WP Engine is not WordPress
Matt Mullenweg criticized WP Engine at WordCamp for misleading branding and disabling the revision feature, urging users to contact support and consider alternative hosting to maintain WordPress integrity.
Read original articleMatt Mullenweg, speaking at WordCamp, emphasized that WP Engine is not an official WordPress service, despite its branding suggesting otherwise. He criticized WP Engine for disabling the revision feature in WordPress, which is essential for tracking changes and protecting user content. This practice, he argues, undermines the core promise of WordPress as a content management system, which is to safeguard users' data. Mullenweg pointed out that WP Engine's decision to turn off revisions is driven by cost-cutting measures rather than genuine performance concerns, as other hosting providers do not disable this feature. He described WP Engine's approach as detrimental to the WordPress ecosystem, warning that it sets a poor precedent for other companies. Mullenweg urged WP Engine customers to contact support to enable revisions and consider switching to other hosting providers that uphold the integrity of WordPress. He concluded by stressing the importance of maintaining high standards for the future of WordPress.
- WP Engine is criticized for misleading branding that suggests it is an official WordPress service.
- The company disables the revision feature, compromising data protection for users.
- Mullenweg warns that WP Engine's practices could set a negative standard in the WordPress ecosystem.
- Users are encouraged to contact WP Engine support to enable revisions and consider alternative hosting options.
- Maintaining the integrity of WordPress is crucial for its long-term sustainability.
Related
Backdoor slipped into multiple WordPress plugins in ongoing supply-chain attack
A supply-chain attack compromised 36,000 websites using backdoored WordPress plugins. Malicious code added to updates creates attacker-controlled admin accounts, manipulating search results. Users urged to uninstall affected plugins and monitor for unauthorized access.
5 WordPress Plugins Compromised; Millions of Websites at Risk
Millions of WordPress sites face security risks from hacked plugins allowing unauthorized access. Owners urged to check, deactivate compromised plugins, update regularly, use strong passwords, two-factor authentication, and security plugins.
Webflow says 2TB of bandwidth is worth $1,250 per month
Webflow faced criticism for price hikes, prompting user backlash. Nico Cerdeira's case led to bandwidth optimization help and waived upgrade fees. Company adjusted pricing and features, but users still struggle with migration.
Exploiting authorization by nonce in WordPress plugins
Vulnerabilities in WordPress plugins arise from nonce misuse, leading to privilege escalation. Critical issues include RCE in Advanced File Manager and Filester, and SQL injection in Squirrly SEO plugin.
Ecosystem Thinking
Matt Mullenweg emphasizes the significance of open-source software and community collaboration, introducing "Ecosystem Thinking" to promote continuous learning and urging support for companies that positively impact the ecosystem.
- Many commenters question the validity of Mullenweg's claims, suggesting that WP Engine's modifications are within their rights as a GPL-licensed product.
- Several users express frustration with the revision system in WordPress, arguing that disabling it can improve performance and resource management.
- Critics highlight perceived hypocrisy in Mullenweg's stance, noting that other companies in the WordPress ecosystem also have ethical issues.
- Some commenters defend WP Engine's services, emphasizing their ease of use and support compared to self-hosting WordPress.
- Concerns are raised about the appropriateness of Mullenweg using his position to publicly attack a competitor, suggesting it undermines the open-source ethos.
There's no mention of the source code being changed or custom patches being applied. So the allegation that it's "something that they’ve chopped up, hacked, butchered to look like WordPress" is maximally overblown. Unless, again, I'm completely missing something.
For Matt to call WP Engine a "cancer" because they use WordPress-supported functionality to turn off a WordPress feature is bizarre. All WordPress hosts modify the software to make it work for them. Especially Automattic!
“But when I go to Wordpress.com…”
SORRY, forget everything you saw there, that’s not Wordpress. Same logo? Yes. Branding? Yes. Company? Yes. But it’s not Wordpress.
