WordPress

WordPress (WP, or WordPress.org) is a web content management system. It was originally created as a tool to publish blogs but has evolved to support publishing other web content, including more traditional websites, mailing lists, Internet forums, media galleries, membership sites, learning management systems, and online stores. Available as free and open-source software, WordPress is among the most popular content management systems – it was used by 22.52% of the top one million websites Template:As of.<ref name="Usage of content management systems for websites">Template:Cite web</ref><ref name="BuiltWith">Template:Cite web</ref>

WordPress is written in the PHP programming language and paired with a MySQL or MariaDB database.<ref>Template:Cite web</ref> Features include a plugin architecture and a template system, known as “themes”. Since 2018, WordPress has included a block-based editor (“Gutenberg”).

To function, WordPress has to be installed on a web server, either as part of an Internet hosting service or on a personal computer.<ref>Template:Cite web</ref>

WordPress was first released on May 27, 2003, by its founders, American developer Matt Mullenweg and English developer Mike Little.<ref>Template:Cite web</ref> The WordPress Foundation owns WordPress, WordPress projects, and other related trademarks.<ref name="Trademark Policy">Template:Cite web</ref>

Overview

File:Wp-twentyten.jpg

A WordPress blog, using the default theme in 2010.

"WordPress is a factory that makes webpages"<ref>Template:Cite web</ref> is a core analogy designed to clarify the functions of WordPress: it stores content and enables a user to create and publish webpages, requiring nothing beyond a domain and a hosting service.

WordPress has a web template system using a template processor. Its architecture is a front controller, routing all requests for non-static URIs to a single PHP file that parses the URI and identifies the target page. This allows support for more human-readable permalinks.<ref>Template:Cite news</ref>

Themes

WordPress users may install and switch among many different themes. Themes allow users to change the look and functionality of a WordPress website without altering the core code or site content. Custom code can be added to the website by using a child theme or through a code editor. Every WordPress website requires at least one theme to be present. Themes may be directly installed using the WordPress "Appearance" administration tool in the dashboard, or theme folders may be copied directly into the themes directory.<ref>Template:Cite web</ref> WordPress themes are generally classified into two categories: free and premium. Many free themes are listed in the WordPress theme directory (also known as the repository), and premium themes are available for purchase from marketplaces and individual WordPress developers. WordPress users may also create and develop their own custom themes and upload them in the WordPress directory or repository.<ref>Template:Cite web</ref>

Plugins

WordPress' plugin architecture allows users to extend or depreciate the features and functionality of a website or blog.<ref>Template:Cite web</ref><ref>Template:Cite web</ref> Template:As of, WordPress.org has 59,756 plugins available,<ref>Template:Cite web</ref> each of which offers custom functions and features enabling users to tailor their sites to their specific needs. However, this does not include the available premium plugins (approximately 1,500+), which may not be listed in the WordPress.org repository. These customizations range from search engine optimization (SEO) to client portals used to display private information to logged-in users, to content management systems, to content displaying features, such as the addition of widgets and navigation bars. Not all available plugins are always abreast with the upgrades, and as a result, they may not function properly or may not function at all. If the plugin developer has not tested the plugin with the last two major versions of WordPress, a warning message will be displayed on the plugin directory, informing users that the plugin may not work properly with the latest WordPress version.<ref>Template:Cite web</ref> Most plugins are available through WordPress themselves, either via downloading them and installing the files manually via FTP or through the WordPress dashboard. However, many third parties offer plugins through their websites, many of which are paid packages.

Web developers who wish to develop plugins need to learn WordPress' hook system, which consists of over 2,000 hooks (as of Version 5.7 in 2021)<ref>Template:Cite web</ref> divided into two categories: action hooks and filter hooks.<ref>Template:Cite web</ref>

Plugins also represent a development strategy that can transform WordPress into all sorts of software systems and applications, limited only by the imagination and creativity of programmers. These are implemented using custom plugins to create non-website systems, such as headless WordPress applications and Software as a Service (SaaS) products.

