EDITS.WS

Tag: plugins

  • Matthaus Klute Acquires Social Link Pages Plugin

    WordPress developer Corey Maass has sold his Social Link Pages plugin to Matthaus Klute, an independent WordPress consultant and developer with Alpha Particle. It’s another story of small plugins changing hands, where developers get the opportunity to test ideas and business models. Even the most modest creations have value in a thriving marketplace where business owners are willing to invest in these types of assets to expand their own offerings.

    In 2019, Maass created Social Link Pages after taking a course on how to market himself as a musician and DJ. The course required him to sign up for Linktr.ee, a popular “link in bio” landing page service.

    “In typical developer fashion, instead of paying $8 a month, I thought ‘I should build this,’” Maass said. “So I spent hundreds of hours building Social Link Pages for WordPress.”

    Initially, Maass built the free version with most of the basic bells and whistles found in other link-in-bio page builders. After getting some pushback from the Plugin Review team, who Maass said were “skeptical about why we needed a ‘mini WordPress inside WordPress,’ the Social Link Pages plugin was approved for the directory.

    Over the next year he added features that he needed while figuring out the right extras for a Pro version.

    “Along the way, a user contacted me, asking if the plug-in could be white-labeled and used to build her own SaaS,” Maass said. “Shortly thereafter I released the Pro and Community (i.e. SaaS) versions of the plugin.

    “Then I took a day job and stopped working on it for about a year and a half. I took the commercial versions offline. I barely looked at the plugin because there were almost no support requests.”

    When Maass’ day job ended 18 months later, he went back to the plugin and was pleasantly surprised to find it had 1,000 active installs. This encouraged him to make some major updates and add new features.

    The first marketing effort he made was to put Social Link Pages on AppSumo. At that time they were just opening up their marketplace.

    “In the marketplace, you don’t benefit from AppSumo’s larger email campaigns, but I think Social Link Pages got a lot of eyes from people looking for good lifetime deals,” Maass said. “I sold about 80-lifetime licenses and was surprised to find that only two or three were ever actually claimed. I’ve since heard of other plugin developers who have had the same experience. Apparently, a lot of people collect lifetime deals, but never actually use them. So in the end it was free money.”

    Over the next few years, Maass continued to add features but his interest was waning.

    “The plugin did what I needed on my own sites, so I was not inspired to keep adding features just because I could,” he said. “I also saw a lot of new link-in-bio apps come online, though none were specific to WordPress. And I wanted to move on to new ideas.”

    At the beginning of 2023, while considering all of his projects, Maass said he “could not find the willpower to market Social Link Pages as it should be.” He knew he was no longer the best owner for the plugin, so he listed it on a couple of sites dedicated to selling small software products.

    Social Links Plugin Sells for $3K

    “I’d always heard the correct pricing for a software product is 12-18 months of revenue,” Maass said. “Social Link Pages was only making about $125 per month at the time, but I was selling a complete business, already set up with e-commerce, multiple products, email automation, and more.

    “I listed it at $5000. I heard from a dozen or so potential buyers, all of whom asked for charts and spreadsheets I did not have. I’m a developer and guilty of ignoring a lot of the standard sales and ‘biz dev’ practices. As I was asking too much based on what was ‘on paper,’ I did not find a buyer. I unlisted Social Link Pages, figuring I’d try again in the future.”

    Maass tried again in the summer, listing the plugin in Post Status and a couple of other solopreneur-focused communities. He also dropped the price to $3,000.

    “Immediately I heard from a number of interested buyers who saw the value in what I was selling,” Maass said.” I probably could’ve brought the price back up to $5000 again, but I wanted to see the plugin go to a new, better owner.”

    Two years ago, Maass sold his Kanban for WordPress plugin to Keanan Koppenhaver at Alpha Particle. After discussing with Matthaus Klute, a developer who works with Koppenhaver, Maass knew he had found the right buyer.

    “He’s a thoughtful developer with WordPress experience interested in building a product business,” Maass said. “We met up in person at WordCamp US in DC in August 2023, and spent a few hours moving all accounts to his name and getting him set up. It was a fun experience to do in person.”

    Klute said Maass came to him highly recommended from others who had purchased plugins from him in the past. After he spoke with his lawyer, they proceeded to do an in-person asset transfer at WordCamp US (WCUS).