This one setting that WP Engine disables is a shame, but it’s nothing compared to the confusion that Automattic has brought upon themselves
Over the years, I've watched them through a progression of management changes move from value of service to value extraction. Chipping away at costs while holding the price constant or raising it and extracting the difference for themselves. This isn't in and of itself a "bad" thing, it is what business does, however I find the integrity around value extraction varies tremendously. From zero integrity Mackenzie type MBAs to high(er) integrity owner operators.
It is rare when a management team says, "this is enough money" and that is sad.
a: There's no angle to analyze this attack from where he isn't a massive hypocrite
b: It's not clear why he singles out WP Engine when so many major players in the WP ecosystem have equal and worse ethical issues. Why does this seem like a grudge match when a higher-minded ecosystem-level call for review and change seems like the right path?
Maybe this is a bit radical but I'm not sure the guy who runs one of the biggest commercial WP operations should be able to make posts attacking rival commercial operations on the .org blog.
I'm not sure I see how the absence of a revision tracking system rises to a violation of sacred principles.
My boss (ie the owner) has never asked me about per post versioning. When we need to roll back, WP Engine's custom snapshotting fits the need.
And that's their right according to the GPL license, is it not?
This entire tirade reads like corporate mudslinging.
The way you win over customers with an open source product is by offering a better service. Period.
As someone outside of the WP world and without a dog in this fight, I'm now more inclined to look into the WP Engine offering rather than whatever Matt Mullenweg is selling.
The way they let you copy the DB between staging and prod, honestly it’s faster and better for their users the way they do it vs. default WordPress. My 2 cents.
Instead of recommending strategies to help fix it, they jacked up our prices. It was a huge pain for everyone involved.
But I think the challenge is, at an agency level, it’s hard to move to another CMS host because it’s seen as difficult to move up the food chain. Providers like WP Engine exploit this misunderstanding by targeting non-technical customers with promises that they’ll help you out. That was clearly an opportunity for them to step in, and they used it to put on the squeeze.
Personally I’m not convinced that keeping a 100% audit trail for reconstruction of old states is useful in production. It may well be a better trade off to run WordPress code in a leaner way for speed and storage requirements. Since that architecture results in many ways to get the current state from the db there is also a purity argument that the default schema is too denormalised. Discuss…
I moved to a service that cost me less for two years than what I paid WPE for one month, and they’re faster and have had zero issues. I also had to rely on backups and they worked too.
WPE was great in theory a few years ago, but then they acquired a few other companies and added too many distancing layers for tech support. They have professional features and a cool API, but their hosting speeds are now abysmal.
Using any variant of wordpress on a project seems equally negligent.
I use Wpengine and have enjoyed it. They have some aggressive upsells and you learn you can ignore them. Actually had no idea about revisions, hadn't used them before I hosted with Wpengine.
I very much like using Wordpress and Wpengine has helped make it easy to do so. I'm sure they have some things to work put between them but I feel this needs more info. At a certain level it's open source software and if it isn't a trademark violation and is allowed by the license terms then Wordpress has only moral suasion to work with.
Very happy with the work Wordpress has done to make an amazing ecosystem. If they need something from WPEngine to keep things going I think it's fair to ask and perhaps they did but we're a bit in the dark here.
1. Dead-simple staging environments
2. Support for Local, which makes WP development an absolute breeze because I don't need to maintain docker, vagrant, or a LAMP stack, etc. And it makes deployments quick/easy.
3. Dead-simple backup/restore features
4. Simplified cache-management
And yeah, I've got the technical know-how to handle all of that myself directly on a proper server and all that devops-y goodness. And yes, $5/mo shared hosting cPanel provider would be comparable (and let's be real, it's good enough for most people using WP)....But man is it nice to just charge/pay a little more for a host that just does that crap for me with a nice interface.
I like revisions as a feature. Hell, I made reference to them a lot in the training material and sessions I put together for clients way-back-when as a way to give clients the confidence to tweak copy without fear of completely ruining their site. But this blog post seems to pretend it's the heart of WP and without it, it's an entirely different piece of software all together, which is absurd.
>> "WP Engine has now filed formal legal action against WordPress.org, myself, Automattic, and we are doing the same against them, so I may not be able to comment on this too much in the future."
