Mullenweg Criticizes WP Engine For Something He Also Does via @sejournal, @martinibuster

Matt Mullenweg cited a Reddit thread on X to promote the idea that WP Engine makes it difficult to cancel accounts. Turns out that his own hosting company does the exact same thing.

“Money Grab” Post By Redditor

Someone posted that they cancelled a WP Engine account on Friday December 6th. They subsequently learned that WP Engine has a 30 day advance notice cancellation policy so they called customer service and was assured they wouldn’t be charged, despite not giving 30 days advance notice.

They wrote:

“On Dec 6th, I cancelled my WPEngine service that I’ve had since 2015. …That’s when I discovered that WPEngine requires 30 days notice to cancel. An obvious money-grab. A user should be able to cancel a single-site hosting environment instantly with one click of a button. In fact, this will be the law soon, created because of unscrupulous cancellation tactics like this.

WPEngine support informed me that my site would be cancelled on Jan 3rd. …Surprise, surprise… it’s Jan 5th. My account hasn’t been cancelled, and I was charged $300 today for another year of service.”

Hours after starting the Reddit post to complain about WP Engine they updated it to say that WP Engine had refunded their money.

They posted:

“UPDATE: WP Engine support got back to me, cancelled the account today, and initiated a refund that’ll take up to 10 business days.”

Mullenweg Dumps On WP Engine

Mullenweg posted on X to compare WP Engine to an unscrupulous gym, accompanying his post with a screenshot of the Reddit post:

“One way @wpengine juices its profits at the expense of its customers is by making it hard to export or cancel your plan, like one of those bad gyms.”

He followed that up with another post touting that WordPress.com has a flexible cancellation policy:

“The WordPress philosophy is to make it easy for people to leave, so they’re more likely to stay. Give freedom and choice.”

But the reality is that WordPress.com’s cancellation policy also requires 30 day advanced notice:

“You must cancel at least one month before the scheduled end date of any annual subscription…”

What’s Going On?

WP Engine’s contract is clear that they require 30 days notice to cancel a service. But it’s not like once you pay you’re committed to a whole year of hosting. The contract enables customers to cancel their yearly hosting plan at any time (with 30 days notice) and the difference for any remaining months will be refunded.

The Redditor cancelled their account with less than 30 days notice (on a Friday), got charged 24 days later and then refunded on a Sunday, before the weekend was over.

Response On Reddit

While many Redditors were supportive of the person who started the discussion, others pointed out the obvious that it’s a weekend and they failed to give adequate notice.

A Redditor named ThePresidentOfStraya posted:

“Not affiliated with WPEngine. Downvoted. This is a boring billing issue, you’re not being oppressed. Annoying sure. But just call them Monday mate.”

Another Redditor downplayed the events:

“Meh, crap happens. It’s not at all abnormal to have a 30 day opt-out prior to renewal.”

Another Redditor put the original posters situation into perspective, commenting:

“Money grab? You know the rules…

Inform yourself. You should have cancelled sooner. Now be polite and ask them for a solution instead of ranting about it online.”

Read the original Reddit post:

UPDATE: WPEngine didn’t follow through on cancelling my account on Jan 3rd and I was charged for another year of service

Featured Image by Shutterstock/Nicoleta Ionescu

Ecommerce SMBs Need Faceless Videos

So-called “faceless videos” use voiceovers, animations, and images to tell a story, educate, or entertain. In the ecommerce context, these relatively easy-to-make videos promote items and build trust.

Video is an excellent way to showcase products and convert shoppers. Enterprise retailers often place videos on ecommerce pages, social media, and ads.

The only drawback is production. Compared to a blog post or a text-based search ad, videos are expensive to produce and require a much higher skill level. Thus some small and mid-sized ecommerce businesses avoid videos altogether.

AI-enabled Faceless Video

Online merchants produced “faceless” videos before the term became a buzzword. Tools such as Animoto have facilitated such videos for 15 years, as in the recent example below.

These tools make creating a video much easier, but the video-production bar was still above some merchant’s reach. Fortunately, generative artificial intelligence has made faceless video production achievable for nearly every ecommerce business.

Consider a faceless video workflow.

