WordPress.org

Judging by the flurry of activity across the WordPress project throughout February, it looks like everyone is really getting into the swing of things for 2018. There have been a lot of interesting new developments, so read on to see what the community has been up to for the past month.

WordPress 4.9.3 & 4.9.4

Early in the month, version 4.9.3 of WordPress was released, including a number of important bug fixes. Unfortunately it introduced a bug that prevented many sites from automatically updating to future releases. To remedy this issue, version 4.9.4 was released the following day requiring many people to manually update their sites.

While this kind of issue is always regrettable, the good thing is that it was fixed quickly, and that not all sites had updated to 4.9.3 yet, which meant they bypassed the bug in that version.

You can find out more technical information about this issue on the Core development blog.

The WordCamp Incubator is Back

In 2016, the Global Community Team ran an experimental program to help spread WordPress to underserved areas by providing more significant organizing support for their first WordCamp event. This program was dubbed the WordCamp Incubator, and it was so successful in the three cities where it ran that the program is back for 2018.

Right now, the Community Team is looking for cities to be a part of this year’s incubator by taking applications. Additionally, each incubator community will need an experienced WordCamp organizer to assist them as a co-lead organizer for their event — if that sounds interesting to you, then you can fill in the application form for co-leads.

You can find out further information about the WordCamp Incubator on the Community Team blog.

WordPress Meetup Roundtables scheduled for March

In order to assist local WordPress meetup organizers with running their meetup groups, some members of the Community Team have organized weekly meetup roundtable discussions through the month of March.

These will be run as video chats at 16:00 UTC every Wednesday this month and will be a great place for meetup organizers to come together and help each other out with practical ideas and advice.

If you are not already in the WordPress meetup program and would like to join, you can find out more information in the WordPress Meetup Organizer Handbook.

GDPR Compliance in WordPress Core

The General Data Protection Regulation (GDPR) is an upcoming regulation that will affect all online services across Europe. In order to prepare for this, a working group has been formed to make sure that WordPress is compliant with the GDPR regulations.

Aside from the fact that this will be a requirement for the project going forward, it will also have an important and significant impact on the privacy and security of WordPress as a whole. The working group has posted their proposed roadmap for this project and it looks very promising.

To get involved in building WordPress Core, jump into the #gdpr-compliance channel in the Making WordPress Slack group, and follow the Core team blog.

Further Reading:

• WPShout published a thorough guide to WordPress security.
• The Community Team has published interesting statistics from the WordCamp program in 2016 and 2017.
• An intriguing proposal has been made for a new ‘Onboarding’ team to be started in the WordPress project.
• The new editing experience for WordPress, named Gutenberg, continues to be actively developed with a feature-packed release this past month.
• The Advanced WordPress Facebook group held an interview with WordPress co-founder, Matt Mullenweg about the Gutenberg project.
• Two factor authentication is on its way to the WordPress.org network — this will be a great improvement to the overall security of the project.

If you have a story we should consider including in the next “Month in WordPress” post, please submit it here.

WordCamps are informal, community-organized events that are put together by a team of local WordPress users who have a passion for growing their communities. They are born out of active WordPress meetup groups that meet regularly and are able to host an annual WordCamp event. This has worked very well in many communities, with over 120 WordCamps being hosted around the world in 2017.

Sometimes though, passionate and enthusiastic community members can’t pull together enough people in their community to make a WordCamp happen. To address this, we introduced the WordCamp Incubator program in 2016.

The goal of the incubator program is to help spread WordPress to underserved areas by providing more significant organizing support for their first WordCamp event. In 2016, members of the global community team worked with volunteers in three cities — Denpasar, Harare and Medellín — giving direct, hands-on assistance in making local WordCamps possible. All three of these WordCamp incubators were a great success, so we're bringing the incubator program back for 2018.

Where should the next WordCamp incubators be? If you have always wanted a WordCamp in your city but haven’t been able to get a community started, this is a great opportunity. We will be taking applications for the next few weeks, then will get in touch with everyone who applied to discuss the possibilities. We will announce the chosen cities by the end of March.

