The WordPress Security Team will never email you requesting that you install a plugin or theme on your site, and will never ask for an administrator username and password.

If you receive an unsolicited email claiming to be from WordPress with instructions similar to those described above, please disregard the emails and indicate that the email is a scam to your email provider.

These emails link to a phishing site that appears to be the WordPress plugin repository on a domain that is not owned by WordPress or an associated entity. Both Patchstack and Wordfence have written articles that go in to further detail.

Official emails from the WordPress project will always:

• Come from a @wordpress.org or @wordpress.net domain.
• Should also say “Signed by: wordpress.org” in the email details section.

The WordPress Security Team will only communicate with WordPress users in the following locations:

• the Making WordPress Secure blog at make.wordpress.org/security
• the main WordPress News site at wordpress.org/news

The WordPress Plugin team will never communicate directly with a plugin’s users but may email plugin support staff, owners and contributors. These emails will be sent from plugins@wordpress.org and be signed as indicated above.

The official WordPress plugin repository is located at wordpress.org/plugins with internationalized versions on subdomains, such as fr.wordpress.org/plugins, en-au.wordpress.org/plugins, etc. A subdomain may contain a hyphen, however a dot will always appear before wordpress.org.

A WordPress site’s administrators can also access the plugin repository via the plugins menu in the WordPress dashboard.

As WordPress is the most used CMS, these types of phishing scams will happen occasionally. Please be vigilant for unexpected emails asking you to install a theme, plugin or linking to a login form.

The Scamwatch website has some tips for identifying emails and text messages that are likely to be scams.

As always, if you believe that you have discovered a security vulnerability in WordPress, please follow the project’s Security policies by privately and responsibly disclosing the issue directly to the WordPress Security team through the project’s official HackerOne page.

Thank you Aaron Jorbin, Otto, Dion Hulse, Josepha Haden Chomphosy, and Jonathan Desrosiers for their collaboration on and review of this post.

This blog is the culmination of a community effort that began last year. Formed by experienced WordPress community members and developers, the editorial group has since worked on a wide range of content already available—from theme and block development tutorials to tips and tricks for leveraging WordPress in the site editing era.

A new home for developers

As a complementary resource to the WordPress documentation, the Developer Blog aims to provide a shared space to stay informed of development-related updates, keep up with ongoing discussions and ideas, and explore cutting-edge use cases.

In other words, consider it as a central hub for developers and extenders of different backgrounds and skill levels to learn with quality content from reliable sources, share knowledge, and drive WordPress development forward.

True to the open source way, the blog will likely evolve. As its editors and readers learn and create more content, it will adapt in response to the needs of community members like you.

Everyone is welcome to chime in on-topic discussions, share ideas or contribute. Learn more about how to get involved.

What about the content?

Content on the WordPress Developer Blog covers many topics, including tutorials on theme development, plugins, and block development. You can also expect posts on WordPress APIs, best practices for working with WordPress, updates on upcoming releases, and learning resources for beginners and seasoned developers.

These articles offer a good hint at what’s already in store for you:

• Demystifying home and posts templates in WordPress theme development
• Creating themes from a pattern-first mindset
• Static vs. dynamic blocks: What’s the difference?
• Creating custom block styles in WordPress themes
• What’s new for developers? (March 2023)

Sounds interesting?

Subscribe to the Developer Blog to keep up with the latest content in the WordPress development space.

Props for content and peer review @chanthaboune @rmartinezduque @mburridge @marybaum @bph @greenshady @webcommsat.

These versions of WordPress were first released eight or more years ago so the vast majority of WordPress installations run a more recent version of WordPress. The chances this will affect your site, or sites, is very small.

If you are unsure if you are running an up-to-date version of WordPress, please log in to your site’s dashboard. Out of date versions of WordPress will display a notice that looks like this:

In WordPress versions 3.8 – 4.0, the version you are running is displayed in the bottom of the “At a Glance” section of the dashboard. In WordPress 3.7 this section is titled “Right Now”.

The Make WordPress Security blog has further details about the process to end support.

Everyone is welcome to watch these events live on YouTube and to share their translation stories which will be featured during the celebrations and beyond. The global events will be in English and include presentations on how and why to you should join the thousands of translators in the project, tips and tools, interviews, and much more.

There are now 205 locales translating in what is a remarkable open source effort, bringing the opportunities of the software and its community to people in their own native languages.

