Head Of WordPress AI Team Explains SEO For AI Agents via @sejournal, @martinibuster

James LePage, Director Engineering AI at Automattic, and the co-lead of the WordPress AI Team, shared his insights into things publishers should be thinking about in terms of SEO. He’s the founder and co-lead of the WordPress Core AI Team, which is tasked with coordinating AI-related projects within WordPress, including how AI agents will interact within the WordPress ecosystem. He shared insights into what’s coming to the web in the context of AI agents and some of the implications for SEO.

AI Agents And Infrastructure

The first observation that he made was that AI agents will use the same web infrastructure as search engines. The main point he makes is that the data that the agents are using comes from the regular classic search indexes.

He writes, somewhat provocatively:

“Agents will use the same infrastructure the web already has.

  • Search to discover relevant entities.
  • “Domain authority” and trust signals to evaluate sources.
  • Links to traverse between entities.
  • Content to understand what each entity offers.

I find it interesting how much money is flowing into AIO and GEO startups when the underlying way agents retrieve information is by using existing search indexes. ChatGPT uses Bing. Anthropic uses Brave. Google uses Google. The mechanics of the web don’t change. What changes is who’s doing the traversing.”

AI SEO = Longtail Optimization

LePage also said that schema structured data, semantic density, and interlinking between pages is essential for optimizing for AI agents. Notable is that he said that AI optimization that AIO and GEO companies are doing is just basic longtail query optimization.

He explained:

“AI intermediaries doing synthesis need structured, accessible content. Clear schemas, semantic density, good interlinking. This is the challenge most publishers are grappling with now. In fact there’s a bit of FUD in this industry. Billions of dollars flowing into AIO and GEO when much of what AI optimization really is is simply long-tail keyword search optimization.”

What Optimized Content Looks Like For AI Agents

LePage, who is involved in AI within the WordPress ecosystem, said that content should be organized in an “intentional” manner for agent consumption, by which he means structured markdown, semantic markup, and content that’s easy to understand.

A little further he explains what he believes content should look like for AI agent consumption:

“Presentations of content that prioritize what matters most. Rankings that signal which information is authoritative versus supplementary. Representations that progressively disclose detail, giving agents the summary first with clear paths to depth. All of this still static, not conversational, not dynamic, but shaped with agent traversal in mind.

Think of it as the difference between a pile of documents and a well-organized briefing. Both contain the same information. One is far more useful to someone trying to quickly understand what you offer.”

A little later in the article he offers a seemingly contradictory prediction of the role of content in an agentic AI future, reversing today’s formula of a well organized briefing over a pile of documents, saying that agentic AI will not need a website, just the content, a pile of documents.

Nevertheless, he recommends that content have structure so that the information is well organized at the page level with clear hierarchical structure and at the site level as well where interlinking makes the relationships between documents clearer. He emphasizes that the content must communicate what it’s for.

He then adds that in the future websites will have AI agents that communicate with external AI agents, which gets into the paradigm he mentioned of content being split off from the website so that the data can be displayed in ways that make sense for a user, completely separated from today’s concept of visiting a website.

He writes:

“Think of this as a progression. What exists now is essentially Perplexity-style web search with more steps: gather content, generate synthesis, present to user. The user still makes decisions and takes actions. Near-term, users delegate specific tasks with explicit specifications, and agents can take actions like purchases or bookings within bounded authority. Further out, agents operate more autonomously based on standing guidelines, becoming something closer to economic actors in their own right.

The progression is toward more autonomy, but that doesn’t mean humans disappear from the loop. It means the loop gets wider. Instead of approving every action, users set guidelines and review outcomes.

…Before full site delegates exist, there’s a middle ground that matters right now.

The content an agent has access to can be presented in a way that makes sense for how agents work today. Currently, that means structured markdown, clean semantic markup, content that’s easy to parse and understand. But even within static content, there’s room to be intentional about how information is organized for agent consumption.”

His article, titled Agents & The New Internet (3/5), provides useful ideas of how to prepare for the agentic AI future.

Featured Image by Shutterstock/Blessed Stock

WordPress Membership Plugin Flaw Exposes Sensitive Stripe Data via @sejournal, @martinibuster

An advisory was published about a vulnerability discovered in the Membership Plugin By StellarWP which exposes sensitive Stripe payment setup data on WordPress sites using the plugin. The flaw enables unauthenticated attackers to launch attacks and is rated 8.2 (High).

Membership Plugin By StellarWP

The Membership Plugin – Restrict Content By StellarWP is used by WordPress sites to manage paid and private content. It enables site owners to restrict access to pages, posts, or other resources so that only logged-in users or paying members can view them and manage what non-paying site visitors can see. The plugin is commonly deployed on membership and subscription-based sites.

Vulnerable to Unauthenticated Attackers

The Wordfence advisory states that the vulnerability can be exploited by unauthenticated attackers, meaning no login or WordPress user account is required to launch an attack. User permission roles do not factor into whether the issue can be triggered, and that’s what makes this particular vulnerability more dangerous because it’s easier to trigger.

What the Vulnerability Is

The issue stems from missing security checks related to Stripe payment handling. Specifically, the plugin failed to properly protect Stripe SetupIntent data.

A Stripe SetupIntent is used during checkout to collect and save a customer’s payment method for future use. Each SetupIntent includes a client_secret value that is intended to be shared during a checkout or account setup flow.

The official Wordfence advisory explains:

“The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 3.2.16 via the ‘rcp_stripe_create_setup_intent_for_saved_card’ function due to missing capability check.

Additionally, the plugin does not check a user-controlled key, which makes it possible for unauthenticated attackers to leak Stripe SetupIntent client_secret values for any membership.”

According to Stripe’s official documentation, the Setup Intents API is used to set up a payment method for future charges without creating an immediate payment. A SetupIntent includes a client_secret. Stripe’s documentation states that client_secret values should not be stored, logged, or exposed to anyone other than the intended customer.

This is how Stripe’s documentation explains what the purpose is for the Setup Intents API:

“Use the Setup Intents API to set up a payment method for future payments. It’s similar to a payment, but no charge is created.

The goal is to have payment credentials saved and optimized for future payments, meaning the payment method is configured correctly for any scenario. When setting up a card, for example, it may be necessary to authenticate the customer or check the card’s validity with the customer’s bank. Stripe updates the SetupIntent object throughout that process.”

