WordPress News Roundup January 2015: Remembering Kim Parsell as Drew Jaynes Takes the Lead on WordPress 4.2

January 2015 began on a sombre note. The WordPress community learned in the first days of the year that Kim Parsell, the documentation contributor known to almost everyone as #wpmom, had died at her home in southern Ohio in the last week of December. Tributes poured in from contributors who had been mentored by her, and within two weeks the WordPress Foundation had set up a travel scholarship in her name.

The rest of the month was about getting the next cycle moving. WordPress 4.1 had shipped just before Christmas, so there was no core release in January, but the project picked its release lead for 4.2, argued in public about how feature plugins should work, and confirmed the host city for WordCamp Europe. It was a quiet month on paper and a busy one in the trackers and Slack channels.

Mergers, Acquisitions, and Investments

No significant acquisitions or funding rounds were announced in the WordPress space in January. The bigger money stories of early 2015 – a fresh round for WP Engine and Automattic’s purchase of WooThemes – were still weeks and months away.

WordPress Core Updates

With 4.1 “Dinah” out in December, January was about planning. The WordPress.org news blog published nothing at all during the month, but the core team’s weekly meetings set the direction for the spring release.

• Drew Jaynes to lead 4.2: Andrew Nacin announced at the meeting that kicked off the 4.2 cycle that Drew Jaynes, an engineer at 10up, would lead the release. The team initially targeted April 8 for launch, with the first beta pencilled in for late February.
• Pretty permalinks by default: A change committed for 4.2 meant new installations would automatically enable pretty permalinks when the server supported them, ending years of “?p=123” URLs on fresh sites.
• Features as plugins under scrutiny: The “features as plugins first” model, in which big changes are developed as standalone plugins before being merged, drew pointed criticism mid-month. By January 30 the discussion had turned to concrete proposals for improving how those projects were run and reviewed.
• A new Themes Directory: WordPress.org previewed a redesign of the Theme Directory, the first step in a wider overhaul of the plugin and theme pages that would roll out over the following weeks.

Other WordPress News

Community news in January ranged from grief to new beginnings, with event announcements and new projects filling the second half of the month.

• Kim Parsell remembered: Parsell had worked on the documentation team, helped document every hook in WordPress inline, and contributed to every release from 3.7 to 4.1. On January 15 the WordPress Foundation announced a travelling scholarship in her memory, to send a woman contributor with financial need to the flagship event replacing WordCamp San Francisco for the first time.
• Seville for WordCamp Europe: On January 29 organisers confirmed that WordCamp Europe 2015 would be held in Seville, Spain, from June 26 to 28 at the Barceló Gran Hotel Renacimiento.
• HeroPress on Kickstarter: Topher DeRosia launched a Kickstarter campaign for HeroPress, a project to tell the stories of WordPress developers from around the world, particularly from regions that rarely got a stage. The campaign did not reach its goal, but the idea would live on.
• Theme review as a service: Emil Uzelac launched a paid theme review service, ThemeReview.co, and Justin Tadlock joined him days later, offering commercial theme shops the same scrutiny WordPress.org reviewers gave free themes.
• BuddyPress 2.2 beta: The first beta of BuddyPress 2.2 arrived on January 12, with the final release due in early February.
• PressNomics 3: Talks from the business-focused PressNomics conference, including sessions on Envato’s numbers and on managing time and energy, circulated widely in the last week of January.

Security Alerts and Plugin Vulnerabilities

There was no core security release in January, but two incidents reminded site owners that themes and hosting infrastructure can be just as exposed as plugins.

• PageLines and Platform themes: During a routine audit, Sucuri found a privilege escalation flaw and a remote code execution flaw in the legacy PageLines Framework and Platform themes. The privilege escalation abused an AJAX hook that let any logged-in user overwrite site options, which on sites with open registration could be used to create administrators. Patched files were pushed to WordPress.org, GitHub and PageLines’ own servers.
• Pressable outages: Managed host Pressable traced a run of outages to a Slow Loris denial-of-service attack, and the episode prompted public questions about how well it was keeping customers through the disruption.

Industry Trends and Insights

The arguments of January 2015 previewed themes that would dominate the next two years. Developers debated whether Composer belonged in WordPress’ workflow, while RedMonk’s programming language rankings put JavaScript at the top of the pack – an early sign of the shift that Matt Mullenweg would famously sum up at the end of the year as “learn JavaScript deeply.”

There was also open talk of WordPress reaching half of the web. WP Tavern asked how important Jetpack would be on WordPress’ road to 50% market share, a question that tied Automattic’s plugin strategy to the platform’s growth. Meanwhile WordPress Stack Exchange reported 17 million page views and 14,000 new questions in 2014, a reminder of how much of WordPress support happened outside WordPress.org itself.

Theme of the Month: Twenty Fifteen

Twenty Fifteen, designed by Takashi Irie and shipped with WordPress 4.1 in December, was the theme most new sites saw in January. Its clean, typography-led blog layout with a fixed sidebar was a deliberate return to WordPress’ writing roots after the magazine-style Twenty Fourteen, and it went on to become the most widely used default theme to that point.

Plugin of the Month: Better Search Replace

Better Search Replace arrived in January as a simple way to update URLs and text across a WordPress database, with support for serialized data and a dry-run option. Anyone who had broken a site by running a raw find-and-replace during a migration understood immediately why it mattered, and it quickly became a standard tool for moving sites between domains.

Host of the Month: WP Engine

WP Engine open-sourced Mercury Vagrant in January, a local development environment for running WordPress on Facebook’s HHVM as well as PHP-FPM. It reflected the host’s bet that faster PHP runtimes would matter to WordPress performance, a bet that would play out differently once PHP 7 arrived at the end of the year.

Founder of the Month: Topher DeRosia

Topher DeRosia launched HeroPress in January with the aim of giving WordPress developers in under-represented regions a place to tell their stories. The Kickstarter fell short, but DeRosia pressed on, and HeroPress went on to publish essays from contributors in dozens of countries, becoming one of the community’s most valued storytelling projects.

Looking Ahead to February 2015

February was expected to bring the final release of BuddyPress 2.2 and the first public look at WordPress 4.2 features, with a beta originally planned for the last week of the month and the Customizer theme switcher among the proposals heading for a merge decision. The redesigned Theme Directory was also due to go live, and a maintenance release for 4.1 was likely as the team gathered bug reports from the December launch.