WordPress’s recent woesStirring panic among online communities that rely on the platform. at present,More than 40% of online websites areUse WordPress. Now, a consortium of high-profile WordPress contributors and the Linux Foundation are launching a joint update and plugin distribution network aimed at eliminating what they call a critical "supply chain security" vulnerability at the heart of the world's most widely used website system.
The FAIR package manager project, which will be announced at a conference in Switzerland later today, will enable website hosting companies and larger organizations to run their own WordPress core updates, plugins, themes and translation server images. The move will replace reliance on WordPress.org - a domain controlled by Automattic CEO Matt Mullenweg.
Backers say the new system will enhance security, reduce costs and open up new business opportunities for web hosting software that millions of people rely on.
The project was launched earlier this year in response to Mullenweg's controversial move. In September, he cut off access to popular WordPress hosting provider WP Engine, accusing it of squeezing hundreds of millions of dollars in value from the open source platform without giving enough back. He also accused the company of infringing WordPress’ trademark rights and causing confusion. In the fallout, about 150 employees left Automattic after Mullenweg offered buyouts to employees who disagreed with his handling of the company.
“In October, when Automattic took over some of the functionality of the WP Engine product within the ecosystem, we got calls from the chief legal counsels of some of our customers, all of them large companies, saying ‘this is a supply chain security issue,’” said Karim Marucchi, CEO of enterprise agency Crowd Favorite and one of the project’s sponsors.
Around the same time, Joost de Valk, founder of Yoast SEO, tried to communicate with Mullenweg. While de Valk agrees that WordPress needs a fairer share of contributions, he disagrees with Mullenweg’s approach. “We pretty much had no contact after that because I didn’t agree with him,” de Valk said.
A core issue is that every WordPress website relies on WordPress.org for updates and expansion. "When we started working on this problem, we realized there was a lot in the entire ecosystem that we couldn't control," de Valcke said. “One thing that everyone noticed is that WordPress.org is not actually part of the WordPress Foundation, but is privately owned by Matt, and he uses it in many ways as his own private website.”
Mary Hubbard, executive director of WordPress, notes that users have always had control over how their site is updated and where updates come from—a flexibility that has existed since the early days of WordPress. “The beauty of WordPress and open source is that people have complete control over how to run it and modify how it works.”
The FAIR system offers an alternative that is fully compatible with WordPress but operates independently of WordPress.org. "It's still completely WordPress," de Valk said, "just a different distribution." FAIR is not a fork of WordPress, but rather provides server components that anyone can run. According to Marucchi, more than 100 contributors from more than 10 organizations have been involved in building FAIR over the past six months. The group has asked the Linux Foundation to provide neutral oversight.
Hubbard pointed out that some large hosts (such as Newfold/Bluehost) have implemented custom mirroring in the past, and emphasized that WordPress's update system has always allowed users to modify the update source. "It's important that users, regardless of hosting provider, know where the updates are coming from and have the option to change them," she said.
Mike Dolan, senior vice president of legal and strategic programs at The Linux Foundation, said: "WordPress is a critical infrastructure for communications, and for the organizations that rely on it to run websites, content management, blogs and media. To maintain a system like this, you need a reliable backend."
To avoid centralization, the Linux Foundation established a technical steering committee co-chaired by long-time WordPress leaders Carrie Dils, Mika Epstein, and Ryan McCue. McCue, the architect of the WordPress REST API, calls FAIR “a platform that will power WordPress growth for decades to come,” noting that the community has been “divided” and needs to be reunited.
Dolan agrees. “What I find most interesting about this is the naturalness of it,” he said. “It’s a product of community. People who have devoted their lives to the WordPress community are calling on us to build it, and they want to work together.”
Jory Burson, vice president of standards at the Linux Foundation and a participant in the project, hopes the move will "reintroduce and reinvigorate the community." Community morale is currently low, she added. "I think it's going to get people really excited and hopefully help some people take a break from this negativity and drama. We want to shine a spotlight on the very positive future that WordPress still has."
Although FAIR was born out of dissatisfaction with Automattic's control of WordPress.org, its backers insist that it is not a competing fork. “When we went on stage on Friday, the thing that came out of our mouth was: ‘We’re going to make this code available to Automattic, WP Engine, GoDaddy, Newfold — everybody.’” Marucci said.
If the network gains widespread adoption, developers could release both free and premium plugins in the same signature package—something currently prohibited by the official WordPress codebase. “This opens the door to innovation,” de Valk said, “making it easier to build a business around plugins and provide a great user experience.”
Still, Hubbard stressed that fragmentation of WordPress’s core infrastructure could create more problems than it solves — such as disrupting the update process, increasing server load, and breaking the plugin telemetry used to ensure compatibility. "If this work leads to improvements, such as signature updates or a better fallback system, we're open to it," she said. "But we must approach this effort with the same long-term caution as we have done before."
The FAIR code base is live on GitHub and accepting contributions. Whether Automattic will participate is uncertain; regardless, the project team plans to move forward. "We're dealing with a community that has faced trust challenges in the past and is looking for stability," Dolan said. "They're looking for neutrality. They have things they want to accomplish."