The integration of WordPress & WordPress.org

If you’ve been following my writing on the Matt Mullenweg and WP Engine saga, it’ll come as no surprise that Quinn Emanuel is writing amazing legal briefs—they are incredibly readable, and written for “the public”, not only the court.

On November 14, 2024, WP Engine filed its amended complaint, which is, again, quite readable, and includes nine new claims (including antitrust claims), and some very choice quotes. If you haven’t already, I’d encourage you to read the complete amended complaint. While the complaint necessarily includes a lot of legalese, most of the document is targeted to more than the court—to the entire community.

Because WP Engine filed its legal briefs first, we’ve had a taste of “what to expect” from Quinn Emanuel. However, until October 30, we hadn’t seen a legal brief from Hogan Lovells—Automattic and Mullenweg’s counsel—and, in turn, did not know how well they would read. Well, colour me disappointed. They have been both dry and uninformed (and, in one instance, over-length). If you’ve ever thought of the law as “dull”, Hogan Lovells agrees and has filed quite a few documents in support of that dullness.

Today, I want to zoom in a bit and review one part of Automattic and Mullenweg’s “Motion to Strike.” Specifically, a declaration by Barry Abrahamson, Automattic’s long time Chief Systems Wrangler, which I find fascinating in what it doesn’t say. If you haven’t already, pull up the relatively short declaration and read it for yourself.

Automattic contributes significantly to WordPress.org

When I worked at both Audrey Capital and Automattic, I helped oversee design and development of the WordPress.org website. One of the many pain points at the time was getting support from Automattic’s systems team—led by Abrahamson—which maintained the infrastructure of WordPress.org. Requests were posted to a public make/systems “P2” blog—resolutions were anything but swift.

So, I was shocked to read paragraph 3 of Abrahamson’s declaration (my emphasis):

Automattic contributes significant time and resources to the operation of the Website, in excess of 3500 hours weekly.

This total seemingly includes all of Automattic’s time dedicated to the WordPress.org website, not only systems, but… wait, what?!

Assuming no overhead at all, 3500 hours is equivalent to 87.5 people working 40 hours per week on the website. I’ve read paragraph 3 a few dozen times now, and I find this inconceivable. I can absolutely believe that 87 Automatticians are contributing to WordPress, more broadly, inclusive of WordPress.org and Gutenberg. But, 87 people devoted to the WordPress.org website should mean drastic changes on a weekly basis.

To put this in context, until earlier this month I worked at 10up, a digital agency that is well-known for its work designing and developing WordPress websites. At the start of my tenure there, I oversaw a client engagement that was one of the largest 10up has seen, which involved migrating content from a legacy CMS to WordPress, designing and developing a new WordPress-powered platform, integrating with third-party platforms, and supporting the new platform. At its peak, the entire team encompassed around 40 employees at 10up—inclusive of design, engineering, project management, strategy, content migration, and support—and not all of them were full time on the project.

I cannot even fathom what 87 people—even including people managers—would do week-to-week on WordPress.org. What are these 87 people working on? If this is true, it should mean, no queue in the plugin directory (currently 318 plugins waiting review). It should mean all of WordPress.org redesigned, instead of parts of the site in an old style. It should mean near-immediate responses on the aforementioned make/systems P2 blog. Even considering projects that “connect” into WordPress.org, like Playground and the Plugin Check plugin, 87 people is a lot.

Additionally, how do Automattic’s investors feel about Automattic employing 87 people to contribute to Mullenweg’s personal website? At present, Automattic lists 1,730 employees. This, in turn, means 5% of its employees^[1] are working on behalf of Mullenweg in his personal capacity as owner of WordPress.org. That’s not 5% devoted to the WordPress project, broadly, but specifically to WordPress.org, the website.

I have difficulty imagining that Abrahamson lied in his declaration to the court, especially since he declared the paragraph to be true “under penalty of perjury”, but this must conflate WordPress-the-software with WordPress.org-the-website, which is baffling in a court filing, especially when, in the sentence prior, Abrahamson explicitly separates the “WordPress software platform” from “www.WordPress.org.”

WordPress.org is tied to WordPress, unless you ask Automattic

The first half of Abrahamson’s declaration defines a number of key facts for the court, including who Abrahamson is, what WordPress is, what plugins and themes are, etc. In court filings, it’s important to establish facts, which the court will later rely on in making its ruling.

To be clear, the facts defined within Abrahamson’s declaration feel true and accurate.^[2] But, starting in paragraph 8, much of his statement feels to be lacking context that is critical to the underlying case. There are several sentences that I want to pull out below (my emphasis), but it’s definitely worth reading the entire declaration for context.

While developers may elect to submit plugins for publication on the Website Plugin Directory, this is not the only option for publishing or hosting the plugins they create.
 
With respect to plugins hosted on the Website, WordPress website users are able to update the plugins for their individual WordPress websites either manually or through automated options provided by certain hosting services for their convenience.
 
That Plugin Directory is publicly accessible, and does not require a Website account or login.
 
Alternatively, certain hosting services which assist users in supporting and optimizing their WordPress websites provide dashboards which allow users to manage and update their plugins from one centralized location. Rather than manually download and upload each desired plugin, they allow users to update their existing plugins with the click of a button. This is a matter of convenience for users.
 
These third party dashboards can function by linking to up-to-date plugin repositories from which they pull updated plugins. Those repositories may include the Website Plugin Directory, or any other repository of such plugins.
 
It is my understanding that prior to September 25, 2024, the dashboards on WPE customer’s WordPress websites were linked to the Website Plugin Directory, for purposes of downloading and updating plugins.
 
