WordPress News Roundup December 2015: The First WordCamp US, “Learn JavaScript Deeply” and WordPress 4.4 “Clifford”

December 2015 was the month WordPress told its developers to change. At the first WordCamp US in Philadelphia, Matt Mullenweg’s tenth State of the Word gave the community a short piece of homework, “Learn JavaScript, deeply,” and held up Automattic’s React-based Calypso as an example of where the WordPress interface could go.

Three days later, WordPress 4.4 “Clifford” shipped with the REST API infrastructure, responsive images, post embeds and the Twenty Sixteen theme, and with more contributors than any release before it. The month closed on a less happy note as WP Engine asked customers to reset their credentials after a security breach.

Mergers, Acquisitions, and Investments

• Pro Plugin Directory acquired: Charlie Livingston, founder of aThemes, acquired the Pro Plugin Directory on December 22 after its owner sought a buyer in November.
• CoSchedule refocuses: Garret Moon and Justin Walsh turned their attention fully to the CoSchedule editorial calendar after their agency, Todaymade, was acquired by MABU.

WordPress Core Updates

• WordPress 4.4 “Clifford”: Released on December 8 and named after jazz trumpeter Clifford Brown, 4.4 introduced the Twenty Sixteen default theme, responsive images, and post embeds that let WordPress content be embedded on other WordPress sites. It added five new oEmbed providers (Cloudup, Reddit Comments, ReverbNation, Speaker Deck and VideoPress), integrated the REST API infrastructure, and brought term meta, comment query improvements and new WP_Term, WP_Comment and WP_Network objects.
• A record team: Scott Taylor led the release, which had 471 contributors with props, by far the most to that point.
• Release leads for 2016: State of the Word confirmed Mike Schroder would lead 4.5, Dominik Schilling 4.6, and Matt Mullenweg himself 4.7.
• Early 4.4 issues: Some sites using SSL found images not loading after the update because of how responsive image URLs were generated, and WP Tavern explained how to restore the removed Get Shortlink button.
• Shiny Updates for themes: Work continued on extending in-place updates to themes, with a progress report at the end of the month.

Other WordPress News

• WordCamp US 2015: The inaugural event at the Pennsylvania Convention Center from December 4 to 6 drew about 1,800 attendees. Sessions were posted on WordPress.tv within days, and tickets for WordCamp US 2016, again in Philadelphia, from December 2 to 4, went on sale on December 9.
• State of the Word: Mullenweg reported that WordPress powered 25% of the web, that 2015 had seen 89 WordCamps with 21,000 attendees in 34 countries, that the Plugin Directory had passed a billion downloads, and that Twenty Fifteen had become the most popular theme ever with 1.6 million active sites. He also said PHP 7 was about twice as fast as its predecessors and called customisation WordPress’ biggest opportunity for improvement.
• Community Summit: Contributors met on December 2 and 3 ahead of WordCamp US to discuss the project’s direction.
• Calypso on every desktop: Automattic released the WordPress.com desktop app for Windows on December 9 and for Linux on December 17, and open-sourced the desktop wrapper.
• WordAds opens up: Automattic’s WordAds advertising network was opened to self-hosted WordPress sites at the end of December.
• Photon and WebP: Jetpack’s Photon image CDN added WebP support for faster-loading images.
• Learning JavaScript: Zac Gordon launched a Kickstarter for a JavaScript course aimed at WordPress developers, and a London REST API conference, A Day of REST, saw tickets selling fast. Treehouse, by contrast, dropped its WordPress courses.
• Growing communities: More than 500 people attended a WordPress meetup in Lahore, and WordCamp Lahore was approved for 2016.

Security Alerts and Plugin Vulnerabilities

• WP Engine breach: WP Engine emailed customers in the second week of December to say it had learned of an exposure involving some customer credentials. It invalidated passwords as a precaution and asked customers to reset five credentials: the User Portal, WordPress database, SFTP, the original wp-admin account, and password-protected and transferable installs. The company said it had no evidence the information had been misused and promised updates as its investigation continued.
• No core security release: WordPress 4.4 shipped without an accompanying security release, though a 4.4.1 update would follow in early January.

Industry Trends and Insights

Two releases outside WordPress shaped its future in December. PHP 7.0 arrived on December 3, delivering large performance gains for WordPress sites on hosts that adopted it, and Let’s Encrypt entered public beta the same day, offering free, automated certificates that would make HTTPS practical for ordinary sites.

Inside the community, “Learn JavaScript, deeply” became the phrase of the year. With the REST API infrastructure in core and Calypso in production, the message was clear: WordPress would remain a PHP application on the server, but its interfaces would increasingly be built in JavaScript. Microsoft even added a WordPress data source to its Windows App Studio beta, a small sign of WordPress becoming a back end for apps.

Theme of the Month: Popper

Popper, a free touch-friendly theme with a strong focus on accessibility, arrived in December. At a time when core was investing heavily in accessibility and responsive images were brand new, it showed how a theme could take full advantage of both.

Plugin of the Month: Shiny Updates

The Shiny Updates feature plugin, extending in-place, page-load-free updates from plugins to themes and bulk actions, made steady progress in December. It addressed one of the most common frustrations in wp-admin, and its work would eventually ship in WordPress 4.6.

Host of the Month: DreamHost

DreamHost announced in early December that it would support Let’s Encrypt’s free certificates as soon as they became publicly available, and it later turned that into one-click integration. It was one of the first hosts to embrace free, automated HTTPS, a step the WordPress project itself would push the whole hosting industry towards a year later.

Founder of the Month: Zac Gordon

Zac Gordon, a WordPress educator, answered Mullenweg’s call less than two weeks later by launching a Kickstarter for a JavaScript course for WordPress developers. The project grew into his JavaScript for WordPress training business, which became a go-to resource as the community moved towards the REST API and, later, the block editor.

Looking Ahead to January 2016

January was expected to bring a 4.4.1 maintenance release and the start of the 4.5 cycle under Mike Schroder, with a release targeted for the spring. WP Engine owed its customers an explanation of how the breach occurred, and A Day of REST in London was set for late January.