WordPress News Roundup March 2017: WordPress 4.7.3 Release, GoDaddy Acquires Sucuri and the Plugin Directory Gets a Redesign

March 2017 was the month WordPress security became big business. GoDaddy bought Sucuri, the firm that had found the REST API flaw behind February’s defacements, and WordPress 4.7.3 patched six more vulnerabilities. Meanwhile, WordPress.org relaunched its Plugin Directory with a new design and search algorithm, to a decidedly mixed reception.

Beneath the headlines, two longer trends picked up speed: a concerted push to move WordPress sites onto PHP 7, and growing debate about how WordPress.com, Jetpack and WordPress.org should relate to one another.

Mergers, Acquisitions, and Investments

• GoDaddy acquires Sucuri: On March 22, GoDaddy announced it had acquired Sucuri, the website security company founded by Daniel Cid and Tony Perez. Sucuri’s firewall, malware scanning and clean-up services gave GoDaddy a security product for its huge WordPress customer base, and Sucuri continued to operate under its own brand. Just weeks earlier, Sucuri researchers had discovered the REST API vulnerability fixed in WordPress 4.7.2.

No other major WordPress deals were announced in March.

WordPress Core Updates

• WordPress 4.7.3: Released March 6, it fixed six security issues, including XSS through media file metadata, a redirect validation bypass using control characters, unintended file deletion when deleting plugins, XSS in YouTube embed URLs and taxonomy term names, and a CSRF issue in Press This. It also included 39 maintenance fixes.
• Media widgets on the way: The Customizer team showed work on new widgets for images and other media, aimed at the next major release. Adding an image to a sidebar without HTML was about to become easy.
• Listening to users: Core teams ran an editor experience survey to guide Gutenberg, and early Customizer survey results suggested many respondents did not use the Customizer at all, useful data for both focus teams.

Other WordPress News

• New Plugin Directory: On March 28, WordPress.org relaunched the Plugin Directory with a new design and an improved search algorithm. Many developers felt their beta feedback had been ignored, especially over the loss of the tabbed layout and download stats, and some of those features were restored in the weeks that followed.
• Jetpack theme installs: Jetpack introduced theme installation from WordPress.com, which critics saw as an alternative marketplace for free themes outside WordPress.org.
• WordCamp Netherlands: WordPress Community Support decided to stop holding a national WordCamp Netherlands in favor of city-based events, a decision that drew pushback from Dutch organizers.
• Political pressure: UK Home Secretary Amber Rudd named WordPress.com among the platforms she linked to the spread of terrorist material, prompting debate about how far hosting platforms should police content.
• Theme Review progress: The Theme Review team reported progress on clearing a backlog of more than 1,000 themes waiting for review.
• WooCommerce 3.0: The release once known as WooCommerce 2.7 was scheduled for April 4 under a new version number, reflecting how large the changes had become.
• Events and editorial tools: WordCamp Miami livestreamed all of its sessions, the Community team released a plugin showing nearby WordPress events in the dashboard, and PressShack forked Edit Flow to create PublishPress.

Security Alerts and Plugin Vulnerabilities

Beyond 4.7.3, March’s security news was about education and infrastructure rather than headline exploits.

• Theme security: Data from the Theme Review team showed that many submitted themes contained basic security mistakes such as missing escaping, and that theme authors needed more education on secure development.
• Clef’s closure: Clef, the two-factor login service with a popular WordPress plugin, announced it would shut down on June 6. Site owners using it for two-factor authentication were told to plan a migration rather than risk losing their extra login protection.
• Google reCAPTCHA: Google launched invisible reCAPTCHA, which many WordPress anti-spam and login plugins soon adopted.

Industry Trends and Insights

• The PHP 7 push: Yoast SEO 4.5 started urging users on old PHP versions to upgrade to PHP 7, and data published this month showed PHP 5.6 had become the most widely used PHP version among WordPress sites. A plugin installed on millions of sites was now acting as a de facto upgrade campaign.
• Developer market: Stack Overflow jobs data suggested React skills were in high demand while the WordPress developer market was crowded, a hint of the JavaScript shift to come.
• Publishing platforms: Medium launched a $5 monthly subscription program, and WordPress.com shipped a Medium importer and a distraction-free post editor, making it easier for writers to move in either direction.
• Headless WordPress: Foxhound became the first theme on WordPress.org built entirely on the REST API, a small but telling milestone for the API merged into core only months before.

Theme of the Month: Foxhound

Foxhound, a React-powered theme by Kelly Dwan, was the first REST API-driven theme accepted into the WordPress.org directory. It loaded content without full page refreshes and served as a working example of the JavaScript-heavy front ends the REST API made possible.

Plugin of the Month: Yoast SEO

Yoast SEO 4.5 added a notice encouraging users on outdated PHP versions to upgrade to PHP 7. Coming from one of the most widely installed plugins in the ecosystem, it put pressure on hosts and site owners in a way core had not yet attempted, and early figures suggested it was working.

Host of the Month: Bluehost

As one of the hosts recommended on WordPress.org, Bluehost was the first stop for many new site owners. With plugins now nudging users toward PHP 7, mass-market hosts like Bluehost were the ones who would have to make newer PHP versions easy to switch to for millions of shared hosting accounts.

Founder of the Month: Tony Perez

Tony Perez, Sucuri’s co-founder and CEO, steered the company to its acquisition by GoDaddy in March. Sucuri had grown from a small security start-up into one of the best-known names in WordPress malware clean-up and firewall protection, and the deal put its tools in front of a far larger audience.

Looking Ahead to April 2017

WooCommerce 3.0 was scheduled for April 4, bringing a new product gallery and CRUD classes for developers. Core contributors were also expected to keep shaping the scope of WordPress 4.8, with the new media widgets as a likely headline feature.

The Plugin Directory team had a list of feedback to work through after the relaunch, and WordCamp Europe was preparing to announce its speakers for June in Paris.