Inaugural session: Introduction and latest news on WordPress Translation

Friday, September 17, 2021 at 10:00 UTC

We will start the global events with a panel featuring the latest update on what is happening in the world of WordPress polyglots. Panellists will include translators and polyglot supporters Petya Raykovska and Erica Varlese. There will be a video demonstration on how to translate WordPress, a short presentation on translation statistics, a run down of upcoming events, and more.

Watch the event live on YouTube (or click on the play button below) – sign-up for notifications in the video stream right now so you don’t miss it when it goes live! 

Friday, September 17, 2021 at 11:00 UTC

Right after the livestream, there will be a ‘drop-in’ translation sprint on Zoom video-conferencing, open to all. You can join and hang out virtually with your Polyglots friends from all around the world and translate WordPress in your own language! RSVP for the session now and get joining links!

Check out the other exciting global events

Sunday, September 19, 2021 12:00 UTC

Panel on Polyglots Tools
Join Jesús Amieiro, Peter Smits, Vlad Timotei, and Vibgy Joseph to talk about the tools they’ve contributed to or developed to help translators and translation editors.

Tuesday, September 21, 2021 11:00 UTC

Panel on Open Source Translation Communities (YouTube link – opens in a new tab)
Join Zé Fontainhas (WordPress), Ali Darwich (WordPress), Michal Stanke (Mozilla), and Satomi Tsujita (Hyperledger Fabric) to learn about nurturing translation communities.

Thursday, September 30, 2021 16:00 UTC

Finale Event – Why do you translate?
Our finale event for 2021 with emcee Abha Thakor and a panel from the WordPress Translation Day Team. It will feature highlights from some of the local and global events during the month and a selection of results. Some of the nominees for this year’s polyglots appreciation will join the livestream to share their stories.

The livestream will be followed by an after party celebration for anyone who has taken part in the event or is a WordPress polyglot. Book now for the session on Zoom.

Ideas on how to get involved this September

There’s lots of ways to take part – discover this list of ideas.

You can also nominate translation contributors to be featured in this year’s celebrations.

Help us spread the word about #WPTranslationDay

• Share what you are translating using the #WPTranslationDay hashtag on: Facebook, Twitter, Instagram, and LinkedIn!
• You can also find images and translator badges in our Media Kit to share during September.

For more information on the 2021 WordPress Translation Day celebrations, visit the WordPress Translation Day website.

Props to @webcommsat, @harishanker, @lmurillom, @oglekler, @meher, @nalininonstopnewsuk, @evarlese for contributing to this story.

Still, if you’ve been putting off using the block editor, this is an excellent time to give it another shot. Since it first appeared in 2018, hundreds of WordPress contributors have made a lot of updates based on user feedback. You will be pleasantly surprised at how far it’s come!

Big thanks to everyone who has been working on WordPress, Gutenberg, and the Classic Editor plugin. And thank you to every WordPress user and tester who has provided the feedback we need to make the software even better.

~ Josepha

Returning to the block editor for the first time in a long time? You can give feedback early in the process by joining the outreach program! Looking at it for the first time ever? Get your bearings with some workshops or check out this demo!

Which means it makes sense to change our theme.

Earlier this year, Matt requested a new design from Beatriz Fialho (who also created the State of the Word slides for 2020). The design keeps a clean, white-space friendly format while incorporating a more jazzy, playful feeling with a refreshed color palette.

More detail on this modern exploration have been posted on make.wordpress.org/design. I encourage you to stop by and read more about the thoughts behind the coming updates; and keep an eye out for the new look here and across WordPress.org!

This cross-team initiative is part of the WordPress.org network and features content from contributors from the global community. It will be updated weekly and will help connect new and existing WordPress users with the broader community while they learn.

What can you learn about WordPress?

On Learn WordPress you can find a range of material and opportunities to use at the time which works for you.

Workshops are practical, skills-based videos that show viewers how to do new things with WordPress, whether you publish, manage, develop with, or contribute to WordPress. Most workshops include quizzes for you to test your newly gained knowledge.

Discussion groups provide an opportunity for further collaborative learning with participants meeting together to discuss the workshop content – they take place online, either in video calls or Slack and accommodate all time zones.

Lesson plans are guides for facilitators to use while presenting at events or within educational environments. Facilitators will find learning objectives (telling people what they are going to learn), any prerequisite skills, assets such as screenshots and slide decks, and learning assessments. 

Courses are a series of interconnected lesson plans to be presented by a facilitator that will strategically focus on defined learning outcomes. Participants can go through these courses individually or as part of a group. After completing the learning, attendees should be able to apply their skills in the real world.

In addition to the wealth of valuable content available on Learn WordPress, the platform provides an opportunity for individuals to learn alongside other community members and become connected with a global network of WordPress users, developers, and contributors.

