WordPress News Roundup September 2016: WordPress 4.6.1 Release, GoDaddy Acquires ManageWP as Twenty Seventeen Is Unveiled

September 2016 opened with a significant deal. On September 6, GoDaddy acquired ManageWP, the multi-site management service founded by Vladimir Prelovac, as part of a push to make itself the home of WordPress professionals. A day later WordPress 4.6.1 shipped with two security fixes, and within a week the 4.7 team had revealed Twenty Seventeen, a new default theme aimed at business sites as much as blogs.

The rest of the month was dominated by two difficult stories: the unravelling of Headway Themes, whose former staff said they had not been paid, and the suspension of Zerif Lite, one of the most popular free themes in the directory, for breaking the rules on themes and functionality.

Mergers, Acquisitions, and Investments

• GoDaddy acquires ManageWP: GoDaddy bought ManageWP for an undisclosed sum. ManageWP, founded in 2010 by Vladimir Prelovac and officially launched in 2012, would operate as an independent company within GoDaddy, with some premium features made free to GoDaddy customers and integration into GoDaddy Pro. Prelovac and GoDaddy’s Jeff King explained the deal on WP Weekly later in the month.
• Iovation acquires LaunchKey: Fraud-prevention company Iovation acquired LaunchKey, maker of a passwordless authentication service, and said it would continue supporting the LaunchKey WordPress plugin.
• GitLab funding: Outside WordPress but closely watched by its developers, GitLab raised a $20 million Series B.

WordPress Core Updates

• WordPress 4.6.1: Released on September 7, it fixed a cross-site scripting vulnerability via image filenames, reported by SumOfPwn researcher Cengiz Han Sahin, and a path traversal vulnerability in the upgrade package uploader, reported by Dominik Schilling of the security team. It also fixed 15 bugs.
• Twenty Seventeen announced: On September 9, release lead Helen Hou-Sandí unveiled Twenty Seventeen. Designed by Mel Choyce, with Laurel Fulford and David Kennedy leading development, it featured a full-screen header image, a call-to-action area and front-page sections, and was meant to showcase improved static front page setup, visible edit icons in the Customizer, video headers and starter content.
• Protected post passwords: 4.7 would allow passwords of up to 255 characters for password-protected posts.
• Editor and customisation: Work continued on rearranging the post editor and on approaches to easier site customisation, both of which fed into the 4.7 scope.

Other WordPress News

• Headway Themes crisis: After weeks of customer complaints, a former employee went public on September 11 to say staff had not been paid and customers were not receiving support. Co-founders Grant and Clay Griffiths published an apology on September 13 confirming financial difficulties, moving version 4.0 back to beta and promising regular updates, though the apology did not address unpaid wages.
• Ninja Forms 3.0: Released on September 6 with a new drag-and-drop form builder, the most significant rewrite in the plugin’s history.
• Jetpack 4.3: Released on September 8 with a new admin interface built in React.
• GoDaddy and WordPress: GoDaddy also launched a new onboarding experience for WordPress customers, and ManageWP added automated security scanning.
• Hosting benchmarks: Review Signal published its 2016 WordPress hosting performance benchmarks.
• WordCamp US scholarship: Kinsta announced a $1,500 travel scholarship to help someone attend WordCamp US.
• Automattic and WP Job Manager: Automattic said it would revive development of WP Job Manager.
• Page builders under review: Pippin Williamson published a critical review of popular page builder plugins, focusing on what happened to content when a builder was deactivated.
• Anniversaries and events: Pagely celebrated seven years of managed WordPress hosting, and San José, Costa Rica, announced its first WordCamp for November.

Security Alerts and Plugin Vulnerabilities

• Core fixes in 4.6.1: The image filename XSS and upgrade path traversal were the month’s core vulnerabilities, rolled out via automatic updates.
• W3 Total Cache: A high-risk cross-site scripting vulnerability was disclosed on September 23, and version 0.9.5 packaged the fix with a major update to the long-quiet plugin three days later.
• Zerif Lite suspended: Not a vulnerability, but a security-relevant decision: the Theme Review Team suspended ThemeIsle’s Zerif Lite, used by roughly 300,000 sites, for violating the presentation-versus-functionality guideline, leaving users without updates through WordPress.org until the issues were resolved.

Industry Trends and Insights

HTTPS moved from best practice to necessity when Google announced that from January 2017 Chrome would begin marking HTTP pages that collect passwords or credit card details as not secure, with broader warnings to follow. Combined with free certificates from Let’s Encrypt, the change put pressure on every host and site owner to switch.

GoDaddy’s purchase of ManageWP showed large hosts competing for the WordPress professionals who built and maintained client sites, not just end users. Meanwhile, Headway’s troubles were a cautionary tale about the commercial theme market. As the founders themselves noted, the market had become very crowded, and visual builders and multipurpose themes were squeezing smaller companies.

Theme of the Month: Twenty Seventeen

Twenty Seventeen was a deliberate change of direction for WordPress default themes. Aimed at businesses as much as bloggers, with large header imagery, front-page sections and video header support, it was designed to show off new 4.7 features and was built in plain CSS to stay easy to maintain.

Plugin of the Month: Ninja Forms

Ninja Forms 3.0 arrived on September 6 with a completely rebuilt drag-and-drop builder, after a long development period that included a preview bundled in the 2.9 branch. For more than half a million sites, it was the biggest change in how they built forms in years.

Host of the Month: GoDaddy

GoDaddy made its most important WordPress move yet in September, acquiring ManageWP and launching a new onboarding experience for WordPress customers. With GoDaddy Pro aimed at web professionals, the company was building a full stack of services for the people who build WordPress sites for others.

Founder of the Month: Vladimir Prelovac

Vladimir Prelovac founded ManageWP in 2010 and grew it into one of the best-known tools for managing many WordPress sites from a single dashboard. Its sale to GoDaddy in September was one of the most notable exits of the year for a WordPress-focused business.

Looking Ahead to October 2016

October was set to bring a merge decision on the REST API content endpoints for 4.7 and the first 4.7 beta, expected around October 26. Twenty Seventeen was due to move into core, and the Polyglots team was preparing for a second Global WordPress Translation Day in November.