Official MCP is here, Finally an overhaul for KSES, JPEG XL, Cloudflare BEACON, and More!

If you’re serious about building better WordPress sites, this is the newsletter for you.

It’s a long one again, but don’t let that discourage you from taking the time to sit down and digest this week’s newsletter. There’s a lot I cover, yes, but there’s also a lot that is happening in our world that you should know about.

Take your time; make it a weekend thing if you have to friend, but make sure you process this one. So much good stuff to learn about. Promise.

Hope you enjoy it!

🗞️ Within WordPress News

Here’s what I saw happening:

You’ll still need plugins or code that supply useful abilities.


  • The WordPress 7.2 release parties start with Beta 1 on October 20, followed by RC1 on November 17 and a December 8 target for the final release. Join at 15:00 UTC in the #core Slack channel; dates can still change.

  • Big update for Ollie! New colors without changing every block by hand. Mike McAlister demonstrates Ollie Pro’s color variations, changing backgrounds, text, and buttons together, but carousels, mega menus, and animations are now directly available to create via MCP.

Ollie’s really rapidly improving to a super AI friendly way to build a theme, btw.


Let’s see if this version is going to do the magic right.


  • Want to turn a site’s URL into a WordPress copy? Liberate puts a download interface around WordPress.com’s static-site importer. It’s still an imperfect conversion, btw. Riad Benguella’s launch thread flags protected or massive sites that can fail. And daily job limits can stop an import. Check out the project README covers the output limitations and Studio import needed for typical hosts.

  • WordPress content as Markdown, straight from the site. The AI plugin with its version 1.4.0 adds an experimental feed at /feed/markdown/ and post/page views via ?output_format=markdown. Enable the experiment on WordPress 7.0.3+.

  • A finished-looking site can still bury real leads in spam. WebDevStudios’ It Looks Done compares two look-alike sites through an illustrative launch day, exposing the work behind sitemaps, forms, share cards, and maintenance.

Now, that’s a good way to start countering the “AI will solve all problems” crowd. This project gives you a checklist to inspect; the costs and timings illustrate the argument rather than report a benchmark. Really cool project Brad!


  • Automattic launched Spacefast, a home for what you agents make. To get an idea of what you can do with it, Derek Hanson has five demos to inspect, including a design questionnaire and cake quote calculator. It’s still a research preview, so test database, email, and access behavior before promising it to a client.

  • Reusable venues, with the fields you choose. EventKoi Pro’s custom taxonomies let you save locations without being stuck with a fixed set of fields. Lesley Sim walks us through the setup and choices that were made in building this feature. Interesting read!

  • A Cover block doesn’t need a still image. Pavel Ciorici’s Inspiro Creative demo uses native blocks, including a Cover with a looping video background. Did you know it could hold a video?


  • Jamie Marsland’s Front-End Editor for Content Teams lets authorized editors change text, links, buttons, and images on a block-theme page. Page and block locks are enforced when saving, so the editable copy can stay separate from the protected layout.

Come on, Jamie, what do we have to do make this a default option in WordPress? 😛




  • You’ve got enough exciting stuff with security releases left and right to worry about. Let Omnisend be the reliable platform you can depend on for email. Make an average of $79* for every $1 you spend.

  • The CSS-Tricks PHP-only block tutorial shows how to wrap existing PHP features in a block using autoRegister. The server-rendered preview won’t automatically track unsaved editor changes.


  • Chris Huber documents an 11-site WordPress network test rig for catching changes that work in one repository but break another. The issue follows topology and release-artifact problems through to a shared harness for network user journeys.

  • Raquel Manriquez talks through organizing PressConf Europe, from choosing the shared hotel to pricing for teams of three or more. The October 27–30 Barcelona event won’t record speaker sessions, although filming elsewhere at the venue is allowed.

It’s only a few weeks away, but seriously, if your work is mainly with, within, inside, or on top of WordPress, you really should be in that room in Barcelona. Bonus, well, depending on how you look at it 😆, I guess, is hearing me speak along with some really wonderful speakers.


If I’m honest, that is actually still shockingly low. I suppose one way of explaining it is that those of us using AI heavily are incredibly ahead of the curve.


If ACF is one of your staple plugins, this is the interview to check.



  • Jurassic.ninja, also by Automattic, offers disposable WordPress test sites—single-site or Multisite, with optional Jetpack/Woo settings—that disappear after 24 hours.

🚀 Performance & Security

  • Using the Cloudflare tracking-parameter rule? Disable it—or its Super Page Cache option. Mateusz Zadorożny has withdrawn the rule: origin redirects could lose campaign attribution.

The replacement Worker restores parameters on same-site redirects. It still hides tracking parameters from server-side readers, though; review the parameter list and test redirects before deploying. Workers Free deployments also need fail-open routing to avoid blocking traffic at the request limit.


  • Want to compare real-user performance across browsers and countries? Cloudflare’s BEACON dataset opens anonymized Core Web Vitals measurements from 10,000 large sites on Cloudflare’s network. The article links the public BigQuery data and example queries, including comparisons of the slowest experiences.

These are broad comparisons across the Cloudflare sample; you’ll still need measurements from your own site, but man, is this cool data to have!