  • Idea generation. Generative AI models — ChatGPT, Gemini, Claude, and Grok — can help create faceless video ideas.
  • Scripting and storyboarding. AI tools such as Jasper and Copy.ai feature script writing, although many other AI models can compose video scripts.
  • Gathering visuals. For this step, an ecommerce business might use product images in combination with AI-generated pictures or video from tools such as Midjourney, Grok, or Pika.
  • Recording the voiceover. This might be an actual recording or AI-generated audio from ElevenLabs, Murf.ai, and others.
  • Video editing. Use AI, humans, or a combination.

Generative AI can help throughout the process. Multiple AI-powered platforms perform almost all these steps based on a prompt or two.

Why Faceless Videos?

AI makes creating faceless ecommerce videos nearly as easy as asking ChatGPT to rewrite some Google Ads copy. But why should online merchants use such videos at all?

The answer is more sales — in five ways.

Video advertising. Most common digital advertising platforms, from Meta’s Facebook and Instagram to Snapchat and Google Ads, support video formats. These platforms report that video in ads boosts performance. A 2023 Meta analysis showed a 35% improvement in clicks for vertical Reels ads containing video with audio.

Showcase products. Videos showing and describing a product and its features can appear directly on its detailed web page. This common practice boosts conversations. With an automated workflow employing Zapier (or similar) and generative AI tools described above, a merchant could generate a faceless product video for every item in a store.

Customer service. The same AI-enabled workflow for products could also generate customer service videos addressing, say, return policies or frequently asked questions.

Content marketing. Several AI tools can convert a blog post or product description into a faceless video, which merchants can embed on the item’s page or distribute via YouTube.

Social media marketing. Finally, videos drive modern social media marketing, and faceless versions — in full or excerpted into vertical shorts — can work on just about every platform, from YouTube to Meta.

Faceless or Humans?

Faceless videos are not perfect.

Some users report that faceless versions do not build trust as well as a human speaker. A person saying, “Hi, I am Bob Smith, and I want to tell you why I love this product,” carries more emotional clout than a voiceover.

Plus, some social media platforms — TikTok, in particular — favor videos with humans such as influencers talking directly into the camera.

Nonetheless, faceless videos can help ecommerce shops improve advertising performance, showcase products, provide customer information, and produce engaging content.

And thanks to ever-improving AI, this type of video is relatively easy to produce.

WordPress Popular Posts Plugin Vulnerability Affects 100k+ Sites via @sejournal, @martinibuster

An advisory has been issued about a high-severity WordPress vulnerability that makes it possible for attackers to inject arbitrary shortcodes into sites using the WordPress Popular Posts plugin. Attackers do not need a user account to launch an attack.

WordPress Popular Posts is installed in over 100,000 websites enables websites to display the most popular posts within any given time period and has been translated into sixteen different languages to extend its use around the world. It comes with caching features to improve performance and an admin console that allows website administrators to view popularity statistics.

WordPress Shortcode Vulnerability

Shortcodes is a feature that allows users to insert functionalities within a web page by inserting a predefined snippet within brackets that automatically inserts a script that performs a function, like adding a contact form with a shortcode that looks like this: [add_contact_form].

WordPress is gradually evolving away from the use of shortcodes in favor of blocks with specific functionalities. The official WordPress developer site encourages plugin and theme developers to discontinue using shortcodes in favor of dedicated blocks, with the main reason being that it’s a smoother workflow for a user to select and insert a block rather than configure a shortcode within a plugin then manually inserting the shortcode into a webpage.

WordPress advises:

“We would recommend people eventually upgrade their shortcodes to be blocks.”

The vulnerability discovered in the WordPress Popular Posts plugin is due to the implementation of the shortcode functionality, specifically a part called do_shortcode(), which is a WordPress function for processing and executing shortcodes that requires input sanitization and other standard WordPress plugin and theme security practices.

According to an advisory published by Wordfence:

“The WordPress Popular Posts plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 7.1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.”

That part about “validating a value” generally means checking to ensure that what the user inputs (the “value”), such as the content of a shortcode, is validated to confirm that it’s safe and conforms to expected inputs before being passed along for use by the website.

