first CMS I ever used actually.

But I really just enjoyed building websites through that process. And I remember graduating in Information Systems in the Business School and being like, I think I’m just going to keep building websites. I think I like doing this. So I didn’t go the consultant route or anything like that, I just stuck with websites. So I stumbled into it when I was a kid, but I definitely chose to stay in it after that.

[00:07:17] Nathan Wrigley: Yeah. And what’s curious about that, and it maps very much what I did, almost every word that you said could map into my own life. Is that you, not working for a company, you are never sort of given the SOP. You have to do the SOP. You have to figure it out as you progress on your journey over the years. So every process that you’ve got, every thing that you do, every price point that you make, every email that you create as a template, you’re probably generating that yourself.

And so that kind of leans heavily into what we’re going to do today, because I felt that journey never ended. Part of being an agency owner was always this constant exploration of not the website itself, that kind of handled itself, more the, what’s the process? How do I get new clients? What are the backend systems that I’m going to use to make it all work?

And so I think freelancers in particular in the WordPress space have got that. And so they’re probably constantly looking around, very much beguiled in the more recent past by what AI can do to them.

And so let’s start, you’ve listed out very kindly a whole load of show notes for me. And the first point that you wanted to get into was, well, the big shift. So let’s start there.

[00:08:26] Matt Schwartz: Yeah, definitely. So I think one thing that we’ve seen as agency owners is, oh, websites and content now can start to be built by AI. And everyone’s talked about that, like you said. But I think what is more interesting is what you’re bringing up, which is around more the process of using AI. Which, if you are a freelancer and you have not looked at your process, please do. I didn’t look at my process for like years, and I would just repeat the same thing over and over again. It wasn’t until I actually started hiring people that I realised that was even really a thing. I know that’s sad, but that’s the reality. So if you haven’t, definitely look at that.

But when it comes to AI, I think being able to use it for process and your SOPs and automation, that’s really where I think it’s actually going to make the biggest impact for agencies that do want to use AI.

Because essentially, not every agency’s this way, this is a generalisation, but as a customer, or a client of an agency, they don’t see the difference between one website and another typically outside of the design, right? They don’t really know the technical know-how. But what they do see is, what is your workflow? What is your process? What is your touch points with them? And that’s ultimately what ends up being the product to your clients.

So I think as an agency owner, being able to use AI to make that process easier, and more clear, to your clients is what will really allow you to thrive. Not necessarily, just the content and executing building the website. Sure, AI may be able to help there, but that actually goes into the bigger process in my opinion.

[00:10:01] Nathan Wrigley: Okay, so we’ll definitely get into all of those, but I think basically the case you are making is that there is a there, there. There is something behind the AI that could definitely improve things.

I think it’s fairly unlikely that anybody listening to this podcast hasn’t dabbled in some way with a little bit of AI, but maybe there’s a handful of people out there who genuinely haven’t. And the last 20 years have been marked by fairly gradual improvements in things. You know, SaaS apps came along and they gradually improved and one superseded another. But again, it was incremental.

But over the last three or four years, I think that’s all gone out the window. Incremental’s no longer really a word. It’s seismic this week, seismic next week, seismic the week after that. Keeping up is going to be difficult. But anyway, needless to say, you are going to make the case that there are areas where AI smuggled into your business is going to be useful.

Can I just ask at the beginning, do you in any way show the AI to your clients? In other words, is there a moment where they get to see behind the curtain, oh, Matt, look, he did that with AI, or do you kind of have this curtain which protects you from the client, so that they never see that you are using AI? It’s a bit like how everybody who was a freelancer always uses the word team. They sort of pretend that there’s like nine of you, but there’s actually only one of you. So it’s a bit like that. Do you hide the AI from your clients or do you let them know that this is what you’re doing?

[00:11:30] Matt Schwartz: So when it comes to the product, we definitely let clients know if we are using it in their product. Because I think, at least from my ethical standpoint, I think you should do that. I don’t want to be in a case where we’re not doing that. But I do think when it comes to your process and internal workflows, no, we don’t typically need to do those things.

The only time we would do that is if we’re actually working with a client to improve their internal processes with AI. Then they may be seeing a parallel setup to what we’ve done, even at our own agency.

