WordPress News Roundup February 2014: BruteProtect Raises Funding as a New Brute-Force Wave Hits WordPress

February 2014 was a quiet month for WordPress releases, with no updates and no posts on the official news blog, but a busy one behind the scenes. WordPress 3.9’s feature list firmed up around live widget previews in the Customizer, another wave of brute-force login attacks swept across WordPress sites, and the company that had built a business defending against them raised its first outside money.

Privacy and surveillance were also on the agenda, as WordPress.com joined a day of protest against mass surveillance.

Mergers, Acquisitions, and Investments

• BruteProtect raises a seed round: In early February BruteProtect, the cloud-based brute-force protection service, closed a seed round with a private angel investor, formed Parka LLC and hired Jesse Friedman as director of innovation. Sam Hotchkiss said the money would go toward a dedicated team and major updates planned for April.
• Joost de Valk buys WPForce: Joost de Valk, author of the WordPress SEO plugin, acquired the WPForce.com site.

WordPress Core Updates

• Widget Customizer approved for 3.9: On February 5 the Widget Customizer feature plugin was approved for WordPress 3.9, bringing live, previewable widget editing into the Customizer.
• Theme review guidelines: Revisions to the theme review guidelines were proposed ahead of 3.9.
• More committers: WP Tavern noted a trend of more contributors receiving commit access to core, spreading the work of reviewing and landing patches.
• Trac for specialists: Fine-grained Trac notifications let contributors follow only the components they cared about.
• WordPress.org profiles revamp: Work continued on redesigned WordPress.org profiles, including plans to show WordCamp participation.

Other WordPress News

• Jetpack 2.9: Released late in the month, Jetpack 2.9 added multisite support and a Related Posts module powered by WordPress.com’s infrastructure.
• BuddyPress 2.0 development begins: BuddyPress 2.0 kicked off with a mid-April target, promising performance improvements and profile editing in the admin.
• Google Summer of Code 2014: WordPress was again accepted as a mentoring organisation.
• WordPress.com and online stores: WordPress.com partnered with hosted e-commerce services to let users run online stores.
• WooThemes All Themes package: WooThemes replaced its theme club with an all-themes package.
• WiredTree sponsors WordCamps: Host WiredTree said it would sponsor every North American WordCamp in 2014.
• Theme shops and portability: UpThemes published an open letter to other theme companies, and several shops moved toward keeping user data portable when switching themes.
• Typekit fonts in themes: The Theme Foundry partnered with Typekit to bring commercial web fonts to its WordPress themes.
• Aesop on WordPress.org: After January’s crowdfunding, the Aesop Story Engine plugin became available in the WordPress.org directory.
• Contributor days spread: Manchester announced its first WordPress contributor day for March 1, part of a growing trend of local events dedicated to contributing back.
• Adopt-me plugins: An “adopt-me” tag came into use in the plugin directory so authors could signal plugins they wanted someone else to take over, a small step against abandonment.
• WP Think Tank: A panel discussion on the future of WordPress was scheduled for February 25.

Security Alerts and Plugin Vulnerabilities

• Brute-force surge: Wordfence reported a large increase in distributed login attacks from February 10, which began to subside within days. BruteProtect saw attack levels about eight times higher than average.
• Better WP Security fixes: A major update to Better WP Security addressed security vulnerabilities in the plugin, just weeks after iThemes acquired it.
• Duo Security plugin: A vulnerability in the Duo two-factor authentication plugin affected a subset of multisite networks.
• Suspicious repository requests: Plugin authors reported unsolicited requests for commit access to their WordPress.org repositories, a warning sign of attempts to take over popular plugins.

Industry Trends and Insights

• Protesting surveillance: On February 11 WordPress.com joined Google, Reddit, Tumblr and others in The Day We Fight Back, a protest against NSA mass surveillance, and a new plugin let self-hosted sites join in.
• Big tech consolidation: Facebook’s purchase of WhatsApp prompted Matt Mullenweg to write about the deal’s lessons for small teams.
• Security as a funded product: Investor interest in BruteProtect suggested that WordPress security services could support venture-backed businesses.

Plugin of the Month: Widget Customizer

Widget Customizer replaced the old “save and surprise” approach to widgets with live previews. Its approval for 3.9 was a win for the features-as-plugins process and a big step toward making the Customizer the place where site appearance was managed.

Host of the Month: WiredTree

WiredTree’s pledge to sponsor all North American WordCamps in 2014 was an unusual show of commitment to the community events that underpin WordPress’s growth.

Founder of the Month: Joost de Valk

Joost de Valk, founder of Yoast and author of the hugely popular WordPress SEO plugin, kept expanding his presence in the ecosystem this month with the WPForce purchase. His plugin was already one of the most installed in the directory.

Looking Ahead to March 2014

WordPress 3.9 Beta 1 is expected in March with TinyMCE 4.0, live widget previews and media improvements to test. The host city for WordCamp Europe 2014 should be announced, and BuddyPress 2.0 heads toward beta.