Uncategorized

What visibility do you have when releasing a plugin directly on GitHub?

I ship side projects on GitHub instead of WordPress.org. Here is what stars, release asset downloads, and a tiny local dashboard can still tell you without any product telemetry.

Gutenberg is huge for a reason. That does not mean every editor has to be.

Classic Editor still holds millions of installs. The block editor is a multi-megabyte platform. Minn Admin stores the same Gutenberg markup from a single vanilla JS file. An architecture audit of why both can be true, and why full feature parity is the wrong goal.

3 Failed WP-Admin Projects, Let’s go for the 4th!

Two weeks ago I replaced /wp-admin/ on my own WordPress sites with /minn-admin/. This is my fourth attempt at building a WordPress backend replacement. This round I used Claude Design…

Grok Build finally made my AI email triage a real workflow

process-emails drains noise. draft-email writes replies. /email-worker plus Grok Build todos is the first time hammering the customer queue felt as fast as the rest of my AI stack.

SandyWP is awesome. And I exploited it.

The owner of SandyWP asked me to look for bugs. I went in blind, drove the whole test with Claude Code, and found a single shared secret that unlocks every sandbox on the platform. Here is how, and why I still recommend it.

My AI Security Pipeline for WordPress Plugins

One person with a Claude subscription and a local WordPress install can audit a large portion of the plugin repository. Here is the four-step pipeline, why every AI finding has to be proven before you trust it, and what the coverage actually looks like.

Anatomy of a WordPress.org supply-chain attack: the six ways in

Six ways an attacker turns a trusted WordPress.org plugin into a foothold on your site, each drawn from a real campaign I have traced, with the code that made it work. Plus the one method you cannot scan for, and what actually catches all of them.

The hall of shame for WordPress admin notices

I have wanted a public database of WordPress admin notices for years. Every WordPress professional knows the feeling. You log into /wp-admin/ to do one small thing, and the top…

From a 7 KB file to a 13-year backdoor operation

Most plugin closures are uneventful. A developer stops responding, wp.org pulls the plugin, the listing goes dark, and that is the end of it. My WP Beacon scanner flags these…

Gravity SMTP Exploit Campaign

The last few weeks have been whack-a-mole with my Mailgun account. My Mailgun account kept getting locked. I would clear a compliance issue, watch everything come back online, and a…