Plugins could also be used by hackers targeting sites that use WordPress, as hackers could exploit bugs in WordPress plugins instead of bugs in WordPress itself.<ref>Template:Cite web</ref>

Mobile applications

Phone apps for WordPress exist for Android,<ref>Template:Cite web</ref> iOS,<ref name="altafsayani">Template:Cite web</ref><ref name="post">Template:Cite news</ref>.These applications, designed by Automattic, have options such as adding new blog posts and pages, commenting, moderating comments, replying to comments in addition to the ability to view the stats.<ref name="altafsayani" /><ref name="post" />

Accessibility

The WordPress Accessibility Coding Standards state that "All new or updated code released in WordPress must conform with the Web Content Accessibility Guidelines 2.0 at level AA."<ref>Template:Cite web</ref>

Other features

WordPress also features integrated link management, a search engine–friendly, clean permalink structure; the ability to assign multiple categories to posts; and support for tagging of posts. Automatic filters are also included, providing standardized formatting and styling of text in posts (for example, converting regular quotes to smart quotes). WordPress also supports the trackback and pingback standards for displaying links to other sites that have themselves linked to a post or an article. WordPress posts can be edited in HTML, using the visual editor, or using one of several plugins that allow for a variety of customized editing features.

Multi-user and multi-blogging

Before version 3, WordPress supported one blog per installation, although multiple concurrent copies may be run from different directories if configured to use separate database tables. WordPress Multisites (previously referred to as WordPress Multi-User, WordPress MU, or WPMU) was a fork of WordPress created to allow multiple blogs to exist within one installation but can be administered by a centralized maintainer. WordPress MU makes it possible for those with websites to host their own blogging communities, as well as control and moderate all the blogs from a single dashboard. WordPress MU adds eight new data tables for each blog.

As of the release of WordPress 3, WordPress MU has merged with WordPress.<ref>Template:Cite web</ref>

History

b2/cafelog, more commonly known as b2 or catalog, was the precursor to WordPress.<ref>Template:Cite AV media</ref> b2/cafelog was estimated to have been installed on approximately 2,000 blogs as of May 2003.<ref>Template:Cite web</ref> It was written in PHP for use with MySQL by Michel Valdrighi, who was a contributing developer to WordPress until 2005. Although WordPress is the official successor, another project, b2evolution, is also in active development.

As the development of b2/cafelog slowed down, Matt Mullenweg began pondering the idea of forking b2/cafelog and new features that he would want in a new CMS, in a blog post written on January 24, 2003.<ref name="matt-blog-2003-01-24">Template:Cite web</ref> Mike Little, a professional developer, became the first to comment on the blog post expressing interest to contribute.<ref name="matt-blog-2003-01-24" /><ref>Template:Cite tweet</ref> The two worked together to create the first version of WordPress, version 0.70,<ref>Template:Cite web</ref> which was released on May 27, 2003.<ref>Template:Cite web</ref> Christine Selleck Tremoulet, a friend of Mullenweg, suggested the name WordPress.<ref>Template:Cite web</ref><ref>Template:Cite web</ref>

In 2004, the licensing terms for the competing Movable Type package were changed by Six Apart, resulting in many of its most influential users migrating to WordPress.<ref>Template:Cite web</ref><ref>Template:Cite web</ref> By October 2009, the Open Source CMS MarketShare Report concluded that WordPress enjoyed the greatest brand strength of any open-source content management system.

Template:As of, WordPress was used by 62.0% of all the websites whose content management system is known, and 22.52% of the top one million websites.<ref name="Usage of content management systems for websites" /><ref name="BuiltWith" />

Starting September 2024, Mullenweg engaged WordPress, Wordpress.com, and Automattic in a dispute leading to a lawsuit with hosting company WP Engine, causing widespread community concern.<ref name="engine">Template:Citation</ref>

Awards and recognition

• Winner of InfoWorld's "Best of open source software awards: Collaboration", awarded in 2008.<ref name="award 2008">Template:Cite web</ref>
• Winner of Open Source CMS Awards's "Overall Best Open Source CMS", awarded in 2009.<ref name="Open Source CMS 2009">Template:Cite web</ref>
• Winner of digital synergy's "Hall of Fame CMS category in the 2010 Open Source", awarded in 2010.<ref name="bossie 2010">Template:Cite web</ref>
• Winner of InfoWorld's "Bossie award for Best Open Source Software", awarded in 2011.<ref name="bossie 2011">Template:Cite web</ref>