[00:11:58] Nathan Wrigley: Yeah. There are some people who kind of revel in the, no AI, if you like, so they make that a badge of honour within their business, whether it’s an agency in the WordPress space or anything else. And so obviously they would probably want to proclaim from the rooftops that they’re not using any AI. But I think yours is a fairly standard position. You know, if it doesn’t actually affect what they’re doing day to day, why would you need to use that? In the same way that you don’t need to tell your client, well, we’re using Salesforce in order to communicate with you. It’s just, there’s the URL, go to that and type your ticket in there and so on.

So your second point, why now? Why is it important right at this moment? So we’re recording this, I don’t know, towards the end of April, let’s say that, 2026. Is this like some sort of red line in the sand? Are we about to enter a Rubicon moment where we can’t go backwards?

[00:12:47] Matt Schwartz: Well, I don’t know. It’s seismic every week as you said. So I do think the gap is widening between agencies that are not using AI and using AI. But that doesn’t necessarily mean, in my opinion, you should just like hop on the AI train if you’re not currently deep in it. You do have to think about what makes sense to your agency and what you’re comfortable with.

But I think it really comes back to the fact that execution is becoming a commodity more and more, at least in the web agency space. If you’re building a brochure site, right, those tools are essentially becoming more and more replaced. Just like drag and drop builders came in and now this is kind of, in my opinion, the next iteration. It’ll be less about the execution of building a simple website. It’ll be more about, what is the true value of your agency to that client?

Which in a sense is not a bad thing, because this was always an argument before. You know, are you an agency that builds solutions for clients? It makes them money, or saves them money. Or are you an agency that just executes what they say? And there’s definitely a place for that. I think there will always be a place for that, but I think when you look at like a brochure site, it’s harder, I think, to make that argument than if it’s like an e-commerce site or a custom app, because the tools are just getting better.

So as an agency, I think there is an edge here with AI because clients are going to have higher expectations. You’re going to compete against companies that are using AI to do better touchpoint, to do more touchpoints, to having a better process.

Now, of course, that is dependent if they implement AI correctly, right? User error and AI is like any technology, that is definitely a major concern, guardrails, all that good stuff. But I think that is why this is the time, because if you’re not already looking at it, your competitors are definitely looking at using it in some capacity.

[00:14:40] Nathan Wrigley: Just something you said really struck home there. You said execution is a commodity. I’ve never heard that phrase, but that encapsulates so much, so well. I think that’s really interesting.

And I also share your moment in time analogy because I think we are at some moment where the seesaw, I don’t know if you use that word where you come from. The seesaw is definitely tipping to the point where, in the part of the world where I live, virtually everybody is aware of it. We mentioned that maybe there’s fatigue about it, but certainly almost everybody has had some exposure to it. They’re now aligned with what can be done, and at what cost, and for what amount of time.

And so it does feel like if you were to go and say, I don’t know, I’m going to build you a $5,000 brochure website with two pages, maybe a few years ago that was much more credible than it seems like now. And so this horizon of expectations is opening up. And it’s not just because we can do it, it’s because the clients, they know we can do it. And they know that things are going to be cheaper to produce en masse in the future.

So I think you’re probably right. So again, you’ve made the case for, this is the time. So not just that this is a good idea, but this is the time. Anything else to add onto that before we move on to your next one?

[00:15:56] Matt Schwartz: The only thing I would add to that is, you know, AI could be an edge for you. It could also be not using AI at all, because ultimately it’s about the value you’re providing, again, to your client. So you may be able to build a two page, $5,000 website using AI, but essentially if you’re able to provide value to that client in some other way, whether it’s your sales process, your overall process, your personality, whatever it is, that all plays into this. So I would keep that in mind.

But overall, you are correct. I think the floor is rising for everyone. And this is real dark, but AI to me only showed us that a lot of the work we do day to day, it’s just not that special, it’s execution. And that just means we need to be spending more time on the strategy and the value to the client, whether that’s using AI or not. But I think using AI to at least look at that is a good idea, if you haven’t done that up to this point, I think it’s the time to at least look.

[00:16:54] Nathan Wrigley: Yeah, I expect the calculus that’s going on in most, and I’m using air quotes here, normal people’s heads. So when I’m talking about that, I mean non-technical clients who might be coming, looking for a website for their bricks and mortar shop or whatever it may be. The calculus of AI is just this shrinking of time. The thing which probably would’ve taken a week to do, you know, okay, I’m going to phone you up, we’re going to set up a meeting, we’ll have that meeting, we’ll back and forth what we might want. And then a week or two later, you’ll show me a few wire frames or something like that.