To apply, fill in the application by March 15, 2018. You don’t need to have any specific information handy, it’s just a form to let us know you’re interested. You can apply to nominate your city even if you don’t want to be the main organizer, but for this to work well we will need local liaisons and volunteers, so please only nominate cities where you live or work so that we have at least one local connection to begin.

We're looking forward to hearing from you!

WordPress 4.9.4 is now available.

This maintenance release fixes a severe bug in 4.9.3, which will cause sites that support automatic background updates to fail to update automatically, and will require action from you (or your host) for it to be updated to 4.9.4.

Four years ago with WordPress 3.7 “Basie”, we added the ability for WordPress to self-update, keeping your website secure and bug-free, even when you weren’t available to do it yourself. For four years it’s helped keep millions of installs updated with very few issues over that time. Unfortunately yesterdays 4.9.3 release contained a severe bug which was only discovered after release. The bug will cause WordPress to encounter an error when it attempts to update itself to WordPress 4.9.4, and will require an update to be performed through the WordPress dashboard or hosts update tools.

WordPress managed hosting companies who install updates automatically for their customers can install the update as normal, and we’ll be working with other hosts to ensure that as many customers of theirs who can be automatically updated to WordPress 4.9.4 can be.

For more technical details of the issue, we’ve posted on our Core Development blog. For a full list of changes, consult the list of tickets.

Download WordPress 4.9.4 or visit Dashboard → Updates and click “Update Now.”

WordPress 4.9.3 is now available.

This maintenance release fixes 34 bugs in 4.9, including fixes for Customizer changesets, widgets, visual editor, and PHP 7.2 compatibility. For a full list of changes, consult the list of tickets and the changelog.

Download WordPress 4.9.3 or visit Dashboard → Updates and click “Update Now.” Sites that support automatic background updates are already beginning to update automatically.

Thank you to everyone who contributed to WordPress 4.9.3:

Aaron Jorbin, abdullahramzan, Adam Silverstein, Andrea Fercia, andreiglingeanu, Andrew Ozz, Brandon Payton, Chetan Prajapati, coleh, Darko A7, David Cramer, David Herrera, Dion Hulse, Felix Arntz, Frank Klein, Gary Pendergast, Jb Audras, Jeffrey Paul, lizkarkoski, Marius L. J., mattyrob, Monika Rao, munyagu, ndavison, Nick Momrik, Peter Wilson, Rachel Baker, rishishah, Ryan Paul, Sami Ahmed Siddiqui, Sayed Taqui, Sean Hayes, Sergey Biryukov, Shawn Hooper, Stephen Edgar, Sultan Nasir Uddin, tigertech, and Weston Ruter.

Things got off to a gradual start in 2018 with momentum starting to pick up over the course of the month. There were some notable developments in January, including a new point release and work being done on other important areas of the WordPress project.

WordPress 4.9.2 Security and Maintenance Release

On January 16, WordPress 4.9.2 was released to fix an important security issue with the media player, as well as a number of other smaller bugs. This release goes a long way to smoothing out the 4.9 release cycle with the next point release, v4.9.3, due in early February.

To get involved in building WordPress Core, jump into the #core channel in the Making WordPress Slack group, and follow the Core team blog.

Updated Plugin Directory Guidelines

At the end of 2017, the guidelines for the Plugin Directory received a significant update to make them clearer and expanded to address certain situations. This does not necessarily make these guidelines complete, but rather more user-friendly and practical; they govern how developers build plugins for the Plugin Directory, so they need to evolve with the global community that the Directory serves.

If you would like to contribute to these guidelines, you can make a pull request to the GitHub repository or email plugins@wordpress.org. You can also jump into the #pluginreview channel in the Making WordPress Slack group.

Further Reading:

• Near the end of last year a lot of work was put into improving the standards in the WordPress core codebase and now the entire platform is at nearly 100% compliance with the WordPress coding standards.
• Gutenberg, the new editor coming to WordPress core in the next major release, was updated to v2.1 this month with some great usability and technical improvements.
• The Global Community Team is taking suggestions for the goals of the Community program in 2018.
• WPCampus Online, a digital conference focused on WordPress in higher education, took place on January 30. The videos of the event sessions will be online soon.
• A WordPress community member has released a toolkit to help developers build blocks for Gutenberg.
• The community team that works to improve the WordPress hosting experience is relatively young, but they have been making some great progress recently.

