So WordCamp Belgrade was great. A good old-fashioned WordCamp high. Followed up with one of the most severe WordPress security updates we’ve seen in a long time: the
But… don’t see that as a negative. I’ll explain why in my article linked below. Lots of other news as well. Hope you enjoy it!
🎓 From The Guild
I published this in The Guild but wanted to share the sentiment outside of it as well, so I published it on my site:
Related to this, I joined Matt, of the Medeiros kind, on his WP Minute podcast and talked about whether
With Mark Weisbrod enjoying the whole conversation so much, he
🗞️ Within WordPress News
Here’s what I saw happening:
- This is cool! Your AI assistant can now
read WordPress Trac directly . Lance Willett announced a free, public MCP server for searching tickets and reading discussions, changesets, and linked pull requests across the WordPress.org Tracs, with no account or API key needed.
Read-only, btw. The
- The
WordPress 7.2 roadmap is out, aiming for early December. Plugin authors are getting room to add screens to the Site Editor, form controls in Global Styles, and suggested edits in Notes. As always, the roadmap is still a work plan, though. This also goes for the AI work, including plans to put the MCP Adapter in the Plugin Directory, which remains plugin experimentation, with no guarantee of inclusion in Core. Sadly.
Not sad that collaborative editing is explicitly out of 7.2 😅
- Getting a Trac ticket into a working test site just got a little easier.
Contributor Toolkit 1.1.0 opens ticket links from your browser, and WP Trac Triager adds the link on Trac itself. The app now bundles Git and checks out pull requests with the original author’s commits intact. One upgrade condition to catch, btw: sites created before 1.1.0 become read-only, so export unfinished work as a patch and create a new site to continue.
- You’ve got enough exciting stuff with security releases left and right to worry about. Let
Omnisend be the reliable platform you can depend on for email. Make an average of $79* for every $1 you spend.
- The Core team has published
six release utilities for jobs such as preparing HelpHub pages, generating SVN tag commands, checking merges, and assembling contributor credits. A useful collection to inspect if you help ship WordPress releases, where one security update can involve more than twenty branches. Or if you want to learn how to implement this for your own projects, ofc.
- Chris Huber shared
Static Site Importer , which converts static HTML into editable WordPress pages, and a companion theme. An interesting route for designs generated with tools like Lovable, provided you have a static export; it won’t recreate an application’s backend. The README walks through a Playground demo, but this is still one for a disposable test site: current issue reports cover import validation, and a WordPress Studio integration test produced an oversized report. Explore the conversion, check the output, and keep a copy of the original.
- Moving thousands of pages into blocks takes more than converting the markup. K. Adam White walks Nathan Wrigley through
Human Made’s migration process : auditing legacy content, building patterns around the layouts, and checking migrated pages with the client. There’s useful detail on keeping styling in the theme and inserting content with the experimental rehydrator plugin, plus a frank discussion of the permissions and editorial workflows WordPress still needs.
I really enjoyed this podcast!
- Nick Hamze makes a useful case for
making WordPress easier for agents to read and discover : clean Markdown, a public menu of readable content, accurate metadata, and the RSS feeds we already have.
- Çağdaş Dağ has launched
WPAcquire , a marketplace for WordPress plugins, themes, stores, and content sites. You can browse revenue, profit, and traffic figures for free; business names and seller contact details require a buyer membership.
- If you’re in any way running a business with/within/on/ WordPress, you need to be at PressConf next month. I’m on the speaker lineup for
PressConf Europe , October 27–30 in Barcelona. The event brings WordPress business owners, agency leaders, and product teams together at H10 Marina Barcelona, with a welcome evening, two days of talks, and WonderDay on the final day. The organizer’s overview covers the format and the option to stay at the conference hotel.
WordPress Accessibility Day’s schedule is up for October 7–8: a free, online, 24-hour event. William Patton will demonstrate accessibility checks in a WordPress plugin’s CI/CD workflow, while Julia Undeutsch examines where accessibility plugins fall short. Two good places to start picking sessions for the work you actually do.
🚀 Performance & Security
- Plugin developers: I watched Simon Kraft‘s presentation in WC Belgrade on the
Cyber Resilience Act . Check it out and learn what you’re not yet doing but should have had finished already! Things like software bills of materials and vulnerability disclosure.
- Cloudflare now lets you
configure Varyin Cache Ruleson every plan, so different languages or formats from one URL can be cached separately without turning every header variation into another cache entry. There is setup involved: the docs recommend bypassing unexpected headers, explicitly configuring the headers you expect, and bypassing cookies or other values specific to a visitor.
Very cool to finally have this!
- Matt Schwartz at Inspry has
compared twelve WooCommerce hosting configurations using a store with roughly 120,000 orders, 15,000 subscriptions, and a 5GB database. Servebolt led the combined performance-and-value score; BigScoots was fastest in the admin and order search. Read the methodology alongside the tables, though: most tests date from July 2025, Kinsta was tested in July 2026 with newer software, and each host used its recommended setup. The scoring uses best-of-run averages and gives order search extra weight. The article is on Servebolt’s site; Servebolt also supplied its test environment and sponsored the Kinsta test. Wait wut? 👀
- Fonts don’t always need another network request.
