WordPress Interview: How SEOs & Publishers Can Improve WordPress via @sejournal, @martinibuster

A full-time sponsored contributor to WordPress discussed how publishers and members of the search marketing community can influence WordPress so that it’s more useful for all the things they want it to do.

The person I spoke with was Naoko Takano, a full-time sponsored WordPress contributor whose focus is on contributor experience improvement. She has also been responsible for organizing WordPress events in Asia.

WordPress Community

Many regard WordPress as software to manage content. But WordPress is more than that.

WordPress is actually a community that creates WordPress together.

As part of that reality, WordPress holds community organized conferences called WordCamp where members of the WordPress community attend workshops and presentations.

But, as far as I know, it’s never been a high priority with the search marketing community or even with publishers.

It seems like many of the publishers and SEO professionals who use WordPress don’t participate in the WordPress community itself.

I asked Casey Markee of Media Wyse (LinkedIn), a consultant for Food and Recipe bloggers, why WordPress publishers don’t seem to get involved with the WordPress community.

Casey offered this opinion:

“I think that’s a valid statement that publishers don’t get involved with the WordPress community.

I can’t tell you of any of my clients who have even considered going to Wordcamp and all I do is WordPress sites.

With the free training, masterminds, other conferences, etc, Wordcamp is not really a top recommendation.”

Perhaps the lack of interest is a perception that WordCamp is for developers and web designers, not for publishers and SEOs?

What WordPress Events Offer SEOs, Affiliates & Publishers

A September 2023 WordCamp in Rochester, New York has sessions about:

• Improving sales pages
• Using AI with WordPress
• The pros and cons of page builder plugins
• Tips on how to cultivate long-term readers

WordCamp is a chance for everyone who uses WordPress to share their ideas about what they want for WordPress and to share how to have success with it.

What follows is an interview with Naoko Takano, a full-time sponsored contributor involved with community at WordPress.

Interview With Naoko Takano of Automattic

It seems like WordPress core contributors seem to get the most spotlight.

However, about non-developers and programmers?

Question: How can SEOs, affiliates and publishers make WordPress better?

Naoko:

More than 20 Make WordPress teams regularly contribute to the project in different ways—from documentation and translation to marketing and support.

A new Sustainability team was formed a few months ago to help ensure sustainable practices and processes for WordPress.

Projects like the Photo Directory have introduced new ways to get involved in the project, catering to those interested in openly licensed photography.

Inclusivity is a core principle of the community, which strives to provide contributing opportunities for everyone.

Moreover, ongoing efforts are to improve the contributor journey and onboarding, such as the WordPress Mentorship pilot program.

For those unsure where to get started, this new tool aims to help them identify areas of contribution that match their skills and interests.

I get the feeling that there are subsets of WordPress users like SEOs, food bloggers, affiliate marketers, and local businesses (plumbers, restaurants, etc.) who may have specific needs that they’d like to be understood by the WordPress ecosystem.

WordPress Wants Insights From Real Users

Question: What would you say to those people who may not know that they can contribute to the development of WordPress?

Naoko:

Contributing to WordPress means your skills, needs, and interests can drive innovation and progress within the project.

The insights from real users are immensely valuable and can help shape WordPress in ways that benefit everyone.

You can share feedback, join discussions and events, report issues, or even participate in testing.

Feel free to reach out through the official forums or local meetups.

Together, we can make WordPress even better for all its users.

About WordCamp

Question: What is WordCamp?

Naoko:

“WordCamps are community-organized events where people who use, build, and work with WordPress come together to learn, contribute, and connect.

They typically include talks, panel discussions, and occasional workshops and hackathons. WordCamp organizers are encouraged to create welcoming and open events, so content often ranges from web development to business to content writing.”

Question: How do WordCamps fit into the overall WordPress community?

Naoko:

“WordCamps began as a gathering for like-minded individuals, but they have grown to become a key connector within the WordPress community—nurturing education, collaboration, and inclusivity.

Like occasional in-person meetings in distributed companies, WordCamps have been essential for the open source project collaboration, allowing contributors to meet and bond.

With 1179 WordCamps across 393 cities in 65 countries (as of August 2023), they have acted as a grassroots marketing tool in the early days of community marketing, with enthusiastic users teaching and inspiring others.

In light of changes in how people gather, especially in recent years, the community looks to evolve the purpose of WordCamps and introduce innovations in both format and content offerings.

While we are seeing a new wave for WordPress events, their core values of inclusion and diversity remain the same.

Fresh, new ideas for events are not only welcome but highly encouraged.”