Stripe documentation also explains that client_secret values are used client-side to complete payment-related actions and are intended to be passed securely from the server to the browser. Stripe states that these values should not be stored, logged, or exposed to anyone other than the relevant customer.

This is how Stripe’s documentation explains the client_secret value:

“client_secret
The client secret of this Customer Session. Used on the client to set up secure access to the given customer.

The client secret can be used to provide access to customer from your frontend. It should not be stored, logged, or exposed to anyone other than the relevant customer. Make sure that you have TLS enabled on any page that includes the client secret.”

Because the plugin did not enforce the appropriate protections, Stripe SetupIntent client_secret values could be exposed.

What this means in real life is that Stripe payment setup data associated with memberships was accessible beyond its intended scope.

Affected Versions

The vulnerability affects all versions of the plugin up to and including version 3.2.16. Wordfence assigned the issue a CVSS score of 8.2, reflecting the sensitivity of the exposed data and the fact that no authentication is required to trigger the issue.

A score in this range indicates a high-severity vulnerability that can be exploited remotely without special access, increasing the importance of timely updates for sites that rely on the plugin for managing paid memberships or restricted content.

Patch Availability

The plugin has been updated with a patch and is available now. The issue was fixed in version 3.2.17 of the plugin. The update adds missing nonce and permission checks related to Stripe payment handling, addressing the conditions that allowed SetupIntent client_secret values to be exposed. A nonce is a temporary security token that ensures a specific action on a WordPress website was intentionally requested by the user and not by a malicious attacker.

The official Membership Plugin changelog responsibly discloses the updates:

“3.2.17
Security: Added nonce and permission checks for adding Stripe payment methods.
3.2.16
Security: Improved escaping and sanitization for [restrict] and [register_form] shortcode attributes.”

What Site Owners Should Do

Sites using Membership Plugin – Restrict Content should update to version 3.2.17 or newer.

Failure to update the plugin will leave the Stripe SetupIntent client_secret data exposed to unauthenticated attackers.

Featured Image by Shutterstock/file404

All In One SEO WordPress Vulnerability Affects Over 3 Million Sites via @sejournal, @martinibuster

A security vulnerability was discovered in the popular All in One SEO (AIOSEO) WordPress plugin that made it possible for low-privileged users to access a site’s global AI access token, potentially allowing them to misuse the plugin’s artificial intelligence features and could allow attackers to generate content or consume credits using the affected site’s AIOSEO AI credits and AI features. The plugin is installed on more than 3 million WordPress websites, making the exposure significant.

All in One SEO WordPress Plugin (AIOSEO)

All in One SEO is one of the most widely used WordPress SEO plugins, installed in over 3 million websites. It helps site owners manage search engine optimization tasks such as generating metadata, creating XML sitemaps, adding structured data, and providing AI-powered tools that assist with writing titles, descriptions, blog posts, FAQs, social medial posts, and generate images.

Those AI features rely on a site-wide AI access token that allows the plugin to communicate with the AIOSEO external AI services.

Missing Capability Check

According to Wordfence, the vulnerability was caused by a missing permission check on a specific REST API endpoint used by the plugin which enabled users with contributor level access to view the global AI access token.

In the context of a WordPress website, an API (Application Programming Interface) is like a bridge between the WordPress website and different software applications (including external apps like AIOSEO’s AI content generator) that enable them to securely communicate and share data with one another. A REST endpoint is a URL that exposes an interface to functionality or data.

The flaw was in the following REST API endpoint:

/aioseo/v1/ai/credits

That endpoint is meant to return information about a site’s AI usage and remaining credits. However, it failed to verify whether the user making the request was actually allowed to see that data. AIOSEO’s plugin failed to do a capability check to verify whether someone logged in with a contributor level access can have access to that data.

Because of that, any logged-in user with Contributor-level access or higher could call the endpoint and retrieve the site’s global AI access token.

Wordfence describes the flaw like this:

“This makes it possible for authenticated attackers, with Contributor-level access and above, to disclose the global AI access token.”

The problem was that the implementation of the REST API endpoint did not do a permission check, which enabled someone with contributor level access to see sensitive data.

In WordPress, REST API routes are supposed to include capability checks that ensure only authorized users can access them. In this case, that check was missing, so the plugin treated Contributors the same as administrators when returning the AI token.

Why The Vulnerability Is Problematic

In WordPress, the Contributor level role is one of the lowest privilege levels. Many sites grant Contributor level access to multiple people so that they can submit article drafts for review and publication.

By exposing the global AI token to those users, the plugin may have effectively handed out a site-wide credential that controls access to its AI features. That token could be used to:

1. Unauthorized AI Usage
The token functions as a site wide credential that authorizes AI requests. If an attacker obtains it, they could potentially use it to generate AI content through the affected site’s account, consuming whatever credits or usage limits are associated with that token.

2. Service Depletion
An attacker could automate requests using the exposed token to exhaust the site’s available AI quota. That would prevent site administrators from using the AI features they rely on, effectively creating a denial of service for the plugin’s AI tools.

Even though the vulnerability does not allow direct code execution, leaking a site-wide API token still represents a possible billing risk.

Part Of A Broader Pattern Of Vulnerabilities

This is not the first time All In One SEO has shipped with vulnerabilities related to missing authorization or low-privilege access. According to Wordfence, the plugin has had six vulnerabilities disclosed in 2025 alone, many of which allowed Contributor or Subscriber level users to access or modify data they should not have been able to access.

Those issues included SQL injection, information disclosure, arbitrary media deletion, missing authorization checks, sensitive data exposure, and stored cross-site scripting. The recurring theme across those reports is improper permission enforcement for low-privilege users, the same underlying class of flaw that led to the AI token exposure in this case.

Six vulnerabilities in one year is a high level for an SEO plugin. Yoast SEO plugin had zero vulnerabilities in 2025, RankMath had four vulnerabilities in 2025 and Squirrly SEO had only three vulnerabilities in 2025.

Screenshot Of Six AIOSEO Vulnerabilities In 2025

How The Vulnerability Was Fixed

The vulnerability affects all versions of All in One SEO up to and including 4.9.2. It was addressed in version 4.9.3, which included a security update described in the official plugin changelog by the plugin developers as:

“Hardened API routes to prevent AI access token from being exposed.”