Release history

Main releases of WordPress are codenamed after well-known jazz musicians, starting from version 1.0.<ref>Template:Cite web</ref><ref>Template:Cite web</ref>

Although only the current release is officially supported, security updates are backported "as a courtesy" to all versions as far back as 4.0.<ref>Template:Cite web</ref>

Version<ref>WordPress Releases</ref>	Codename	Release date<ref>WordPress History</ref>	Notes
Template:Version	Template:NA	May 27, 2003<ref>Template:Cite web</ref>	Used the same file structure as its predecessor, b2/cafelog, and continued the numbering from its last release, 0.6.<ref>Template:Cite web</ref> Only 0.71-gold is available for download in the official WordPress Release Archive page.
Template:Version	Davis	January 3, 2004<ref>Template:Cite web</ref>	Added search engine-friendly permalinks, multiple categories, dead-simple installation, and upgrade, comment moderation, XFN support, and Atom support.
Template:Version	Mingus	May 22, 2004<ref>Template:Cite web</ref>	Added support of Plugins; in which the same identification headers are used unchanged in WordPress releases Template:As of.
Template:Version	Strayhorn	February 17, 2005<ref>Template:Cite web</ref>	Added a range of vital features, such as the ability to manage static pages and a template/Theme system. It was also equipped with a new default template (codenamed Kubrick).<ref>Template:Cite web</ref> designed by Michael Heilemann.
Template:Version	Duke	December 31, 2005<ref>Template:Cite web</ref>	Added rich editing, better administration tools, image uploading, faster posting, improved import system, fully overhauled the back end, and various improvements to Plugin developers.
Template:Version	Ella	January 22, 2007<ref>Template:Cite web</ref>	Corrected security issues, a redesigned interface, enhanced editing tools (including integrated spell check and auto save), and improved content management options.
Template:Version	Getz	May 16, 2007<ref>Template:Cite web</ref>	Added widget support for templates, updated Atom feed support, and speed optimizations.
Template:Version	Dexter	September 24, 2007<ref>Template:Cite web</ref>	Added native tagging support, new taxonomy system for categories, and easy notification of updates, fully supports Atom 1.0, with the publishing protocol, and some much-needed security fixes.
Template:Version	Brecker	March 29, 2008<ref>Template:Cite web</ref>	Major revamp to the dashboard, dashboard widgets, multi-file upload, extended search, improved editor, an improved plugin system, and more.
Template:Version	Tyner	July 15, 2008<ref>Template:Cite web</ref>	Added new features that made WordPress a more powerful CMS: it can now track changes to every post and page and allow easy posting from anywhere on the web.
Template:Version	Coltrane	December 11, 2008<ref>Template:Cite web</ref>	Administration interface was redesigned fully, added automatic upgrades, and installed plugins, from within the administration interface.
Template:Version	Baker	June 10, 2009<ref>Template:Cite web</ref>	Added speed improvements, automatically installing themes from within the administration interface, introducing the CodePress editor for syntax highlighting, and a redesigned widget interface.
Template:Version	Carmen	December 19, 2009<ref>Template:Cite web</ref>	Added global undo, built-in image editor, batch plugin updating, and many less visible tweaks.
Template:Version	Thelonious	June 17, 2010<ref>Template:Cite web</ref>	Added new theme APIs, merged WordPress and WordPress MU, creating the new multi-site functionality, new default theme "Twenty Ten" and a refreshed, lighter admin UI.
Template:Version	Reinhardt	February 23, 2011<ref>Template:Cite web</ref>	Added the Admin Bar, which is displayed on all blog pages when an admin is logged in, and Post Format, best explained as a Tumblr-like micro-blogging feature. It provides easy access to many critical functions, such as comments and updates. Includes internal linking abilities, a newly streamlined writing interface, and many other changes.
Template:Version	Gershwin	July 4, 2011<ref>Template:Cite web</ref>	Focused on making WordPress faster and lighter. Released only four months after version 3.1, reflecting the growing speed of development in the WordPress community.
Template:Version	Sonny	December 12, 2011<ref>Template:Cite web</ref>	Focused on making WordPress friendlier for beginners and tablet computer users.
Template:Version	Green	June 13, 2012<ref>Template:Cite web</ref>	Focused on improvements to theme customization, Twitter integration and several minor changes.
Template:Version	Elvin	December 11, 2012<ref>Template:Cite web</ref>	Support for the Retina Display, color picker, a new default theme "Twenty Twelve", improved image workflow.