Offer Feedback To Your Favorite Plugin, Themes & Web Hosts

Plugin makers, hosting companies, and other well-known brands associated with WordPress attend WordCamps.

Question: Are there opportunities to meet with these companies and provide feedback or get more information about how they can help publishers?

Naoko:

“WordCamps often include a designated area with sponsor booths where companies display their products and services.

Representatives from these companies are present as attendees during the event and at after-parties, and they welcome people to ask questions, provide feedback, and learn about their offerings.

WordCampers love “hallway tracks” where informal conversations and networking happen outside the scheduled sessions.”

WordPress Events Are Opportunities To Grow Your Business

It seems that publishers should be at the heart of the WordPress community.

What can you say to publishers like food bloggers or affiliate marketers that would encourage them to attend a WordCamp?

Question: What’s in it for bloggers and affiliate marketers? What can they get out of it?

Naoko:

“Attending a WordCamp or WordPress event provides publishers, bloggers, and marketers valuable insights into the ongoing evolution of the WordPress platform and its ecosystem, such as plugins and themes.

WordCamps present numerous opportunities to grow their business and build connections in diverse ways, particularly through networking and learning from experts and fellow creators.

These events are designed with an inspirational approach and contribute significantly to the personal and professional development of those participating.”

The Difference Between WordPress.org & WordPress.com

For some users of WordPress, it might not be apparent that there’s a difference between WordPress.org and WordPress.com.

Question: Where do WordPress.com and Automattic fit into the overall picture of WordPress.org, the CMS most people use?

Naoko:

“WordPress (often referred to as WordPress.org) is free, open-source software that anyone can download and install on the hosting platform of their choice.

Supporting its mission of democratizing publishing and the freedoms that come with open source is a large community of people and organizations collaborating and contributing to the project.

Throughout its 20-year history, WordPress has given rise to an ecosystem that represents a thriving economy in its own right, being the foundation for commercial products built on top of the open source software, such as WordPress.com—owned and operated by Automattic.

WordPress.com is a fully hosted version of WordPress with added features for security, speed, support, and more.

In other words, there’s no software to install or manage.

You can just sign up and start publishing content.

In addition to WordPress.com, Automattic has other WordPress-related commercial services and products and significantly contributes to the open source project.

Resources like this one from Learn WordPress provide a more detailed explanation of the differences between WordPress.org and WordPress.com.”

The Future Of WordPress

The WordPress open-source project is a remarkable success story that has many chapters yet to be written.

Question: What are some of those chapters that users can look forward?

Naoko:

“The present and future of WordPress hold exciting opportunities for everyone, from builders to enterprises.

The newly released WordPress 6.3 is packed with exciting features and tools that allow users to seamlessly shape all aspects of their online presence using blocks.

Explorations for Phase 3 of the WordPress roadmap, which have already begun, are focused on fostering real-time collaboration and streamlining the publishing flows to improve how creators and teams work together within WordPress.

This will help pave the way for the much-anticipated multilingual feature (Phase 4), making WordPress more accessible across different languages.”

How Can Publishers, Bloggers and Search Professionals Get Involved?

The publishing community, including affiliates and search marketers, have specific needs for how websites perform.

But these people are not coders.

Question: How can search marketers, affiliates and other publishers help make WordPress better for their specific requirements?

Naoko:

“Participation in future development is not limited to coding; it involves providing feedback, testing new features, and sharing feedback with the community of contributors.

By actively engaging, every user can have a say in shaping the future of WordPress and ensuring it remains a platform that thrives in the changing digital landscape.

A great way to stay on top of the latest developments and contributing opportunities is to subscribe to WordPress News and the WP Briefing podcast.”

WordPress Belongs To You

The search marketing community, for a long time and even today, experienced frustration from the low core web vitals scores of WordPress sites.

I can’t help but think that if SEOs and publishers had participated more in the WP community, core web vitals would have been addressed years earlier.

We can dump on WordPress and point fingers but ultimately, WordPress is all of us who use the CMS, so some of those fingers should rightfully point back at us.

An important takeaway from this interview is that WordPress does not improve in a top-down manner, where SEOs, affiliates and publishers passively wait for improvements to happen.

There are many opportunities that WordPress offers publishers and SEOs to get involved, including testing and offering feedback.

WordCamp is something that all publishers should view as important to their business.

It’s an opportunity to tell the people who make the plugins, the business that host your sites and create the themes, the people who work on the WordPress core what we want to see improved, what features we need  right now to make our businesses perform better.

There’s a lot going on at WordPress where publisher and SEO influence is needed.