That all seems now to have been crunched into literal minutes. That’s no longer a secret. I think at the beginning of the AI, movement, let’s call it that, a few years ago, I think there was a call that you could basically say, make more money, because the client’s expectations would be the same in terms of time, and the amount of expertise that was needed.

But that seems to be shrinking as well, because now the clients are aware that the AI can do that thing. Look, you just knocked it up with AI in three minutes. No, we’re not going to pay you for six weeks for that kind of thing.

Okay so, right, there we go. So that’s the now. Then you move on to something that I’ve not even thought about before, which is creating an AI vision document. Now you’re going to need to explain what you mean by that I think.

[00:18:08] Matt Schwartz: Yeah, definitely. So the idea really with this is being more purposeful about adding AI. At least in the past, at my agency, you know, I’d wake up one day freaking out and be like, we’ve got to try to see how this works. Does this make sense to add AI to this process? And it wouldn’t be very purposely built. It would just be like, hey, let’s try this.

And to some extent that experimentation is good, but at the same time, I think if you are a lot more methodical about that process, it will be better for the long-term use of AI. Because as I’ve said, I definitely have, maybe I didn’t say, I have hesitations about AI and I use it, right? I think that’s the paradox of what’s happening. A lot of people are using it, but we’re not all trustful of it. But we can see that there are potential gains and you want to be on the cutting edge.

But ultimately, the vision document, the idea is that you will create a document that outlines all of your processes at your company, at your agency. And see what are the things that you want to add AI to, what makes sense, things that are repetitive, that the team is losing time on, compared to things that really require human judgement.

So it’s not just like shove AI into everything. This AI document sounds like that’s what it is. But it’s actually like, there may be many places we don’t want AI at all, or we may want to have a guard for human judgement. And I think that’s actually a really good idea to protect your agency from risk and really just your reputation. Because otherwise, I think a lot of agencies are just kind of, you know, yolo, adding it everywhere and not really thinking about it from a high level.

The other neat thing you can do if you’re building this is, obviously you can use AI to help find patterns in your business from using your time tracking software to see who is working on what tasks, and what’s taking the longest. And being like, are these good places that we could use AI? Like I can connect Claude to Everhour that we use, and it can spit out who’s working on what in the past month. And I actually can get a good pattern, because one thing you can, I will say with AI is it’s pretty good at pattern recognition. That’s what it was built for. So if you just need like a high level idea, again, grain of salt, but at a high level, it’s pretty good at that.

So I think for a vision document, pulling all that data in, using AI and then setting these guardrails, figuring out what in your team’s processes you can build into a vision is a good idea. And that goes into the high level point I made, which was really, I think AI being used for more process and agency is the big thing here, more than anything.

[00:20:42] Nathan Wrigley: I suppose if you’re the agency owner as well, and obviously agency could be like three people, two people, right up to, you know, several hundreds, maybe thousands, who knows. If you are at the, towards the top of that pyramid, let’s put it that way, knowing when and where it’s going to be used is really important. You need to know that, okay, our support, 80% of our support is going to be handled by AI. That’s the thing that we’ve leaned into. We’re going to do it that way.

Or maybe you are exactly the opposite. You know, we’ve learned, our customer base are very dissatisfied with the kind of answers that they get, because of the nature of our company and the expertise that we need to bring to bear. So we’re not going to do any AI for support.

But also development, to know, okay, this is the moment where you must stop using AI. When you run into this snag, we’re going to deal with that as humans. We’re going to huddle together, figure it out as humans, and maybe take it back to the AI at that point.

But having that overarching understanding, and writing it down. Having an SOP, if you like, for AI so that everybody’s on the same page and knows where it’s permissible and not permissible. So you mentioned you’ve got a whole laundry list of possible things. So it might be in the sales process, the delivery process, the proposal stage, project management, QA, launch. There’s a whole bunch on here.

Yeah, that seems like a really neat idea, and not something that I’d figured out. And it’s kind of like, keeps you honest in a way. It means that this is what we’ve agreed to do as a company, these are the boundaries that we’re going to set ourselves. And they can change, but for now, this is what they are.

[00:22:14] Matt Schwartz: Yeah. I think that even if you’re not, again, jumping in the deep end of AI, just having a doc like this will protect you so that I think you do have these guardrails with your employees or your contractors. You know who’s using what, and you can really protect your agency even if it’s not implementing more AI, right? I think it’s just a good idea.

