Latest / Wpfavs - Your favourite WordPress news / WordPress Fatigue, Legacy Plugins, and Zero-Trust Security

Transcript

WordPress Fatigue, Legacy Plugins, and Zero-Trust Security · Wpfavs - Your favourite WordPress news

• 0:13
  If you, um, if you ask a room of four hundred web developers how they feel about
• 0:19
  open source, almost every single hand goes up.
• 0:22
  But, uh, if you ask those exact same people how they feel about WordPress
• 0:26
  specifically...
• 0:28
  the room just goes completely quiet.
• 0:30
  Yeah, I mean, the numbers on this are, they are just brutal.
• 0:34
  The WP Open Community Collective did this State of the Community survey for 2026,
• 0:38
  right?
• 0:39
  Four hundred and thirty one active builders.
• 0:42
  And, er, eighty one point seven percent say they are totally enthusiastic about open
• 0:47
  source as an idea, as a philosophy.
• 0:50
  But WordPress specifically?
• 0:53
  Only thirty two point seven percent feel positive about it.
• 0:56
  Wait, thirty, thirty two point seven percent?
• 0:58
  Wow.
• 0:58
  That is...
• 1:00
  that is an absolute chasm between loving open source and actually liking the
• 1:03
  platform you build on every single day.
• 1:05
  It really is.
• 1:07
  And, and it gets worse when you look at how fast it dropped.
• 1:10
  Over seventy seven percent, seventy seven point three percent to be exact,
• 1:15
  said their sentiment shifted in just the last two years.
• 1:19
  And out of that group?
• 1:20
  Ninety five point five percent said their feelings got worse.
• 1:23
  Three out of four people surveyed are now flat out negative or completely uncertain
• 1:28
  about where WordPress is even heading.
• 1:30
  Okay, but, er, let us pause for a second here because as someone watching where
• 1:36
  clients are putting their money, the work is still there, right?
• 1:39
  People are still buying web infrastructure.
• 1:42
  Client demand for WordPress sites has not dropped off a cliff.
• 1:46
  So is this...
• 1:48
  is this just community burnout, or is the actual utility of the software breaking
• 1:52
  down?
• 1:52
  It is friction.
• 1:53
  It is, it is absolute ecosystem fatigue.
• 1:57
  I talk to agency owners all the time, and people are just exhausted from managing
• 2:01
  scattered tools, constant noise, and unpredictable platform updates.
• 2:06
  You end up spending half your week fighting admin clutter instead of actually
• 2:10
  building great stuff for clients.
• 2:11
  Right, but there is this weird divergence, you know?
• 2:14
  The emotional morale is at an all time low, but the installed base is so massive
• 2:19
  that nobody is actually leaving in droves yet.
• 2:21
  They are just grumbling while they ship sites.
• 2:24
  Exactly.
• 2:24
  The business reality and the vibe in the developer community are pulled in two
• 2:28
  totally different directions.
• 2:29
  And you can see that exact same inertia in the real world market data.
• 2:33
  Look at the HTTP Archive data from July 2026 for form plugins.
• 2:38
  We have all these modern, incredible form builders with AI integrations and slick
• 2:43
  visual workflows.
• 2:44
  But Contact Form 7 is still running on twenty nine point seven four percent of all
• 2:49
  sampled WordPress sites on the web.
• 2:50
  Almost thirty percent!
• 2:52
  That is insane.
• 2:53
  Meanwhile, Gravity Forms is sitting at three point five three percent,
• 2:58
  and Fluent Forms is at one point zero nine percent.
• 3:02
  Almost a third of the web is running a legacy plugin that has been around forever
• 3:06
  just because nobody wants to touch what already works.
• 3:09
  Inertia is a massive force.
• 3:11
  If a form on a site built in 2018 is still collecting leads,
• 3:14
  a business owner is not going to replace it just because a shinier plugin launched
• 3:18
  last week.
• 3:19
  Right, but here is where things get really interesting, because while people are
• 3:23
  sitting on these legacy sites, supply chain security risks are spiking.
• 3:27
  And developers are starting to take security into their own hands in really
• 3:31
  aggressive ways instead of waiting for core to handle it.
• 3:34
  Oh, yeah, like what WPManageNinja just did with Fluent Forms.
• 3:38
  That 6.2.13 release was a massive statement for the ecosystem.
• 3:42
  Wait, what did they do in six point two point thirteen?
• 3:45
  They literally compiled a public key directly into the plugin code.
• 3:49
  So when your site pulls a package update, it uses zero trust cryptographic
• 3:54
  verification to check the server package signature before it even unzips the file on
• 3:59
  your server.
• 4:00
  Which is huge!
• 4:01
  If the signature does not match, it does not execute, period.
• 4:04
  It basically blocks supply chain attacks or compromised update servers right at the
• 4:09
  front door.
• 4:10
  So we are moving into an era where plugin developers are building autonomous,
• 4:15
  self hardening security inside their own tools because they cannot afford to trust
• 4:20
  external delivery pipelines implicitly anymore.
• 4:23
  Yeah, exactly.
• 4:24
  The future of building on WordPress right now, it is not being driven by starry eyed
• 4:28
  platform optimism.
• 4:30
  It is being driven by pragmatic builders who know they have to harden millions of
• 4:34
  legacy sites with bulletproof, zero trust tooling.
• 4:37
  You stop worrying about the drama, you lock down the infrastructure,
• 4:41
  and you just get the work done.
• 4:42
  Honestly, that might be the healthiest shift this ecosystem has seen in years.
• 4:46
  Less talk, more ironclad engineering.
• 4:49
  Yeah, I think you are right about that.
• 4:51
  All right, good chatting, talk soon.