That change corresponds directly to the REST API flaw identified by Wordfence.

What Site Owners Should Do

Anyone running All in One SEO should update to version 4.9.3 or newer as soon as possible. Sites that allow multiple external contributors are especially exposed since low-privilege accounts could access the site’s AI token on vulnerable versions.

Featured Image by Shutterstock/Shutterstock AI Generator

WooCommerce WordPress Plugin Exploit Enables Fraudulent Charges via @sejournal, @martinibuster

The popular WooCommerce Square plugin for WordPress vulnerability enables unauthenticated attackers to uncover credit cards on file and make fraudulent charges. The vulnerability affects up to 80,000 installations.

WooCommerce Square WordPress Plugin

The WooCommerce Square plugin enables WordPress sites to accept payments through the Square POS, as well as synchronize product inventory data between Square and WooCommerce. Square plugin enables a WooCommerce merchant to support payments through Apple Pay®, Google Pay, WooCommerce Pre-Orders, and WooCommerce Subscriptions.

Insecure Direct Object Reference

The vulnerability in the plugin arises from an Insecure Direct Object Reference (IDOR) vulnerability, a flaw that happens when critical data is exposed in URL file parameters, such as identification numbers, which then enables an attacker to manipulate that data without proper access that would normally prevent them from accessing those files.

The Open Worldwide Application Security Project (OWASP) defines IDOR as:

“Insecure Direct Object Reference (IDOR) is a vulnerability that arises when attackers can access or modify objects by manipulating identifiers used in a web application’s URLs or parameters. It occurs due to missing access control checks, which fail to verify whether a user should be allowed to access specific data.”

Exploiting the vulnerability does not require that the attacker acquire any level of authentication or permission levels, making it easier for them to launch an attack on affected websites.

According to a Wordfence advisory:

“The WooCommerce Square plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.1 via the get_token_by_id function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary Square “ccof” (credit card on file) values and leverage this value to potentially make fraudulent charges on the target site.”

There are multiple versions of the WooCommerce Square plugin that are patched, it’s recommended that users of the plugin update to at least one of the following versions:

  • 4.2.3
  • 4.3.2
  • 4.4.2
  • 4.5.2
  • 4.6.4
  • 4.7.4
  • 4.8.8
  • 4.9.9
  • 5.0.1
  • 5.1.2

The CVSS severity vulnerability score is rated at 7.5, indicating it’s a dangerous vulnerability that can be remotely exploitable but is mitigated by a constraint that keeps it from being rated as “Critical.”

Featured Image by Shutterstock/IgorZh

WordPress X Account’s ‘Childish’ Trolling Causes Backlash via @sejournal, @martinibuster

An official WordPress.org social media account was used to troll the open source movement to decentralize the WordPress plugins and themes repository, creating what some feel was an undignified, even “childish”, representation of the WordPress community.

What Is The FAIR Project?

The Federated And Independent Repositories project is an open-source initiative that was launched in 2025 in response to actions by Matt Mullenweg and Automattic that exposed a weakness in how plugins and themes are distributed to WordPress sites. The project was initiated after Mullenweg cut off WP Engine from updating their plugins, disrupting the proper functioning of thousands of websites.

The FAIR goal of the FAIR project is to decentralize the distribution of WordPress plugins and themes to protect against one person from disrupting the free distribution of software.

FAIR is backed by open source giant Linux, announced in June 2025. The official announcement explained that the purpose of FAIR is to create a “vendor-neutral” method for distributing WordPress software within a trusted environment, writing:

“Vendor-neutral package management for content management systems like WordPress provides critical universal infrastructure that addresses the new realities of content, e-commerce and AI.

The FAIR Package Manager project helps make plugins and tools more discoverable and lets developers choose where to source those plugins depending on the needs of their supply chain. By giving commercial plugin developers, hosts, and application developers more options to control the tools they rely on, the FAIR Package Manager project promotes innovation and protects business continuity.”

What Caused An Issue With FAIR?

A WordPress user recently experienced a temporary problem updating their website using the FAIR repository, forcing them to manually SFTP the software updates to their server.

They posted on X:

“Here I am updating one of my sites for the new year, and it looks like FAIR broke my plugin and theme updates.”

After updating their site they returned to X with more thoughts about their experience with FAIR:

“Glad this was just a “for fun” site and not something critical. I like experimenting with stuff in the WordPress ecosystem, but this is a bit too experimental for my taste. Going back to stock updates, at least until 2.0.

…This is making me rethink how I organize my domains and sites. Should probably just set up a sandbox for things like this, but then again… the squeaky wheel gets the grease. If it’s all locked away in a sandbox, I’ll forget to ever touch it.”

There was an issue with an update to FAIR version 1.2.2. According to the release notes:

“FAIR Connect 1.2.2 Release Announcement

Version 1.2.2 of FAIR Connect is a fast follow up to our version 1.2.1 release. This release fixes a fatal error introduced in 1.2.1 that impacts the updating process.

If you previously updated to 1.2.1, you will need to perform this update manually.”

So apparently there’s an issue with updating the FAIR Connect plugin which requires manually deactivating the FAIR Connect plugin, downloading the updated version of the plugin from the FAIR repository, then manually uploading the plugin from the WordPress admin plugin dashboard (unless the site is unavailable, which necessitates SFTP’ing the updated plugin).

WordPress Trolls The FAIR Project

The official WordPress.org X account posted the following comment about the FAIR project:

“Looks like the Federated and Independent Repository project is going great. This is clearly going to rock the WordPress world. We don’t know how we’ll continue without these contributors. Maybe they need some REST.”

The post was highly unusual for the WordPress X account because it’s normally a feel-good destination of announcements and inspiration related to WordPress. The unprofessional tone of the post caught many in the WordPress community by surprise.

One person shared their disappointment:

“Hi Matt! These comments aren’t clearly going to rock the atmosphere in our community too. So, http://WP.org never had issues?”

RapidLightnings responded:

“These people working at or for WordPress are so childish and unprofessional. Professional people wouldn’t care or would not post stuff like that on official accounts.”

Responses Hidden By WordPress

There were additional responses that were hidden by WordPress:

Like this by o_be_one:

“For an OpenSource project, your take is toxic af.”

