Tips Tuesday – WordPress Security, AI SEO Markdown, FAIR Project Update
Tips this week include:
- Thank you for the donations!
- Imma video making maniac this week
- DIY SEO content revamp for AI SEO
- Joost steps away from plugin project
- WordPress is entering a new stage
- Changes to hosting promotion
- WordPress credits program in universities
- WordPress security report
- How I’m helping you stay safe
- The AI markdown debate continues
- The real cost of cheap offers on your site
- A little help with spotting AI buy buttons
- The return of Mr. Rodgers quiet teaching style
Happenings
Thank You!
Thank you to everyone who has made a donation to Tips Tuesday!!!
I so appreciate you helping me offset the cost of the additional reading and research time it takes to keep up with AI, SEO, Security, and so much more.
You can find the donation button anytime at the bottom of your Tips Tuesday email too.
Video Making Maniac
This week I’m deep into making videos for my new YouTube channel.
The Shorts that have been posting since December have flat-lined as far as new subscribers. And the watchtime decreases daily. That’s to be expected. YouTube gave them a big push at first, but now we’re down to regular discovery.
And this is the point where most folks get discouraged and quit. Nope, not me! I know better. This is the time to double-down and keep producing regularly. Y’all went through this same roller coaster with your blogs, remember? You got one big push and then it leveled off for a while. But, you kept producing and the traffic started going up again.
This week I’m making longer video tutorials that will be the real meat of the channel. They will be about 1.5 hours long and I will have at least 3 of them. That’s a LOT of editing time!!! (FYI, all of the similar tutorials that get millions of views are this length.)
Then I’ll have shorter ones that focus on a single tip, but I’ll be doing them in landscape, not vertical, to keep them out of Shorts.
I will be making teaser-type Shorts later. All of my instructional Shorts are getting good play on Instagram still. They produced crickets on TikTok, so I’m switching to just the teaser or scene type ones for that platform.
DIY SEO Content Revamp
Last week in the DIY SEO course live workshop we covered How to Write for AI SEO.
And the homework included reviewing the info in all 3 Content Refresh workshops.
So, we’re going to take a week off from live workshops to give everyone a chance to do their homework, which includes writing blog posts in a new style to attract AI crawler attention too.
We’ll check in next week to see how that’s going and look at more examples.
WordPress Tips
Joost Steps Away From Plugin Project
Remember last week when I reminded you of the FAIR project, where a bunch of WordPress OGs started a new repository for plugin and theme updates after Matt scared everyone with gatekeeping access and barring anyone who disagreed with him?
And I told you things seemed a little too quiet.
Well, a few days ago, Joost de Valk (the original dev of Yoast SEO) announced that he is stepping away from the FAIR project due to lack of interest and support.
Basically, funding is drying up because hosts, devs, and others who have a stake in all of this don’t want to commit to the risk of taking sides in the Mullenweg vs WP Engine fight.
Here’s why.
Nobody likes the current situation, but there is no winner in this fight no matter what the outcome is.
As Joost comments in his own announcement about it, there are PLENTY of hosts and others in the WP ecosystem who are making tons of money from WP, but not paying their fair share for continued development and support. This goes way beyond WP Engine not paying what Matt considers are their “dues” of giving back to the WP community.
And the longer the lawsuits drag out, the more likely the FAIR project will totally fold, especially with Joost stepping away.
I’ll keep up with the news and will let you know when there is movement, and how it will affect us. But my bet is that this thing is over and we’ll be sticking with what we have now.
WordPress is Entering a New Stage
Matt Cromwell is one of the most beloved OGs in WordPress. So, his perspective on the current state of the WP ecosystem is filled with deep insight.
While some folks say that WP is old and dying, Matt says WordPress Faces an Event Horizon, Not a Sunset.
He says that competition and AI are changing the physics of WP. So, the future of it comes down to whether devs adapt to the changes or not.
Honestly, when I see AI-coded sites, plus ad after ad about how you can whip up a site in 10 minutes, I just shake my head.
You and I know how much more powerful our sites are with all the integrated functions we have available with WordPress. If a pretty site with a buy button were all there was to it, sure, you could have AI code it for you.
But we know how much more it takes to be successful.
I’m guessing the pendulum will have to swing hard toward vibe-coded sites for a while before new site owners figure it out the hard way.
At least they will not have invested much time and money into that failure ;-)
Changes to Hosting Promotion
All of this new AI site competition gives hosts, and others, even more reason not to “pay dues” to keep the WP foundation going.
Instead of promoting that their hosting is optimized for WP, they may want to start advertising that it is AI friendly.
Personally, I don’t want my sites to be anywhere near a host that starts running in that direction. And if all of them start going that way, I hope that they at least keep the WP sites on separate servers than the ones running AI, or force those AI site owners to get their own VPS, which is their own little piece of cloud hosting.
WordPress Credits Program in Universities
The future of WP is not up to the OGs anymore, and they know it.
That has everything to do with why a new program has been started to bring in new blood.