And like you said, writing it down, it’s funny, it’s kind of like when you build your agency, you write your mission statement and your values and that really does do something in, I think, the human psyche when you do that. And I think that can be applied here with the AI vision document too.

[00:22:47] Nathan Wrigley: I love your fourth point, which you’ve entitled, AI as a new core service offering. Because this feels like a really nice sweet spot. Because with the best will in the world, you and I, and probably a lot of the people that are listening to this podcast are very much into technology. We deliberately put ourselves in front of new tech, new features, new widgets, new gadgets, whatever. So we’re beguiled by it. But the truth is, we know there’s a lot of people out there that aren’t, probably don’t really want to get all that close to it. And so I think what you are suggesting here is, why not offer your AI expertise that you gain as an actual service to clients? Have I got that right?

[00:23:24] Matt Schwartz: Correct. So essentially, like you said, if you’re already building up these new technology skills, being able to apply this directly in a, I would say in the proper way, right? Like we’re seeing, again, AI thrown in everywhere. You have to know your clients and your customers. They may not want to hear the word AI. What they may want to hear it instead is, hey, I can fix your business workflow and I can save you thousands of dollars, and we can automate this. They don’t want to hear the word AI, and that’s okay. But it’s essentially AI at the end of the day, right?

So it may not be that the product offerings actually use the word AI. If anything personally, I’m kind of avoiding that, at least at our agency. Of course I’ll tell them it’s using AI, but it’s not what I lead with. I think it’s more about going in on, okay, what solutions can we provide clients and using this as a new offering, especially as a way to handle and mitigate what’s happening with brochure sites, right?

Brochure sites I think are going to continue to drop and you need to provide value to clients. And I think getting closer to their actual processes, there’s a couple different ways you could do this. Like I know some agencies that are using AI to build custom web apps, like lightweight internal ones. Which I think can be helpful, but I have concerns around the risks and security of that because I do know some agencies that are, again, are just yolo building it. I don’t think they’re doing the due diligence. But I do think there’s a way that you can build, let’s say an app that used to cost 50,000 for 10,000 now, right? Or 8,000 and do it mostly like the right way, do human review of the code. So it’s still something that they couldn’t have done at all before. They couldn’t have had this custom internal app.

And I think that is the argument for people that say, hey, I’m going to replace all my SaaS products. It’s not, in my opinion, you replace all your SaaS products. If you can build a SaaS internally that is built specifically for your business, and you feel like you can maintain and build it properly at the right cost, sure. You’re willing to do that. But if there’s a SaaS product out there that does exactly what you need, I’m going to pay the $30, and then go yell at that company. I’m not going to build it internally. So having these conversations with clients, if you’re going to build custom apps, I know I went on a little side tangent, but I think that’s really important say.

And then the other one I’ll mention as far as AI core offerings is using more automation with tools like n8n or any of those Make type tools. n8n, I would say is a little more advanced, but the benefit is clients are hearing about AI, they realise it can do a lot, and starting to ask them, well, how can I help save you money or make you money in your processes? So productising or creating SOPs that are more automated. Even using those tools for your own customers, I think can be huge. Because then you’re really getting to value directly with them.

Like, brochure sites, I think the problem is, it’s almost subjective sometimes the value, which I’ve always struggled with, depending on the client. But things like their processes and them seeing you automate this stuff, they see the value immediately. So it’s an easy sale that you can make. And you can provide that value, and potentially even get recurring income off of that. Because maybe you’re hosting the automation for them or you’re tweaking the automation. So those are some ways you can mitigate, I think what’s going on with AI.

[00:26:50] Nathan Wrigley: The next one, I’m just going to skirt over quite quickly because I think everybody can kind of grasp this. One of the things which AI is obviously superior, let’s go with that word, to the typical human, is its capacity to wrap its arms around a massive amount of data, and kind of make sense of its straight away.

One of the areas where I think you are saying this could be deployed pretty effectively is in things like marketing, where having an understanding of, I don’t know, geography, spending power in different geographical locations, what kind of products are going to service the market that you are launching into, and therefore how to build websites, pages that kind of react to that and will work well.

That’s the kind of thing that was always off limits to me. I wasn’t interested in the marketing side. Looking at that data, trying to digest that data, it was just never of interest to me. And now, I think everybody can understand that you point an AI in the right direction and it can draw conclusions, which are just so much more credible than somebody like me could summon up in six months of hard work, really.