    “I wasn’t actively shopping for a plugin, however I’ve always had a passing interest in asset and/or small businesses acquisitions,” Klute said. “Corey’s plugin caught my attention for several reasons. It fit well within my budget, boasted an active user base, and generated consistent recurring revenue.

    “With my 9 -5 spent coding, the prospect of having an existing solution that I could focus on marketing rather than building was enticing. Lastly, I wanted to gain a deeper understanding of the plugin ecosystem.”

    Klute said Maass’s experience played a crucial role in ensuring a smooth transfer. He had all the plugin’s accounts and services separated from his other entities, making it easily transferable. While at WCUS, they conducted a few Zoom sessions to explore the plugin’s codebase in-depth.

    “Despite the focus on marketing, I do have a few ideas for the plugin roadmap,” Klute said. “I’m looking at the possibility of a digital business card functionality similar to Blinq and also exploring ways to enhance the plugin’s compatibility with WooCommerce for my dynamic shop functionality for e-commerce businesses.”

  • Block Visibility 3.1.0 Adds WooCommerce and Easy Digital Downloads Controls

    When WordPress contributor and developer Nick Diego released version 3.0 of his Block Visibility plugin earlier this year in March, he made all the Pro features available in the free version, with the exception of a few that would take more time. The plugin, which is used on more than 10,000 WordPress sites, allows users to conditionally display blocks based on specific user roles, logged in/out, specific users, screen sizes, query strings, ACF fields, and more.

    In the latest 3.1.0 update Block Visibility has added the missing WooCommerce and Easy Digital Downloads (EDD) controls. These features were originally planned to be merged into the free version in April but required more development to improve how they work on sites with large product/download catalogs.

    The WooCommerce controls include 18 conditional visibility rules with full support for products with variable pricing. It allows users to show or hide blocks based on products, cart contents, customer purchase history, and more.

    “There is one notable change to the product-based rules,” Diego said. “Previously, you had to select which product you wanted to target with the visibility conditions. While this is still possible, Block Visibility can now detect the current product.

    “This functionality is extremely useful on product pages, single product templates, and product grids (Query blocks).”

    The EDD controls allow users to show or hide blocks based on downloads, cart contents, customer purchase history, and more. Since EDD doesn’t have as many block-powered layouts as WooCommerce, Diego did not include the “Detect current product” feature.

    “The EDD visibility control currently has no product-based rules,” he said. “If greater block support is added to EDD in the future, such as an EDD Products block that supports inner blocks, expect more functionality.”

    Block Visibility 3.1.0 also adds a new Command Palette command to “Manage Visibility Presets,” which requires WordPress 6.3+.

    image credit: Block Visibility repository – PR #84

    Diego said he doesn’t plan on adding any new integrations to the plugin but will continue improving existing controls. Now that all the features from the Pro version have been merged into the free plugin, users who have the Pro version installed can deactivate it after upgrading to version 3.1.0.

  • WordPress Plugin Review Team Onboards New Members, Releases Plugin to Flag Common Errors

    WordPress’ Plugin Review Team continues to dig out from under a massive backlog that has grown to 1,260 plugins awaiting review. Developers submitting new plugins can expect to wait at least 91 days, according to the notice on the queue today.

    Currently there are 1,241 plugins awaiting review,” Automattic-sponsored Plugin Review team member Alvaro Gómez said earlier this week.

    “We are painstakingly aware of this. We check that number every day and realize how this delay is affecting plugin authors.”

    Although the backlog seems to be getting worse, Gómez published an update outlining new systems the team is putting in place to get the situation under control. He likened it to patching a hole in a boat, as opposed to simply prioritizing bailing out the water.

    “During the last six months, the Plugin review team has worked on documenting its processes, training new members, and improving its tools,” he said. “Now, thanks to your patience and support, the tide is about to turn.”

    The team has now onboarded two rounds of new members, with three more reviewers added recently, and has a system in place to make this easier in the future. After receiving more than 40 applications to join the team, the form will be closing at the end of September.

    They also sent plugin authors still waiting in the queue an email asking them to self-check their plugins to meet basic security standards, as another effort to mitigate the growing backlog.

    “We find ourselves correcting the same three or four errors on +95% of plugins and this is not a good use of our time,” Gómez said. “Once authors confirm that their plugins meet these basic requirements, we will proceed with the review.”

    A new plugin called Plugin Check has just been published to WordPress.org for plugin authors to self-review for common errors, which will eventually be integrated into the plugin submission process.