In this interview on the WP Minute, they discuss how the WordPress Credits Program is giving real-world, hands-on education to the next generation of open-source devs, while they are also learning how to contribute to the future of WP.
This program is going into universities and reaching those who will shape the future of every platform used on the internet, not just WP.
Considering these folks have so much AI assistance available to them, I’m thinking that coding and function breakthroughs are going to come faster than ever.
WordPress Security Report
Patchstack makes security scanning software that many popular hosts run to detect issues that make the whole server vulnerable to attack. That includes sites that have been compromised in ways that give hackers a back door from the site into the server where they can hit more sites or use the server’s resources for attacking other entities.
About this time of year, Patchstack releases a report that summarizes the security issues they found over the previous year and what they anticipate will be an issue for the current year.
A few things in their State of WordPress Security for 2026 report stood out to me.
- The number of easy-to-exploit vulnerabilities rose by 113% in 2025.
- A full 46% of those high-priority vulnerabilities were not patched by the time the info became public, which gave hackers an extra opportunity to exploit them.
- The median time for mass exploitation once an issue has been found/reported is down from days to just 5 hours.
- More high-vulnerability issues were found in 2025 than in the 2 previous years combined. Most of these came from premium plugins, especially those from Evanto, where white-hat hackers can’t check them for vulnerabilities and report and fix them for a bug bounty reward. (33 of these plugins had Zero-day programs in them.)
- Attackers have pivoted from full-on frontal attacks to complex, multi-stage attacks. This helps them fly under the radar of detection software.
Here’s the big one:
- WP integrating with AI is increasing the attack surface area. This will require completely new ways to protect the site.
Unfortunately, several of the popular plugins and themes we use are integrating AI like crazy.
I’m going to have to start checking into how they are connecting to our sites and to see if there is a way to turn off that connection. I would love to be able to turn off the entire integration, but that’s probably asking for too much.
How I’m Helping You Stay Protected
All of the above is exactly why I do audits on my client’s sites every 6 months.
It’s why I’m so careful to remove orphaned files, folders, and database tables of plugins and themes that are no longer in use.
And it’s why I check that any uncommon plugins in use are still in active development – that’s especially true with premium plugins that are not in the WP repository and don’t show a public changelog.
And this is why we’re doing a super deep clean of WP and certain database tables this year.
AI SEO
The AI Markdown Debate Continues
The past 2 workshops in the DIY SEO course covered the “do this, not that” of using markdown and .txt files to help AI bots make sense of the content on your site without getting lost in all the markup of JS and CSS and other formatting.
I gave course members the reasons why we should hold off using some of these methods for now, not the least of which are because there is no standard, but also because of the way black-hat SEOs are using them to game the system, and that will backfire at some point.
But, that doesn’t mean that more options for doing them are slowing down.
The Codex app has been introduced by OpenAI to manage complex AI agent tasks, like those needed for crawling sites.
Matt Mullenweg has proposed a native WP markdown function to help AI crawlers glean just the content.
A few weeks ago I told you about the new NLWeb standard that is being developed and why it will likely be a far better alternative to llm.txt.
And while all of these new things look promising, there is one huge caveat.
Google’s John Mueller says that any type of markdown is going to increase crawl budget.
And that’s the bottom line, literally.
Google has THE deepest search engine, by far, because they have forever outspent their competition in the sheer number of crawls they do – every day.
If we do anything that makes them spend more money, and lose more time crawling our site, how favorable do you think they’re going to look on that?
Right!!
And this is the main reason we are sitting out this dance until the music changes.
The Real Cost of Cheap Offers On Your Site
It’s an AI agent in the browser that can take actions on sites, like booking a flight or such.
It also comes with a warning that it has security risks if misconfigured.
Y’all, this is the future of e-commerce.
And eventually, all platforms are going to include buy buttons and such that an AI agent can understand and take actions on.
I am SUPER concerned for Shopify and other e-comm platforms when they introduce this function – and you know they will eventually.
Why Not to Offer a $1 Product
Even without this AI buy button, there are bot risks.
I have one client that got a flood of bot purchases on a low-dollar, entry product, and then she got hit with tons of chargebacks. They were basically using the $1 product to test stolen credit card info. And each chargeback cost $$$.
This is another reason why stupid cheap products are no longer a good idea. If you put a price on it, then charge enough that someone has to put skin in the game to get it. Those are your peeps.
Browser agents are simply going to speed up bad bot hits like that. And I suspect hacking won’t be the main problem with them when it starts happening. Some folks are going to be in for a VERY expensive learning curve.
A Little Help, Please
I need your help with keeping an eye out for any WP buttons that are “AI Agent friendly”.
I’m betting some block plugins will jump on this trend well ahead of WP making it a native button function.
When it does hit, let’s hope they make it an option that is turned off by default. But let’s not take that for granted!!
Google Patent for Custom AI Pages
Remember when Google started showing Featured Snippets that had info taken directly off a site, yet they gave no link to that article?