Rohan K called the post by the official WordPress account immature:

“Growing pains. Why are you gleefully gloating about this, when your immature and short-sighted actions led the creation of it? It makes you look bad.

Grow up.”

Aron Prins posted a one-word response:

“Ewww”

Thisbit commented on how it reflects poorly on the WordPress leadership:

“Shameful leadership.”

Jono Alderson reflected on the childishness of the tweet:

“Oh hush. Your misuse of this account for sniping is childish and tedious. Be better.”

Other posts were directed at Matt Mullenweg, with this one prematurely dancing on WordPress’s grave:

“SO HAPPY that AI is ending WordPress for good.
Ciao CattyMatty”

And this one:

“I’d say get a clue, but you’d probably steal it from another developer.”

Jono Alderson’s Response

Alderson started a new discussion to express his opinion about the WordPress troll-post:

“I love WordPress-the-software, but this kind of childish nonsense makes me ashamed and embarrassed to be associated with WordPress-the-brand. What childish, petty, unprofessional, shameful, amateur nonsense. All of these people need firing and replacing with capable grown-ups.”

The responses to Jono’s post generally expressed disappointment that the official WordPress account was used for trolling, with one person responding that it seemed crazy.

Featured Image by Shutterstock/AYO Production

Review Of 2025: Highlights & Lowlights For SEO (& WordPress) via @sejournal, @martinibuster

It was a landmark year in SEO, largely driven by the uncertainty introduced by AI Search. The year began with the digital marketing community questioning its relevance and ended with a strong affirmation of its central position as it gradually adjusted to new realities. WordPress entered the year with uncertainty about whether the core would see meaningful updates and closed out the year with version 6.9, an update that strongly positions it for AI-led innovations.

GEO Is Recognized But Remains An Inchoate Concept

SEOs Turn To Geo

2025 is the year that GEO went mainstream, energized by client demand for solutions that are specific to AI Search. This resulted in the somewhat awkward situation of some SEOs pivoting to providing GEO-specific services while simultaneously affirming SEO best practices for ranking in AI search. Attempts to define GEO as a process distinct from SEO generally fell short.

WordPress SEO Plugins Go GEO

WordPress SEO plugins faced a similar issue with clients demanding GEO-specific solutions, leading to the introduction of LLMs.txt generation features. LLMs.txt is a proposed standard for providing content to AI; however, it’s a solution in search of existential justification because no AI companies use or have plans to adopt the standard.

While other WordPress SEO plugins justified LLMs.txt support as a future-proofing feature, the Squirrly SEO WordPress plugin was refreshingly candid about its reasons for introducing it:

“I know that many of you love using Squirrly SEO and want to keep using it. Which is why you’ve asked us to bring this feature.

So we brought it.

But, because I care about you: know that LLMs txt will not help you magically appear in AI search. There is currently zero proof that it helps with being promoted by AI search engines.”

Google Accidentally GEOs Itself

Google’s John Mueller has strongly and unambiguously insisted there are many reasons why the LLMs.txt proposal is not viable. Thus, many were startled and amused when Lidia Infante discovered that Google itself was using LLMs.txt. The LLMs.txt file was quickly removed, but that didn’t stop some GEO “experts” from crowing that Google’s use of the file validates LLMs.txt, apparently unaware that Google had already removed it.

Google’s Advice For Better Rankings: Become A Brand

In remarks at the New York City Search Central Live event (which I attended), Google’s Danny Sullivan encouraged SEOs and businesses to think about how they can differentiate themselves as brands in order to improve their search visibility.

Sullivan explained:

“And I’ve seen where people do research and say, ‘I’ve figured out that if you have a lot of branded searches…’ That’s kind of valid in some sense.

…What it’s saying is that people have recognized you as a brand, which is a good thing. We like brands. Some brands we don’t like, but at least we recognize them, right?

So if you’re trying to be found in the sea of content and you have the 150,000th fried chicken recipe, it’s very difficult to understand which ones of those are necessarily better than anybody else’s out there.

But if you are recognized as a brand in your field, big, small, whatever, just a brand, then that’s important.

That correlates with a lot of signals of perhaps success with search. Not that you’re a brand but that people are recognizing you. People may be coming to you directly, people, may be referring to you in lots of different ways… You’re not just sort of this anonymous type of thing.”

Sullivan’s reference to “branded searches” may have been a reference to an article I wrote about Google’s branded search patent that describes the use of branded search queries as ranking factors.

People think of “brand” in terms of something that big sites have and little sites do not. But the reality is that brand is just what people think about a company, and the challenge for any business is to distinguish itself from its competitors in such a way that its customers and site visitors remember it, ask for it by name on Google search, and recommend the site to their friends. That, in a nutshell, is how I interpret what Danny Sullivan was communicating.

User behavior is a trusted source of signals that can indicate qualities like expertise, experience, authoritativeness, and trustworthiness (E-E-A-T). E-E-A-T is not something that an SEO adds to a website. While Google has cryptically referred to signals that it uses to determine qualities related to E-E-A-T, in my opinion, those signals are likely related to how users react to a website, user behavior signals.

Read what Danny Sullivan said: Google’s SEO Tips For Better Rankings – Search Central Live NYC

Advances In AI And Search

This year saw the publication of a number of research papers and patents that point to improvements in AI and algorithms that may play a role in how webpages are ranked.

Google’s Thematic Search Patent

Google filed a patent that describes how an LLM can organize related search results by themes and then provide a short summary. It describes a deep research method that closely parallels what we see happening in AI Mode.

The patent describes the invention:

“In some examples, in response to the search query being generated, the thematic search engine may generate thematic data from at least a portion of the search results. For example, the thematic search engine may obtain the search results and may generate narrower themes (e.g., sub-themes) (e.g., “neighborhood A”, “neighborhood B”, “neighborhood C”) from the responsive documents of the search results. The search results page may display the sub-themes of theme and/or the thematic search results for the search query. The process may continue, where selection of a sub-theme of theme may cause the thematic search engine to obtain another set of search results from the search engine and may generate narrower themes (e.g., sub-sub-themes of theme) from the search results and so forth.”