[00:27:53] Matt Schwartz: Well,I mean I think you could sum it up, but I think you bring up a really good point, which is that with AI, it can pull in all this data and it can give you, I would say, summaries and next points that you just wouldn’t have done before. I actually think that’s the sweet spot with AI is, are we using this to replace a really good existing setup, or are we doing something that we literally couldn’t even do before because the client couldn’t afford it?

So I think that’s what’s really neat is I can be like, okay, client, we looked through your Freshdesk, we looked through all the data you gave us. Here’s what we saw your personas. And before, there’s just no way, as an agency, I would be offering that at the budget that they could afford, or maybe the interest as an agency to do that. So I think that is, a really neat thing is, especially for small businesses, we can offer them services that they just wouldn’t even be able to have in the past at the budget that they have.

[00:28:46] Nathan Wrigley: Okay, so really you are kind of broadening the product offering that you can have. I mean nobody here is going to advocate that you just use an AI and regurgitate whatever it says without some background knowledge that what you are saying makes sense. There clearly needs to be a bit of that. But the amassing of the data with some common sense, heuristics around what it is that the data is showing you.

Okay, that’s interesting. So maybe there’s some sort of low hanging fruit that previously you would’ve said no to and, look, we just don’t do that. You can now not only retroactively sort of say, yes, we now do that, but maybe even proactively say, look, we’ve got these other things that we can discuss as well. Okay, that’s interesting.

Right, here’s the next bit, and this is, I think if you are not an AI expert, and I definitely would consider myself in that bucket, I think this next one is some really great low hanging fruit to get you started. So this is, your number six, is AI inside agency operations. So this is using AI to make work easier, I guess would be an easy way to say it. So just run us through these points.

[00:29:51] Matt Schwartz: Definitely. So this is probably, if you’re familiar with AI, the most common uses. But essentially it’s going to be, you know, things like your meeting summaries, right? I think everyone has seen the bots that join in and, you know, there’s like 10 bots and there’s like two people and we’re like, are we in dystopia? Or it’s you and like 10 bots, and the other person doesn’t show up and you’re like, am I supposed to just talk to this bot? I think Mark Zuckerberg actually says he’s starting to have a bot fill in for him at meetings. Anyways, very dystopian.

But when it comes to meeting summaries and that sort of thing, I think where it can be really helpful if you’re not using it, again is, in the past, if I was having these discovery calls where I may not actually land this client, I don’t want to spend 20 hours trying to figure out the perfect proposal for them. It’s just not worth my time, basically, right?

So what this lets you do is it lets you, as an agency, do things you couldn’t do before, or you didn’t have the budget and resources to do. One would be on discovery. I can now take all the meeting notes, I can have it go to the client’s website and I can also have it look at my previous proposals. And I can have it put together a solution for this client, in terms of like what proposal makes sense for them.

To your point, I’m still going to review it. I’m still going to edit it. I’m still going to make sure that this makes sense, but I think that’s a perfect sweet spot again for AI. I know I keep saying it. Something I just wouldn’t have done before. I would’ve like, either I just spent 20 hours on it or sent a very generic proposal just to get something out the door. Now I can make it really a lot more nuanced because it can go through all that data.

So if you’re not using it for summaries or proposals or SOWs, I think a draft version of that, it’s really good at those sort of things with combining all the data.

[00:31:36] Nathan Wrigley: I am so surprised by how quickly that remarkable technology became utterly mundane. That is say that three years ago, the first time somebody dropped in a Zoom meeting with an AI bot, I thought, okay, that’s really unusual, what’s going on here? And then within three minutes you get the email after the call is finished and you see this perfect summarisation of exactly what you talked about, including correctly labelled next tasks for each of the individuals on the call.

That to me was, I was living in Star Trek. And now that just seems so pedestrian. And that’s remarkable. That’s the speed at which we’ve become adapted, and it’s become part of our modus operandi.

And if you haven’t used those, it’s really worth a try because you will experience the amazement that I had three years ago. And then you too can become completely numb to how amazing it is really quickly.

It literally will take an hour of audio and spit out a basically perfect summary in 150 words or whatever it may be, and it will capture it perfectly. I suppose the rebuttal to that is, well, what do you do with that? If nobody does anything with that then, well, you haven’t really lost anything. You’re in exactly the same place as you were before, but at least you’ve got a written record of it.