Why you should use Learn WordPress – videos from our community.

How can you get involved?

Learn WordPress is an open-source platform available for anyone to contribute content in any areas mentioned above. Find out more about how you can get involved with this initiative.

Take part in our fun promotion campaigns on social and with your local community.

Hundreds of people spanning a number of years have contributed to the development of learning materials. Thanks to everyone who worked so hard to make Learn WordPress a reality. 

Particular thanks to:

Training: @courane01, @azhiyadev, @geheren, @webtechpooja, @jessecowens, @onealtr, @rastaban, @evarlese, @manzwebdesigns
Meta: @coreymckrill, @dufresnesteven, @jonoaldersonwp
Community: @hlashbrooke, @camikaos, @harishanker, @angelasjin, @nao, @courtneypk, @andreamiddleton, @rmarks, @sippis
Marketing: @webcommsat,  @oglekler, @lmurillom, @yvettesonneveld, @meher, @nalininonstopnewsuk, @megphillips91, @marks99, @marybaum, @antialiasfactory, @herculespekkas, @chaion07
Design: @melchoyce 

For a fuller list of the contributors who have been involved in training and Learn WordPress, visit the initial beta launch post. Thanks to everyone who has been involved to date and will be in the future. 

#LearnWordPress #LearnWP

Accessibility

• Contacted: @joedolson, @audrasjb, @arush
• Priority: Work on authoring a manual for assistive technology users on Gutenberg, led by Claire Brotherton (@abrightclearweb). Continue to work on improving the overall user experience in Gutenberg. Update and organize the WP A11y handbook.
• Struggle: Lack of developers and accessibility experts to help test and code the milestone issues. Still over 100 outstanding issues, and developing the Gutenberg AT manual helps expose additional issues. The announcement of an accessibility focus on 4.9.9 derailed our planning for Gutenberg in September with minimal productivity, as that goal was quickly withdrawn from the schedule.
• Big Win: Getting focus constraint implemented in popovers and similar components in Gutenberg.

CLI

• Contacted: @danielbachhuber, @schlessera
• Priority: Current priority is v2.1.0 of WP-CLI, to polish the major refactoring v2.0.0 introduced. You can join in or follow progress on their site.
• Struggle: Getting enough contributors to make peer-review possible/manageable.
• Big Win: The major refactoring of v2 was mostly without any negative impacts on existing installs. It provided substantial improvements to maintainability including: faster and more reliable testing, more straight-forward changes to individual packages, and simpler contributor on-boarding.

Community

• Contacted: @francina, @hlashbrooke
• Priority: Supporting contributors of all levels via: monthly WordCamp Organizers chat, better onboarding with a translated welcome pack, and Contribution Drive documentation.
• Struggle: Fewer contributors than usual.
• Big Win: Meetup Vetting Sprint! 

Core

• Contacted: @jeffpaul
• Priority: Continued preparation for the 5.0 release cycle and Gutenberg.
• Struggle: Identifying tasks for first time contributors, as well as for new-to-JS contributors.

Design

• Contacted: @melchoyce, @karmatosed, @boemedia, @joshuawold, @mizejewski
• Priority: Preparing for WordPress 5.0 and continuing to work on better onboarding practices.
• Struggle: Identifying tasks for contributor days, especially for small- to medium-sized tasks that can be fit into a single day.
• Big Win: Regular contributions are starting to build up.

Documentation

• Contacted: @kenshino
• Priority: Getting HelpHub out before WordPress 5.0’s launch to make sure Gutenberg User Docs have a permanent position to reside
• Struggle: Getting the documentation from HelpHub into WordPress.org/support is more manual than initially anticipated.
• Big Win: Had a good discussion with the Gutenberg team about their docs and how WordPress.org expects documentation to be distributed (via DevHub, Make and HelpHub). Getting past the code blocks to release HelpHub (soon)

Hosting

• Contacted: @mikeschroder, @jadonn
• Priority: Helping Gutenberg land well at hosts for users in 5.0.
• Struggle: Short time frame with few resources to accomplish priority items.
• Big Win: Preparing Try Gutenberg support guide for hosts during the rollout and good reception from users following it.

Marketing

• Contacted: @bridgetwillard
• Priority: Continuing to write and publish case studies from the community.
• Big Win: Onboarding guide is going well and is currently being translated.