    “Once the PCP is merged with this other plugin that the Performance team has been working on, it will provide checks for a lot of other things,” Gómez said. “When this is completed, we will be in a better spot to take in feedback and make improvements.

    “In the short term, we are going to ask authors to test their plugins using the PCP before submitting them, but our goal is to integrate the plugin as part of the submission process and run automated checks.”

    So far plugin authors have reported a few bugs and issues with the plugin not recognizing files or giving unintelligible errors. These issues can be reported on the GitHub repo, which is temporarily hosted on the 10up GitHub account but will be moving to WordPress.org in the near future.

  • WordPress.com Plugin Pages Add Download Link for Using Plugins on Self-Hosted Sites

    WordPress.com plugin pages have been updated to include a download link for WordPress.org plugins listed in the .com directory. These are the listings that are scraped from WordPress.org. The plugins are available for free on WordPress.org for self-hosted sites but can only be used on WordPress.com with a paid subscription.

    Logged out view of WordPress.com plugin pages

    The text in the sidebar includes a link to an article explaining the difference between WordPress.org and WordPress.com. It appears on both the logged-out and logged-in views:

    This plugin is available for download to be used on your WordPress self-hosted installation.

    Themes hosted on WordPress.com have a similar notice with a link to download the theme and use it on a self-hosted site.

    This change comes as the result of developers raising concerns about WordPress.com plugin listings outranking WordPress.org on Google Search in some instances. During that discussion, many developers were surprised to learn that their plugins created for WordPress.org were also listed on WordPress.com as only available with a paid subscription. Patchstack responded by updating its readme file to ensure that WordPress.com users and visitors are made aware that the plugin is available for free in the official WordPress plugin repository. This response may not be necessary now, unless developers want to include a direct link to their plugins.

    In a discussion on Post Status Slack, some plugin developers said they would prefer a link to the actual plugin page where they can see and participate in reviews. The omission of a link back to WordPress.org may be intentional, as it would take users off of the .com site, which does not facilitate customers upgrading to paid plans in order to use plugins.

    Some developers had also asked Automattic CEO Matt Mullenweg to noindex those pages, but he said that WordPress.com users should also be able to search Google for the listings.

    Some developers have asked to know what percentage of their active installs come from WordPress.com vs. WordPress.org, or other hosting platforms. Mullenweg said there are currently no reports for this but that the data could be interesting.

    “If people are providing more distribution to unaltered plugins, I think that’s great,” Mullenweg said during the discussion last week. “Happy for all our plugins to be duplicated and distributed by every host and site on the planet.”

    When asked if WordPress.org could extract the data for known plugin distributors, like WordPress.com, Mullenweg said, “.com or any other host could share plugin info if it’s allowed by their privacy policy. Also it’s fairly trivial to get plugin info from crawling sites.”

  • New Plugin Adds Citations and Bibliography Block to WordPress Editor

    Citations is a new plugin created by WP Munich and the team at Luehrsen // Heinrich, a German WordPress agency. It makes it easy to create in-text citations and assign them a specific source. Most of the existing plugins that do this are for older versions of WordPress. This one is created specifically for those using the block editor.

    Citations introduces a new menu item to the rich text formatting toolbar. Users can highlight the text they want to cite, click ‘Cite’ in the toolbar, and then define the source in the pop-up by inputting the source information into the fields provided.

    The Citations plugin includes one Bibliography block, which will be automatically populated with all the sources of the in-text citations added in the content. Citations are linked to the corresponding source inside the Bibliography block. The block can be positioned anywhere in the document, although readers likely expect it at the bottom.

    Users can edit the citations and the sources in the Bibliography block by clicking on them.

    What’s the difference between citations and WordPress’ core Footnotes block? Although both are used in academic and scholarly writing to provide references and additional information about sources used in a document, there are a few key differences.

    Citations credit the original source of the information with all the source details in the bibliography at the end of the document. Footnotes are more flexible in that they can include additional context or comments at the bottom of the document, to keep the text from becoming too cluttered with explanatory notes. They may also be used to source citations with the author, title, and publication details, but do not always follow the bibliography format.

    The Citations plugin also includes a pattern that will insert some Lorem Ipsum paragraphs with citations and a sample bibliography with sources at the bottom. This gives users an idea of how the plugin can be used to structure a document for citing sources, if they are just getting started. Users can search for “Citations Demo” in the pattern search bar to find it.

