Between 31 July and 13 August 2026, this site logged 157,619 requests. About 5% of them claimed to be an AI crawler — GPTBot, ClaudeBot, PerplexityBot, ChatGPT-User, OAI-SearchBot. We checked each one against the IP ranges the vendors publish themselves. Forty-six percent were not who they said they were. That number matters because “how much…

There is a setting in our chatbot’s admin screen that says transcripts are deleted after one month. It is set. It has been set for a long time. This morning I checked whether it actually happens, and the honest answer is that the job responsible for it last ran on 9 August and is not…

WordPress now runs an AI security review over plugin and theme updates before they reach your site, and holds each release for a cooldown period first. It is called Protect The Shire, it has been live since June, and it is a genuinely good idea. This morning I pointed it at my own install and…

Correction — 19 August 2026: the increase described below will not happen. This post was published on 10 August 2026 and argued, correctly at the time, that Claude Sonnet 5 would move from $2/$10 to $3/$15 per million tokens on 1 September. Anthropic has since reversed that. Its pricing documentation now carries this note: “The…

One article of the EU Cyber Resilience Act starts applying on 11 September 2026, and it lands on commercial WordPress plugin vendors — including free plugins with a Pro tier.

On 2 August 2026, Article 50 of the EU AI Act became applicable. Most of the coverage aimed at WordPress site owners — including ours — was about the chatbot: the widget in the corner now has to tell people it is an AI. That is the visible half. The half that reaches more WordPress…

If you run a WooCommerce store, you have probably read that AI agents are about to start buying things on your customers’ behalf, and that you should get ready. What almost none of that coverage tells you is that the readiness work is already sitting in your plugins directory. WooCommerce 11.0.0 ships a complete implementation…

On 10 July 2026, a merge proposal that would have given WordPress its first shared place to store site knowledge was closed. It did not fail review, and nobody found a bug in it. It was reviewed with Matt Mullenweg and, in the words of the closing comment from Anne McCarthy (annezazu) on Make/Core, “this…

Every guide to WordPress API key security says roughly the same thing: your keys live in the database, so protect the database. That sentence is true and it is also misleading, because it describes where the key sits at rest and not where it spends most of its life. I ran the audit on a…