WordPress News Roundup June 2007: WordPress 2.2.1, a Webware 100 Win and WordCamp 2007 Announced

June 2007 combined routine maintenance with a good deal of public attention. WordPress 2.2.1 cleaned up the 2.2 release, WordPress won the Publishing category of CNET’s Webware 100 awards, and WordCamp San Francisco was confirmed for late July as a two-day event. Not all of the attention was welcome: a widely shared critique of WordPress security prompted a detailed response from Matt Mullenweg.

Mergers, Acquisitions, and Investments

No deals were announced. Automattic continued to hire, adding Alex Shiels and Raanan Bar-Cohen during the month.

WordPress Core Updates

• WordPress 2.2.1 (June 21): A bug-fix release that arrived about a month after 2.2, smoothing out small problems and refining details.
• Next release: Development of the next major version continued, with a September target and native tagging among the features in the works.

Other WordPress News

• WordCamp 2007: Registration opened on June 19, and the WordPress blog announced WordCamp San Francisco for July 21–22, expanded to two days after about 350 people attended the 2006 event.
• Webware 100 win: WordPress won the Publishing category of the Webware 100, and the team thanked voters and contributors.
• Two contests: The community was invited to two GPL-only competitions: a Sandbox theme design contest, using only CSS on top of the Sandbox theme with more than $1,000 in prizes, and a plugin competition run by Weblog Tools Collection.
• Big-name blogs: The Flickr blog moved to WordPress, and Sony’s new PlayStation Blog launched on the platform.
• WordPress MU history: Mullenweg published a short history of WordPress MU, the multi-site version behind WordPress.com, and wrote about using WordPress for sites that are not blogs.

Security Alerts and Plugin Vulnerabilities

Developer Wincent Colaiuta’s post arguing that WordPress was unsafe to run on the public internet circulated widely after a link from Daring Fireball. Mullenweg responded in “On WP Security” on June 22.

• The 2.2 SQL flaw: Mullenweg said it only affected upgraded 2.2 sites with user registration enabled, which was off by default, and that he had heard of fewer than five exploits, while acknowledging it was serious.
• The 2.1.1 incident: He described March’s tampered download as a server compromise rather than a flaw in WordPress code.
• The real problem: He argued that upgrading complex web software was too painful, and said better update notifications and easier upgrades were goals for the next major release.

Industry Trends and Insights

The security debate captured a growing tension. WordPress’s popularity made it a bigger target, and many sites ran outdated versions because upgrading meant copying files by hand. The promise of in-dashboard update notices pointed to a fix that would arrive later in the year. Elsewhere, Apple’s first iPhone went on sale at the end of June, an early hint of how much mobile browsing would matter to web publishers.

Theme of the Month: Sandbox

Sandbox, created by Andy Skelton and Scott Allan Wallick, was a deliberately bare theme full of semantic CSS classes. The Sandbox Designs competition invited designers to restyle it with CSS alone, showing how much variety a single well-built markup base could support.

Plugin of the Month: WordPress Database Backup

With security in the news, a reliable backup was the simplest protection any site owner could have. The WordPress Database Backup plugin let administrators export their database from the dashboard or schedule regular backups by email, which made recovery after a problem far less painful.

Founder of the Month: Mark Ghosh

Mark Ghosh founded Weblog Tools Collection, one of the main news sources for WordPress users at the time. Its plugin competition, promoted on the WordPress blog this month, encouraged developers to release new GPL plugins through the official directory.

Looking Ahead to July 2007

WordCamp San Francisco on July 21–22 was the highlight of the coming month. Work on the next major release, with tagging and update notifications under development, was expected to continue toward its September target.