  • wp_kses() is getting a different parser, and that can change the HTML your code gets back. The HTML API rewrite is in WordPress trunk: sanitized markup is normalized, and disallowed script/style contents are removed too.

Dennis Snell’s before-and-after examples give plugin and theme developers concrete cases to test. Inclusion in 7.2 or 7.3 is still under consideration; the legacy-parser opt-out is temporary.



  • Weston Ruter has committed admin asset prefetching to WordPress 7.2 trunk. With concatenation off, the login screen warms critical admin assets and the Dashboard warms the block editor’s CSS. Editor JavaScript is left out; the PR explains that decision and how HTTP caching affects reuse.

  • An uncached WordPress analysis in about eight seconds. That’s the result in PHPStan 2.3’s performance write-up, with Turbo on the maintainer’s M1 Pro MacBook Pro, down from 60 seconds in December 2025. The comparison spans several releases; the table separates Turbo’s contribution.

  • Presence API 0.14.0 stops post-lock refreshes from invalidating cached post queries on sites with a persistent object cache. It’s still a feature plugin for WordPress 7.0+.

  • Out-of-order HTML streaming lets a server send the page shell first and fill placeholders as the remaining content becomes ready, without JavaScript doing the replacement. The <template for> mechanism is in the HTML standard and supported from Chrome 150; other browsers still need a fallback.

Some of my favorite WordPress tools:

🔆 Within WordPress Highlight

Say an author changes a name and URL. The profile looks right, but the second archive page breaks, and the sitemap still lists the old address. A small edit with quite a trail behind it.

Jono Alderson follows those connections through a website: redirects, feeds, shared records, and metadata all need to stay in step.

AI can build that system too. The useful exercise here is to follow a few ordinary edits through your existing site before replacing the CMS. That helps you find the requirements a finished-looking page won’t reveal.

💡 Interesting Finds

  • Chrome 155 adds JPEG XL decoding. Google recommends comparing JPEG XL with AVIF for photographic or lossless images, especially when progressive loading is useful.

  • Need to give an AI agent a whole computer? VMPal gives it a macOS, Windows, or Linux VM on an Apple silicon Mac running macOS 26+. The setup guide explains opt-in control of the screen, keyboard, mouse, and administrator commands.

Check what you expose to the agent: shared folders and network access remain within its reach.


  • image-blaster uses Claude skills, World Labs, and FAL to turn one image into a 3D environment. The repo includes a viewer and assets you can use in Three.js or Blender, with API access required for generation.

  • For all you Mac users: TypeSeer puts AI autocomplete into standard text fields across Mac apps, with suggestions generated on the device. It needs Apple Silicon, macOS 14+, and Accessibility permission; the vendor says writing stays local.

  • Less hand-written keyboard plumbing: Chrome 150’s focusgroup example gives a toolbar arrow-key navigation, a tab stop, and last-focused memory. Keep a fallback for browsers without support.


  • CSS progress() turns a value’s position between two limits into a ratio—handy for scaling opacity or size with a container’s width. It reached Baseline in September; older browsers still need a fallback.

  • Chrome’s Email Verification origin trial can verify an address through a participating provider’s signed token, without an inbox detour. It needs an active provider session in the same browser, server-side token validation, and your usual email-confirmation fallback; this is still a trial.

  • Mailflare is a self-hosted inbox for custom domains built on Cloudflare. The repository includes deployment instructions; sending mail needs Cloudflare’s Email Service or a configured Resend or Amazon SES provider.

  • Plannotator gives you a visual place to mark up an agent’s plan before execution and review the resulting diff. The local tool sends those annotations back as structured feedback.

  • Radish puts a Redis-compatible server inside a Cloudflare Durable Object, with SQLite storage and an R2 cold tier. It’s not production-ready: command coverage is incomplete, and there’s no export or point-in-time restore.


  • Theo Ephraim’s Cloudflare self-hosted app index groups deployable tools for analytics, email, documents, and more, with licenses and required services listed. It’s a place to compare options, not a promise that every app runs free.

  • Justin Sternberg’s agentic engineering blueprint separates coordination, building, and verification, with durable state to survive handoffs. The implementation is private; merges still wait for a person.

🛒 WooCommerce News



  • Darren Ethier walks through ten merged WooCommerce changes, including weight-based shipping formulas and fixes for scheduled sales and downloads. Most target 11.3; merged code isn’t a promise about the version running in your store.

🔎 Scanfully Updates

We’ve been kinda quiet and dropped a few hints here and there these past couple of months, but for a good reason!

We’re wrapping up a complete overhaul of our Dashboard, and “redesign” doesn’t quite cover it: every view has been rebuilt from the ground up.

Think far more control over notifications, grouping sites by client, plain-language insights per site, and countless smaller improvements everywhere you look.

When we’ve launched it, expect a lot of news coming up in the next couple of weeks. Heck, months! We’re on a roll with an exciting additional feature/direction in the works as well.


That’s it for this week’s edition of Within WordPress. Thanks for reading!

Best, Remkus

Join the Within WordPress Newsletter Today

Get on top of valuable WordPress news, tools, and techniques—and join more than 2000+ today!

This field is for validation purposes and should be left unchanged.
First name


Comments

Leave a Reply

Your email address will not be published. Required fields are marked *