Modern Font Stacks groups ready-to-copy system font stacks by typeface style, with previews to compare the options. The actual font varies by operating system, but you avoid downloading a web font just to get a decent serif, sans-serif, or monospace face.
🔆 Within WordPress Highlight
Proud of Carl Alexander finally having
Way to go, Carl 👏🏻
💡 Interesting Finds
- An iframe that fits its content without the usual
postMessage()plumbing? Bramus hasexamples and a demo for Chrome 154 . Both pages must opt in, and dynamic changes still need window.requestResize(); Firefox and Safari don’t support it yet. Keep a fallback and watch for layout shifts, especially above the fold—theChrome documentation covers both.
- Agency on Slack, client on Teams? George Stephanis is building
InterBridge to relay messages and threaded replies between the two. It’s open source and self-hosted, with setup and permission requirements to work through; Teams support is limited to standard channels, and most files travel as links that still require access to the original. Early software, with bugs still possible, but a very familiar agency headache to tackle!
- The
Inclusive Design 24 programme for September 24 has a few sessions I’d point you towards: Manuel Matuzović on the Popover API, keyboard navigation, and ARIA, plus Jamila Savoy and Jess Mathew on making content easier to understand. Each session in the schedule links to its public YouTube stream, so you can head straight for a topic instead of hunting through the channel.
- A temporary fix that stuck around for twelve years. Jake A. Smith is
retiring http_build_url, a PHP polyfill with nearly 20 million Packagist installs by his count, and known bugs that will remain unfixed. Existing releases will still install, but the README has migration examples : PHP 8.5’s URI API, or alternatives such as league/urifor older PHP. Worth checking your dependencies, especially if this little helper has quietly become part of something you maintain.
- Switching between Claude Code, Codex, and another coding agent?
bb puts those agents in one local workbench, with plugins for GitHub, memory, scheduled jobs, and your own tools. The site shows an agent building a task tracker into the interface itself, which is a rather interesting way to customize your workspace!
It’s free and open source, btw! The agents still use the provider subscriptions you pay for separately.
- Need to show someone a site that’s still running on your laptop?
Cloudflare Quick Tunnels gives localhost a temporary public HTTPS URL with one cloudflaredcommand, without an account or DNS setup. Handy for a quick preview or testing webhooks, provided you’re happy for that server to be publicly reachable. Keep it to development:the limits include 200 concurrent requests, no Server-Sent Events, and no uptime guarantee.
- Scott Buscemi shared
Cloudflare’s new Cursor Origin integration : push to your configured production branch, and Workers Builds builds and deploys the Worker. Enable preview builds for other branches, and you get an isolated preview plus build status in the pull request.
Very handy if your code already lives in Origin; the setup lets you limit Cloudflare’s access to selected repositories.
🛒 WooCommerce News
- Josh Kohlbach has launched
StoreAgent’s connection for ChatGPT and Claude , so your assistant can work with your WooCommerce store: draft product descriptions, apply tags, and generate image alt text. You’ll need StoreAgent 1.1.9 or later; the hosted MCP connection is included on every plan, including free. Read-only is preselected, and write abilities stay off until you enable each one.
WooCommerce 11.2 is now in beta , with the release planned for October 6. One useful change for catalog work: with ‘Update existing products’ enabled, CSV imports can match by GTIN, UPC, EAN, or ISBN when no ID or SKU is supplied. Unmatched non-blank identifiers skip the row, and a match can’t silently change the product type; cleanup now removes only that import’s temporary products.
Do check the developer advisories before testing on staging. The default-off abandoned-cart recovery and Agentic Checkout experiments are being removed, including the wc/agentic/v1 routes with no replacement. This is a beta to test against your integrations, not a stable-store update.
- Considering a block theme for your next store? Mike McAlister, Karol Manijak, and Lucio Giannotta will discuss
building with WooCommerce block themes on September 30 , including compatibility, performance, and where visual editing gives way to custom code. The session starts at 19:00 Amsterdam time, with audience questions and a recording afterwards.
Useful timing if you’ve been looking at Ollie or the Purple beta and want to weigh up the fit for a real project!
- Rodolfo Melogli’s
Save the Plugin opens a 30-day marketing sprint on October 5 for paid WordPress plugins that integrate with WooCommerce and already have customers. Seats must be purchased by September 30; the listed price is $297 for the first ten seats, then $397. Josh Kohlbach joins the teaching lineup for Black Friday planning. One detail to read carefully: completing all twenty tasks earns a choice of credit or a conference ticket, not a cash refund.
🔎 Scanfully Updates
We’re getting closer and closer to Beta status for our WooCommerce Checkout Monitoring feature.
Let me know if you want to test this out when we announce the beta!
That’s it for this week’s edition of Within WordPress. Thanks for reading!
Best, Remkus
Leave a Reply