    Download the plugin for free from WordPress.org, or give it a test drive using WordPress Playground.

  • ActivityPub 1.0.0 Released, Introducing Blog-Wide Accounts and New Blocks

    Version 1.0.0 of the ActivityPub plugin was released this week with major updates that make it possible to have a blog-wide account, instead of just individual author accounts, where followers receive updates from all authors. This new feature allows people to follow blogs on decentralized platforms like Mastodon (and many others) with replies automatically published back to the blog as comments.

    In the ActivityPub plugin settings, users can check “Enable blog” to have the blog become an ActivityPub profile. Authors can be enabled at the same time as a blog-wide profile.

    Activities originating from a Blog profile can be further customized through the existing post content and image settings. Users can also set the activity object type to default, article, or WordPress post format which maps the post format to the ActivityPub object type. Supported post types include posts, pages, and media. Note that the blog-wide profile only works with sites that have rewrite rules enabled.

    An experimental hashtags setting is also available, which adds hashtags in the content as native tags and replaces the #tag with the tag link. Users should be aware that it may still produce HTML or CSS errors.

    ActivityPub 1.0.0 introduces two new blocks – one for displaying Fediverse Followers and the other for displaying a “Follow” button to allow people to follow the blog or author on the Fediverse. The Follower system has also gotten a complete rewrite based on Custom Post Types.

    Other notable updates in this release include the following:

    • Signature Verification: https://docs.joinmastodon.org/spec/security/
    • Simple caching
    • Collection endpoints for Featured Tags and Featured Posts
    • Better handling of Hashtags in mobile apps
    • Update: Improved linter (PHPCS)
    • Fixed: Load the plugin later in the WordPress code lifecycle to avoid errors in some requests
    • Fixed: Updating posts
    • Fixed: Hashtag now support CamelCase and UTF-8

    Automattic acquired the plugin in March 2023 from German developer Matthias Pfefferle, who joined the company to continue improving support for federated platforms. Next on the roadmap for the ActivityPub plugin is threaded comments support and replacing shortcodes with blocks for layout.

  • Developers Raise Concerns About WordPress.com Plugin Listings Outranking WordPress.org on Google Search

    WordPress core developer John Blackbourn sparked a heated discussion yesterday when he posted an image of his WordPress User Switching plugin ranking higher for the WordPress.com listing than the page on WordPress.org.

    Blackbourn later apologized for the inflammatory wording of the original post, but maintains that .com plugin listings being displayed higher in search results is not healthy for the open source project.

    “This was a frustrated 2AM tweet so I could have worded it better, but the point still stands,” he said. “The plugin pages on dotcom are little more than marketing landing pages for the dotcom service and they’re strongly competing with the canonical dotorg pages. That’s not healthy.”

    Several others commented about having similar experiences when searching for plugins, finding that the WordPress.com often ranks higher, although many others still see WordPress.org pages ranked highest.

    Blackbourn said his chief concern “is the process that introduced the directory clone on .com either disregarded its potential impact on .org in favor of inbounds or never considered it in the first place – both very concerning given the ranking power of .com.”

    The tweet highlighted the frustration some members of the open source community feel due to the perennial branding confusion between WordPress.com and WordPress.org. Nothing short of renaming WordPress.com will eliminate the longstanding confusion, but this is unlikely as Automattic benefits from tightly coupling its products to WordPress’ name recognition.

    “Duplicate content confuses the human + search engines,” SEO consultant Rebecca Gill said. “Search engines won’t like it, nor will humans trying to find solutions to their problems. There is already enough confusion w/ .org + .com for non-tech folks. This amplifies it. Noindex .com content or canonical it to .org.”

    Participants in the discussion maintain that the duplication of the open source project’s plugin directory “creates ambiguity and confusion” but WordPress co-creator and Automattic CEO Matt Mullenweg contends it also gives plugin authors greater distribution.

    “It’s providing distribution to the plugin authors, literally millions and millions of installs,” Mullenweg said. He elaborated on how the cloned plugin directory is integrated with Calypso, WordPress.com’s admin interface:

    .com has its own plugin directory which includes the .org one, it provides more installs and distribution to the plugin authors, which helps their usage and for commercial ones gets them more sales. The plugins are not altered. .com takes no cut for the distribution.