Template:Version	Oscar	August 1, 2013<ref>Template:Cite web</ref>	New default theme "Twenty Thirteen", admin enhancements, post formats UI update, menus UI improvements, new revision system, autosave, and post locking.
Template:Version	Basie	October 24, 2013<ref>Template:Cite web</ref>	Automatically apply maintenance and security updates in the background, stronger password recommendations, and support for automatically installing the right language files and keeping them up to date.
Template:Version	Parker	December 12, 2013<ref>Template:Cite web</ref>	Improved admin interface, responsive design for mobile devices, new typography using Open Sans, admin color schemes, redesigned theme management interface, simplified main dashboard, "Twenty Fourteen" magazine-style default theme, second release using "Plugin-first development process".
Template:Version	Smith	April 16, 2014<ref>Template:Cite web</ref>	Improvements to the editor for media, live widget and header previews, and new theme browser.
Template:Version	Benny	September 4, 2014<ref>Template:Cite web</ref>	Improved media management, embeds, writing interface, easy language change, theme customizer, plugin discovery, and compatibility with PHP 5.5 and MySQL 5.6.<ref>Template:Cite web</ref>
Template:Version	Dinah	December 18, 2014<ref name="wordpress1">Template:Cite web</ref>	Twenty Fifteen as the new default theme, distraction-free writing, easy language switch, Vine embeds, and plugin recommendations.
Template:Version	Powell	April 23, 2015<ref>Template:Cite web</ref>	New "Press This" features, improved characters support, emoji support, improved customizer, new embeds, and updated plugin system.
Template:Version	Billie	August 18, 2015<ref>Template:Cite web</ref>	Focus on the mobile experience, better passwords, and improved customizer.
Template:Version	Clifford	December 8, 2015<ref>Template:Cite web</ref>	Introduction of "Twenty Sixteen" theme, and improved responsive images and embeds.
Template:Version	Coleman	April 12, 2016<ref>Template:Cite web</ref>	Added inline linking, formatting shortcuts, live responsive previews, and other updates under the hood.
Template:Version	Pepper	August 16, 2016<ref>Template:Cite news</ref>	Added streamlined updates, native fonts, editor improvements with inline link checker and content recovery, and other updates under the hood.
Template:Version	Vaughan	December 6, 2016<ref>Template:Cite web</ref>	Comes with new default theme "Twenty Seventeen", Video Header Support, PDF preview, custom CSS in the live preview, editor Improvements, and other updates under the hood.
Template:Version	Evans	June 8, 2017<ref>Template:Cite web</ref>	The next-generation editor. Additional specific goals include the TinyMCE inline element/link boundaries, new media widgets, and WYSIWYG in the text widget. End Support for Internet Explorer Versions 8, 9, and 10.
Template:Version	Tipton	November 16, 2017<ref>Template:Cite web</ref>	Improved theme customizer experience, including scheduling, frontend preview links, autosave revisions, theme browsing, improved menu functions, and syntax highlighting. Added a new gallery widget and updated text and video widgets. Theme editor gives warnings and rollbacks when saving files that produce fatal errors.<ref>Template:Cite web</ref>
Template:Version	Bebo	December 6, 2018<ref>Template:Cite web</ref>	New block-based editor Gutenberg<ref>Template:Cite web</ref> with new default theme "Twenty Nineteen".
Template:Version	Betty	February 21, 2019<ref>Template:Cite web</ref>	PHP version upgrade notices and block editor improvements.
Template:Version	Jaco	May 7, 2019<ref>Template:Cite web</ref>	Include Site Health Check, PHP error protection, the all-new block directory, and update package signing.
Template:Version	Kirk	November 12, 2019<ref>Template:Cite news</ref>	Polish current user interactions and make user interfaces more user-friendly. New default theme "Twenty Twenty", was designed by Anders Norén.
Template:Version	Adderley	March 31, 2020<ref>Template:Cite web</ref>	Social Icons and Buttons blocks added, blocks customization and user interface improved, added features for personal data exports, custom fields for menu items, blocks improvements for developers.<ref>Template:Cite web</ref>
Template:Version	Eckstine	August 11, 2020<ref>Template:Cite web</ref>	Added lazy-loading images, XML sitemaps by default, auto-updates to plugins and themes, and improvements to the block editor.<ref>Template:Cite web</ref>
Template:Version	Simone	December 8, 2020<ref>Template:Cite news</ref>	New default theme "Twenty Twenty-One," Gutenberg enhancements, automatic updates for core releases, increased support for PHP 8, application passwords for REST API authentication, improved accessibility.<ref>Template:Cite news</ref>