Official Plugin Changelog

A changelog is the documentation of what’s being updated, which for users of the plugin provides them an opportunity to understand what is being updated and to make decisions about whether to update their installation or not, thus transparency is important.

The WordPress Popular Posts plugin is responsibly transparent in their documentation of the update.

The plugin changelog advises:

“Fixes a security issue that allows unintended arbitrary shortcode execution (props to mikemyers and the Wordfence team!)”

Recommended Actions

All versions of the WordPress Popular Posts plugin up to and including version 7.1.0 are vulnerable. Wordfence recommends updating to the latest version of the plugin, 7.2.0.

Read the official Wordfence advisory:

WordPress Popular Posts <= 7.1.0 – Unauthenticated Arbitrary Shortcode Execution

Featured Image by Shutterstock/GrandeDuc

WordPress Backup Plugin Vulnerability Affects 3+ Million Sites via @sejournal, @martinibuster

A high severity vulnerability in a popular WordPress backup plugin allows unauthenticated attackers to exploit the flaw. The vulnerability is rated 8.8 on a scale of 0.0 to 10.

UpdraftPlus: WP Backup & Migration Plugin

The vulnerability affects the popular Updraft Plus WordPress plugin, installed in over 3 million websites. Updraft Plus comes in a free and paid version that allows users to upload backups to a user’s cloud storage or to email the files. The plugin allows users to manually backup the website or schedule it for automatic backups. It offers a tremendous amount of flexibility of what can be backed up and can make a huge difference for recovering from a catastrophic server issue and is also useful for migrating to a different server altogether.

Wordfence explains the vulnerability:

“The UpdraftPlus: WP Backup & Migration Plugin plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.24.11 via deserialization of untrusted input in the ‘recursive_unserialized_replace’ function. This makes it possible for unauthenticated attackers to inject a PHP Object.

No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code. An administrator must perform a search and replace action to trigger the exploit.”

The Updraft Plus changelog seems to minimize the vulnerability, it doesn’t even call the update a security patch, it’s labeled as a “tweak.”

From the official Updraft Plus WordPress plugin changelog:

“TWEAK: Complete the review and removal of calls to the unserialize() PHP function allowing class instantiation begun in 1.24.7. (The final removal involved a theoretical security defect, if your development site allowed an attacker to post content to it which you migrated to another site, and which contained customised code that could perform destructive actions which the attacker knew about, prior to you then cloning the site. The result of this removal is that some search-replaces, highly unlikely to be encountered in practice, will be skipped).”

Updraft Plus Vulnerability Patched

Users are recommended to consider updating their installations of Updraft Plus to the latest version, 1.24.12. All versions prior to the latest version are vulnerable.

Read the Wordfence advisory:

UpdraftPlus: WP Backup & Migration Plugin <= 1.24.11 – Unauthenticated PHP Object Injection

Featured Image by Shutterstock/Tithi Luadthong

Google Shows How To Confirm Indexing Issues Due To JavaScript via @sejournal, @martinibuster

SearchNorwich recently published an excellent video featuring Google’s Martin Splitt discussing how to debug crawling and indexing issues related to JavaScript, saying that most of the times it’s not JavaScript that’s causing indexing issues, the actual cause is something else. Even if you don’t know how to code with JavaScript, the tips that Martin shares will enable anyone to get a good start on debugging crawl issues that are originating on a website.

JavaScript Is Rarely The Cause Of SEO Issues

Martin’s SearchNorwich video was published a month ago. Just a few days ago John Mueller advises that too much JavaScript can have a negative impact on SEO, which aligns with Martin’s assertion that JavaScript is rarely the reason for SEO issues, that it’s either the misuse of JavaScript or something else entirely.

He explains that of the issues that virtually all suspected JavaScript issues that get emailed to him end up being something else. He pins the blame on a flawed approach to debugging SEO issues. What he describes is confirmation bias, which is suspecting that something is the cause and then looking for clues to justify that opinion. The definition of confirmation bias is the tendency to interpret existing evidence or to look for evidence that confirms existing beliefs, while ignoring evidence that contradicts those beliefs.

Martin explained:

“…it seems to me, as someone on the Google side of things, that SEOs look for clues that allow them to blame things they’re seeing on JavaScript. Then they show up, or someone from their team shows up, in my inbox or on my social media and says, “We found a bug. It’s JavaScript. You say JavaScript works in Google Search, but we have a strong hint that it doesn’t, and you know it’s because of JavaScript.”