    When participants in the discussion suggested that other hosts doing the same thing would create a wild west situation for plugin rankings, Mullenweg said he would not mind if the plugins were “duplicated and distributed by every host and site on the planet,” as they are all licensed under the GPL.

    Outrage against distributing WordPress.org plugins in this fashion was not universal in the discussion. A few commenters support this strategy and see it as beneficial for the long-term health of the open source project.

    “I’m all for it to be honest,” WordPress developer Cristian Raiber said. “Anyone could scrape those pages but not everyone gives back to WordPress and makes sure it’s here to stay for the next decades. Controversial, I know. But I prefer we build together instead of alone.

    “I fail to see how this is not an advantage to anyone who hosts their plugins (for FREE) on w[dot]org ?” Raiber continued in a separate response. “Is it about being outranked in Google’s SERPs for brand kws? Why has this generated so much outcry when the intent is clearly beneficial?

    “This FINALLY solves a friction point for potential buyers. Streamlined plugin installation and usage vs ‘here’s a list of 55 steps you have to take to install my plugin.’ Users want options, different uses cases and all. I want wp.com to make money so they keep growing this product.”

    XWP Director of Engineering Francesco Marano suggested that WordPress.com has benefitted from the branding and reputation of .org, which is built by volunteers. She also proposed that Automattic “has the resources to do a whole rebranding which would ultimately benefit both projects.”

    Mullenweg responded to these comments, defending WordPress.com’s efforts in fending off early WordPress competitors and cited Automattic’s preeminence in contributing back to core, despite taking in less revenue than some larger companies making money from the software:

    Since its foundation, .org has benefitted from the branding and reputation of having a robust SaaS version available from .com, including a free version, something basically no other host does. Over 200M people have used it, and countless started on .com and then migrated to another host. The shared branding made it very difficult for services like Typepad to compete. You want to see what WP would look like without it? Go to Joomla.

    .com has also been the source of countless performance improvements, we deploy pre-release versions of core to millions of sites to find bugs and do testing, making WP releases way more stable for regular users and hosts. No company contributes more, even though many make more from WP than .com’s revenue. It would have been way easier to fork the software, not merge MU. Most hosts (and many community members) bad-mouth .com while not contributing a fraction back to core. Hosts spend tens of millions a year on ads against .com. I get attacked constantly.

    In 2010, when the WordPress Foundation was created, Automattic transferred the WordPress trademarks to the Foundation, after having been the temporary custodian of the trademarks until that time. As part of the transfer, the Foundation granted Mullenweg use of the WordPress trademark for WordPress.com.

    This trademark was deliberately secured, and the company does not appear to be open to renaming the platform. This doesn’t mean WordPress.com can’t do anything to mitigate the confusion that scraping the WordPress.org plugin directory creates. Participants in the discussion suggested that WordPress.com forego indexing the pages they created for plugins that developers submitted to the open source project.

    “You can control SEO by telling search engines to not index those pages of open source software developed for .org on the .com domain,” WordPress plugin developer Marco Almeida said.

    “I have 20 free plugins on the repository and I don’t see how my plugins will benefit if we open this pandora box and normalize cloning these pages and diluting the WordPress.org importance on search engines.”

    Developers who are just now discovering their WordPress.org plugins cloned to WordPress.com listings are also wanting to know how many of their installs come from WordPress.com so they can better understand their user bases. Mullenweg suggested developers who want a different listing for WordPress.com users can sign up for the .com marketplace.

    Tensions remained high as the heated discussion continued throughout the day and into the evening with criticism flowing across X (Twitter), Post Status Slack, and other social channels, as many developers learned for the first time that their plugin listings have been cloned on WordPress.com. As long as a commercial entity shares the open source project’s branding, these types of clashes and friction will continue popping up.

    “Personally, I can’t help but empathize with plugin authors that chose to support OSS and find the directory cloned in a commercial service, albeit free, with no access to stats,” Francesca Marano said. “As I mentioned before, the main issue is the confusion around the two projects.”

  • WordPress.org Plugin Developers Renew Demands for Better Plugin Metrics

    It has be nearly one year since WordPress silently turned off active install growth data for plugins hosted in the official plugin repository, a key metric that many developers rely on for accurate tracking and product decision-making. “Insufficient data obfuscation” was cited as the reason for the charts’ removal, but this opaque decision landed without any communication from those who had made the call in a private discussion.