The takeaway from the above passage is that an AI system that incorporates what’s in the patent is still relying on a search engine for retrieving the documents. What those who are interested in GEO need to wrap their heads around is that what’s being ranked for a given search query is vastly different from classic search because it’s generating “sub-themes” of the initial query and then ranking those webpages in addition to the initial query.

Insight About GEO: While the underlying infrastructure is still classic search, what’s getting ranked is not classic search relative to the initial query. This is the nuance that genuinely distinguishes GEO from SEO.

The patent also describes a summary generator that groups answers by themes using data from passages from documents, but may also use data from titles, metadata, and surrounding passages.

Read more: Google’s Thematic Search Patent

Google’s Patent On Personalization In AI Answers

Google filed a patent about using five real-world contextual signals to influence the answers that an AI answer engine provides.

The five factors that this system describes as influencing LLM answers are:

  1. Time, Location, And Environmental Context.
  2. User-Specific Context.
  3. Dialog Intent And Prior Interactions.
  4. Inputs (text, touch, and speech).
  5. System And Device Context.

The first four factors influence the answers provided by the LLM. The last one influences whether to turn off LLM-assisted answers and revert to standard AI answers.

An interesting part of this patent is about the concept of “related intents.”

The patent describes how this works:

“For example, …one or more of the LLMs can determine an intent associated with the given assistant query… Further, the one or more of the LLMs can identify, based on the intent associated with the given assistant query, at least one related intent that is related to the intent associated with the given assistant query… Moreover, the one or more of the LLMs can generate the additional assistant query based on the at least one related intent.”

This patent is useful for understanding how AI Search differs from Classic Search. It describes a way that AI systems can personalize answers with context-aware responses.

Read more: Google Patent On Using Contextual Signals Beyond Query Semantics

Google’s Patent On Personal History-Based Search

This patent is about solving a user’s problem of identifying where they read about a certain topic, whether the topic was in an email or a webpage. The name of the patent is Generating Query Answers From A User’s History.

Traditional email search did not enable natural language querying; it still relied on basic keyword-matching algorithms. This patent solves that problem, partially through the ability to understand fuzzy queries.

The patent describes this process:

“For example, the browser history collection… may include a list of web pages that were accessed by the user. The search engine… may obtain documents from the index… based on the filters from the formatted query.

For example, if the formatted query… includes a date filter (e.g., “last week”) and a topic filter (e.g., “chess story”), the search engine… may retrieve only documents from the collection… that satisfy these filters, i.e., documents that the user accessed in the previous week that relate to a “chess story.””

Read more: Google Files New Patent On Personal History-Based Search

Google’s Sufficient Context Signal

Google published a research paper introducing a new method for determining whether retrieved content provides enough information to answer a query. The breakthrough makes it possible to identify when retrieved context is incomplete or insufficient, which is a major source of hallucinations in RAG systems.

The paper’s contributions and insights are:

  • Defines “sufficient context” as a content passage that contains enough information to answer the question.
  • Builds an autorater that classifies whether a retrieved passage has sufficient context.
  • Provides the insight that hallucinations can still happen when context is sufficient, meaning that hallucinations are not only a retrieval problem.
  • Provides the insight that models can provide correct answers with insufficient context, sometimes because of “parametric memory,” which is the knowledge from their model training.
  • Proposes a selective generation framework that uses the sufficient-context signal plus a confidence signal to reduce hallucinations by 2-10%.

SEO Takeaway: The research paper underscores the importance of ensuring that published content contains the necessary context to fully support the topics it covers.

Read more: Google Researchers Improve RAG With “Sufficient Context” Signal

MUVERA

Google’s MUVERA enables multi-vector models to retrieve at speeds comparable to single-vector systems while preserving their ability to perform token-level matching. Token-level matching means the model compares each individual word in the query to individual words in the content it evaluates. MUVERA keeps the accuracy advantages of multi-vector models while removing the heavy computation in the retrieval step by learning efficient virtual document vectors that approximate multi-vector scoring.

Read about Google MUVERA

WordPress And AI

WordPress generated buzz in the developer community with the announcement of the WordPress Abilities API, a way to safely integrate external plugin functionalities into WordPress in a more unified, less fragmented way. This also lays the foundation for a dramatic expansion of capabilities with AI.

According to WordPress:

“This API creates a centralized registry where all functionalities can be formally registered with well-defined schemas, comprehensive descriptions, and explicit permissions. By adopting this common language, plugins and themes will empower AI-driven solutions to seamlessly discover, interpret, utilize, and coordinate capabilities throughout the entire WordPress ecosystem.”

The December State of the Word event in San Francisco provided a sneak peek at the improvements AI will play in online publishing. WordPress co-creator Matt Mullenweg said that he envisions hundreds, if not thousands, of specialized AI models integrated into different levels of the WordPress workflow.

Mullenweg explained:

“So I imagine that in the future, we’ll actually have hundreds, if not thousands, of different specialized models that might be tuned for different things. In fact, in some of our work at Automattic around like a site builder, we’re finding that models that are tuned specifically for like logo creation can be essentially fine-tuned or smaller, cheaper to run, sort of less memory, etcetera, can do more specialized tasks.”

Mullenweg views a future in which narrowly focused models contribute to different parts of the publishing process, showing how WordPress expects AI to take on routine creative tasks so that users can focus on the work that matters, further democratizing the act of publishing online.

2025 “Low-Lights”

Google Blocks Rank Trackers

Google blocked rank trackers from scraping the top 100 search results. An unexpected consequence of blocking rank trackers from scraping the top 100 search results is that Google Search Console began reporting fewer keyword impressions, sending SEOs and businesses into a panic. It turned out that rank trackers had been inflating the Search Console impression data.

This, in turn, caused some SEOs to revise the idea of zero-click searches, an idea dating from at least 2019, that blamed a low click-to-impression ratio on things like Featured Snippets. In hindsight, that low ratio of clicks to impressions was likely due to inflated impression data.

Declining Clicks Is A Reality

The irony of the zero-click idea being revisited is that businesses in 2025 are reporting declines in traffic that are blamed on Google’s AI Overviews and AI Mode. The biggest story of the year related to SEO is arguably the decline of search clicks.

While Google’s CEO Sundar Pichai insisted that Google’s AI Overviews is sending more clicks than ever, SEOs and their clients strongly disagreed with that point of view.