He goes on to say that out of hundreds of times a year that he’s approached with a diagnosis that JavaScript is to blame for an SEO problem he has only seen one actual instance where an actual bug related to JavaScript was to blame. Just one.

He also says:

“People often claim, “You say it works if you use client-side rendering, but clearly, it is not working. It must be a JavaScript problem and maybe even a bug in Google.” Surprisingly, many of the people who end up in my inbox suspect it’s a Google bug. I find that interesting, especially when a small, niche website claims to be affected by a bug that doesn’t affect any other websites. Most of the time, it’s not us—it’s you.”

Splitt explains that when JavaScript is involved in a crawling or rendering issue, it’s most often not because JavaScript is to blame but rather it’s being used incorrectly

Finding Source Of Rendering Issues

Martin suggests debugging rendering issues by checking how Google “sees” the web page. Rendering, in the context of Googlebot crawling, is the process of downloading all the resources from a web page like fonts, JavaScript, CSS and HTML and then creating fully functional web page that’s similar to what a human user would experience in a web browser.

Debugging how Google renders a page may show that the page renders fine, that certain parts don’t render or that the page cannot be indexed at all.

He recommends using the following tools for debugging possible JavaScript issues:

1. Google Search Console URL Inspection Tool

2. Google Rich Results Test

3. Chrome Dev Tools

Easy JavaScript Debugging

Both of the first two tools let you submit a URL that gets immediately crawled by Google and they’ll show you the rendered page, what the page looks like for Google for indexing purposes.

Martin explains the usefulness of the JavaScript console messages in Chrome Dev Tools:

“There’s also more info that gives you very helpful details about what happened in the JavaScript console messages and what happened in the network. If your content is there and it’s what you expect it to be, then it’s very likely not going to be JavaScript that is causing the problem. If people were doing just that, checking these basics, 90% of the people showing up in my inbox would not show up in my inbox. That’s what I do.”

He also explained that just because the JavaScript console flags an error that doesn’t mean that the problem is with the JavaScript itself. He uses the example of an error in how JavaScript failed to execute that was caused by an API that’s blocked by Robots.txt, preventing the page from rendering.

Why Do So Many SEOs Blame JavaScript?

Martin implies that not knowing how to debug JavaScript is the cause of the reputation it’s received as a cause of crawling and indexing issues. I get it, I learned the basics of coding JavaScript by hand 25 years ago and I disliked it then and now, it’s never been my thing.

But Martin’s right that knowing a few tricks for debugging JavaScript will save a lot of wasted time chasing down the wrong problem.

Watch Martin Splitt’s presentation here:

Maybe It Isn’t JavaScript – Martin Splitt at SearchNorwich 18

Featured Image by Shutterstock/Artem Samokhvalov

Small language models: 10 Breakthrough Technologies 2025

WHO

Allen Institute for Artificial Intelligence, Anthropic, Google, Meta, Microsoft, OpenAI

WHEN

Now

Make no mistake: Size matters in the AI world. When OpenAI launched GPT-3 back in 2020, it was the largest language model ever built. The firm showed that supersizing this type of model was enough to send performance through the roof. That kicked off a technology boom that has been sustained by bigger models ever since. As Noam Brown, a research scientist at OpenAI, told an audience at TEDAI San Francisco in October, “The incredible progress in AI over the past five years can be summarized in one word: scale.”

But as the marginal gains for new high-end models trail off, researchers are figuring out how to do more with less. For certain tasks, smaller models that are trained on more focused data sets can now perform just as well as larger ones—if not better. That’s a boon for businesses eager to deploy AI in a handful of specific ways. You don’t need the entire internet in your model if you’re making the same kind of request again and again. 

Most big tech firms now boast fun-size versions of their flagship models for this purpose: OpenAI offers both GPT-4o and GPT-4o mini; Google DeepMind has Gemini Ultra and Gemini Nano; and Anthropic’s Claude 3 comes in three flavors: outsize Opus, midsize Sonnet, and tiny Haiku. Microsoft is pioneering a range of small language models called Phi.