    In a ticket originally titled “Bring back the active install growth chart,” RebelCode CEO Mark Zahra made the opening plea for thousands of plugin developers who were asking for the return of this data. From those who simply host hobby plugins and enjoy the thrill of watching people use software they made to business owners who need this data to make critical decisions, the overwhelming consensus was that this data is valuable and should be available to those who are contributing to WordPress through plugins.

    In an appearance on the WPwatercooler podcast last year, Audrey Capital-sponsored meta contributor Samuel “Otto” Wood confirmed the decision was made through private channels via Slack DMs in a discussion initiated by Matt Mullenweg. He also revealed that the active install growth chart was removed because it was giving inaccurate data and that the data one could derive from it was inaccurate:

    I read through all that discussion and we worked, they worked on it for a long, Scott and several people tried various things before removing it. They adjusted the values, they adjusted numbers. They, they went through a ridiculous amount of iteration and in the end, none of it worked. People were still using it even though it was giving them basically garbage. So finally removing it was the only thing to do. We did have a plan for replacing it. We just didn’t have a plan for replacing it immediately. Nevertheless, giving them active install count numbers that are wrong is more harmful, we felt, to both users and developers interests than simply not giving them at all. 

    Wood offered an explanation on the podcast that should have been delivered weeks earlier by those involved in the discussion on official channels. Despite the earlier data being flawed and “insufficiently obfuscated,” developers still want access to the raw data, not interpretations of that data.

    These are the posts that track the history and development of developer’s pleas to reinstate access to the data:

    During the height of this discussion, developers made many suggestions for different data points that would be meaningful for tracking their efforts, and Matt Mullenweg responded that he was amenable to showing more stats to plugin authors about their plugins. No progress on this effort has been reported since then.

     StellarWP Product Marketing Director Taylor Waldon has reopened this discussion nearly a year later, calling on Mullenweg to stop restricting access to plugin data from people who are hosting themes and plugins on WordPress.org.

    “I talked to a bunch of folks at [WCUS] contributor day,” Paid Memberships Pro co-founder and CEO Jason Coleman said in response to Waldon’s tweet. “As far as I know, there isn’t any other current effort to update or replace the install count numbers or old ‘growth’ chart.’”

    Coleman put together a draft proposal with some ideas from his conversations. The document describes a common scenario where plugin developers are left in the dark about the growth or decline of their plugins’ active installations:

    Imagine a developer with a plugin with 150k active installations. That developer has effectively 0 quantitative feedback on whether users of his plugin are growing or falling. The download count has a trend, but there is no separation between new downloads and updates. The download count tracks developmental pace as much as user growth. A bump in downloads could be due to a security vulnerability being patched or an influx of new users. The current active installations count is severely rounded and offers no feedback until such a plugin either gains or loses 33% of its users, which are drastically different outcomes.

    Coleman contends that plugins hosted outside of WordPress.org are able to gather more meaningful metrics. Popular plugins have resorted to including features in non-WordPress.org add-ons or simply removing their extensions altogether from the repository for lack of data.

    His proposal includes a few metrics that would help developers better track their plugins, even if that data is only shown to the authors themselves:

    • Share a more accurate active installations count with the owners of a plugin.
    • Share more accurate version number counts with the owners of a plugin.
    • Differentiate the download count by type: website downloads, dashboard installs, dashboard downloads, updates, other (hits to the zip file).
    • Allow plugin developers to define custom event triggers to be tallied and displayed to the plugin owners on the plugins .org profile page.

    Coleman’s draft is still in progress. He was not immediately available for comment when I asked about the next step once the proposal is further developed.

    WordPress.org has always been the most popular distribution channel for the most widely used plugins, but the data available has not kept pace with developer and business needs. Releasing the raw data, while respecting any privacy limitations, would allow developers to extract their own interpretations of that data and allow services to present it in creative ways.

    At the very least, this data should be available to developers (even if it’s not public) to help them better track the trajectory of their plugins and the efficacy of their marketing efforts. More data can only serve to improve the WordPress ecosystem’s ability to continue powering a multi-billion dollar economy. There are undoubtedly many technical requirements for supporting the release of this data, and they need to be prioritized if WordPress.org is to continue attracting the best products for distribution.

    “This is not about vanity metrics or inflating numbers for marketing purposes,” Coleman said. “This is about getting valuable feedback on the relative use of a plugin hosted in the .org repository so developers can make informed decisions and investments in those plugins.”