WordPress Versus WP Engine

The news dominating the WordPress world in 2025 was Automattic and WordPress co-creator Matt Mullenweg’s self-described “nuclear” attacks against WP Engine, which included publishing a website with the goal of encouraging WP Engine’s customers to migrate away, locking WP Engine out of the WordPress ecosystem, and creating a copy of WP Engine’s premium version of their ACF plugin.

The basis for the conflict is what Mullenweg describes as WP Engine’s lack of support for the open-source WordPress project. WP Engine responded with a federal lawsuit against Mullenweg and Automattic, seeking to hold them responsible for actions that WP Engine argued hindered its business.

Many months later, Automattic responded with a counterclaim against WP Engine, using creative statistics about WP Engine’s use of SEO that, in my expert opinion, don’t hold up on closer scrutiny (Read: Automattic’s Legal Claims About SEO… Is This Real?).

Automattic and Matt Mullenweg are on solid ground to encourage big corporations to give back to the WordPress community because it supports the long-term viability of the WordPress open source project. It’s quite likely that many in the WordPress community would have rallied behind Mullenweg against WP Engine if he had pursued a less extreme approach toward WP Engine.

Negative Sentiment Against WordPress Co-Creator

What happened between Mullenweg and WP Engine arguably backfired on Mullenweg, generating substantial negative sentiment against him that persists to this very day. The effect is that many in the community are siding against Mullenweg while simultaneously not necessarily siding with WP Engine.

An example of how the negativity persists, Kevin Geary, the creator of the Etch WordPress page builder, recently tweeted:

“As usual, the adults do sensible things and serve the community, and all Matt can do is p— on us and wreak havoc.

WP is an unserious org led by an unserious person. Embarrassing.”

Another example: It didn’t take long for negative sentiment against Mullenweg to arise in a recent popular Reddit discussion about Automattic’s SCF plugin, a fork of WP Engine’s premium ACF plugin.

A Redditor asked:

“ACF vs SCF this far along – have they diverged?
Politics and such aside – , what is the difference now between Advanced Custom Fields and Secure Custom Fields after some time developing?”

A typical comment:

“When you say “politics and such aside,” it’s pretty hard to put GPL theft of the most extreme WordPress has ever seen aside.

Just don’t use SCF. Plain and simple.”

Another Redditor responded:

“Man u must have missed it when the wordpress owner had a feud with wpengine over their branding and spiraled and then stole the ACF plugin and renamed it and started just burning bridges and flexing ownership ability

He even put some petty checkbox on the wp login screen like check this box that you’re in no way working with WPEngine or you can’t log in

It was crazy / petty / weird and then in the end scary for all plugin devs that what you thought was open source could be manhandled and banned and stolen or replaced by one guy at the top of wordpress

Sad to see”

Many people are grateful to Matt Mullenweg for what he’s accomplished with WordPress. But, as the Redditor commented, the conflict was “sad to see.” One doesn’t have to click around the web for long to discover evidence of the extremely negative sentiment that follows Mullenweg around across the internet.

2025 Online Marketing Wrapped

2025 was largely a year of transition. Everything, from SEO to WordPress to the tools that online businesses use, was in the process of preparing for what comes next. In terms of internet marketing, 2025 was the gateway to 2026.

More Resources:


Featured Image: Emre Akkoyun/Shutterstock

Redirection For Contact Form 7 WordPress Plugin Vulnerability via @sejournal, @martinibuster

A vulnerability in the popular WordPress Contact Form 7 plugin addon installed in over 300,000 websites enables attackers to upload malicious files and makes it possible for them to copy files from the server.

Redirection For Contact Form 7

The Redirection for Contact Form 7 WordPress plugin by Themeisle is an add-on to the popular Contact Form 7 plugin. It enables websites to redirect site visitors to any web page after a form submission, as well as store information in a database and other functions.

Vulnerable To Unauthenticated Attackers

What makes this vulnerability especially concerning is that it is an unauthenticated vulnerability, which means that an attacker doesn’t need to log in or acquire any level user privilege (like subscriber level). This makes it easier for an attacker take advantage of a flaw.

According to Wordfence:

“The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ‘move_file_to_upload’ function in all versions up to, and including, 3.2.7. This makes it possible for unauthenticated attackers to copy arbitrary files on the affected site’s server. If ‘allow_url_fopen’ is set to ‘On’, it is possible to upload a remote file to the server.”

That last part of the vulnerability is what makes exploiting it a little harder. ‘allow_url_fopen’ controls how PHP handles files. PHP ships with this set to “On” but most shared hosting providers routinely set this to “Off” in order to prevent security vulnerabilities.

Although this is an unauthenticated vulnerability which make it easier to take advantage, the fact that it relies on the PHP ‘allow_url_fopen’ setting to be “on” mitigates the likelihood of the flaw being exploited.

Users of the plugin are encouraged to update to version 3.2.8 of the plugin or newer.

Featured Image by Shutterstock/katalinks

Core Web Vitals Champ: Open Source Versus Proprietary Platforms via @sejournal, @martinibuster

The Core Web Vitals Technology Report by the open source HTTPArchive community ranks content management systems by how well they perform on Google’s Core Web Vitals (CWV). The November 2025 data shows a significant gap between platforms with the highest ranked CMS scoring 84.87% of sites passing CWV, while the lowest ranked CMS scored 46.28%.

What’s of interest this month is that the top three Core Web Vitals champs are all closed source proprietary platforms while the open source systems were at the bottom of the pack.

Importance Of Core Web Vitals

Core Web Vitals (CWV) are metrics created by Google to measure how fast, stable, and responsive a website feels to users. Websites that load quickly and respond smoothly keep visitors engaged and tend to perform better in terms of sales, reads, and add impressions, while sites that fall short frustrate users, increase bounce rates, and perform less well for business goals. CWV scores reflect the quality of the user experience and how a site performs under real-world conditions.

How the Data Is Collected

The CWV Technology Report combines two public datasets.

The Chrome UX Report (CrUX) uses data from Chrome users who opt in to share performance statistics as they browse. This reflects how real users experience websites.
The HTTP Archive runs lab-based tests that analyze how sites are built and whether they follow performance best practices.

Together, the report I generated provides a snapshot of how each content management system performs on Core Web Vitals.