Meta (WordPress.org Site)

• Contacted: @tellyworth, @coffee2code
• Priority: Support for other teams in the lead up to, and the follow-up of, the release of WP 5.0. ETA is the WP 5.0 release date (Nov 19) and thereafter, unless it gets bumped to next quarter.
• Struggle: Maintaining momentum on tickets (still).
• Big Win: Launch of front-end demo of Gutenberg on https://wordpress.org/gutenberg/

Mobile

• Contacted: @elibud
• Priority: Have an alpha version of Gutenberg in the WordPress apps, ETA end of year 2018.
• Struggle: Unfamiliar tech stack and the goal of reusing as much of Gutenberg-web’s code as possible.
• Big Win: Running mobile tests on web’s PRs.

Plugins

• Contacted: @ipstenu
• Priority: Cleaning up ‘inactive’ users, which was supposed to be complete but some work preparing for 5.0 was necessary.
• Struggles: Devnotes are lacking for the upcoming release which slows progress.
• Big Win: No backlog even though a lot were out!

Polyglots

• Contacted: @petya, @ocean90, @nao, @chantalc, @deconf, @casiepa
• Priority: Help re-activating inactive locale teams.
• Struggle: Many GTEs are having a hard time keeping up with incoming translation validation and PTE requests.
• Big Win: Made some progress in locale research and reassigning new GTEs.

Support

• Contacted: @clorith
• Priority: Preparing for the upcoming 5.0 release
• Struggle: Finding a good balance between how much we want to help people and how much we are able to help people. Also, contributor recruitment (always a crowd favorite!)
• Big Win: How well the team, on a global level, has managed to maintain a good flow of user engagement through support.

Theme Review

• Contacted: @acosmin, @rabmalin, @thinkupthemes, @williampatton
• Priority: Implementing the Theme Sniffer plugin on WordPress.org which is one step forward towards automation. ETA early 2019
• Struggle: Not having so many contributors/reviewers.
• Big Win: Implementing multiple requirements into our review flow, like screenshots and readme.txt requirements.

Training

• Contacted: @bethsoderberg, @juliek
• Priority: Getting the learn.wordpress.org site designed, developed, and being able to publish lesson plans to it.
• Struggle: Getting contributors onboard and continually contributing. Part of that is related to the learn.wordpress.org site. People like to see their contributions.
• Big Win: We have our new workflow and tools in place. We are also streamlining that process to help things go from idea to publication more quickly.

Interested in updates from the last quarter? You can find those here: https://wordpress.org/news/2018/07/quarterly-updates-q2-2018/

Accessibility

• Contacted: @rianrietveld, @joedolson, @afercia
• Priority: Working to make sure that Gutenberg is reasonably accessible prior to merge. ETA is before 5.0
• Struggle: Lack of developers and accessibility experts to help test and code the milestone issues. The team is doing outreach to help solve this problem.
• Big Win: Interest from companies like The Paciello Group and Tenon.io to help out with Gutenberg code review and testing tools.

CLI

• Contacted: @danielbachhuber, @schlessera
• Priority: Very first global Hack Day is coming up July 20. Version 2.0.0 is still in progress (new ETA is end of July).
• Struggle: The team continues to need new contributors. The current team is tiny but tough.
• Big Win: WP-CLI is currently one of the project’s four main focuses, as mentioned in the Summer Update at WordCamp Europe.

Community

• Contacted: @francina, @hlashbrooke
• Priority: Focusing on smoothing out the processes in our community management by building up our team of volunteers and establishing what tools we need to keep things running well. ETA is ongoing.
• Struggle: Our two biggest struggles at the moment are tracking what we need to get done, and making final decisions on things. There is current work on the tools available to assist with tracking progress.
• Big Win: After making a concerted effort to get more contributors on the Community Team, we now have a much larger group of volunteers working as deputies and WordCamp mentors

Core

• Contacted: @jeffpaul
• Priority: Following the WordCamp Europe summer update (and the companion post here), the team is getting Gutenberg (the new WordPress editing experience) into a strong state for the 5.0 release. Potential ETA as soon as August.
• Struggle: Coordinating momentum and direction as we start seeing more contributors offering their time. Still working our way through open issues. The team is starting multiple bug scrubs each week to work through these more quickly and transparently.
• Big Win: Had a sizable release in 4.9.6 which featured major updates around privacy tools and functionality in Core.

Design

• Contacted: @melchoyce, @karmatosed, @boemedia, @joshuawold, @mizejewski
• Priority: Better on-boarding of new contributors, especially creating better documentation. ETA is end of July.
• Struggle: It’s hard to identify reasonably small tasks for first-time contributors.
• Big Win: The team is much more organized now which has helped clear out the design backlog, bring in new contributors, and also keep current contributors coming back. Bonus: Joshua Wold will co-lead the upcoming release.

