WordPress News Roundup December 2016: WordPress 4.7 “Vaughan” Ships the REST API as Mullenweg Rewrites the Release Cycle

December 2016 closed the year with a release and a change of course. At WordCamp US in Philadelphia, Matt Mullenweg used his 11th State of the Word to announce that WordPress would drop its time-based release schedule in 2017 and focus on three projects: the REST API, the editor and the Customizer, with no guarantee of any releases during the year.

Three days later, WordPress 4.7 “Vaughan” shipped with Twenty Seventeen, a much-improved Customizer and the REST API content endpoints, built by 482 contributors, the most ever. Around those headlines, the month brought a commitment to HTTPS, two acquisitions by companies serving WordPress professionals, and a WordCamp sponsorship row.

Mergers, Acquisitions, and Investments

• Flywheel acquires Pressmatic: On December 1, Flywheel acquired Pressmatic, a local WordPress development app for macOS built by Clay Griffiths. Flywheel renamed it Local by Flywheel, made it free, and planned a Windows version.
• GoDaddy acquires WP Curve: On December 5, GoDaddy announced it had bought WP Curve, the WordPress small-jobs service founded in 2013 by Dan Norris and Alex McClafferty, which had completed more than 105,000 jobs. McClafferty would lead the team at GoDaddy, while Norris planned to move on.
• Plugin deals: UpdraftPlus acquired WP-Optimize to integrate it into UpdraftCentral, and Podcast Motor acquired the Seriously Simple Podcasting plugin.
• Funding WP-CLI: The WP-CLI project launched a patron support model to fund ongoing development.

WordPress Core Updates

• WordPress 4.7 “Vaughan”: Released on December 6 and named after jazz vocalist Sarah Vaughan, 4.7 introduced Twenty Seventeen, theme starter content, visible edit shortcuts, video headers, the ability to create pages while building menus, custom CSS in the Customizer, PDF thumbnail previews and a per-user dashboard language.
• REST API content endpoints: 4.7 completed the REST API merge begun in 4.4, giving every WordPress site machine-readable access to posts, pages, users, terms and more.
• Developer features: Post type templates, custom bulk actions, a settings registration API and Customizer changesets rounded out the release.
• The team: Helen Hou-Sandí led 4.7, with Jeff Paul and Aaron Jorbin as release deputies. Of the 482 contributors with props, 205 were contributing for the first time. 4.7 was also the first release to be 100% translated into Urdu.
• A new release model: Mullenweg said 2017 would be project-based rather than time-based, with himself returning as product lead and plans to appoint technical and design leads. He also proposed a WordPress Growth Council later in the month to study how to grow the platform’s share.

Other WordPress News

• State of the Word 2016: WordCamp US drew 1,923 attendees in person and 2,028 livestream viewers. Mullenweg reported 115 WordCamps in 41 countries during 2016, more than 62,500 meetup attendees in 58 countries, and WordPress’ share of the web rising from 13.1% to 27.2% over five years. Plugin downloads rose 34% to 1.48 billion, and translation contributors grew from 5,000 to 17,000.
• Calypso and the editor: Mullenweg argued that Calypso, or something like it, was the future of the WordPress interface, noting that 68% of WordPress.com posts were already published through it. He also announced that Ephox, the company behind TinyMCE, would help improve the core editing experience.
• WordCamps get a new home: WordCamps would move to WordPress Community Support, a public benefit corporation owned by the WordPress Foundation, which took in about $4.3 million in 2016.
• Moving toward SSL: On December 1, Mullenweg wrote in “Moving Toward SSL” that 2017 would be the year WordPress features began requiring HTTPS, and that early in the year WordPress.org would only promote hosting partners providing an SSL certificate by default. He added that the project would also consider whether hosts used PHP 7 by default for new accounts. At State of the Word, he put HTTPS usage at just 11.45% of active sites and named PHP 7 or higher as the official hosting recommendation.
• WordPress.org redesign: A redesigned WordPress.org homepage launched on December 22.
• Incubator success: Harare, Zimbabwe, hosted its first WordCamp, one of the cities chosen for the WordCamp Incubator.
• WordCamp Europe 2018: Organisers opened applications from cities wanting to host the 2018 event.
• WooCommerce’s reach: Figures published in December showed WooCommerce powering 42% of all online stores.

Security Alerts and Plugin Vulnerabilities

• BuddyPress 2.7.4: Patched a vulnerability that could allow arbitrary file deletion on December 23.
• Bluehost outage: A network outage at Bluehost left customers with around 12 hours of downtime in mid-December.
• Pantheon sponsorship revoked: The night before WordCamp US, Matt Mullenweg revoked Pantheon’s $100,000 sponsorship after a dispute over advertising Pantheon had placed in the official hotel’s elevators, citing a code of conduct violation. Pantheon was refunded, and both sides later said communication could have been better.
• REST API in hindsight: The new content endpoints would need an urgent fix in early 2017, when a serious content injection flaw introduced with 4.7 was patched in a later security release.

Industry Trends and Insights

The end of fixed release dates was Mullenweg’s response to what he called stagnation. Releases had become predictable but incremental, and he wanted WordPress to make bigger leaps in the editor and customisation, the areas where hosted builders such as Wix and Squarespace were competing hardest. The editor focus he announced would, within a year, become the Gutenberg project.

HTTPS and PHP 7 became official priorities. With only about 4% of self-hosted sites on PHP 7 and around one in nine using HTTPS, WordPress was using its influence over the hosting market to push both forward. Hosting innovation also continued at the edges, with Japan’s DigitalCube launching Shifter, a serverless WordPress hosting service that generated static sites.

Theme of the Month: Wallace

Wallace, a free theme built on the WP REST API and Angular, arrived in December just as the REST API content endpoints shipped in core. It was an early example of the JavaScript-driven themes the new API made possible on any WordPress 4.7 site, without depending on a plugin.

Plugin of the Month: WP-Optimize

WP-Optimize, a popular database clean-up plugin, was acquired by the UpdraftPlus team in December with plans to integrate it into UpdraftCentral. The deal reflected a trend of established plugin businesses buying complementary tools to build broader site maintenance suites.

Host of the Month: Shifter

Shifter, launched by DigitalCube on December 2, offered serverless hosting for WordPress by generating static versions of sites. It was an unusual answer to WordPress’ performance and security challenges, removing the live PHP application from public view entirely.

Founder of the Month: Dan Norris

Dan Norris co-founded WP Curve in 2013 with Alex McClafferty and bootstrapped it into a service that had handled more than 105,000 small WordPress jobs. Its sale to GoDaddy in December, part of the host’s push to become a one-stop shop for WordPress professionals, was one of the year’s notable exits for a WordPress services business.

Looking Ahead to January 2017

January 2017 was expected to bring the first maintenance release for 4.7 and the start of the new project-based approach, with Mullenweg due to name technical and design leads for the editor, Customizer and REST API focuses. WPCampus Online was scheduled for January 23, and LoopConf for early February in Salt Lake City.