It took a major outcry from publishers, and then a lawsuit to get Google to include the citation.
The same thing happened when Google introduced AI Overviews. They didn’t include citation links until publishers jumped up and down about it and threatened lawsuits.
Well, this may be the next iteration of that game.
Basically, Google will determine on the fly if the website with the info has structured it in a way that best satisfies the query intent.
If Google decides that they can summarize or present that info better, then they will generate an AI page with their version of the info.
Now, just because Google has this patent doesn’t mean that they will actually roll this thing out. But I most certainly would not put it past them!!!
And I think this may be modified to present product inquiry results – sort of like a review page of the product.
If they do something like that, I’m betting review sites are going to be hopping mad. But considering how many of those sites have review summaries that were written by folks who have never used the products, I’m betting those sites won’t have a leg to stand on for complaining.
FYI, the Google’s Product Reviews Updates that rolled out from 2021-2023 were supposed to clear the rankings of these summary review sites, but there are still plenty of them showing at the top of search even now.
Video Tips
The Return of Mr. Rodgers Quiet Teaching Style
I am really inspired by this interview with Children’s Emmy nominations Ms. Rachel and Mr. Aron.
They have proved that you don’t need a big studio or flashy, quick-changing graphics, to produce a quality show.
They have returned to a no-sensory-overload format, like Mr. Rodgers, to help kids learn new social skills and how to make friends.
They started their YouTube show in their living room.
And what they shared became a safe screen-time activity for kids everywhere.
This is a testament to keeping it simple and keeping it real and serving an audience in a way that is good for them. And that Emmy nomination just validates it.
I hope it inspires you too!!!
I have clients who take me for a peaceful walk in their gardens and share life happenings in a very relaxed way. One of those clients just passed 300k YT subscribers and has turned video into a full-time income.
Video doesn’t have to be flashy or perfect. The best ones are just real people sharing with others something they enjoy.
Hi MaAnna
Wow this is an incredibly comprehensive report thanks.
Word press is basically too complicated now to maintain and run safely
by the average person – it cannot be done unless they have a person in their camp like you.
And that is why WP will continue to fade and the masses (like me) will just say “too hard”
and move to systems run by people that provide the full suite of business digital needs and tools with security provided by and within the system.
Just look at the “State of WordPress Security” and see the vulnerabilities and exploitation that is increasing rapidly as time goes by.
So, the scammers, attackers and hackers are getting smarter and finding it easier to break into the WP systems because it is SO complicated and complex with the amount of security protections and plugins you need to make it work – without losing your own business..
Whereas we, the non programmers cant even attempt to understand and keep up with what is necessary to protect ourselves.
That is why I think WP will fall.
Google puts more nails into the coffin as they take your digital creations and work for their own use and AI and do not credit or link to the creator.
Not trying to be pessimistic but that is how I see things.
Bill
William, I understand where you’re coming from. But your premise rests on never hearing about the issues that other platforms have, thus there aren’t any. FAR FROM IT!!!!!!
Remember when I offered the Shopify courses on eCreatorsHub? I thought I was going to also move into doing SEO and speed and such on those sites for folks too because they were hiring agencies to speed up their sites every 3 months. Once I had a look at the code, I ran – fast!!!! It’s a hot mess!! Nothing is standardized or modular. Functions that should be plugins are hard coded into the theme. You can’t even change themes without having to pay a dev to recode everything.
They don’t have open source for anything, like WP does. And they certainly don’t have a whole white-hat dev community and agencies that make a living on bug bounties. Did you notice in the Patchstack report that most of the issues with plugins, including all of the Zero-day ones, were private, paid plugins from a platform that doesn’t check the code for vulnerabilities?
I guarantee that WP is no more complex than the other platforms. Actually, is way more standardized and modular, making it super simple for us to use the themes and plugins that get us the best results, and from devs who are held to a standard of compatibility, and routinely checked for issues.
The main reason WP is attacked is because of its huge footprint online. But, even when 100k sites get hit with something, that’s barely a drop in the bucket of how many WP sites there are. If 100k get hit on Shopify, that’s a much bigger percentage of users.
There really aren’t many platforms where site owners are not having to pay for more advanced help, at least among site owners who are making a real living at it.
So, I don’t think WP is going to fail, not by a long shot. What I do think is that we have to adapt to the current reality of the internet and AI. Remember over a decade ago when hosts were being brought to their knees for weeks from DDoS attacks? We had to adapt then too. In fact, that was THE biggest pivot in my business. I went from teach WP basics to helping folks with SEO, speed, and security. And I’ve been doing those things ever since.
As far as Google putting the nail in the coffin for digital creators, I’ve been jumping up and down for the last 15 years about Google treating all of us like we are their staff writers. As far as this latest shift with AI, that pendulum is going to swing back from the novelty entertainment to people wanting to connect with other people again. I think video is going to lead the way with that – just like I’ve been preaching for the last 6 years. But written content will still have a place online.