It seems a little disingenuous for Matt to pull on the self-righteous mantle of open source in order to run down a company that directly competes with his commercial platform.
What happened to the idea of WordPress as an inclusive, flexible project that lifts all boats? What happened to open source means you can do what you want?
The more I think about it, the more troubling this seems for other commercial entities working with WordPress. Is Matt going to start putting targets on the backs of companies who get too successful with “his” software WordPress?
The history or vague sentiment that comes to mind for you is probably not from WordPress itself, but plugins or integrations that used it.
A victim of success, WordPress alone isn't much. All of that said... I know absolutely nothing about WP Engine. This isn't an endorsement
Actually, since WordPress supports ActivityPub now, it's a spat between two massive AP platforms with apocalyptic potential. Someone needs to get follower migration from WordPress to anything else on the AP fediverse done quick.
This is nothing more than commercially focused.
This allowed companies like WPEngine to exist... and focus their resources like marketing and maintaining their internal "fork" rather than contributing to core Open Source Project... and this might be one of the reasons they are getting some good success.
Generally trademark is what should offer some protection here and I think this is where Open Source landscape was not tested well.
WP Engine claims on their front page they are "Most Trusted Wordpress Hosting" which arguably makes folks to assume they host full featured Open Source Wordpress, which per Matt's article does not seem to be the case.
Here’s a common example: you have a blog with 20 pages and 20 custom plugins (quite a standard these days). In a year of hosting that one, you’ll end up with millions of revisions in the database, which is really resource and speed issue for MySQL servers as the developers of WordPress never considered sharding; everything is stuffed into one table, with no indexes by default.
So, usually, the size of the DB and resources to run it go over what you would expect, so naturally, you limit it to a more sane value.
TLDR; In pristine WP env with no plugins unlimited revisions make sense. In a WP with many plugins they don't as other plugins declare them but not use them and thus we end with a system that uses huge amount of resources for nothing.
Oh and revision in WP is not like GIT revision as is full copy of the content.
Running WordPress is such a pile of security and customer support suck that nobody wants to deal with it. Consequently, if you are being made to run WordPress, you also want to pay somebody to make the pain go away. If I pay WPEngine, I can tell my marketing and design teams "Customer support is over there. Talk to WPEngine and leave me alone."
If WordPress made their software such that hosting administration wasn't such a fiasco, WPEngine would have viable competitors and wouldn't be able to extract the ecosystem.
That being said, some commercial users of open-source software need to be better contributors to the eco-system and not just vampires.
(A)GPL provides no protection here.
Polyform NonCommercial however does protect against this, because WP Engine would have to pay for the privilege of re-sale.
https://polyformproject.org/licenses/noncommercial/1.0.0/
See also the closely aligned Fair Source:
Related
Backdoor slipped into multiple WordPress plugins in ongoing supply-chain attack
A supply-chain attack compromised 36,000 websites using backdoored WordPress plugins. Malicious code added to updates creates attacker-controlled admin accounts, manipulating search results. Users urged to uninstall affected plugins and monitor for unauthorized access.
5 WordPress Plugins Compromised; Millions of Websites at Risk
Millions of WordPress sites face security risks from hacked plugins allowing unauthorized access. Owners urged to check, deactivate compromised plugins, update regularly, use strong passwords, two-factor authentication, and security plugins.
Webflow says 2TB of bandwidth is worth $1,250 per month
Webflow faced criticism for price hikes, prompting user backlash. Nico Cerdeira's case led to bandwidth optimization help and waived upgrade fees. Company adjusted pricing and features, but users still struggle with migration.
Exploiting authorization by nonce in WordPress plugins
Vulnerabilities in WordPress plugins arise from nonce misuse, leading to privilege escalation. Critical issues include RCE in Advanced File Manager and Filester, and SQL injection in Squirrly SEO plugin.
Ecosystem Thinking
Matt Mullenweg emphasizes the significance of open-source software and community collaboration, introducing "Ecosystem Thinking" to promote continuous learning and urging support for companies that positively impact the ecosystem.