Ranking By November 2025 CWV Score

Duda Is The Number One Ranked Core Web Vitals Champ

Duda ranked first in November 2025, with 84.87% of sites built on the platform delivering a passing Core Web Vitals score. It was the only platform in this comparison where more than four out of five sites achieved a good CWV score. Duda has consistently ranked #1 for Core Web Vitals for several years now.

Wix Ranked #2

Wix ranked second, with 74.86% of sites passing CWV. While it trailed Duda by ten percentage points, Wix was just about four percentage points ahead of the third place CMS in this comparison.

Squarespace Ranked #3

Squarespace ranked third, at 70.39%. Its CWV pass rate placed it closer to Wix than to Drupal, maintaining a clear position in the top three ranked publishing platforms.

Drupal Ranked #4

Drupal ranked fourth, with 63.27% of sites passing CWV. That score put Drupal in the middle of the comparison, below the three private label site builders. This is a curious situation because the bottom three CMS’s in this comparison are all open source platforms.

Joomla Ranked #5

Joomla ranked fifth, at 56.92%. While more than half of Joomla sites passed CWV, the platform remained well behind the top performers.

WordPress Ranked Last at position #6

WordPress ranked last, with 46.28% of sites passing Core Web Vitals. Fewer than half of WordPress sites met the CWV thresholds in this snapshot. What’s notable about WordPress’s poor ranking is that it lags behind the fifth place Joomla by about ten percentage points. So not only is WordPress ranked last in this comparison, it’s decisively last.

Why the Numbers Matter

Core Web Vitals scores translate into measurable differences in how users experience websites. Platforms at the top of the ranking deliver faster and more stable experiences across a larger share of sites, while platforms at the bottom expose a greater number of users to slower and less responsive pages. The gap between Duda and WordPress in the November 2025 comparison was nearly 40 percentage points, 38.59 percentage points.

While an argument can be made that the WordPress ecosystem of plugins and themes may be to blame for the low CWV scores, the fact remains that WordPress is dead last in this comparison. Perhaps WordPress needs to become more proactive about how themes and plugins perform, such as come up with standards that they have to meet in order to gain a performance certification. That might cause plugin and theme makers to prioritize performance.

Do Content Management Systems Matter For Ranking?

I have mentioned this before and will repeat it this month. There have been discussions and debates about whether the choice of content management system affects search rankings. Some argue that plugins and flexibility make WordPress easier to rank in Google. But the fact is that private platforms like Duda, Wix, and Squarespace have all focused on providing competitive SEO functionalities that automate a wide range of technical SEO tasks.

Some people insist that Core Web Vitals make a significant contribution to their rankings and I believe them. But in general, the fact is that CWV performance is a minor ranking factor.

Nevertheless, performance still matters for outcomes that are immediate and measurable, such as user experience and conversions, which means that the November 2025 HTTPArchive Technology Report should not be ignored.

The HTTPArchive report is available here but it will be going away and replaced very soon. I’ve tried the new report and, unless I missed something, it lacks a way to constrain the report by date.

Featured Image by Shutterstock/Red Fox studio

WooCommerce Is Integrating Agentic AI Capabilities via @sejournal, @martinibuster

WooCommerce announced that it will roll out integration with Stripe’s Agentic Commerce Suite, which will enable AI shopping assistants to conduct transactions.

Agentic AI Shopping

Agentic AI seems a long way off but OpenAI currently supports end-to-end shopping from the discovery and comparison stages to completing purchases. With the rollout in WooCommerce the infrastructure will be in place to enable over four million stores to be accept product browsing and payments through AI agents.

Stripe Agentic Commerce Suite

Stripe’s Agentic Commerce Suite uses the Agentic Commerce Protocol (ACP), an open source protocol jointly created by Stripe and OpenAI. ACP is model agnostic and does not lock in users to any particular payment provider.

ACP is compatible with the Model Context Protocol (MCP) which was created by Anthropic initially for connecting AI models to external data. The significance is that MCP enables models to call APIs, retrieve data, and perform actions.

According to the official WooCommerce announcement:

“WooCommerce is proud to be a launch partner. Woo merchants will be among the first to benefit when Agentic Commerce Suite rolls out in the coming months.

This is a significant moment for WooCommerce merchants. Instead of building custom integrations for every new AI shopping assistant or platform, you’ll be able to connect your product catalog once and reach customers shopping through whichever AI agent they prefer. Stripe handles discovery, checkout, payments, and fraud protection, while you continue using your existing WooCommerce + Stripe stack.”

This represents a step toward putting the necessary infrastructure in place to enable consumers to interact with AI as part of a new shopping experience. The very near future may see a dramatic change in shopping habits, something SEOs and merchants will have to consider.

Featured Image by Shutterstock/TarikVision

WordPress Meets Vibe Coding: White-Labeled Platform & API For Search-Ready AI Websites

This post was sponsored by 10Web. The opinions expressed in this article are the sponsor’s own.

Not long ago, building a website meant a discovery call, a proposal, a sitemap, and a few weeks of back and forth. Today, we go from “I need a website” to “Why isn’t it live yet?” People are getting used to typing a short prompt and seeing an entire site structure, design, and a first-draft of their site in minutes. That doesn’t replace all the strategy, UX, or growth work, but it changes expectations about how fast the first version should appear, and how teams work.

This shift puts pressure on everyone who sits between the user and the web: agencies, MSPs, hosting companies, domain registrars, and SaaS platforms. If your users can get an AI-generated site somewhere else in a few clicks, you better catch the wave or be forgotten.

That’s why the real competition is moving to those who control distribution and can embed an AI-native, white-label builder directly into products. WordPress still powers over 43% of all websites globally, and remains the default foundation for many of these distribution players.

Now that AI-native builders, reseller suites, and website builder APIs are available on top of WordPress, who will own that experience and the recurring revenue that comes with it.

AI & Vibe Coding Is Turning Speed-To-Launch Into a Baseline 

AI site builders and vibe coding tools have taught people a new habit: describe what you want, get a working draft of a site almost immediately.

Instead of filling out long briefs and waiting for mockups, users can:

  • Type or paste a business description,
  • Point to a few example sites,
  • Click generate,
  • And see a homepage, key inner pages, and placeholder copy appear in minutes.