If you have a story we should consider including in the next “Month in WordPress” post, please submit it here.

WordPress 4.9.2 is now available. This is a security and maintenance release for all versions since WordPress 3.7. We strongly encourage you to update your sites immediately.

An XSS vulnerability was discovered in the Flash fallback files in MediaElement, a library that is included with WordPress. Because the Flash files are no longer needed for most use cases, they have been removed from WordPress.

MediaElement has released a new version that contains a fix for the bug, and a WordPress plugin containing the fixed files is available in the plugin repository.

Thank you to the reporters of this issue for practicing responsible security disclosure: Enguerran Gillier and Widiz.

21 other bugs were fixed in WordPress 4.9.2. Particularly of note were:

• JavaScript errors that prevented saving posts in Firefox have been fixed.
• The previous taxonomy-agnostic behavior of get_category_link() and category_description() was restored.
• Switching themes will now attempt to restore previous widget assignments, even when there are no sidebars to map.
  

The Codex has more information about all of the issues fixed in 4.9.2, if you'd like to learn more.

Download WordPress 4.9.2 or venture over to Dashboard → Updates and click "Update Now." Sites that support automatic background updates are already beginning to update automatically.

Thank you to everyone who contributed to WordPress 4.9.2:

0x6f0, Aaron Jorbin, Andrea Fercia, Andrew Duthie, Andrew Ozz, Blobfolio, Boone Gorges, Caleb Burks, Carolina Nymark, chasewg, Chetan Prajapati, Dion Hulse, Hardik Amipara, ionvv, Jason Caldwell, Jeffrey Paul, Jeremy Felt, Joe McGill, johnschulz, Juhi Patel, Konstantin Obenland, Mark Jaquith, Nilambar Sharma, Peter Wilson, Rachel Baker, Rinku Y, Sergey Biryukov, and Weston Ruter.

Activity slowed down in December in the WordPress community, particularly in the last two weeks. However, the month started off with a big event and work pushed forward in a number of key areas of the project. Read on to find out more about what transpired in the WordPress community as 2017 came to a close.

WordCamp US 2017 Brings the Community Together

The latest edition of WordCamp US took place last month in Nashville on December 1-3. The event brought together over 1,400 WordPress enthusiasts from around the world, fostering a deeper, more engaged global community.

While attending a WordCamp is always a unique experience, you can catch up on the sessions on WordPress.tv and look through the event photos on Facebook to get a feel for how it all happened. Of course, Matt Mullenweg’s State of the Word talk is always one of the highlights at this event.

The next WordCamp US will be held in Nashville again in 2018, but if you would like to see it hosted in your city in 2019 and 2020, then you have until February 2 to apply.

WordPress User Survey Data Is Published

Over the last few years, tens of thousands of WordPress users all over the world have filled out the annual WordPress user survey. The results of that survey are used to improve the WordPress project, but that data has mostly remained private. This has changed now and the results from the last three surveys are now publicly available for everyone to analyze.

The data will be useful to anyone involved in WordPress since it provides a detailed look at who uses WordPress and what they do with it — information that can help inform product development decisions across the board.

New WordPress.org Team for the Tide Project

As announced at WordCamp US, the Tide project is being brought under the WordPress.org umbrella to be managed and developed by the community.

Tide is a series of automated tests run against every plugin and theme in the directory to help WordPress users make informed decisions about the plugins and themes that they choose to install.

To get involved in developing Tide, jump into the #tide channel in the Making WordPress Slack group, and follow the Tide team blog.

Further Reading:

• If you’re following the development of Gutenberg, or if you want a primer on where it’s headed, then Morten Rand-Hendriksen’s talk from WordCamp US is a must watch.
• The annual surveys for WordPress meetup members and meetup organizers are available for people to fill out — if you’re involved in or attend your local meetup group then be sure to complete those.
• 10up has a brand new plugin in beta that will assist with powerful and flexible content publishing and syndication across WordPress sites.
• The Community Team is exploring a move to make the recently developed CampSite theme the default theme for all new WordCamp websites. This is the theme that was developed and employed for WordCamp Europe 2017.
• The team working on the multisite features of WordPress Core has recently published their planned roadmap for development.

