WordPress Is Eating Itself Alive

Core question / framing

• The video examines how WordPress—software powering a large share of the web—lost “trust” in ~90 days in 2024, despite becoming the dominant open-source CMS over ~20 years.
• It argues that the conflict between open-source/community governance and commercial monetization (hosting, plugins, trademark control, lawsuits) caused the ecosystem to fracture, impacting agencies, plugin developers, and hosts that rely on WordPress updates working predictably.

Early WordPress growth & feature approach (historical context)

• The origin story contrasts early static-site publishing problems with b2’s approach:
  • Database-backed content (posts/comments/metadata)
  • Pages generated on the fly
  • No large publication queues; easier web-based editing/publishing
• Community momentum:
  • Matt Mullenweg publishes “The Blogging Software Dilemma” and discusses fork compatibility (GPL code enabling forks).
  • WordPress releases in May 2003, with quickly growing downloads.
  • Major early catalyst: Six Apart / Movable Type introducing paid licensing for features/usage, pushing users toward WordPress.
• WordPress 1.5 (“Strayhorn”) is described as close to the modern system:
  • Themes, pages, and a control panel
  • Rapid download growth after release

The “engine vs platform” separation and monetization model

• The video differentiates what “WordPress” can mean:
  1. The software (GPL, downloadable, forkable; services built on top)
  2. wordpress.org (directories, update path, core infrastructure)
  3. WordPress Foundation (non-profit holding the name/trademark/legal brand)
  4. Automattic (wordpress.com) (commercial gateway and hosting/services)
• It claims the structure effectively balances “non-profit brand” with “commercial rights,” and that trademark/legal control becomes central later.

Recurring pattern: monetization attempts that break trust (examples)

• 2005 “Hot Nacho” incident on wordpress.org:
  • Abuse described: SEO spam, hidden keyword stuffing, off-screen links.
  • Fallout: Google reportedly removed ranking; site recovered quickly but trust damage is framed as a recurring lesson.
• Ecosystem business success:
  • WP Engine is highlighted as a reliability-focused managed host for agencies:
    • “Set it and forget it” managed WordPress services
  • Automattic investment in WP Engine is mentioned as seemingly ecosystem-supportive.

2021–2024 intensifying conflict: branding, monetization, and governance

• The video claims tensions expanded as big players compete for WordPress market share:
  • Mentions GoDaddy, WP Engine, Wix, Squarespace and the idea that they take “a chunk of the pie.”
• Matt’s messaging escalates:
  • June 2022: Matt calls GoDaddy a “parasitic” threat (then tweets are deleted; GoDaddy responds).
  • March 2023: Matt argues that supporting certain companies can be like being a shareholder because spending allegedly reinvests into what you “own yourself.”

2024 WordCamp US “nurture vs parasitism” keynote (trigger point)

• Sept 20, 2024 (WordCamp US): Matt gives a keynote that:
  • Frames WordPress as a “garden” that needs nurture
  • Attacks “parasitic entities” and depicts a host/harvester dynamic
  • Names/targets Lee Wittinger / WP Engine in particular (board/control of WP Engine).
• Audience reaction is described as mixed, with pushback from attendees about leadership and blame being too personalized.
• Immediately afterwards, the video notes:
  • Matt posts stating “WP Engine is not WordPress.”
  • Characterizes WP Engine using “cancer” metaphors (as described)

Legal and operational escalation: claims of “scorched earth” tactics

• The video alleges a rapid sequence across days:
  • WP Engine sends cease-and-desist notices to Automattic.
  • Matt is portrayed as threatening a “scorched earth” approach (described as nuclear/hostilities within the community).
  • Text-message allegations are included (timeline around night of Sept 19 / morning of Sept 20).

The “trust breaking” technical events in 2024

These are described as the central “product feature / ecosystem breakage” parts:

1. wordpress.org access blocked for WP Engine

   • WP Engine is cut off from wordpress.org services after trademark disputes.

2. Feed/widget disabled / panic risk

   • WP Engine disables a wordpress.org news feed shown in dashboards to avoid users seeing it and panicking.

3. ACF incident: plugin supply-chain disruption

   • Advanced Custom Fields (ACF) is described as a widely used plugin.
   • WP Engine previously acquired the ACF development company.
   • The video claims wordpress.org effectively:
     • Forked the plugin code (renamed to Secure Custom Fields / SCF)
     • Delivered updates from a “different maintainer”
   • Result: developers/agencies reportedly encounter:
     • Plugins appearing that they didn’t install
     • Unscheduled maintenance across client sites
   • Agencies are said to have had to debug “what broke after an update no one asked for.”
   • A “mandatory oath” checkbox at login is mentioned as compounding confusion (a claim about requiring users to affirm non-affiliation with WP Engine).

4. Update/installation path disrupted for WP Engine users

   • The “oxygen tube” (standard wordpress.org update channel) is described as stopped working for WP Engine users.
   • Reported outcome: security/update signals appear and update risk increases.

Court-ordered rollback and immediate mitigation (72 hours)

• Within days, the video says a federal judge orders restoration:
  • Restore wordpress.org access for WP Engine
  • Uncheck the login box / revert oath requirement
  • Return ACF
• Automattic is described as stating it’s temporary pending court resolution.

Organizational/engineering governance changes announced by Automattic

• A post titled “WordPress Sponsorship Reconciliation” is summarized:
  • Core/core-adjacent staff are transitioned to commercial products
  • The post claims commercial entities (examples given: wordpress.com, Pressable, WP VIP, Jetpack, WooCommerce) will contribute only 45 hours/week to the open-source project (down from ~4,000 hours per week before, per the video’s claims)

Community response: “Fair Package Manager” (ecosystem resiliency)

• About 5 months later, veterans launch the Fair Package Manager under the Linux Foundation umbrella:
  • Goal: reduce reliance on wordpress.org as the single critical update dependency
  • Framed as a response to “distrust” of the original maintainership/update channel
• The video draws parallels to other open-source forks/alternatives supported under Linux Foundation due to trust issues.

Technology/market metrics discussed (2026 update)

• The video claims:
  • WordPress has had six consecutive quarters of declining market share
  • Website share drops from 43% (Dec 2025) to 41.5% (at time of recording in July 2026)
• It also argues causality is uncertain:
  • Many users may never notice the governance drama
  • CMS growth may be stalled overall; people migrate to Shopify/Wix
• Performance/upgradability claim:
  • Mention of WordPress 7.0 (released a week before the WP23 post)
  • Within 7 days, 46% of installations upgraded automatically without major breakage; no supply-chain attacks were reported (as claimed)

Overall analysis conclusion

• The video portrays a repeated software-industry cycle:
  • Open-source project becomes a business platform
  • Commercial incentives collide with community governance
  • Trust erodes when technical distribution/update mechanisms appear controlled by competing interests
• It frames “trust” as a kind of infrastructure dependency:
  • When the update channel and maintainer boundaries are contested, agencies and developers experience real operational risk.

Main speakers / sources mentioned

• Matt Mullenweg (WordPress founder/Automattic)
• Naoko Takano (translator/locale manager; resigned after the conflict)
• Lee Wittinger (WP Engine board/control, targeted in the keynote)
• Jason Cohen (WP Engine founder)
• Heather Brunner (WP Engine CEO)
• Ryan McCue (WordPress REST API veteran; associated with Fair Package Manager)
• Automattic and WP Engine (as sources of claims via posts/positions)
• Linux Foundation (supporting Fair Package Manager)