Yesterday I spoke at WordCamp Sofia after an 8-year pause. Great panels, great speakers, and organizers who once again did an outstanding job. The core is fine, as it has ever been. Good things end up here.
About 300 people came. Last year it was 400. A quarter of the room is gone in 12 months. And these are not AI-eliminiated jobs. These are people lost for the cause.
But I do not think WordPress lost those people. I think we did, for three key reasons:
- our egos
- our attitude towards change
- our lack of listening to end users and clients
1. Our egos
People started publishing plugins for the sake of publishing plugins. F**k quality, f**k security. Ship it, collect the stars, move on.
And now people publish plugins for the sake of giving somebody the finger. Literally. This was posted in the Bulgarian WordPress community group:
Translated: "This security plugin for WordPress rivals all paid (commercial) plugins and is completely free. Free forever. No 'trial' versions or limited features. I created it to show one big middle finger 🖕 to the developers of paid security plugins. If you try it, you will understand exactly what I mean. Enjoy!"
The proud author has since deleted the post. The plugin is still out there.
Read it again. A security plugin. Not built to protect anyone. Built out of spite, aimed at other developers, and pushed to site owners who will install it because it says "free" and "security" in the same sentence. That code now sits between real businesses and the internet. Spoiler alert: I have checked it. It is not so secure itself. The author may contact me if he wants feedback.
This is ego in its purest form. The plugin is not about the user. It is about the developer, his grudge and his audience. And this is what freedom looks like in the wrong hands. Nobody stopped it, nobody had to approve it, and the people who pay for it will be the clients who never saw the post in the first place. Free is free, with every side effect that comes with it. Clients do not care about developers who build plugins out of spite. They want fast, reliable and secure websites.
The numbers say it is not an outlier. Patchstack's 2026 report counts 11,334 new vulnerabilities in the WordPress ecosystem for 2025, up 42% in a year. About 91% are in plugins and 9% in themes. WordPress core had six (and yes, this year we had WP2Shell, the first core RCE discovered in a decade or so). Nearly half had no fix at the moment of disclosure, and the most attacked ones were mass-exploited within about five hours. We have had that experience ourselves, but I will tell it some other time.
Core is fine. We are the vulnerability. The 40-plugin site with no update plan, built by someone who has never read the code they installed, is not a WordPress problem at its core. But in the eyes of the client it is a WordPress problem.
2. Our attitude towards change
Yesterday Lyubomir Rusanov from JetHost said something that stuck with me. Twenty years ago WordPress gave freedom to the internet. Making a website became easy. Now it has to reinvent itself to keep that image, because today "a website on WordPress" is associated with bloat, poor security, and not many other good things.
He is right, and it hurts because it is fair. WordPress is not losing ground because it is poor technology (well, there is some of that as well, but that is another discussion). It is losing ground because of what we built with it, and how. Part of PHP's poor image comes from WordPress and poor developer practices too. And yes, I have been part of those practices. Perhaps somewhere I still am. But it's not about what you have done. It is about what you have become after taking your mistakes into account.
When the world around us changes, we tend to do one of two things. We get defensive: Shopify is for amateurs, page builders are fine, it has always worked this way. Or we run: rewrite it all in the new thing, and solve the same old problems again in a newer syntax. Both are ego again, just dressed differently.
Meanwhile Shopify and the other hosted platforms package exactly the work we keep skipping, infrastructure, security, accessibility, into one predictable monthly bill. On paper, at least. Lock-in, transaction fees and an app store full of plugins with a subscription attached are all part of that deal. But the client who picks it is not stupid. They are tired of us.
Real change looks different. It looks like WooCommerce moving orders out of wp_posts and
postmeta into their own tables with
High-Performance Order Storage:
slow, careful work on the shared foundation, with a migration path, so that thousands of shops
can grow without starting over. Not a rebrand. A better base.
3. We stopped listening
Four days ago we had PHP2Shell. My team spent the whole of October 21st, and the better part of the night and day on the 22nd, on logs, patches and verification.
The clients did not care about any of it, and they should not have to. Patching, backups, a plugin with a hole in it: that is the part of the iceberg under the water. The client sees the tip. The site is slow, orders get lost. When the site gets hacked, it is their business that bleeds. They should not have to care about somebody's middle finger towards somebody else. They pay us to own everything related to their website.
Every time we make the client deal with our mess, we throw stones into their garden, and into WordPress's garden too.
And we do it because we stopped listening. A project starts, and ten minutes in we already have an opinion on the framework, the plugins, the hosting. The person across the table is still explaining how their orders work and what they want to do next year. We nod. Yes, yes, yes. That is not listening. That is waiting for our turn to talk about the stack.
Shopify listened. Cloudflare listened. Next.js listened. Others listened. And here we are.
Where we stand
I am not neutral on this, so I will not pretend to be. This is what my team and I are doing about it, and why.
- We invest in infrastructure. Patching, tested backups, monitoring and the ability to fix things without a vendor's panel. Because the work under the water is the work clients actually pay for, and the bad day is when it gets tested.
- We invest in training. In our own people first. Security, infrastructure, accessibility, the business side. Because freedom over the whole stack only turns into value when someone understands the whole stack.
- We solve people's problems, whatever the stack. WordPress, Laravel, Shopify, something else. The client came with a business problem, not a technology preference. Our job is to solve it, not to hand them new problems that come with our favorite tool.
- We treat every plugin and library as a responsibility. Each one gets a reason to be there and a person who owns its updates. Because every plugin we add is a promise to the client.
- We build accessible by default. Because a site that some people cannot use is not finished, and with the European Accessibility Act in force, for many clients it is also the law.
- We go out, listen and share. Conferences, trainings, community events, and not only the WordPress ones. We listen to people on other stacks, because they may have already solved our problem. And we share what we learn, mistakes included, because that is how all of us started. Because we also tened to have lost our hearing. It is well about time to get it back.
WordPress is a tool for other people's freedom
In my talk I called WordPress a door. I will go further.
WordPress is a tool. Its purpose is to solve other people's business problems and give them the freedom to grow. Freedom to epxress themselves. Twenty years ago it did exactly that for the whole internet. It can do it again, but only if the people holding the tool remember who it is for.
The core is fine. It is up to us to fix the rest.