WordPress News Roundup April 2012: WordPress 3.3.2 Release, WordPress 3.4 Enters Beta, Automattic Eyes $45 Million in Revenue and Wordfence Launches

April 2012 put WordPress 3.4 in testers’ hands. Three betas arrived in just over two weeks, each bringing the new live theme customizer closer to release. Alongside the third beta, WordPress 3.3.2 fixed security issues in bundled upload libraries and in core itself.

It was also a month of rare financial transparency from Automattic. The company said it was profitable and on track for about $45 million in revenue for the year, and announced its first chief financial officer and first general counsel. In the plugin world, Mark Maunder launched Wordfence, a security plugin that would become one of the most widely used in the directory.

Mergers, Acquisitions, and Investments

No WordPress acquisitions were announced in April 2012, but Automattic shared rare detail about its finances.

• Automattic’s growth (April 25): In an interview reported by TechCrunch, Automattic said it was profitable and on track to make about $45 million in revenue in 2012. Mullenweg had put revenue at around $10 million in December 2010.
• New executives: Stuart West, previously CFO of education software company Kno and a former vice chair of the Wikimedia Foundation board, joined as Automattic’s CFO. Paul Sieminski joined as the company’s first general counsel.
• Beyond WordPress: Facebook’s $1 billion purchase of Instagram on April 9 was the month’s biggest deal in social publishing, and a sign of how much value investors placed on content platforms.

WordPress Core Updates

• WordPress 3.4 Beta 1 (April 5): The first beta was released for testing, with the usual warning not to use it on production sites.
• WordPress 3.4 Beta 2 (April 12): Beta 2 followed a week later with more than 60 bug fixes and feature changes based on testing.
• WordPress 3.3.2 and 3.4 Beta 3 (April 20): WordPress 3.3.2 was a security update for all previous versions, released alongside Beta 3, which had nearly 90 changes since Beta 2.
• What 3.4 was bringing: The headline feature was the theme customizer, which let users preview changes to colours, backgrounds and headers live, along with faster theme browsing and better custom headers.

Other WordPress News

• WordPress and the top 100 blogs: Mullenweg pointed to a Pingdom study showing WordPress powered 49% of the top 100 blogs, and said he expected the share to keep rising as custom-built platforms declined.
• WordCamp San Francisco date: WordCamp Central announced that WordCamp San Francisco 2012 would take place on August 4.
• Team meetups: Automattic’s Janitorial team spent a week working together in Seaside, Florida, one of many small in-person meetups at the distributed company.
• Password reuse: Mullenweg floated the idea of services checking whether new users were reusing passwords from other sites, a sign of how much password security was on people’s minds.

Security Alerts and Plugin Vulnerabilities

• Bundled libraries: WordPress 3.3.2 updated the Plupload uploader to version 1.5.4 and patched the SWFUpload and SWFObject libraries. The Plupload and SWFUpload bugs were reported by Neal Poole and Nathan Partlan, with another SWFUpload issue credited to Szymon Gruszecki.
• Core fixes: The release also fixed a limited privilege escalation that let a site administrator deactivate network-wide plugins on some multisite networks, credited to Jon Cave and Adam Backstrom, and cross-site scripting issues credited to Jon Cave and Mauro Gentile.
• Wordfence arrives: Mark Maunder launched Wordfence, a mostly free plugin that compared core files against the originals, scanned for malware, added a firewall and protected logins from brute force attacks.

Industry Trends and Insights

Automattic’s revenue figures gave the wider industry a rare look at the money behind WordPress. Going from around $10 million to an expected $45 million in about 16 months showed that hosting, upgrades, VIP and services such as VaultPress and Akismet were adding up to a serious business.

• Security as a product: Wordfence joined Sucuri and VaultPress in a fast-growing market for WordPress security tools, a market that the TimThumb flaw and rising brute force attacks had helped create.
• Third-party code: The 3.3.2 fixes showed that libraries bundled in WordPress could carry risk, just as TimThumb had for themes.

Theme of the Month: Responsive

Responsive, a free theme by Emil Uzelac of ThemeID, was one of the breakout themes of 2012. In April, a post to the theme reviewers mailing list noted that it had more downloads than Twenty Eleven in the free theme directory, a remarkable achievement for a theme that adapted to phones and tablets at a time when few did.

Plugin of the Month: Wordfence

Wordfence launched in April 2012 with file integrity checks, malware scanning, a firewall, login protection and live traffic monitoring, nearly all for free. Built on lessons Maunder learned during the TimThumb episode, it would grow into one of the most installed security plugins in WordPress history.

Host of the Month: A Small Orange

A Small Orange was a well-regarded shared hosting company with a loyal following among bloggers and developers for its support and fair pricing. For new WordPress users trying the 3.4 betas on a test site, affordable hosts like it were a practical option.

Founder of the Month: Emil Uzelac

Emil Uzelac founded ThemeID and created the Responsive theme. He was also a dedicated theme review volunteer who had passed 700 reviews by February. His theme’s rise in April showed how much demand there was for free, mobile-friendly designs.

Looking Ahead to May 2012

More 3.4 betas, and possibly a release candidate, were expected in May. WordPress would also turn nine on May 27, and planning for WordCamp San Francisco on August 4 was under way.