Documentation

• Contacted: @kenshino
  
• Priority: Opening up the work on HelpHub to new contributors and easing the onboarding process. No ETA.
  
• Struggle: Some blockers with making sure the code and database can be ready to launch on https://wordpress.org/support/
  
• Big Win: The first phase of HelpHub creation is complete, which means content updates (current info, more readable, easier discovery), internal search, design improvements, and REST API endpoints.

Hosting

• Contacted: @mikeschroder, @jadonn
• Priority: Preparing hosts for supporting Gutenberg, especially support questions they’re likely to see when the “Try Gutenberg” callout is released. ETA July 31st, then before WordPress 5.0
  
• Struggle: Most contributions are still made a by a small team of volunteers. Seeing a few more people join, but progress is slow.
  
• Big Win: New team members and hosting companies have joined the #hosting-community team and have started contributing.

Marketing

• Contacted: @bridgetwillard
• Priority: Continuing to write and publish case studies from the community. ETA is ongoing.
• Struggle: No current team struggles.
• Big Win: Wrote and designed a short Contributor Day onboarding card. It was used at Contributor Day at WCEU and onboarding time went down to 1 hour instead of 3 hours.

Meta (WordPress.org Site)

• Contacted: @tellyworth, @coffee2code
• Priority: Reducing manual work around the contributor space (theme review, GDPR/privacy, plugin review). ETA for small wins is end of quarter, larger efforts after that.
• Struggle: Maintaining momentum on tickets. There are also some discussions about updating the ticket management process across teams that use the Meta trac system.
• Big Win: The new About page launched and has been translated across most locale sites.

Mobile

• Contacted: @elibud
• Priority: Getting Gutenberg in the mobile applications. ETA is late December.
• Struggle: Consuming the Gutenberg source in the ReactNative app directly. More info can be found here: https://make.wordpress.org/mobile/2018/07/09/next-steps-for-gutenberg-mobile/
• Big Win: The WordPress mobile applications now fully support right-to-left languages and are compliant with the latest standards for accessibility.

Plugins

• Contacted: @ipstenu
• Priority: Clearing ~8,000 unused plugins from the queues. Likely ETA is September.
  
• Struggles: Had to triage a lot of false claims around plugins offering GDPR compliance.
• Big Win: Released 4.9.6 and updated expectations with plugin authors. Huge thanks to the Core Privacy team for their hard work on this.

Polyglots

• Contacted: @petya, @ocean90, @nao, @chantalc, @deconf, @casiepa
• Priority: Keep WordPress releases translated to 100% and then concentrate on the top 100 plugins and themes. ETA is ongoing.
  
• Struggle: Getting new PTEs fast enough, and complex tools/systems. Overall, the volume of strings awaiting approval.

Support

• Contacted: @clorith
• Priority: Getting ready for the Gutenberg callout (it got pushed last quarter). Needing a better presence on the official support forums, and outreach for that is underway, ETA end of July. 
  
• Struggle: Keeping contributors participating post-contributor days/drives. Considering the creation of a dedicated post-contributor day survey to get some insight here.
• Big Win: The increase in international liaisons joining for weekly meetings, helping bring the wider support community together.

Theme Review

• Contacted: @acosmin, @rabmalin, @thinkupthemes, @williampatton
• Priority: Building a better Theme Check/Sniffer in order to automate most of the checks done right now by reviewers. ETA late 2018, early 2019.
• Struggle: Bringing in new contributors to the team.
• Big Win: Trusted Authors program

Tide

• Contacted: @valendesigns (but usually @jeffpaul)
• Priority: Storing PHPCompatibilty results inside the WordPress.org API and building a UI to display those results, an endpoint to request an audit is required for this work to continue.
• Struggle: Development has dramatically slowed down while team members are on leave or pulled into internal client work.
• Big Win: Migration to Google Cloud Platform (GCP) from Amazon Web Services (AWS) is complete and the audit servers have all been rewritten in Go. (This allows us to be faster with greater capacity and less cost.)

Training

• Contacted: @bethsoderberg, @juliek
• Priority: Lesson plan production. ETA is ongoing.
• Struggle: The workflow is a little complex, so recruiting and training enough contributors to keep the process moving is a struggle.
• Big Win: WordCamp Europe’s Contributor Day was very productive. New tools/workflow are in place and two team representatives were there to lead and help.

Interested in updates from the first quarter of this year? You can find those here: https://make.wordpress.org/updates/2018/04/24/quarterly-updates-q1-2018/