A growing number of smaller companies offer small models as well. The AI startup Writer claims that its latest language model matches the performance of the largest top-tier models on many key metrics despite in some cases having just a 20th as many parameters (the values that get calculated during training and determine how a model behaves). 

Explore the full 2025 list of 10 Breakthrough Technologies.

Smaller models are more efficient, making them quicker to train and run. That’s good news for anyone wanting a more affordable on-ramp. And it could be good for the climate, too: Because smaller models work with a fraction of the computer oomph required by their giant cousins, they burn less energy. 

These small models also travel well: They can run right in our pockets, without needing to send requests to the cloud. Small is the next big thing.

Vera C. Rubin Observatory: 10 Breakthrough Technologies 2025

WHO

US Department of Energy’s SLAC National Accelerator Laboratory, US National Science Foundation

WHEN

6 months

The next time you glance up at the night sky, consider: The particles inside everything you can see make up only about 5% of what’s out there in the universe. Dark energy and dark matter constitute the rest, astronomers believe—but what exactly is this mysterious stuff? 

A massive new telescope erected in Chile will explore this question and other cosmic unknowns. It’s named for Vera Rubin, an American astronomer who in the 1970s and 1980s observed stars moving faster than expected in the outer reaches of dozens of spiral galaxies. Her calculations made a strong case for the existence of dark matter—mass we can’t directly observe but that appears to shape everything from the paths of stars to the structure of the universe itself. 

Explore the full 2025 list of 10 Breakthrough Technologies.

Soon, her namesake observatory will carry on that work in much higher definition. The facility, run by the SLAC National Accelerator Laboratory and the US National Science Foundation, will house the largest digital camera ever made for astronomy. And its first mission will be to complete what’s called the Legacy Survey of Space and Time. Astronomers will focus its giant lens on the sky over the Southern Hemisphere and snap photo after photo, passing over the same patches of sky repeatedly for a decade. 

By the end of the survey, this 3.2-gigapixel camera will have catalogued 20 billion galaxies and collected up to 60 petabytes of data—roughly three times the amount currently stored by the US Library of Congress. Compiling all these images together, with help from specialized algorithms and a supercomputer, will give astronomers a time-lapse view of the sky. Seeing how so many galaxies are dispersed and shaped will enable them to study dark matter’s gravitational effect. They also plan to create the most detailed three-dimensional map of our Milky Way galaxy ever made. 

If all goes well, the telescope will snap its first science-quality images—a special moment known as first light—in mid-2025. The public could see the first photo released from Rubin soon after. 

Long-acting HIV prevention meds: 10 Breakthrough Technologies 2025

WHO

Gilead Sciences, GSK, ViiV Healthcare

WHEN

1 to 3 years

In June 2024, results from a trial of a new medicine to prevent HIV were announced—and they were jaw-dropping. Lenacapavir, a treatment injected once every six months, protected over 5,000 girls and women in Uganda and South Africa from getting HIV. And it was 100% effective.

The drug, which is produced by Gilead, has other advantages. We’ve had effective pre-exposure prophylactic (PrEP) drugs for HIV since 2012, but these must be taken either daily or in advance of each time a person is exposed to the virus. That’s a big ask for healthy people. And because these medicines also treat infections, there’s stigma attached to taking them. For some, the drugs are expensive or hard to access. In the lenacapavir trial, researchers found that injections of the new drug were more effective than a daily PrEP pill, probably because participants didn’t manage to take the pills every day.

 In 2021, the US Food and Drug Administration approved another long-acting injectable drug that protects against HIV. That drug, cabotegravir, is manufactured by ViiV Healthcare (which is largely owned by GSK) and needs to be injected every two months. But despite huge demand, rollout has been slow.   

Explore the full 2025 list of 10 Breakthrough Technologies.

Scientists and activists hope that the story will be different for lenacapavir. So far, the FDA has approved the drug only for people who already have HIV that’s resistant to other treatments. But Gilead has signed licensing agreements with manufacturers to produce generic versions for HIV prevention in 120 low-income countries. 

In October, Gilead announced more trial results for lenacapavir, finding it 96% effective at preventing HIV infection in just over 3,200 cisgender gay, bisexual, and other men, as well as transgender men, transgender women, and nonbinary people who have sex with people assigned male at birth. 