But like I say, that’s the low hanging fruit. They’re definitely things. SOWs, SOPs, meeting summaries, that kind of thing. Great idea.

Okay, next one. Number seven. AI for support workflows. What’s going on here?

[00:33:04] Matt Schwartz: Yeah, so this one’s a little bit more about the actual operations. But I’ve talked to some agencies that are starting to really build into their support process AI tools. For example, using things like n8n, the automation platform, where it can digest your help tickets. And we’re not necessarily going to have it solve the problems, right? But what it can do, again, is it’s going to have access to a lot of data about that website. It may have access to your project management software, all the other tickets that came in.

And unlike a human where it would take hours to do this, so we just aren’t going to do it, it can do a really good job of essentially making sure that we can have all the information we need for the support person to do what they need to do, the support team, right? So it can even give good initial resolutions for the team to do, so that they can work through tickets faster.

That’s a good example of, we’re not replacing the human, we’re not trying to automate it so it emails back the customer. But what we are doing is we’re taking in all the context of, hey, it’s this client, they’ve had these other tickets, it has access possibly to the WordPress site, so it can even see the error logs. It may have access to the server APIs, so that it can actually see what’s going on with that server. And then it can basically come up with a resolution that is likely the issue.

And you are seeing a lot of, even hosting companies going that route, where they’re starting to have agents inside their hosting so that you can pinpoint issues in WordPress a lot faster than you could in the past. And again, I still want a human to review that, but I do think by doing that, you can get a speedier response to your customers, and you can cover more tickets without alienating your customers or making it seem like it was, you know, written by a robot with em dashes everywhere, right?

[00:34:54] Nathan Wrigley: Yeah, you know what? I think this is a real area to tread carefully, certainly from my point of view, because I have definitely got AI bot fatigue. In that, there is some button that gets pushed when I find that I’m in a chat bot, and that is the only route that I’ve got through this whole system. I really dearly love to get in front of a human quite quickly. And I think a lot of people are learning that technique of, you know, the first thing you type is, speak to a human, or something equivalent to that. I think it’s really easy to misstep here, and misjudge people’s capacity to take AI only, or AI mostly or whatever.

This I think will be an interesting area to watch. And maybe this will be at the vanguard of when people express their frustration, you know, how much of this can you take? And monitoring that and keeping sight on when people’s, I don’t know, anger boils over because they’re not getting the service that they paid for or the service that they’ve come to expect or what have you. So, yeah. Anyway, that’s my 2 cents on that.

[00:35:50] Matt Schwartz: Hundred percent agree. It’s the most sensitive portion in my opinion. I mean that’s your touch point with your customer when they’re most frustrated.

[00:35:56] Nathan Wrigley: Right, that’s the pain moment. And introducing additional pain at the moment of pain is fraught with problems. And we’ve seen this play out in all sorts of other ways. I’m sure it’s the case where you are in your part of the world with telephone systems where you end up in this just infinite loop of, press three for, and then press four for. And then eventually you get back to, oh, well, I’m back to pressing three am I? Okay. And the anger boils over.

It feels like such a win. We’re saving time. We’ve got the AI to answer because it’s read all of our documentation. I’m going to guarantee that somebody will not be able to get what you think they ought to be getting with it.

And dare I say it, what about all those dear people out there who really are unable to access the technology in the way that you anticipate, or the way that you can. Maybe they’re elderly, maybe they don’t have the capacity to do it. Maybe they’ve got accessibility needs or something like that.

Okay, number eight. AI assisted debugging and WordPress management. I like this. This is a good one.

[00:36:53] Matt Schwartz: Yeah, so we covered this a little. It goes along actually with the above point which is, one thing that I see other agencies, and we’re also doing this internally is, you know, you can obviously connect AI agents now to WordPress sites directly, obviously with guardrails in place. But it can connect to the REST API you have the Abilities API with Automattic. There’s third party solutions like Novamira out there that can actually work with the PHP code side of things. Your hosting companies often are actually building their own tools as well.

So doing all of that, debugging has been, I will say, has been dramatically improved, at least at our agency. Because it can do all of that and it can really find a nuanced solution where, you know, we could spend 10 hours trying to work on some weird PHP issue because, again, it can look at the whole picture. And I think that is where AI is very good, is when it’s a one-off thing, right? Where it’s just like, this is a one-off troubleshooting task. I don’t want to spend 10 hours learning exactly what this was. It’s likely going to get you there, and then you can obviously finish it up if it’s not able to get you fully there.

