WordPress News Roundup February 2016: REST API Gridlock, WordPress 4.4.2 and AMP Comes to WordPress

February 2016 exposed the hardest question in WordPress development: how and when to finish the REST API. With the infrastructure already in core, the content endpoints that would make it useful ran into gridlock early in the month, and they did not make it into WordPress 4.5. The debate showed how difficult it was to lock in an API that would have to be supported for years.

Elsewhere the month moved quickly. A security release patched two flaws, WordPress 4.5 entered beta with responsive Customizer previews and custom logos, Google launched Accelerated Mobile Pages in search and Automattic shipped an AMP plugin the same day, and a serious vulnerability affected one of the most popular commercial theme families.

Mergers, Acquisitions, and Investments

No significant acquisitions or funding rounds were announced in February. Several smaller businesses changed direction instead: Rescue Themes was put up for sale, and Happy Joe announced it would shut down its non-profit in favour of a for-profit venture.

WordPress Core Updates

• WordPress 4.4.2: Released on February 2, it fixed a possible server-side request forgery for certain local URIs, reported by Ronni Skansing, and an open redirection attack, reported by Shailesh Suthar, along with 17 bugs.
• REST API stalls: On February 5, WP Tavern reported the content endpoints were delayed amid disagreement among contributors, noting that fewer than 20 plugins in the directory were using the API infrastructure already in core. The API team released version 2 beta 12 and asked WordPress’ lead developers for feedback as contributors searched for a path forward.
• Customizer features merged: Responsive previews, letting users see their site at desktop, tablet and mobile sizes in the Customizer, and selective refresh, which updates only the changed part of the preview, were approved for 4.5.
• Theme logos: 4.5 would introduce native support for a site logo that themes could adopt.
• WordPress 4.5 Beta 1: Released on February 25.
• Shiny Updates v2: The feature plugin added updates for themes and bulk plugin updates without page reloads.

Other WordPress News

• WordCamp Incubator: WordPress announced an experimental incubator programme to choose three cities without an active WordPress community and provide extra organising support for a first WordCamp in 2016.
• Contributor weekend: The second global contributor weekend, at the end of February, challenged volunteers to process at least one hour of WordCamp video.
• Plugin Directory makeover: WordPress.org announced that the Plugin Directory was getting a redesign.
• Components: Automattic launched Components, five new starter themes based on Underscores.
• Bluehost open source: Bluehost open-sourced the script it used to update 2.5 million WordPress sites on its network.
• WordCamp Europe: Organisers of the Vienna event assembled a 130-person volunteer team.
• Commerce: WooCommerce made its Stripe payment gateway free, and 10up open-sourced ElasticPress support for WooCommerce.
• A Day of REST: Human Made reported that its London REST API conference had gone well, with 81% of surveyed attendees saying they would attend again.
• Developer tools: Varying Vagrant Vagrants 1.3.0 added MailCatcher support, and Mandrill’s decision to end its free tier sent many WordPress developers looking for new transactional email services.

Security Alerts and Plugin Vulnerabilities

• Elegant Themes products: A critical information disclosure vulnerability that could lead to privilege escalation affected the Divi Builder in the Divi and Extra themes and the standalone plugin, as well as the Bloom and Monarch plugins. Registered users of any role could perform some actions in the builder, including manipulating posts. Elegant Themes patched the issue with help from a third-party security vendor.
• Core security release: The 4.4.2 SSRF and open redirect fixes were delivered automatically to most sites.

Industry Trends and Insights

Mobile publishing took a big step on February 24, when Google began showing Accelerated Mobile Pages in search results. Automattic added AMP support to WordPress.com and released an AMP plugin for self-hosted sites the same day, making WordPress one of the easiest ways for publishers to adopt the format.

The REST API dispute, meanwhile, revealed a philosophical divide. Some contributors wanted the endpoints in core quickly so that developers could build on them; others argued that WordPress needed proof of real-world adoption and an API that could fully replicate wp-admin before committing to it permanently. The low number of plugins using the existing infrastructure gave the cautious side ammunition.

Theme of the Month: Components

Components, launched by Automattic in February, offered five starter themes built on Underscores, each tailored to a common site type. For theme developers, it was a faster route to well-structured, standards-compliant themes at a time when WordPress.org review queues were long.

Plugin of the Month: AMP

Automattic’s AMP plugin arrived the day Google started surfacing AMP pages in search. It generated lightweight AMP versions of posts automatically, giving self-hosted publishers a simple way to compete for mobile visibility, and it later became a major collaboration between Automattic, Google and XWP.

Host of the Month: Bluehost

Bluehost open-sourced the script it had used to update 2.5 million WordPress sites, a contribution that echoed Matt Mullenweg’s praise at State of the Word for its automatic upgrades. Pushing that many sites onto current versions was one of the most effective security measures any host had taken.

Founder of the Month: Nick Roach

Nick Roach, founder of Elegant Themes, steered the company through a critical vulnerability in its flagship Divi Builder in February. With Divi installed on a very large number of sites, the speed of the fix and the push to get customers updated mattered well beyond Elegant Themes’ own membership base.

Looking Ahead to March 2016

March was set to bring further 4.5 betas and a release candidate ahead of an April launch, with inline link editing, more formatting shortcuts and Customizer improvements in the mix. BuddyPress 2.5 was due early in the month, and PressNomics 4 was scheduled for March 3 and 4 in Phoenix.