Check out the WordCamp schedule to see if there’s one near you.

It may help you improve your bottom line.

Logo by WordPress/Featured image by author

WordPress Metform Elementor Contact Form Builder Plugin Vulnerability via @sejournal, @martinibuster

The U.S. government National Vulnerability Database (NVD) issued an advisory about a vulnerability affecting Metform Elementor Contact Form Builder WordPress plugin that could leak sensitive information.

Metform Elementor Contact Form Builder for WordPress

The Metform Elementor Contact Form builder is a third party add-on to the popular Elementor page builder plugin with over over 200,000 installations.

It offers a drag-and-drop interface that makes it easy to build contact forms, including multi-step forms.

The Metform contact form builder WordPress plugin for Elementor allows beginners with no coding skills to create surveys forms, contact forms, referral feedback forms and also can save a form so that a user can return to the form if they lose and regain Internet connection.

According to the official WordPress plugin repository:

“MetForm, the drag-and-drop WordPress contact form builder is an addon for Elementor, build any fast and secure contact form on the fly with its drag-and-drop flexibility.

It can manage multiple contact forms, and you can customize the multi step form with an Elementor builder.”

Information Disclosure Vulnerability

The vulnerability allows an attacker to obtain sensitive information.

This vulnerability is rated by the NVD as a medium level threat because it requires an attacker to obtain a subscriber-level or higher user role.

A subscriber-level user role is a relatively low bar for activating the exploit, as it’s easier to obtain than an admin or editor level user role.

An attacker only needs to subscribe to a website in order to be able to launch an attack.

Elementor’s website describes the subscriber user role:

“A WordPress subscriber is a site user who can only edit their profile, read posts, and leave comments.

WordPress uses the concept of ‘roles’ to enable a site owner to control and manage what set of tasks (capabilities) users can do or not do within the site.

A subscriber is the lowest level of user role with the fewest permissions.”

Thus, an attacker can begin hacking the site with the lowest level user role.

The NVD describes the threat:

“The Metform Elementor Contact Form Builder for WordPress is vulnerable to Information Disclosure via the ‘mf_first_name’ shortcode in versions up to, and including, 3.3.1.

This allows authenticated attackers, with subscriber-level capabilities or above to obtain sensitive information about arbitrary form submissions, including the submitter’s first name.”

Update Plugin To Mitigate Attack Threat

This vulnerability affects Metform Elementor Contact Form Builder plugin versions up to and including 3.3.1.

The most current version of the plugin is 3.4.0.

Metform Elementor Contact Form Builder Version 3.3.2 is the version that fixed the vulnerability.

According to the official Metform Elementor Contact Form Builder Changelog:

“Version 3.3.2

…Improved: Security, nonce and authorization checking.”

Read the official NVD advisory:

CVE-2023-0689 Detail

Featured image by Shutterstock/pedrorsfernandes

Forminator WordPress Plugin Vulnerability Affects Up To 400,000+ Websites via @sejournal, @martinibuster

The U.S. Government National Vulnerability Database (NVD) published notice of a critical vulnerability affecting the Forminator WordPress Contact Form plugin up to an including version 1.24.6.

Unauthenticated attackers can upload malicious files to websites which, according to the warning, “may make remote code execution possible.”

The vulnerability score rating is 9.8, on a scale of one to ten, with ten being the most severe vulnerability level.

Screenshot Of Wordfence Advisory

Screenshot from Wordfence.com

Vulnerability To Unauthenticated Attackers

Many vulnerabilities tend to require an attacker to first attain a WordPress user level before they can launch an attack.

For example, some vulnerabilities are available to those with a subscriber user level, others require contributor or admin level in order to perform an attack.

What makes this vulnerability particularly worrisome is that it allows unauthenticated attackers, those with no user level at all, to successfully hack the site.

A second reason why this vulnerability is rated 9.8 on a scale of 1 – 10 (critical) is that the attacker can upload an arbitrary file, which means any kind of file, like a malicious script.

The National Vulnerability Database (NVD) describes the vulnerability:

“The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6.

This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site’s server which may make remote code execution possible.”

Remote Code Execution

A Remote Code Execution (RCE) vulnerability is a type of exploit where the attacker can execute malicious code on the attacked website remotely from another machine.

The damage from this kind of exploit can be as severe as a full site takeover.

Contact Forms Must Be Locked Down

WordPress plugins that allow a registered or unauthenticated users to upload anything, even text or images, must have a way to limit what can be uploaded.

Contact Forms must be especially locked down because they accept input from the public.