If you have a story we should consider including in the next “Month in WordPress” post, please submit it here.

For many years, we’ve invited folks to tell us how they use WordPress by filling out an annual survey. In the past, interesting results from this survey have been shared in the annual State of the Word address. This year, for the first time, the results of the 2017 survey are being published on WordPress News, along with the results of the 2015 and 2016 survey.

So that information from the survey doesn’t reveal anything that respondents might consider private, we do not publish a full export of the raw data. We’d love to make this information as accessible as possible, though, so if you have a suggestion for an OS project or tool we can put the data into that allows people to play with it that still protects individual response privacy, please leave a comment on this post!

Major Groups

This survey features multiple groups, dividing respondents at the first question:

Which of the following best describes how you use WordPress? (Mandatory)

Those who selected “I’m a designer or developer, or I work for a company that designs/develops websites; I use WordPress to build websites and/or blogs for others. (This might include theme development, writing plugins, or other custom work.)” were served questions from what we’ll call the “WordPress Professionals” group.

This “WordPress Professionals” group is further divided into WordPress Company and WordPress Freelancer/Hobbyist groups, based on how the respondent answered the question, “Which of the following best describes your involvement with WordPress? (2015) / Do you work for a company, or on your own? (2016-17).”

Those who selected “I own, run, or contribute to a blog or website that is built with WordPress.” were served questions in what we’re calling the “WordPress Users” group.

The relevant survey group is noted in each table below. In the case of questions that were served to different groups in 2015 but then served to all respondents in 2016 and 2017, the group responses from 2015 have been consolidated into one set of data for easier comparison between years.

Survey results

Jump to answers from WordPress Professionals

Jump to answers from WordPress Users

Jump to answers from All Respondents

Which of the following best describes how you use WordPress? (Mandatory)

WordPress Professionals

Which of the following best describes your involvement with WordPress? (Mandatory, 2015) / Do you work for a company, or on your own? (Mandatory, 2016-17)

How does your company or organization work with WordPress?

How would you describe the business of your typical client(s)? (2015) / How would you describe the business of your typical client/customer? (2016, 2017)

How does your company or organization use WordPress when developing websites? (2015) / When making websites, how does your company or organization use WordPress? (2016, 2017)

How much is your average WordPress site customized from the original WordPress installation?

Roughly how many currently active WordPress sites has your company or organization built?

How many person-hours (of your company’s work) does the typical site take to complete?

Roughly what percentage of your company or organization’s output is based around WordPress (as opposed to other platforms or software)?

In which of the following ways do you work with WordPress?

How would you describe the business of your typical client(s)?

How do you use WordPress in your development?

How much is your average WordPress site customized from the original WordPress installation?

How many currently active WordPress sites have you built? (2015) / Roughly how many currently active WordPress sites have you built? (2016, 2017)

Roughly what percentage of your working time is spent working with WordPress?

How many hours of your work does the typical site take to complete? (2015) / How many hours of work does your typical WordPress project take to launch? (2016, 2017)

Which of the following have you done with WordPress?

What’s the best thing about WordPress?*

 What’s the most frustrating thing about WordPress?*

WordPress is as good as, or better than, its main competitors.

WordPress Users

Which of the following describes how you use WordPress?

Who installed your WordPress website?

How much has the site been customized from the original WordPress installation?

What’s the best thing about WordPress?*

What’s the most frustrating thing about WordPress?*

WordPress is as good as, or better than, its main competitors.

All Respondents

Can you (truthfully!) say “I make my living from WordPress”?

Which devices do you access WordPress on?

WordPress now updates minor & security releases automatically for you. Check all that apply: (question not asked in 2016, 2017)

What is your gender?*

Where are you located?

What is your age?

Thank you to everyone who made time to fill out the survey — we’re so happy you use WordPress, and we’re very grateful that you’re willing to share your experiences with us! Thanks also to everyone who spread the word about this survey, and to those of you who read all the way to the bottom of this post. 😉

*Text Field Questions: Each survey included some questions that could be answered only by filling out a text field. In the case of the questions “What is the best thing about WordPress?” and “What is the most frustrating thing about WordPress?” we listed the five most common responses, aggregated when applicable. In the case of the question “What is your gender?” in the 2016 and 2017 surveys, we aggregated responses as best we could. Responses meant to obscure respondents’ gender entirely are aggregated in “prefer not to answer.”

