WordPress News Roundup June 2006: WordPress 2.0.3 Adds Nonces as Automattic Launches Paid Support

June 2006 opened with a security release and ended with WordPress moving toward a more commercial ecosystem. WordPress 2.0.3 backported important protections from the development branch. Automattic began selling paid support to companies that wanted a guaranteed response, and a new community-built theme directory made thousands of designs easier to find.

Mergers, Acquisitions, and Investments

No deals were announced in the WordPress world this month. Om Malik, the journalist behind GigaOM and an early chronicler of WordPress and Automattic, left his job to run GigaOM full time, an early example of a blog becoming a media business.

WordPress Core Updates

• WordPress 2.0.3 (June 1): The latest stable release fixed bugs and security issues, including one raised on Bugtraq days earlier. It also backported security enhancements from 2.1, notably nonces. Other changes included small performance improvements and fixes for the Movable Type and TypePad importer and for podcast enclosures.
• Bug Independence Day: On June 29 the team announced a 24-hour bug hunt starting at midnight between July 4 and 5, San Francisco time, to clean up the tracker before 2.0.4 and 2.1. Testers of every skill level were invited.

Other WordPress News

• Automattic Support Network: On June 26 Automattic launched paid support for WordPress and WordPress MU, essentially VIP support with guaranteed response times. Mullenweg said the volunteer forums were as good as ever, but some large companies would not deploy software without a paid support contract. New commercial pricing for Akismet was introduced in the same week.
• A new theme directory: Thomas Silkjær built a new WordPress theme directory at themes.wordpress.net, with uploading, tags, voting and download counts.
• Webmonkey tutorial: Webmonkey, where Mullenweg had learned web development, published a beginner’s introduction to WordPress.
• Andy Skelton interview: iTimes interviewed the Automattic developer behind 2.0’s editor and the widgets system.

Security Alerts and Plugin Vulnerabilities

Nonces were the big security change in 2.0.3. They are one-time tokens that make sure an admin action was really requested by the logged-in user, which blocks cross-site request forgery, and they are still central to WordPress security today. The month also had a cautionary story. Mullenweg’s own blog was taken over after an attacker found his password embedded in an unreleased project’s Subversion repository. The intruder switched on WordPress’s blog privacy setting, and the resulting noindex tag briefly removed Mullenweg’s site from Google.

Industry Trends and Insights

Paid support and commercial Akismet licences showed the open-source business model taking shape. The software and the community forums stayed free, while businesses paid for guarantees. As enterprises and media companies adopted WordPress, there was growing demand for services that volunteers could not provide, and that demand would eventually support a whole industry of agencies, hosts and support companies.

Founder of the Month: Thomas Silkjær

Danish designer Thomas Silkjær built the themes.wordpress.net directory as a community project, giving theme authors somewhere to publish and users a way to rate and search designs. It was the main place to find WordPress themes until the official WordPress.org theme directory arrived in 2008.

Looking Ahead to July 2006

The July 4 bug hunt would kick off the month, with WordPress 2.0.4 and the long-awaited 2.1 as its targets. Automattic would be watching the first customers of its new support and Akismet commercial products.