RCE Not Specific To WordPress

These kinds of vulnerabilities are not particular to WordPress, they can happen to any Content Management System.

WordPress publishes coding standards for publishers to know how to prevent these kinds of things.

The WordPress developer page for plugin security (Sanitizing Data) explains how to properly handle uploads from untrusted sources.

The developer page advises:

“Untrusted data comes from many sources (users, third party sites, even your own database!) and all of it needs to be checked before it’s used.

Sanitizing input is the process of securing/cleaning/filtering input data.

Validation is preferred over sanitization because validation is more specific.

But when “more specific” isn’t possible, sanitization is the next best thing.”

Has the Forminator Contact Form Plugin Fixed The Vulnerability?

According to National Vulnerability Database and the Wordfence WordPress security company, the issue has been addressed in version 1.25.0.

Wordfence recommends updating to the latest version:

“Update to version 1.25.0, or a newer patched version…”

Forminator Plugin Changelog

A changelog is a record of all the changes made to a software. It allows users to read it and determine whether or not they want to update their software.

It’s a good practice to let your users know that a software update contains a fix (called a patch) for a vulnerability.

This lets users know that a particular update is urgent so that they can make an informed decision about updating their software.

Otherwise, how would a software user know that an update is urgent without the changelog informing them, right?

Judge for yourself whether the Forminator changelog offers sufficient notification to their users about a vulnerability patch:

Screenshot of Forminator Changelog

Sources:

Read the official National Vulnerability Database advisory:

CVE-2023-4596 Detail

Read the Wordfence advisory on the Forminator WordPress Contact Form Plugin Vulnerability

Forminator <= 1.24.6 – Unauthenticated Arbitrary File Upload

Read the Exploit Database report on the Forminator Contact Form vulnerability

WordPress Plugin Forminator 1.24.6 – Unauthenticated Remote Command Execution

Featured image by Shutterstock/ViDI Studio

WordPress Releases Free Course On Building & Monetizing Membership Sites via @sejournal, @martinibuster

WordPress just released a free course on how to make money with a membership site that walks through the process of setting it up, deciding the best payment plans and managing subscriptions.

The step by step guide is useful for anyone with a skill or knowledge to teach, a perfect way to start a new income stream.

What Is A Membership Site?

A membership site is a type of business that offers a group of people access to exclusive information.

The offering can be group lessons on creative writing, crafting, tying fishing flies, yoga, music class, art school and virtually anything else that can be taught.

The membership site can be executed by video, it could be in the form of an online community, it could even be a site that offers training videos and articles on a topic.

WordPress Course On Building A Membership Site

The course is called Membership Sites 101.

It provides a foundation for understanding the process of getting a membership site up and running, including design, monetization and recommended plugins.

WordPress announced the following learning topics:

• “Setting up the Paid Content Block: Learn how to blend free content with paid content and entice new members with exclusive perks.
• Crafting membership plans:
  Discover the magic of one-time, monthly, or annual payments, along with the power of “Pay what you want.”
• Multiple membership levels:
  Unveil the secrets of Bronze, Silver, and Gold levels, or even create specialized topical memberships.
• Managing subscriptions:
  Get insights on handling subscribers, earnings, and payment plans with ease.”

Membership Sites 101

The course takes about one hour and thirty minutes to complete.

It’s entirely self-guided and paced in short lessons that won’t overwhelm first timers.

WordPress lists the following topics for learning:

Three methods for setting up a membership site:

1. Privacy and Password Protection
2. Paid Content blocks
3. Membership plugins

Suggestions for different types of membership sites

Guidance on choosing and setting up different membership levels

Ideas for a range of different types of content to include

What Is Needed To Learn?

The course assumes a basic understanding of how to use WordPress.

Students should be prepared to go through the information twice to make sure it is fully understood.

There is also a WordPress Education Community Forum for support if at any point a student needs assistance.

Read the full announcement:

Membership Sites 101

Featured image by Shutterstock/pAbscent Vector

WordPress Announces 100-Year Domain Name Registrations via @sejournal, @martinibuster

WordPress.com announced a one hundred year domain registration that comes with managed hosting and 24/7 customer service and other features for one price.

WordPress 100-Year Plan

The typical maximum domain name registration period is capped at ten years.

So it’s quite unusual to be able to register a domain for one hundred years.

WordPress calls this new offer the 100-year plan.

The cost of the 100 year domain name registration is $38,000 USD.

That works out to $380 per year for hosting and domain registration.

What Comes With WordPress Century Plan?