But you can use these tools today to really reduce the amount of debugging and management you’re doing. And you can extend it. We’re not going to spend a lot of time on this, but doing edits on websites, a lot of page builders now are starting to build in syntax for agents so that it understands Gutenberg blocks. It understands how to edit and edit nested blocks. I’ve had struggles with Claude, where it would try to write nested blocks and it would just mush the whole page.

But as these page builders are becoming better, and as WordPress becomes better, essentially WordPress becomes the infrastructure, right? And Claude is actually doing the work. You’ve heard that. And what I get out of that with the infrastructure is WordPress is the platform, it provides all the capabilities, but then the AI tool, mixed with the human, is essentially going to be managing the WordPress site. And it’s much easier to tell AI to do that than to go into the backend and make edits.

But I am a little hesitant on just making free flowing edits, not checking the work on the actual website, or letting AI check the work. Some people are doing that. I’m not doing that. We’re saying, give us the link after every page you edit, and I’m going to go click it and I’m going to look at it.

Some agencies, they’re saying, okay, Claude’s going to go to the Chrome link and do that. Whatever you’re comfortable with, but in our opinion, there still needs to be human review. And I still don’t think that’s going to change, even if it gets better because until AI is as good as a human being, in the sense that we can trust it and it won’t lie. I give this analogy, right? You hire a developer, they lie to you twice, you’re probably going to fire them, right? But with AI, we just keep giving them a second chance. And, why?

[00:39:41] Nathan Wrigley: Free pass every time.

[00:39:42] Matt Schwartz: Why are doing that? And I think the way to mitigate that is you still have to have human review based on the risk factor. That’s really what it’s about.

[00:39:50] Nathan Wrigley: Yeah, I share your sentiment there. I think it’s very important to have a human in the loop. And usually at the end of whatever is going on, there needs to be a human just to do the sort of final summary and checking and what have you.

But the point that you mentioned there is, WordPress really has done an awful lot of work in the background to make itself AI ready. So a lot of the capabilities inside of WordPress, a lot of the things that you would normally have had to engage with the admin, with a mouse, or with a keyboard or what have you, a lot of that has been taken over.

And we are very much entering an era where WordPress becomes almost like the scaffolding for the website in a way. And you can talk to the website through these AI agents, but in many situations, I think in the next five, six years, there’ll be a lot of people who will be never visiting the WordPress admin and clicking around and trying to find the menus for things because they will simply ask an AI.

Can I change the clock to the 24 hour clock? Sure, done. And that will extend into everything. You know, I want that block to be, I don’t know, I want the text in that block to be bold, and have this particular font and yada yada, on it goes. And WordPress is doing a really incredible job at an incredible speed of laying that foundational work.

If you haven’t looked at what the Core AI team are doing, there’s definitely some interesting stuff.

[00:41:06] Matt Schwartz: It’s really neat.

[00:41:06] Nathan Wrigley: Yeah, it’s, and I think that an interesting and commendable approach as well, because rather than trying to, I don’t know, hold everything into WordPress, it’s very much the opposite. It’s, we’re just allowing everything to communicate inwards to WordPress. And WordPress will just be the foundation upon which the whole thing resides.

Okay, so we’ve got through 8 of what turns out to be 16 points in Matt’s comprehensive show notes. And just looking at the clock, Matt, we’re at it’s kind of 40 odd minutes, which is about the sweet spot. So I’m going to recommend that we split this up into a second episode. So this in effect, will be the first of a two part mini series, if you are okay with that. How do you feel? Is that all right with you?

[00:41:45] Matt Schwartz: Definitely. You know, I didn’t know we were going to dive this far into it, but I’m so glad we are. And I hope, you know, the audience is interested in staying around for part two.

[00:41:52] Nathan Wrigley: Okay. In which case, if you are happy with that, what we’ll do is we’ll knock it on the head, as we say in the UK, here. We will return next week with the second part. And I will advise people at that point to listen to the first part so they can keep up to date.

So we will see you in a week’s time. I guess all it remains for me to do, Matt, is to say thank you very much for joining me today. Part two next week. See you soon.

[00:42:14] Matt Schwartz: Thank you so much. Look forward to it.