Category Archives: WordPress

The open source publishing platform I co-founded — development, releases, community, and the ecosystem.

Dance to Calypso

Automattic, Design, WordPress

One of the hardest things to do in technology is disrupt yourself.

But we’re trying our darndest, and have some cool news to introduce today. When I took on the responsibility of CEO of Automattic January of last year, we faced two huge problems: our growth was constrained by lack of capital, and the technological foundations of the past decade weren’t strong enough for the demands of next one.

The first has a relatively straightforward answer. We found some fantastic partners, agreed on a fair price, issued new equity in the company to raise $160M, and started investing in areas we felt were high potential, like this year’s WooCommerce acquisition. This “war chest” gives us a huge array of options, especially given our fairly flat burn rate — we don’t need to raise money again to keep the company going, and any capital we raise in the future will be purely discretionary. (Since last May when the round happened we’ve only spent $3M of the investment on opex.)

The second is much harder to address. The WordPress codebase is actually incredible in many ways — the result of many thousands of people collaborating over 13 years — but some of WordPress’ greatest strengths were also holding it back.

The WordPress codebase contains a sea of institutional knowledge and countless bug fixes. It handles hundreds of edge cases. Integrates constant security improvements. Is coded to scale. Development moves at a fast clip, with six major releases over the past two years and more around the corner. Its power and flexibility is undeniable: WordPress just passed a huge milestone, and now powers 25% of the web. You can run it on a $5-a-month web host, or scale it up to serve billions of pageviews on one of the largest sites on the web, WordPress.com.

The interface, however, has been a struggle. Many of us attempted to give it a reboot with the MP6 project and the version 3.8 release, but what that release made clear to me is that an incremental approach wouldn’t give us the improvements we needed, and that two of the things that helped make WordPress the strong, stable, powerful tool it is — backward compatibility and working without JavaScript — were actually holding it back.

The basic paradigms of wp-admin are largely the same as they were five years ago. Working within them had become limiting. The time seemed ripe for something new, something big… but if you’re going to break back compat, it needs to be for a really good reason. A 20x improvement, not a 2x. Most open source projects fade away rather than make evolutionary jumps.

So we asked ourselves a big question. What would we build if we were starting from scratch today, knowing all we’ve learned over the past 13 years of building WordPress? At the beginning of last year, we decided to start experimenting and see.

Today we’re announcing something brand new, a new approach to WordPress, and open sourcing the code behind it. The project, codenamed Calypso, is the culmination of more than 20 months of work by dozens of the most talented engineers and designers I’ve had the pleasure of working with (127 contributors with over 26,000 commits!).

gm-2015-final

Calypso is…

  • Incredibly fast. It’ll charm you.
  • Written purely in JavaScript, leveraging libraries like Node and React.
  • 100% API-powered. Those APIs are open, and now available to every developer in the world.
  • A great place to read, allowing you to follow sites across the web (even if they’re not using WordPress).
  • Social, with stats, likes, and notifications baked in.
  • Fully responsive. Make it small and put it in your sidebar, or go full-screen.
  • Really fun to write in, especially the drag-and-drop image uploads.
  • Fully multi-site for advanced users, so you can manage hundreds of WordPresses from one place.
  • Able to manage plugins and themes on Jetpack sites, including auto-upgrading them!
  • 100% open source, with all future development happening in the open.
  • Available for anyone to adapt to make their own, including building custom interfaces, distributions, or working with web services besides WordPress.com.

A lot of people thought we should keep this proprietary, but throughout my life I’ve learned that the more you give away, the more you get back. We still have a ton to figure out around plugins, extensibility, contributions, Windows and Linux releases, API speed, localization, and harmonizing the WordPress.com API and WP-API so it can work with core WordPress. Thousands more PHP developers will need to become fluent with JavaScript to recreate their admin interfaces in this fashion. I’m also really excited to revisit and redesign many more screens now that we have this first version out the door.

This is a beginning, not an ending. (1.0 is the loneliest.) Better things are yet to come, as all of you dig in. Check out these links to read more about Calypso from different perpsectives:

This was a huge bet, incredibly risky, and difficult to execute, but it paid off. Like any disruption it is uncomfortable, and I’m sure will be controversial in some circles. What the team has accomplished in such a short time is amazing, and I’m incredibly proud of everyone who has contributed and will contribute in the future. This is the most exciting project I’ve been involved with in my career.

With core WordPress on the server and Calypso as a client I think we have a good chance to bring another 25% of the web onto open source, making the web a more open place, and people’s lives more free.

If you’re curious more about the before and after, what’s changed, here’s a chart:

Whats-New-WPcom@2x

 

What’s the coolest uses and applications built on top of WordPress APIs that you’ve seen? I’m looking for some examples to highlight in the State of the Word next month.

And remember the $5 billion website, 5 billion we spent on a website, and to this day it doesn’t work. A $5 billion dollar website.I have so many websites. I have them all over the place. I hire people, they do a website. It costs me $3.

We were just talking about government websites! The transcript of Donald Trump’s 2016 presidential announcement is one of the more interesting things I’ve read in a while. “And I promise I will never be in a bicycle race. That I can tell you.” In the spirit of alway saying something positive, I do agree that La Guardia airport is a hot mess.

Woo & Automattic

Automattic, WordPress

For years, we’ve been working on democratizing publishing, and today more people have independent sites built on open source software than ever before in the history of the web. Now, we want to make it easy for anyone to sell online independently, without being locked into closed, centralized services — to enable freedom of livelihood along with freedom of expression.

It’s not a new idea: at a WordCamp a few years ago, someone stood up and asked me when we were going to make it as easy to create an online store as we’d made it to create a blog. Everyone applauded; there’s long been demand for better ecommerce functionality, but it’s been outside the scope of what Automattic could do well.

