WordPress News Roundup October 2015: REST API Infrastructure Lands in Core as WordPress 4.4 Enters Beta

October 2015 was a milestone month for WordPress development. On October 8, Ryan McCue committed the REST API infrastructure to core, the first half of a two-stage merge that would reshape how developers built on WordPress. Two weeks later, WordPress 4.4 entered beta with responsive images and post embeds alongside the new API foundations.

The month also brought a rare venture round for a WordPress product, a new scholarship recipient, and a fresh reminder from security researchers that XML-RPC remained an attractive target.

Mergers, Acquisitions, and Investments

• VersionPress raises $400K: VersionPress, which brought Git-powered version control to WordPress, raised a $400,000 seed round from five investors led by Prague-based Credo Ventures. Founder Borek Bernard said the funding would let the team develop faster after the recent 2.0 release added database synchronisation.
• Plugin changes hands: Developer Nikhil Vimal acquired the Front End Registration and Login Forms plugin from Pippin Williamson.

WordPress Core Updates

• REST API infrastructure merged: Ryan McCue, who had recently received guest commit access for 4.4, committed the API infrastructure in changeset 34928 on October 8. He called it the “baby API”: routing and the JSON layer were in core, while the content endpoints remained in the plugin, targeted for a later release.
• WordPress 4.4 Beta 1: Released on October 22, followed by Beta 2 on October 28.
• Responsive images: 4.4 added srcset and sizes support so WordPress would automatically serve appropriately sized images to different screens. Joe McGill, who led the effort, explained how it worked as the beta landed.
• Post embeds: WordPress sites would become oEmbed providers in 4.4, letting any WordPress post be embedded in another simply by pasting its URL.
• Term meta and more: Developers were also getting term metadata, a long-requested feature, along with new term, comment and network objects.
• Language packs for plugins: WP Tavern explained how plugin authors could prepare for language packs delivered through translate.wordpress.org.

Other WordPress News

• Kim Parsell scholarship awarded: Anyssa Ferreira was named the first recipient of the Kim Parsell Memorial Scholarship, which would send her to WordCamp US in December.
• Honest theme stats: The Theme Directory stopped counting automated downloads, giving a more accurate picture of real usage.
• ManageWP Orion: ManageWP launched Orion, a rebuilt dashboard for managing multiple WordPress sites.
• Testing made easier: TryWPBeta let people test new WordPress features without installing anything.
• Agency investment: WP Tavern profiled 10up’s continuing investment in WordPress, including contributions to core and open-source tools.
• Hosting data: GoDaddy published the 100 most active themes and plugins across its hosting network, a rare look at real-world usage on a major host.
• Measuring Jetpack: An independent project, Measure Jetpack, set out to benchmark Jetpack’s performance impact.
• Anniversaries: Shawn Hesketh’s WP101 training service turned seven.

Security Alerts and Plugin Vulnerabilities

• XML-RPC amplification attacks: Sucuri reported brute force attacks abusing the XML-RPC system.multicall method to test hundreds of username and password combinations in a single request. Jetpack Protect already blocked the technique, and Sucuri advised other administrators to block system.multicall requests.
• Akismet 3.1.5: Sucuri disclosed a stored cross-site scripting flaw in Akismet 3.1.4 and earlier that applied when emoticon conversion was enabled. Akismet found no evidence of active exploitation and blocked attack attempts at the API level while users updated.
• Jetpack 3.7.2: Patched two security vulnerabilities on October 2.

Industry Trends and Insights

The REST API merge marked the start of what WordPress’ leaders described as a new era for the platform. With routing infrastructure in core, plugin developers could begin building on a shared foundation rather than shipping their own custom endpoints, and front-end developers had a clearer path to JavaScript-driven interfaces.

XML-RPC, by contrast, was looking like a liability. The amplification attacks prompted WP Tavern to argue that it was time for XML-RPC in WordPress to “hit the road,” a debate that would continue for years as the REST API matured into a replacement for many of its uses. Responsive images, meanwhile, showed WordPress responding to the mobile-first web by making performance improvements automatic for every site.

Theme of the Month: Customizr

Nicolas Guillaume’s Customizr was one of the most popular free themes on WordPress.org in 2015, built from the start around the Customizer that WordPress.org now required. As the Theme Directory switched to more honest usage counts in October, established free themes like it showed how far a well-supported Customizer-first design could go.

Plugin of the Month: VersionPress

VersionPress tackled one of WordPress’ hardest problems: version control for both files and database content, with undo and rollback powered by Git. Its October seed round made it one of very few WordPress products to raise venture capital, and its ambitions drew wide attention from developers.

Host of the Month: GoDaddy

GoDaddy’s decision to publish the most active themes and plugins on its network underlined how important WordPress had become to the world’s largest domain registrar. The company was steadily building out managed WordPress products, and its data offered the community a useful view of what millions of everyday sites actually ran.

Founder of the Month: Borek Bernard

Borek Bernard, founder and lead developer of VersionPress, closed a $400,000 seed round in October. Having started with a crowdfunding campaign, he had turned an ambitious idea about bringing Git to WordPress content into a funded company, though the business would later pivot to an open-source model.

Looking Ahead to November 2015

November was expected to bring further 4.4 betas and a release candidate ahead of a planned December release, with Twenty Sixteen, responsive images, post embeds and the REST API infrastructure all on board. WordCamp US in Philadelphia was a month away, and tickets were still on sale.