Template:Version	Esperanza	March 9, 2021<ref>Template:Cite news</ref>	New editor is easier to use, do more without writing custom code, simpler default color palette, from HTTP to HTTPS in a single click, new Robots API, lazy-load your iframes and ongoing cleanup after update to jQuery 3.5.1.<ref>Template:Cite news</ref>
Template:Version	Tatum	July 20, 2021<ref>Template:Cite web</ref>	Block widgets, query loop blocks, block themes, List View, Pattern Transformations, Duotone, new theme.json file, dropped IE11 support, WebP image support, new block support flags.<ref>Template:Cite news</ref>
Template:Version	Joséphine	January 25, 2022<ref>Template:Cite web</ref>	New default theme "Twenty Twenty-Two", new WordPress Admin feature Site Editor, Block Themes manageable through Site Editor, new Navigation block, improved block controls, Pattern Directory, List View, refactored Gallery block, Theme.json child theme support, block-level locking, multiple stylesheets per block.<ref>Template:Cite news</ref>
Template:Version	Arturo	May 24, 2022<ref>Template:Cite web</ref>	Gutenberg writing improvements, multiple style variations and expanded template options for block themes, integrated patterns, additional design tools, multiple block selections from the list view, block locking, and various performance, and accessibility improvements.<ref>Template:Cite news</ref>
Template:Version	Misha	November 1, 2022<ref>Template:Cite web</ref>	Gutenberg writing improvements, design tools for more consistency and control, cleaner layouts and document settings visualization, menu management, fluid typography, improved block placeholders, and spacing presets.<ref>Template:Cite news</ref>
Template:Version	Dolphy	March 29, 2023<ref>Template:Cite web</ref>	Reimagined Site Editor interface, improved Navigation block, Block Inserter, and organized block settings sidebar with tabs for Settings and Styles. A collection of header and footer patterns for block themes is also available, as well as Openverse media integration and Distraction Free mode for writing. The new Style Book provides a complete overview of how each block in the site's library looks, and users can now copy and paste styles and add custom CSS for more control over their site's appearance. Other features include sticky positioning for top-level group blocks, options to import favorite widgets from Classic themes, and local fonts in default WordPress themes for better privacy with Google Fonts included.<ref>Template:Cite web</ref>
Template:Version	Lionel	August 8, 2023<ref>Template:Cite web</ref>	Full content management through Site Editor, Block Theme preview, new My Patterns section for saved block arrangements, template and editor preference management via Command Palette, improved design tools and workflow, new Footnotes and Details block, performance and accessibility improvements. Image aspect ratio settings, distraction-free editing for Site Editor, updated Top Toolbar, improved List View, pattern template building.<ref>Template:Cite web</ref>
Template:Version	Shirley	November 7, 2023<ref>Template:Cite web</ref>	New default theme "Twenty Twenty-Four," writing enhancements, improved Command Palette, advanced Pattern filtering, expanded Block design tools, image lightbox functions, Group block renaming, image previews in List View, export custom patterns as JSON files, new Block Hooks feature, and various performance and accessibility improvements.<ref>Template:Cite web</ref>
Template:Version	Regina	April 2, 2024<ref>Template:Cite web</ref>	Google Fonts management via Font Library, view timestamps, quick summaries, and revision history via Style Book, enhanced background tools, aspect ratios, and box shadows for Block layouts and groups, Data views, enhanced drag-and-drop, improved link controls, new Interactivity and Block Bindings API's, new appearance tools for Classic themes without using theme.json, Plugin Dependencies, and various performance and accessibility improvements.<ref>Template:Cite web</ref>
Template:Version	Dorsey	July 16, 2024<ref>Template:Cite web</ref>	Additional color palette and font set choices, quick previews for pages, rollbacks for automatic plugin updates, Block style overrides, and various performance and accessibility improvements.<ref>Template:Cite web</ref>
Template:Version	Rollins	November 12, 2024<ref>Template:Cite web</ref>	New default theme "Twenty Twenty-Five," Zoom Out preview, custom fields for Blocks, font size presets for Styles, HEIC image support, and various performance and accessibility improvements.<ref>Template:Cite web</ref>
Template:Version	Cecil	April 15, 2025<ref>Template:Cite web</ref>	Style Book update, editor improvements, speculative loading, stronger password security with bcrypt.<ref>Template:Cite web</ref>
Template:Version