  • ACF’s 2023 Annual Survey Results Reinforce Plugin’s Focus on Improving the Block Building Experience

    Advanced Custom Fields (ACF), one of the plugins WP Engine acquired from Delicious Brains in 2022, has published the results if its first annual survey. Although ACF reports more than 4.5 million active users, including PRO site installs, the survey only gathered feedback from 2,031 respondents.

    These results are more representative of the plugin’s developer community, as 81% of respondents are developers who maintain between 11-50 websites. 63% use version control for their codebase, and 27% manage dependencies with Composer.

    The survey showed that ACF is still an important tool for its early adopters, as 50% said they have been using it since its early days and 70% of all respondents use the plugin on all the websites they build.

    When asked what type of sites they are building, respondents had the option to choose multiple answers. Sites using Classic WordPress themes are the most popular followed by Hybrid themes, Block themes, and page builders. Surveying those who use the block editor, 56% report that they build blocks using ACF blocks.

    “It was cool to see the strong representation of hybrid and block themes,” WP Engine Product Marketing Manager Rob Stinson said. “It shows us that there is growing adoption of the modern WP editor experience amongst the PHP friendly crowd that is the ACF user base.

    “We had this scoped for upcoming releases anyway, but it reinforces our focus on improving the block building experience in ACF.”

    Among those ACF users building sites with page builders, the most popular selections include Elementor, Divi, Beaver Builder, and WPBakery Page Builder. Naturally, ACF Extended is the most popular extension used with ACF, followed by Gravity Forms, Yoast SEO, and ACF Better Search.

    Respondents demonstrated high confidence in those maintaining the plugin, as 98% of them are comfortable updating ACF to the latest version. They are also confident in continuing to build on top of WordPress, as 91% of survey participants said they are likely to continue with the platform. For a more detailed look at the questions and responses, check out the 2023 annual survey results on the ACF website.

  • Patchstack Reports 404 Vulnerabilities Affecting 1.6M+ Websites to WordPress.org Plugins Team

    After an accumulation of undisclosed and unpatched vulnerabilities in plugins hosted on WordPress.org, Patchstack has reported 404 plugins to WordPress’ Plugin Review Team.

    “This situation creates a significant risk for the WordPress community, and we decided to take action,” Patchstack researcher Darius Sveikauskas said. “Since these developers have been unreachable, we sent the full list of those 404 vulnerabilities to the plugins review team for processing.”

    Ordinarily, reporting plugins to WordPress.org is a last resort for challenging cases after Patchstack fails to find a way to contact the vendors. In this case, many of these plugin authors have included zero contact information in their extensions or are not responding to communication attempts. Patchstack has characterized it as a “zombie plugins pandemic” due to the overwhelming number of abandoned plugins affecting more than 1.6 million sites.

    The WordPress.org Plugins Team has acted on the report by closing more than 70% of the plugins. In June, the team added six new sponsored volunteers and opened applications for more team members but have struggled with managing a formidable backlog of plugins waiting to be reviews. The backlog is climbing higher and is now over 1,119 plugins with a 71-day wait time.

    Adding plugin vulnerability issues, where hundreds have to be closed, only adds to how long developers have to wait to get new plugins reviewed.

    As of August 31, 2023, Patchstack reports the following stats associated with these reports to WordPress.org:

    • 404 vulnerabilities
    • 358 plugins affected
    • 289 plugins (71,53%) – Closed
    • 109 plugins (26,98%) – Patched
    • 6 plugins (1,49%) – Not closed / Not patched
    • Up to 1.6 million active installs affected
    • Average installs per plugin 4984
    • Highest install count 100000 (two plugins)
    • Highest CVSS 9.1
    • Average CVSS 5.8
    • “Oldest” plugin – 13 years since the last update

    Patchstack is urging developers to add their contact details to their plugins’ readme.txt and/or SECURITY.md files. To streamline security issue management, the company has created the Patchstack mVDP (managed vulnerability disclosure program) project, which is free for developers to join. Patchstack validates the reports that come through, rewards the researchers, and passes them to the vendor to be addressed.

    The company is also advocating for a dashboard alert when a plugin or theme is removed due to security reasons, as WordPress does not currently give the user this information. Their researchers will soon be submitting more reports that may result in closed extensions.

    “We are preparing more similar lists for the WordPress.org themes repository and repositories focused on premium products,” Sveikauskas said. “We are currently processing about extra 200+ similar vulnerabilities.”