For non-technical users, this is magic. For agencies and infrastructure providers, it’s a new kind of pressure. The baseline expectation has become seeing something live quickly and refining it afterward.

This demand is everywhere:

  • Small businesses want a site as soon as they buy a domain or sign up for SaaS.
  • Creators expect their website to follow them seamlessly from the tools they already use.
  • Teams inside larger organizations need landing pages and microsites created on demand, without long internal queues.

If you’re an agency, MSP, hosting provider, domain registrar, or SaaS platform, you’re now measured against that baseline, no matter what your stack was designed for. Bolting on a generic external builder isn’t enough. Users want websites inside the experience they trust and already pay you for, with your branding, your billing, and your support.

AI-native builders that are built directly into your stack are no longer a nice bonus but an essential part of your product.

With Vibe Coding Leveling The Field: What Is Your Differentiator? 

In this environment, the biggest advantage doesn’t belong to whoever ships the flashiest AI demo. It belongs to whoever owns the distribution channels:

  • Agencies and MSPs, the ground level players holding client relationships and trust.
  • Hosting and cloud providers where businesses park their infrastructure.
  • Domain registrars where the online journey starts.
  • SaaS platforms, already owning the critical data needed to reflect and sync with company websites.

These players already control the key moments when someone goes from thinking they need a website to taking action.

  • Buying a domain
  • Using a vertical SaaS product
  • Working with an MSP or agency retainer
  • Adding a new location, service, or product line

If, at those moments, the platform automatically provides an AI-generated, editable site under the same login, billing, and support, the choice of stack is made by default. Users simply stay with the builder that’s already built into the service or product they use.

This is why white-label builders, reseller suites, and website builder APIs matter. They give distribution owners the opportunity to:

  • Brand the website experience as their own
  • Decide on the underlying technology (e.g., AI-native WordPress)
  • Bundle sites with hosting, marketing, or other services
  • Keep the recurring revenue and data inside their ecosystem

In other words, as AI pushes the web toward instant presence, distribution owners who embed website creation into their existing flows become the gatekeepers of which tools, stacks, and platforms win.

How To Connect WordPress Development, SEO & Vibe Coding

For most distribution owners, WordPress is still the safest base to standardize on. It powers a huge share of the web, has a deep plugin and WooCommerce ecosystem, and a large talent pool, which makes it easier to run thousands of sites without being tied to a single vendor. Its open-source nature also allows full rebranding and custom flows, exactly what white-label providers need, while automated provisioning, multisite, and APIs make it a natural infrastructure layer for branded site creation at scale. The missing piece has been a truly AI-native, generation-first builder. The latest AI-powered WordPress tools are closing that gap and expanding what distribution owners can offer out of the box.

Use AI-Native WordPress & White Label Embeddable Solutions

Most of the visible WordPress innovation around AI and websites has happened in standalone AI builders or coding assistants, relying on scattered plugins and lightweight helpers. The CMS is solid, but the first version of a site is still mostly assembled by hand.

AI-native WordPress builders move AI into the core flow: from intent straight to a structured, production-ready WordPress site in one step. In 10Web’s case, Vibe for WordPress is the first to bring Vibe Coding to the market with a React front end and deep integrations with WordPress. As opposed to previous versions of the builder or other website builders working off of generic templates and content, Vibe for WordPress allows the customer to have unlimited freedom during and after website generation via chat based AI and using natural language.

For distribution owners, AI only matters if it is packaged in a way they can sell, support, and scale. At its core, the 10Web’s White Label solution is a fully white-labeled AI website builder and hosting environment that partners brand as their own, spanning the dashboard, onboarding flows, and even the WordPress admin experience.

Instead of sending customers to a third-party tool, partners work in a multi-tenant platform where they can:

  • Brand the entire experience (logo, colors, custom domain).
  • Provision and manage WordPress sites, hosting, and domains at scale.
  • Package plans, track usage and overages, and connect their own billing and SSO.

In practice, a telco, registrar, or SaaS platform can offer AI-built WordPress websites under its own brand without building an editor, a hosting stack, or a management console from scratch.

APIs and White-Label: Quickly Code New Sites Or Allow Your Clients To Feel In Control

There is one fine nuance, yet so important. Speed alone isn’t a deciding factor on who wins the next wave of web creation. Teams that can wire that speed directly into their distribution channels and workflows will be the first to the finish line.

The White label platforms and APIs are two sides of the same strategy. The reseller suite gives partners a turnkey, branded control center; the API lets them take the same capabilities and thread them through domain purchase flows, SaaS onboarding, or MSP client portals.

From there, partners can:

  • Generate sites and WooCommerce stores from prompts or templates.
  • Provision hosting, domains, and SSL, and manage backups and restore points via API.
  • Control plugins, templates, and vertical presets so each tenant or region gets a curated, governed stack.
  • Pull usage metrics, logs, and webhooks into their own analytics and billing layers.

For MSPs and agencies treating websites as a packaged, recurring service, see more predictable revenue and stickier client relationships. They bake “website included” into retainers, care plans, and bundles, using white-label reseller dashboard to keep everything under their own brand.

As for SaaS platform and vertical solutions, instead of just giving partners a branded dashboard, 10Web’s Website Builder API lets them embed AI-powered WordPress site creation and lifecycle management directly into their own products. At a high level, it’s a white-label AI builder you plug in via API so your users can create production-ready WordPress sites and stores in under a minute, without ever leaving your app.

In this model, when someone buys a domain, signs up for a SaaS tool, or comes under an MSP contract, they experience the AI website Builder as a built-in part of the product. And the distribution owner, armed with white-label and API tools, is the one who captures the recurring value of that relationship.

The Next Wave

WordPress remains the foundation distribution owners trust, the layer they know can scale from a single landing page to thousands of client sites. With 10Web’s  AI-native builder, reseller dashboard, and API, it isn’t playing catch-up anymore, but is quickly becoming the engine behind fast, governed, repeatable site creation.

For agencies, MSPs, cloud infrastructure providers, and SaaS platforms, that means they can sell websites as a packaged service. The winners of the next wave are the ones who wire AI-native, white-label WordPress into their distribution and turn “website included” into their default.

Unlock new revenue by selling AI. Websites, Hosting, AI Branding, AI Agents, SMB Tools, and your own services.


Image Credits

Featured Image: Image by 10Web. Used with permission.