WordPress 5.0 "Bebo"

File:WordPress PostEdit.png

New page editor in WordPress 5

The December 2018 release of WordPress 5.0, "Bebo", is named in homage to the pioneering Cuban jazz musician Bebo Valdés.<ref>Template:Cite web</ref>

It included a new default editor "Gutenberg" – a block-based editor; that allows users to modify their displayed content in a much more user-friendly way than prior iterations. Blocks are abstract units of markup that, composed together, form the content or layout of a web page.<ref>Template:Cite web</ref> Past content that was created on WordPress pages is listed under what is referred to as a Classic Block.<ref>Template:Cite web</ref> Before Gutenberg, there were several block-based editors available as WordPress plugins, e.g. Elementor. Following the release of Gutenberg, comparisons were made between it and those existing plugins.<ref>Gutenberg vs Elementor: Comparing The New WordPress Block Editor To Elementor, CREATE & CODE, December 5, 2018</ref><ref>Gutenberg vs. Elementor: ThemeIsle Actually Attempted to Build Their New Site With Both — Here’s What Happened Template:Webarchive, Elementor.com, February 6, 2020</ref>

Classic Editor plugin

The Classic Editor plugin was created as a result of User preferences and helped website developers maintain past plugins only compatible with WordPress 4.9, giving plugin developers time to get their plugins updated & compatible with the 5.0 release. Having the Classic Editor plugin installed restores the "classic" editing experience that WordPress has had up until the WordPress 5.0 release.<ref>Template:Cite web</ref> The Classic Editor plugin will be supported at least until 2024.<ref>Template:Cite web</ref>

As of August 2023, the Classic Editor plugin is active on over 5 million installations of WordPress.<ref>Template:Cite web</ref>

Vulnerabilities

File:Apache Log.png

Apache HTTP Server access log, showing visits to the WordPress login.

Many security issues<ref>Template:Cite web</ref> have been uncovered and patched in the software, particularly in 2007, 2008, and 2015. A cumulative list of WordPress security vulnerabilities, not all of which have been corrected in the version current at any time, is maintained by SecurityScorecard.<ref>Template:Cite web Updated as required.</ref>

In January 2007, many high-profile search engine optimization (SEO) blogs, as well as many low-profile commercial blogs featuring AdSense, were targeted and attacked with a WordPress exploit.<ref>Template:Cite web</ref> A separate vulnerability on one of the project site's web servers allowed an attacker to introduce exploitable code in the form of a back door to some downloads of WordPress 2.1.1. The 2.1.2 release addressed this issue; an advisory released at the time advised all users to upgrade immediately.<ref>Template:Cite web</ref>

In May 2007, a study revealed that 98% of WordPress blogs being run were exploitable because they were running outdated and unsupported versions of the software.<ref>Template:Cite web</ref> To help mitigate this problem, WordPress made updating the software a much easier, "one-click" automated process in version 2.7 (released in December 2008).<ref>Template:Cite web</ref> However, the filesystem security settings required to enable the update process can be an additional risk.<ref>Template:Cite web</ref>