That changes today — drum roll — as WooCommerce joins the Automattic team to make it easier for people to sell online. Along with Woo’s announcement, here’s a short video explaining more:

In the past few years, WooCommerce really distinguished itself in its field. Just like WordPress as a whole, it developed a robust community around its software, and its products meet the needs of hundreds of thousands of people around the world.

Woo is also a team after Automattic’s own distributed heart: WooCommerce is created and supported by 55 people in 16 countries. Added to Automattic’s 325 people in 37 countries, that’s a combined 380-person company across 42 countries — the sun never sets.* I can’t wait to meet all my new colleagues.

Just like us, the vast majority of WooCommerce’s work is also open source and 100% GPL. And just like WordPress, you’ll find WooCommerce meetups popping up everywhere, from Los Angeles to London, and its global and community-focused work together to make the users’ experiences the best they can be.

ecomm-trends The stats are impressive: the WooCommerce plugin has over 7.5 million downloads and a million+ active installs; BuiltWith’s survey of ecommerce platforms shows Woo passing up Magento in the top million, with about triple the number of total sites. Even a conservative estimate that WooCommerce powers 650,000 storefronts means they’re enabling a huge number of independent sellers. They’ve added a tremendous amount to the WordPress ecosystem (alongside everyone else working in this area).

WordPress currently powers about 23% of the web. As we work our way toward 51%, WooCommerce joining Automattic is a big step opening WordPress up to an entirely new audience. I can’t wait to see how much more we can build together.

Automattic turns ten next month: another amazing milestone I couldn’t have imagined a decade ago. Today’s news is just the first of a number of announcements we have planned for the remainder of the year, so please stay tuned! There’s still so much work to do.

* Want to work with us? We’re hiring. Bonus points if you live in Antarctica, the only continent we don’t have covered.

As I said in the video, please drop any questions you might have in the comments and I’ll answer them as soon as I can. Also check out the posts from Mark and Magnus.

Read more: Mashable, Recode, Techcrunch, Venturebeat.

Andrew Nacin, lead developer of WordPress, just finished a talk at Loopconf, where he talked about a series of related WordPress security fixes that spanned two years, with the final fix included into WordPress core under the guise of Emoji support.

Post Status has a good look at some of the really deep security work that has been going on in WordPress lately. There will always be more problems, but we’re getting to the point where the problems (and the fixes) are often quite subtle.

The ability of radiation to cause cancer is dependent on whether or not the radiation is able to alter chemical bonds. This occurs when electrons involved in bonding in a molecule absorb radiation with enough energy to allow them to escape – this is called ionization. The thing is, whether or not radiation is ionizing is based solely on its energy, not on its number, and as we saw above, its energy is determined entirely from its frequency.

Cool article on WordPress.com about Why Cell Phones Can’t Cause Cancer, But Bananas Can, which I read while eating (and finishing) a banana. It covers dielectric heating too.

A Bank Website on WordPress

Personal, WordPress

There’s a thread on Quora asking “I am powering a bank’s website using WordPress. What security measures should I take?” The answers have mostly been ignorant junk along the lines of “Oh NOES WP is INSECURE! let me take my money out of that bank”, so I wrote one myself, which I’ve copied below.

I agree there’s probably not a ton of benefit to having the online banking / billpay / etc portion of a bank’s website on WordPress, however there is no reason you couldn’t run the front-end and marketing side of the site on WordPress, and in fact you’d be leveraging WordPress’ strength as a content management platform that is flexible, customizable, and easy to update and maintain.

In terms of security, there are a two simple points:

  1. Make sure you’re on the latest version of core and all the plugins you run, and update as soon as new version become available.
  2. Use strong passwords for all user accounts. For extra credit you could enable a 2-factor plugin, use Jetpack’s WordPress.com login system, or restrict logged-in users to a certain IP range (like behind a VPN).

If your host doesn’t handle it, make sure you stay up-to-date for everything in your stack as well from the OS on up. Most modern WP hosts handle this (and updates) for you, and of course you could always run your site on WordPress.com VIP alongside some of the top sites in the world. If you use any non-core third party code, no harm in having a security firm audit the source as well (an advantage of using open source).

For an example of a beautiful, responsive banking website built on WordPress, check out Gateway Bank of Mesa AZ. WordPress is also trusted to run sites for some of the largest and most security-conscious organizations in the world, including Facebook, SAP, Glenn Greenwald’s The Intercept, eBay, McAfee, Sophos, GNOME, Mozilla, MIT, Reuters, CNN, Google Ventures, NASA, and literally hundreds more.

As the most widely used CMS in the world, many people use and deploy the open source version of WordPress in a sub-optimal and insecure way, but the same could be said of Linux, Apache, MySQL, Node, Rails, Java, or any widely-used software. It is possible and actually not that hard to run WordPress in a way that is secure enough for a bank, government site, media site, or anything.

If you wanted any help on this feel free to reach out to Automattic as well, we have a decade of experience now dealing with high-risk, high-scale deployments, and also addressing the sort of uninformed FUD you see in this thread.

If you’ve developed a major bank site in WordPress leave a link in the comments.

We’re organizing an exciting new conference series focused on blogging, called Press Publish. The speaker list has some really awesome folks on it, and will include notable WordPress bloggers telling their stories as well as Automattic employees teaching tutorials and workshops. Plus, WordPress.com Happiness Engineers will be ready and waiting to help people one-on-one with their blogs.

The first two events are in Portland on March 28 and in Phoenix on April 18, and if you register with this link in the next week or so you get a discount, special for Ma.tt readers.