The United Nations has set a goal of ending AIDS by 2030. It’s ambitious, to say the least: We still see over 1 million new HIV infections globally every year. But we now have the medicines to get us there. What we need is access. 

Generative AI search: 10 Breakthrough Technologies 2025

WHO

Apple, Google, Meta, Microsoft, OpenAI, Perplexity

WHEN

Now

Google’s introduction of AI Overviews, powered by its Gemini language model, will alter how billions of people search the internet. And generative search may be the first step toward an AI agent that handles any question you have or task you need done.

Rather than returning a list of links, AI Overviews offer concise answers to your queries. This makes it easier to get quick insights without scrolling and clicking through to multiple sources. After a rocky start with high-profile nonsense results following its US release in May 2024, Google limited its use of answers that draw on user-­generated content or satire and humor sites.   

Explore the full 2025 list of 10 Breakthrough Technologies.

The rise of generative search isn’t limited to Google. Microsoft and OpenAI both rolled out versions in 2024 as well. Meanwhile, in more places, on our computers and other gadgets, AI-assisted searches are now analyzing images, audio, and video to return custom answers to our queries. 

But Google’s global search dominance makes it the most important player, and the company has already rolled out AI Overviews to more than a billion people worldwide. The result is searches that feel more like conversations. Google and OpenAI both report that people interact differently with generative search—they ask longer questions and pose more follow-ups.    

This new application of AI has serious implications for online advertising and (gulp) media. Because these search products often summarize information from online news stories and articles in their responses, concerns abound that generative search results will leave little reason for people to click through to the original sources, depriving those websites of potential ad revenue. A number of publishers and artists have sued over the use of their content to train AI models; now, generative search will be another battleground between media and Big Tech.

Cattle burping remedies: 10 Breakthrough Technologies 2025

WHO

Blue Ocean Barns, DSM-Firmenich, Rumin8, Symbrosia

WHEN

Now

Companies are finally making real progress on one of the trickiest problems for climate change: cow burps. 

The world’s herds of cattle belch out methane as a by-product of digestion, as do sheep and goats. That powerful greenhouse gas makes up the single biggest source of livestock emissions, which together contribute 11% to 20% of the world’s total climate pollution, depending on the analysis.

It’s hard to meaningfully cut those emissions by reducing demand, simply because hamburgers, steaks, butter, and milk taste good—and a global population that’s growing larger and wealthier is only set to consume more of these foods. 

Explore the full 2025 list of 10 Breakthrough Technologies.

Enter the cattle burping supplement. DSM-Firmenich, a Netherlands-based conglomerate that produces fragrances, pharmaceuticals, and other products, has developed a feed supplement, Bovaer, that it says can cut methane emissions by 30% in dairy cattle and even more in beef cattle. It works by inhibiting an enzyme in the animals’ guts, which ordinarily helps convert hydrogen and carbon dioxide produced during digestion into the methane that they burp up. 

In May 2024, the Food and Drug Administration cleared the way for its use in the US. DSM says the additive is now available in more than 55 countries, including Australia, Brazil, and members of the European Union.

Meanwhile, startups like Blue Ocean Barns, Rumin8, and Symbrosia are developing, testing, or seeking approval for products derived from a type of red seaweed, which could reduce methane levels even further. Still other organizations are trying to tackle the problem in longer-lasting ways, by developing vaccines or altering the microbes in the guts of cattle.

It remains to be seen how many cattle farmers will pay for such products. But in the case of Bovaer, farmers who use it can earn greenhouse-gas credits that some companies will buy on voluntary carbon markets as a way to reduce their corporate climate footprints, according to Elanco, which is marketing the additive in the US. Meanwhile, Rumin8 says cattle taking its supplements could deliver more meat and milk.

The additives certainly don’t solve the whole problem. The cattle industry needs to take other major steps to cut its climate emissions, including halting its encroachment into carbon-absorbing forests. And to make any real dent in demand, food companies will have to develop better, cheaper, cleaner alternative products, like plant-based burgers and dairy substitutes.

But methane-cutting supplements increasingly look like a promising way to solve a big chunk of a very big problem.