What the WordPress 7.0 roadmap means for your build
The November 2025 core committers check-in set the direction for WordPress 7.0: PHP 7.4 as the minimum, AI models running in the browser instead of on your server, and a reworked WP Admin.
Category: Core Updates
What WordPress 6.9 features mean for high-traffic sites
Notes from a slow 80k-post news portal and what WordPress 6.9 changes about it: consistent cache keys for query groups, the new block processor and HTML API, and the Abilities API.
WordPress 6.9 core updates and the bugs RC4 fixed
A pre-release WordPress install killed a client’s publish button. The cause was a core bug in hidden async-upload fields, one of several things the 6.9 release candidates cleaned up alongside alternate cron and REST API errors.
What a moderation fight taught me about incident response
A banned member was back in ten minutes on three new accounts, because a dynamic IP beats a firewall rule. What the site actually needed was an incident response protocol: logging, permissions, and a human who owns the ban button.
Why custom plugins fail WordPress security standards
A client shipped a custom plugin to the WordPress repo and got twenty-four violations back. Most of them came down to one habit: escaping data at the moment you output it instead of trusting the sanitization you did on input.
The WordPress HTML API in 6.9 replaces your regex hacks
A regex that injected attributes into product images broke a store’s layout over one misplaced quote. WordPress 6.9 makes serialize_token() public, so the processor rebuilds the markup for you.
How WordPress 6.9 features fix team editing workflows
Twelve editors on one set of long-form guides, with feedback spread across Slack, email and sticky notes. Block-level notes and the hide and show toggle in 6.9 move that conversation into the editor.
20 years of WordPress.com: when to leave the walled garden
A client’s WordPress.com site outgrew the managed plan after nearly a decade. The XML export timed out and broke thousands of image links, so the move became a SQL migration with a media path filter.
The WordPress Abilities API replaces your wrapper classes
Fifty layers of function_exists() held a membership site together until the LMS renamed its methods. The Abilities API in 6.9 gives plugins a registry to declare what they can do instead.
Keep WordPress 6.9 testing off your production site
A client pushed WordPress 6.9 RC3 to a live WooCommerce store and lost checkout inside ten minutes. What broke, why my first quick fix made it worse, and where release candidate testing actually belongs.