The official announcement named these features that come with the plan:

• Domain secured for one hundred years
• Multiple backups across data centers in different geographic locations
• “Top-tier” managed WordPress hosting
• Unmetered bandwidth (means unlimited traffic)

Dedicated and personalized support that’s available 24 hours per day, seven days a week

Who Is The 100 Year Plan For?

WordPress says that the plan is designed for individuals, families and company founders who want to document their company’s legacy.

The announcement explains:

• “Families who wish to preserve their digital assets—the stories, photos, sounds, and videos that make up their rich family history—for generations to come.
• Founders who want to protect and document their company’s past, present, and future.
• Individuals seeking a stable, flexible, and customized online home that can adapt to whatever changes the future of technology will bring.”

At this time it feels apparent that the usage they have in mind are individuals who want to create a lasting way to communicate their stories.

Matt Mullenweg, CEO of WordPress.com is quoted as saying:

“Whether it’s giving a newborn the special gift of a domain and lifetime home on the web, or something you put in your will to make sure your website and story are accessible to future generations, I hope this plan gets people and other companies thinking about building for the long term.”

Signing up for the plan is simple, just fill out a form at the WordPress.com website.

Read WordPress.com’s announcement:

Introducing the 100-Year Plan: Secure Your Online Legacy for a Century

Sign up for the 100-Year Plan here

Featured image by Shutterstock/Roman Samborskyi

WordPress Paying Google Domains Transfer Fees via @sejournal, @martinibuster

WordPress.com announced that they are paying the domain transfer fees for Google Domain customers, and is committed to keeping domain registration prices low.

WordPress.com is matching Google’s pricing on over 400 top-level domains that are offered by WordPress.com.

Existing WordPress.com customers will also benefit from rock bottom prices on domain name registrations.

According to WordPress.com announcement:

“You may have heard that your account has been sold to Squarespace. Everything is expected to transfer and close later this year.

Fortunately for you, you’re not locked into that deal.

And we think we can do better.

For the first million domains that move from Google to WordPress.com, we’ll pay your transfer fee, which also extends your registration for an additional year. “

Are WordPress.com Domain Registrations Cheap?

Yes, registering a domain with WordPress.com is very low priced, matching the low prices that Google Domains charges.

• GoDaddy charges $21.99 per year for registering a dot com domain.
• WordPress.com only charges $12 per year for the same dot com domain.

It was announced that WordPress intends to keep domain registration prices low from now on, only raising the prices when the wholesale prices rise.

The official WordPress.com announcement says that they intend to offer budget priced domain names as a permanent business model.

WordPress.com explains:

“This isn’t a temporary thing.

We’re committed to keeping domain prices low, and will only raise them if our wholesale costs go up (we’ll run our domains business like Costco).”

WordPress.com is a Domain Name Registrar

WordPress.com is a different company from WordPress.org. WordPress.org is the CMS that everyone loves and uses.

WordPress.com is a part of the Automattic family of brands like WooCommerce, Jetpack, Akismet, Gravatar and other companies.

WordPress.com offers managed WordPress hosting.

Managed WordPress hosting is a hosting environment that is optimized for WordPress websites.

WordPress.com is also a domain name registrar.

Why Register a Domain With WordPress.com?

WordPress states that their service is superior in many ways to Google, GoDaddy and DigitalOcean.

The WordPress.com announcement explains:

“Our DNS speeds are faster than Google, GoDaddy, and DigitalOcean. But don’t take our word for it. Feel free to check for yourself at dnsperf.com. “

These are the advantages of registering domains at WordPress.com:

• Faster DNS Speeds
• Free privacy protection (some exclusions for non-U.S. domains)
• Free SSL for domains hosted on WordPress.com
• Low pricing on domain names

Lastly, WordPress.com is a trusted name on the web, known for their commitment for an open web for the entire world. committed to the democratization of

How to Transfer a Domain From Google Domains to WordPress.com

The process for transferring a domain is similar to transferring it to any other registrar.

The first step is to unlock the domain at your current domain name registrar, in this case at the Google Domains dashboard.

At the Google Domains dashboard you select which domains you want to transfer, then click on the Registration Settings located in the sidebar menu.

Then click on the Domain is Unlocked toggle switch.

Once the domain is unlocked, scroll down to the Transfer Out section then click on the link labeled, “Get auth code.”

From there you can visit the WordPress.com Domain Transfer page and follow the prompts.

You can also start at the Transfer your Google domains page at WordPress.com for full instructions.

Read the official WordPress.com announcement:

Transfer Your Google Domains to WordPress.com—On Us

Featured image by Shutterstock/Studio Romantic