At no time, however, was WPE or its customers prevented from downloading plugins or associated updates from the Website via the manual process described above.
 
I also understand that WPE has been blocked from accessing certain developer resources on the Website would allow it to update the software behind plugins residing on the Website Plugin Directory. That block, however, in no way impacted WPE’s ability to update, modify or deploy those plugins from its own website or from other repositories where those plugins may reside.

The gist of Abrahamson’s declaration is that the WordPress.org Plugin Directory is only one such repository of plugins—that companies routinely use plugins from all over the Internet, from a variety of repositories—and that no login or registration is required to use the WordPress.org Plugin Directory—it’s publicly available and free to use.

By way of real world examples, it’s worth noting that both WordPress.com and WordPress.com VIP use plugins from Automattic’s GitHub, and likely use Composer (or something similar) to update and deploy those plugins. In fact, many enterprise WordPress installations use this method—this is the common and recommended approach for enterprise WordPress.

Taken at face value, everything said in this declaration is true. Yes, there are other places to get plugins from, both sourced from version control repositories like GitHub, and directly from plugin developers’ websites. And yes, downloading plugins directly from the WordPress.org Plugin Directory requires no registration, and is free for anyone, worldwide.

But, dear reader, something feels missing in this declaration… hmm… what could it be?

Whither thee, WordPress?

If you’ve ever used WordPress^[3], you’ve interacted with WordPress.org, either intentionally or unintentionally, in numerous ways.

On the intentional front, consider the deep integration with the WordPress theme and plugin directories.^[4] As an end user, I frequently install plugins via the integrated directory, using it to search, install, and update. I’ve used the theme directory to do the same.

Behind the scenes, however, WordPress integrates with WordPress.org in many, many other ways. First on the list might be update checks, which happen silently, sending information about every WordPress installation to WordPress.org. But consider the “WordPress Events and News” dashboard widget. Consider the About WordPress page, which pulls its images directly from WordPress.org. The relatively new font interface pulls its list of Google Fonts from WordPress.org. Hell, even emoji are served from WordPress.org.^[5]

We, the broader community, take these features for granted, without realizing the deep integration between WordPress and WordPress.org.^[6] But, so do end users.

I imagine the vast majority of WordPress’ users have no idea that WordPress integrates so deeply with WordPress.org and, if it was explained to them, would retort back, “so what?” They would be right. For a CMS to survive in the market today, specifically with an end user focus, these are features that must be included. Integration with a seemingly first-party service is mandatory, the bare minimum of an offering.

Put another way, end users see WordPress.org integration as part of the WordPress software offering. These two things are deeply coupled, and must be to deliver a product with mass market appeal.

All of this is what makes Abrahamson’s declaration so problematic.

In stating that WordPress.org’s plugin directory is just one of the many sources for plugins, Abrahamson glosses over—or intentionally omits—how deeply intertwined WordPress.org is within the WordPress product. In declaring:

It is my understanding that prior to September 25, 2024, the dashboards on WPE customer’s WordPress websites were linked to the Website Plugin Directory, for purposes of downloading and updating plugins.

… Abrahamson excludes the basic fact that virtually all WordPress websites are linked to the “Website Plugin Directory” for those purposes, and integrated with said “Website” in dozens of other material and immaterial ways, and avoids stating the plain truth: at its core, this is how WordPress is built.

It almost feels like Abrahamson’s declaration was made in some alternate universe, where WordPress does not exist in its present form and is instead a standalone software application with no ties to any API or website.

In a legal filing opposing the motion for a preliminary injunction, Automattic and Mullenweg wrote:

WP Engine conflates the open source WordPress software with a website located at wordpress.org (“Website”) that is provided by Matt. The Website is distinct from the WordPress open source software platform and both are distinct from Automattic and the WordPress Foundation, a nonprofit public benefit corporation that was organized exclusively for charitable, scientific and educational purposes, not commercial endeavors.

While it is now abundantly clear that Mullenweg fully controls WordPress.org, and has since its inception, I think this statement is factually inaccurate—it is not WP Engine who is conflating the open source WordPress software with WordPress.org, it is WordPress. The open source WordPress software has so deeply integrated WordPress.org that these two things are effectively one in the same—a single product with a software component and a web service component, no different from other major downloadable software today.

---

1. The magic number. Five for the Future of Matt Mullenweg. ↩︎

2. Well, except perhaps the 87 people that are allegedly working on WordPress.org. I know, I just spent seven paragraphs explaining my disbelief. But, here we are, and you’re still reading, so you might as well stick with me. 30 people built an entire barn in 10 hours. The first nuclear reactor, Chicago Pile-1, was built in under six months, by a team of 30. The Beatles (all four of them) recorded Sgt. Pepper’s Lonely Hearts Club Band in 129 days. Oh, and 359 people built 23 new websites across three days. ↩︎

3. And, if you haven’t, why are you reading this blog?! Literally all I’ve written about is WordPress. ↩︎

4. A key point that I’m certain will come up is the branding of these directories. It is not the “WordPress.org Plugin Directory” but, rather, the “WordPress Plugin Directory.” ↩︎

5. The deep integration happens before any consent is given as well. By default, during the installation process, WordPress makes an API call to WordPress.org to get a “salt”, and loads languages and language packs from WordPress.org as well. ↩︎

6. Andrew Norcross developed and maintains a WordPress plugin called Airplane Mode that is built to prevent WordPress from connecting to external servers, including WordPress.org and third party services like Gravatar. The core features of the plugin are over 1300 lines long. ↩︎