In a June 2007 interview, Stefan Esser, the founder of the PHP Security Response Team, spoke critically of WordPress' security track record, citing problems with the application's architecture that made it unnecessarily difficult to write code that is secure from SQL injection vulnerabilities, as well as some other problems.<ref>Template:Cite web</ref>

In June 2013, it was found that some of the 50 most downloaded WordPress plugins were vulnerable to common Web attacks such as SQL injection and XSS. A separate inspection of the top 10 e-commerce plugins showed that seven of them were vulnerable.<ref>Template:Cite web</ref>

To promote better security and to streamline the update experience overall, automatic background updates were introduced in WordPress 3.7.<ref>Template:Cite web</ref>

Individual installations of WordPress can be protected with security plugins that prevent user enumeration, hide resources, and thwart probes. Users can also protect their WordPress installations by taking steps such as keeping all WordPress installations, themes, and plugins updated, using only trusted themes and plugins,<ref>Template:Cite web</ref> and editing the site's .htaccess configuration file if supported by the webserver to prevent many types of SQL injection attacks and block unauthorized access to sensitive files. It is especially important to keep WordPress plugins updated because would-be hackers can easily list all the plugins a site uses and then run scans searching for any vulnerabilities against those plugins. If vulnerabilities are found, they may be exploited to allow hackers to, for example, upload their files (such as a web shell) that collect sensitive information.

Developers can also use tools to analyze potential vulnerabilities, including Jetpack Protect, WPScan, WordPress Auditor, and WordPress Sploit Framework developed by 0pc0deFR. These types of tools research known vulnerabilities, such as CSRF, LFI, RFI, XSS, SQL injection, and user enumeration. However, not all vulnerabilities can be detected by tools, so it is advisable to check the code of plugins, themes, and other add-ins from other developers.

In March 2015, it was reported that the Yoast SEO plugin was vulnerable to SQL injection, allowing attackers to potentially execute arbitrary SQL commands.<ref>Template:Common Vulnerabilities and Exposures ID Template:Cite web, Retrieved on July 7, 2017</ref><ref>Common Vulnerabilities and Exposures Template:Common Vulnerabilities and Exposures IDTemplate:Cite web, Retrieved on July 7, 2017</ref> The issue was fixed in version 1.7.4 of the plugin.<ref>Barry Schwartz "Yoast WordPress SEO Plugin Vulnerable To Hackers" Template:Webarchive, Retrieved on February 13, 2016.</ref>

In January 2017, security auditors at Sucuri identified a vulnerability in the WordPress REST API that would allow any unauthenticated user to modify any post or page within a site running WordPress 4.7 or greater. The auditors quietly notified WordPress developers, and within six days WordPress released a high-priority patch to version 4.7.2, which addressed the problem.<ref>Template:Cite news</ref><ref>Template:Cite news</ref>

File:Typical Tor Browser notification of a canvas read attempt.png

The canvas fingerprinting warning is typically given by Tor Browser for WordPress-based websites.

As of WordPress 6.0, the minimum PHP version requirement is PHP 5.6,<ref name=":0">Template:Cite web</ref> which was released on August 28, 2014,<ref name="eol">Template:Cite web</ref> and which has been unsupported by the PHP Group and not received any security patches since December 31, 2018.<ref name="eol" /> Thus, WordPress recommends using PHP version 7.4 or greater.<ref name=":0" />

In the absence of specific alterations to their default formatting code, WordPress-based websites use the canvas element to detect whether the browser can correctly render emoji. Because Tor Browser does not currently discriminate between this legitimate use of the Canvas API and an effort to perform canvas fingerprinting, it warns that the website is attempting to 'extract HTML5 canvas image data. Ongoing efforts seek workarounds to reassure privacy advocates while retaining the ability to check for proper emoji rendering capability.<ref>Template:Cite web</ref>

Development and support

Key developers

Matt Mullenweg and Mike Little were co-founders of the project. Current key people are listed on WordPress's Web site.<ref>Template:Cite web Updated as required.</ref>

WordPress is also developed by its community, including WP tester, a group of volunteers who test each release. They have early access to nightly builds, beta versions, and release candidates. Errors are documented via a mailing list and the project's Trac tool.