The WordPress project recently released WordPress 4.9, “Tipton” — a new major release named in honor of musician and band leader Billy Tipton. Read on to find out more about this and other interesting news from around the WordPress world in November.

WordPress 4.9 “Tipton”

On November 16, WordPress 4.9 was released with new features for publishers and developers alike. Release highlights include design locking, scheduling, and previews in the Customizer, an even more secure and usable code editing experience, a new gallery widget, and text widget improvements.

The follow up security and maintenance, v4.9.1, has now been released to tighten up the security of WordPress as a whole.

To get involved in building WordPress Core, jump into the #core channel in the Making WordPress Slack group, and follow the Core team blog.

Apply to Speak At WordCamp Europe 2018

The next edition of WordCamp Europe takes place in June, 2018. While the organizing team is still in the early stages of planning, they are accepting speaker applications.

WordCamp Europe is the largest WordCamp in the world and, along with WordCamp US, one of the flagship events of the WordCamp program — speaking at this event is a great way to give back to the global WordPress community by sharing your knowledge and expertise with thousands of WordPress enthusiasts.

Diversity Outreach Speaker Training Initiative

To help WordPress community organizers offer diverse speaker lineups, a new community initiative has kicked off to use existing speaker training workshops to demystify speaking requirements and help participants gain confidence in their ability to share their WordPress knowledge in a WordCamp session.

The working group behind this initiative will be meeting regularly to discuss and plan how they can help local communities to train speakers for WordCamps and other events.

To get involved in this initiative, you can join the meetings at 5pm UTC every other Wednesday in the #community-team channel of the Making WordPress Slack group.

Further Reading:

• WordCamp US 2017 is happening on December 1-3 in Nashville, with the annual State of the Word talk happening on Saturday afternoon — the live stream of the entire event is available to view for free.
• Tide, a new service from XWP designed to help users make informed plugin choices, is due to launch at WordCamp US.
• Gutenberg development is continuing rapidly, with a packed new release and a focus on usability testing.
• After some discussion among the community, a new type of micro-regional WordCamp is going to be introduced into the global WordCamp program.

If you have a story we should consider including in the next “Month in WordPress” post, please submit it here.

WordPress 4.9.1 is now available. This is a security and maintenance release for all versions since WordPress 3.7. We strongly encourage you to update your sites immediately.

WordPress versions 4.9 and earlier are affected by four security issues which could potentially be exploited as part of a multi-vector attack. As part of the core team's ongoing commitment to security hardening, the following fixes have been implemented in 4.9.1:

1. Use a properly generated hash for the newbloguser key instead of a determinate substring.
2. Add escaping to the language attributes used on html elements.
3. Ensure the attributes of enclosures are correctly escaped in RSS and Atom feeds.
4. Remove the ability to upload JavaScript files for users who do not have the unfiltered_html capability.

Thank you to the reporters of these issues for practicing responsible security disclosure: Rahul Pratap Singh and John Blackbourn.

Eleven other bugs were fixed in WordPress 4.9.1. Particularly of note were:

• Issues relating to the caching of theme template files.
• A MediaElement JavaScript error preventing users of certain languages from being able to upload media files.
• The inability to edit theme and plugin files on Windows based servers.

This post has more information about all of the issues fixed in 4.9.1 if you'd like to learn more.

Download WordPress 4.9.1 or venture over to Dashboard → Updates and click "Update Now." Sites that support automatic background updates are already beginning to update automatically.

Thank you to everyone who contributed to WordPress 4.9.1:

Alain Schlesser, Andrea Fercia, Angelika Reisiger, Blobfolio, bobbingwide, Chetan Prajapati, Dion Hulse, Dominik Schilling (ocean90), edo888, Erich Munz, Felix Arntz, Florian TIAR, Gary Pendergast, Igor Benic, Jeff Farthing, Jeffrey Paul, jeremyescott, Joe McGill, John Blackbourn, johnpgreen, Kelly Dwan, lenasterg, Marius L. J., Mel Choyce, Mário Valney, natacado, odyssey, precies, Saša, Sergey Biryukov, and Weston Ruter.