WordPress News Roundup April 2010: WordPress 3.0 Beta 1 Arrives as Network Solutions Sites Are Hacked

April 2010 put WordPress 3.0 into testers’ hands and WordPress security into the headlines. The first 3.0 beta arrived on April 3, giving users an early look at multisite, custom menus and Twenty Ten. A week later, hundreds of WordPress blogs hosted at Network Solutions were found to have been compromised, and some coverage blamed WordPress itself.

The project pushed back firmly, explaining that the root cause was server configuration that let customers read each other’s files. By the end of the month the 3.0 team was sprinting to fix more than 200 remaining bugs before Beta 2, and WordCamp San Francisco was days away.

Mergers, Acquisitions, and Investments

• Shareaholic acquires SexyBookmarks (April 13): Shareaholic bought the social sharing plugin, downloaded more than 200,000 times, and kept its main author involved.

WordPress Core Updates

• WordPress 3.0 Beta 1: Released on April 3 as an early beta with some features still being finished, it invited testers to try the merged multisite code, the new menu system and the Twenty Ten theme.
• Menus under construction: Austin Matzko submitted the main menu system patch, which still needed Ajax and Internet Explorer work, and screenshots of the planned menu interface circulated late in the month.
• Beta 2 sprint: On April 24 WordPress.org said the second beta was planned for early the following week and asked developers to help, since the 3.0 milestone still had more than 200 open bugs. Menu work was the main reason Beta 2 slipped into May.
• Who contributed: Andrew Nacin published a visualisation of the contributors who had submitted patches to 3.0 so far.

Other WordPress News

• @WordPress on Twitter: An April 2 post highlighted the official @WordPress account and the growing range of Twitter apps.
• Summer of Code deadline: Student applications for Google Summer of Code 2010 closed at 19:00 UTC on April 9.
• WordCamp San Francisco: WordPress.org previewed the fourth annual WordCamp SF, scheduled for May 1, recalling that the first had been held in 2006 when WordPress was at version 2.0.
• Help for Ning users: As Ning moved away from free networks, Boone Gorges released a free plugin to import Ning members and profile data into BuddyPress.
• The state of spam: Akismet published an overview of how web spam had changed since 2005, including spam posted by humans and spam carrying malware.
• Supporting WordCamps: A WordCast interview with Automattic’s Maya Desai described the company’s work helping WordCamp organisers.
• Commercial WordPress series: WordPress Weekly wrapped up its month-long series on businesses built around themes, plugins and services.

Security Alerts and Plugin Vulnerabilities

The Network Solutions incident was the month’s defining story and an important lesson in shared hosting security.

• Mass infection: Around April 10, owners of WordPress sites on Network Solutions found their sites injecting malicious code. Sucuri documented the attack, in which database credentials were harvested from readable wp-config.php files and used to alter the siteurl setting.
• WordPress responds: On April 13 WordPress.org published “Secure File Permissions Matter,” explaining that any web application must store its database credentials in a form the server can read, and that a host allowing customers to read each other’s files was the real flaw. Network Solutions’ own investigation pointed to file permissions on wp-config.php.
• A second wave: On April 19 customers at Network Solutions were reported to be under attack again.
• Built-in security? WP Tavern asked whether WordPress needed a native security suite in response to the month’s attacks on web hosts.

Industry Trends and Insights

April showed how WordPress’s popularity made it the visible face of problems it had not caused. With so many sites on shared hosting, a single misconfigured server could compromise hundreds of blogs at once, and headlines tended to name the software rather than the host.

• Speed becomes a ranking signal: On April 9 Google announced it was using site speed as a factor in web search rankings, adding urgency to caching and performance work on WordPress sites.
• Ning’s retreat: Ning’s decision to phase out free networks sent community organisers looking for alternatives, and BuddyPress was well placed to benefit.
• Tablets arrive: Apple’s iPad went on sale on April 3, the same day as the 3.0 beta, opening a new screen size for themes and publishing apps to consider.

Theme of the Month: Mystique

digitalnature’s Mystique was a free theme launched in 2009 with the explicit goal of matching commercial templates in design and features, including a settings interface, custom widgets and multiple page layouts. Its popularity in the directory showed that free themes could compete with paid ones on polish.

Plugin of the Month: W3 Total Cache

Frederick Townes’ W3 Total Cache combined page caching, minification, browser caching and content delivery network support in a single plugin. When Google said in April that speed would influence rankings, comprehensive caching tools like it became a priority for many site owners.

Host of the Month: SiteGround

After the Network Solutions breach, many WordPress users started asking hosts pointed questions about account isolation and file permissions. SiteGround was among the shared hosts competing on WordPress support and security practices at a moment when those questions had become a deciding factor.

Founder of the Month: Daniel Cid

Daniel Cid founded Sucuri, whose research during April’s Network Solutions attacks gave site owners clear explanations of what had happened and how to clean up. The incident helped establish Sucuri as one of the leading names in WordPress security.

Looking Ahead to May 2010

May was set to open with WordCamp San Francisco on May 1, followed by WordPress 3.0 Beta 2 and, if testing went well, a release candidate. WordPress’s seventh anniversary also fell on May 27.