Though largely developed by the community surrounding it, WordPress is closely associated with Automattic, the company founded by Matt Mullenweg.<ref>Template:Cite web</ref>

WordPress Foundation

WordPress Foundation is a non-profit organization that was set up to support the WordPress project.<ref name=":04">Template:Cite web</ref><ref name=":12">Template:Cite web</ref><ref>Template:Cite web</ref> The purpose of the organization is to guarantee open access to WordPress's software projects forever.<ref name=":04"/><ref name=":12" /> As part of this, the organization owns and manages WordPress, WordCamp, and related trademarks.<ref name=":04"/><ref name="Trademark Policy"/><ref name=":23">Template:Cite web</ref> In January 2010, Matt Mullenweg formed the organization<ref name=":04"/> to own and manage the trademarks of WordPress project.<ref name=":32">Template:Cite web</ref><ref name=":23"/> Previously Template:En dash from 2006 onwards Template:En dash Automattic acted as a short-term owner of the WordPress trademarks. From the beginning, he intended later to place the WordPress trademarks with the WordPress Foundation, which did not yet exist in 2006 and which eventually took longer to set up than expected.<ref name=":32" /><ref>Template:Cite web</ref>

WordPress Photo Directory

On December 14, 2021, Matt Mullenweg announced the WordPress Photo Directory at the State of the Word 2021 event.<ref name=":13"/> It is an open-source image directory for open images maintained by the WordPress project.<ref name=":13">Template:Cite web</ref> The image directory aims to provide an open alternative to closed image banks, such as Unsplash, Pixbaby, and Adobe Stock, whose licensing terms have become restrictive in recent years. Use in WordPress themes, for example, is restricted.<ref name=":13"/><ref>Template:Cite web</ref> In January 2022, the project began to gather volunteers, and in February, its own developer website was launched, where team representatives were next selected.<ref name=":4">Template:Cite web</ref>

WordCamp developer and user conferences

File:WordCamp 2011 Bulgaria.jpg

A WordCamp in Sofia, Bulgaria (2011)

WordCamps are casual, locally organized conferences covering everything related to WordPress.<ref name="WordCamp Central About">Template:Cite web</ref> The first such event was WordCamp 2006 in August 2006 in San Francisco, which lasted one day and had over 500 attendees.<ref>Template:Cite web</ref><ref>Template:Cite web</ref> The first WordCamp outside San Francisco was held in Beijing in September 2007.<ref name="wordcamp schedule">Template:Cite web</ref> Since then, there have been over 1,022 WordCamps in over 75 cities in 65 countries around the world.<ref name="WordCamp Central About" /> WordCamp San Francisco 2014 was the last official annual conference of WordPress developers and users taking place in San Francisco, having now been replaced with WordCamp US.<ref>Template:Cite web</ref> First ran in 2013 as WordCamp Europe, regional WordCamps in other geographical regions are held to connect people who are not already active in their local communities and inspire attendees to start user communities in their hometowns.<ref>Template:Cite web</ref> In 2019, the Nordic region had its own WordCamp Nordic.<ref>Template:Cite web</ref><ref>Template:Cite web</ref> The first WordCamp Asia was to be held in 2020,<ref>Template:Cite web</ref> but cancelled due to the COVID-19 pandemic.<ref>Template:Cite web</ref>

Support

WordPress' primary support website is WordPress.org. This support website hosts both WordPress Codex, the online manual for WordPress and a living repository for WordPress information and documentation,<ref>Template:Cite web</ref> and WordPress Forums, an active online community of WordPress users.<ref>Template:Cite web</ref>

Hosting

Template:Unreferenced section WordPress hosting services typically offer one-click WordPress installations, automated updates and backups, and security features to safeguard against common threats. Many also provide support and are configured for optimal performance with the CMS.

There are two primary types of WordPress hosting: shared WordPress hosting and managed WordPress hosting. Shared WordPress hosting is a budget-friendly option where multiple websites reside on a single server, sharing resources. Managed WordPress hosting includes comprehensive management of a WordPress site, including technical support, security, performance optimization, and often higher server resources, but comes at a higher price.

See also

• List of content management systems
• NextGEN Gallery
• Weblog software
• WordPress.com

External links

• Template:Official website