#232 – Aaron D Campbell on Navigating WordPress Security in the AI Era

Tiffany Farriss joined the podcast to talk about the sustainability issues affecting open source communities, drawing from her experience with the Drupal Association. Tiffany is currently the interim CEO of the Drupal Association, and is the organisation’s longest-serving board member after Drupal’s founder, Dries Buytaert. We examine how a small group of contributors often carry the bulk of financial and development responsibilities, while many users benefit without supporting the ecosystem. Tiffany outlined efforts to make these hidden costs transparent and to promote a utility-based funding model instead of relying on charity. We also covered Drupal's new certification program to publicly recognise meaningful contributions, as well as the increasing role of government procurement and cross-community collaboration in ensuring the resilience of open source projects.

The conversation focused on Martin Schmidt’s expertise in connecting WordPress plugin companies with web hosting providers. We discussed was how plugin creators frequently lack marketing strategies after product development. We also explored why partnering with hosts gives access to large customer bases and effective marketing channels. Martin also had advice on starting with smaller hosts, pitching clear value propositions, and preparing for outreach.

Today the podcast is focused on Scanfully, a WordPress site health and performance monitoring tool, detailing its evolution to version 2.0. We talk about how the tool is making complex site data accessible and actionable for users of all skill levels, from freelancers to agencies and hosts. We explored new features, including a public API, improved dashboards, human-readable alerts, and an MCP for AI-powered queries. Upcoming add-ons like WooCommerce checkout and form monitoring also got a mention, with emphasis on proactive site management and the importance of community-driven skill development in the WordPress ecosystem.

Data migration is under discussion in this episode thanks to Chris Huber, who brings tales from Automattic’s front lines. We explored how Data Liberation and the Static Site Importer give WordPress users the power to 'liberate' their sites from other platforms, any platform. One concept discussed was transforming any static HTML or existing site into a fully editable WordPress block theme, quirks and all. Innovations, roadblocks with WooCommerce and events, and collaboration hopes all got featured, with Chris adding a touch of behind-the-scenes geekery to the path toward more open and flexible web content.

The conversation focused on insights from the 2026 WordPress Security Survey by Melapress, featuring guest Robert Abela. We talked about persistent concerns among WordPress users, with 78 percent of survey participants expressing security worries and nearly 68 percent having experienced at least one security incident in the last year. The discussion explored the gap between high concern and limited preventative action, like recovery plans and team training. We also addressed escalating threats, particularly with new AI tools, while many sites, especially smaller ones, remain underprepared. We round it up with a call for improved prevention, monitoring, and recovery strategies in the WordPress ecosystem.

Today, I'm joined by Brian Coords from Automattic, and the podcast is focused upon the intersection of WordPress block themes, AI, and agency workflows, using the concept that "the site is the source of truth." We talk about the value of leveraging WordPress' built-in systems, like patterns and content guidelines, to ensure consistency and guide AI in content and design creation. We also explored challenges around plugin functionality, WooCommerce block theme development, and the evolving role of AI in website building versus human contribution. Towards the ens we get into the tension between innovation, plugin developers’ livelihoods, and the enduring human desire for purposeful platform engagement.

The conversation focused on Jetpack’s new podcasting features for WordPress, discussing how creators can now easily publish, distribute, and manage podcasts directly from their sites. We talk about the integration with newsletters and social sharing, enabling creators to distribute content through a single publish action. We also explore the advantages of WordPress ownership versus proprietary platforms like Substack, and highlighted Pocket Casts integration, simple setup, stats, and planned import/export tools. Go listen.

Today I'm talking with K. Adam White from Human Made about large-scale content migrations to WordPress’ block editor, especially for enterprise clients. We discuss the use of patterns and bespoke tooling to transfer complex layouts from other CMS platforms, like Sitecore, while maintaining editorial flexibility and brand consistency. We also get into the growing power of patterns and core blocks, as well as the enhanced role of AI in auditing and transforming content. The discussion explored challenges of permissions, workflow limitations, and Human Made’s approach to guiding clients through technical and editorial transitions for successful, scalable WordPress adoption.

The conversation focused on AI-assisted development in WordPress, exploring how large language models like Claude can be both powerful and unpredictable. We talked about the need for guardrails, structured project contracts and reviewer agents, to ensure outputs are reliable, secure, and accessible. We also explored the changing nature of developer work, the increasing playfulness and accessibility of technology, and the challenges of trusting AI-generated code. Several points were raised, including concerns about losing foundational skills, the future of developer roles, and the ongoing evolution of AI within the WordPress ecosystem. Go listen.

The conversation focused on the rapidly evolving landscape of WordPress security, emphasising the impact of AI on both attack complexity and defence strategies. We talked about the accelerating pace at which vulnerabilities are discovered and exploited, prompting the need for proactive, collaborative efforts within the WordPress and hosting communities. We also got into layered security, industry-wide information sharing, and the importance of open source in strengthening defences. Go listen...