Uncategorized

A visitor asked my chatbot a question this week. The question was 34 characters long. To answer it, the site sent just under 15,000 characters to the model. That ratio is the whole economics of a self-hosted AI chatbot, and almost nobody publishing pricing advice has measured it on a real install. So I did…

On 12 August 2026, an advisory landed for WooCommerce Subscriptions: unauthenticated PHP object injection, escalating to remote code execution, in every version below 9.1.0. The trigger condition is the interesting part — it applies when High-Performance Order Storage is switched on. HPOS is switched on here. So before writing anything about it, I ran the…

Verified — 20 August 2026, against the shipped release: Guidelines is not in WordPress 7.1. This post said the Guidelines feature appeared in the June roadmap, was absent from the August Field Guide, and that secondary coverage contradicted itself — and it declined to call the outcome. Here is the outcome, checked rather than read…

WordPress 7.0.4 patches an Author+ RCE. Our automatic updates were enabled and it still never installed. Here is the measurement, and the 30-second check.

Between 31 July and 13 August 2026, this site logged 157,619 requests. About 5% of them claimed to be an AI crawler — GPTBot, ClaudeBot, PerplexityBot, ChatGPT-User, OAI-SearchBot. We checked each one against the IP ranges the vendors publish themselves. Forty-six percent were not who they said they were. That number matters because “how much…

There is a setting in our chatbot’s admin screen that says transcripts are deleted after one month. It is set. It has been set for a long time. This morning I checked whether it actually happens, and the honest answer is that the job responsible for it last ran on 9 August and is not…

WordPress now runs an AI security review over plugin and theme updates before they reach your site, and holds each release for a cooldown period first. It is called Protect The Shire, it has been live since June, and it is a genuinely good idea. This morning I pointed it at my own install and…

Correction — 19 August 2026: the increase described below will not happen. This post was published on 10 August 2026 and argued, correctly at the time, that Claude Sonnet 5 would move from $2/$10 to $3/$15 per million tokens on 1 September. Anthropic has since reversed that. Its pricing documentation now carries this note: “The…

One article of the EU Cyber Resilience Act starts applying on 11 September 2026, and it lands on commercial WordPress plugin vendors — including free plugins with a Pro tier.

On 2 August 2026, Article 50 of the EU AI Act became applicable. Most of the coverage aimed at WordPress site owners — including ours — was about the chatbot: the widget in the corner now has to tell people it is an AI. That is the visible half. The half that reaches more WordPress…