The anatomy of a WordPress core security update

Note: This is part of a series of posts highlighting talks from the BigWP San Francisco meetup at the Henry J Kaiser Family Foundation on the evening of November 6.

As both a WordPress VIP Technical Account Manager and a Core Security Release Lead on the WordPress project, I have a rare glimpse into one of the most critical aspects of enterprise WordPress: security.

I spoke at BigWP SF this fall to share a behind-the-scenes look at one small slice of what it takes to make WordPress a secure platform for 35% of the internet.

In this talk, I cover:

  • Who is in charge of safeguarding WordPress
  • How the team uses HackerOne to identify, disclose, and address vulnerabilities
  • What the security release process looks like from the inside
  • How people can contribute to keeping WordPress secure

You can see the full talk here:

BigWP is our enterprise WordPress meetup series. It brings together developers, business leads, and product people who work with high-scale WordPress applications every day. To be the first to find out about the next enterprise WordPress event in San Francisco, join the meetup group. You’ll find groups for other cities there as well.

Find all of the talks in the BigWP SF November 2019 playlist.

How to spin up a WordPress-powered React app in 1 step

Note: This is part of a series of posts highlighting talks from the BigWP NYC meetup hosted at Postlight on the evening of November 13.

“People are wrestling with the same issues across the software industry,” declared Gina Trapani, Managing Partner at Postlight, during her talk at BigWP NYC.

Postlight is a newly-minted WordPress VIP Silver partner who builds digital experiences for clients like Goldman Sachs, the Obama Foundation, the National Audubon Society, and more. As a premier product, design, and development agency, the Postlight team is exposed to content management challenges across sectors and organizations large and small.

So, Gina took to the stage to address one of the questions clients often struggle with.

Pattern recognition

React is a popular JavaScript framework with more than a few fans. Unsurprisingly, countless companies are seeking the best software solution to deliver content to their React applications. Gina’s answer? For many scenarios, decoupled WordPress is the way to go.

After successfully arguing this case, the Postlight team found themselves writing the same code for the same architecture over and over again. So they decided to combine a front-end, back-end React/WordPress instance into a downloadable, user-friendly package.

Converting the decoupled doubters

With Postlight’s WordPress + React Starter Kit, users get two working example sites out of the box. Each site contains React components that implement common WordPress features like rendering pages, posts, taxonomies and content previews; in addition to custom post types with fields exposed via APIs.

The bottom line of the starter kit, explains Gina, is that WordPress works beautifully with modern technology and tooling.

Check out her full talk about creating the WordPress + React Starter Kit, including actionable tips for countering anyone who argues that WordPress doesn’t play nicely in forward-thinking software implementations.

BigWP is our enterprise WordPress meetup series. It brings together developers, business leads, and product people who work with high-scale WordPress applications every day. To be the first to find out about the next enterprise WordPress event in New York, join the meetup group. You’ll find groups for other cities there as well.

Find all of the talks in the BigWP NYC November 2019 playlist.

Updating the Apple News plugin to be Gutenberg native

Note: This is part of a series of posts highlighting talks from the BigWP NYC meetup hosted at Postlight on the evening of November 13.

WordPress VIP featured partner Alley originally created their Publish to Apple News plugin to help users seamlessly submit and edit their Apple News content straight from the WordPress editor. Version one of the plugin automatically converts HTML content to JSON and sends it to Apple to publish via their API.

After the WordPress 5.0 update, which brought the new Gutenberg editing experience to core WordPress software, Alley began developing version two of the plugin, which provides full native support for Gutenberg. Chief plugin contributor and Alley’s director of software development Kevin Fodness recently shared learnings from this project at BigWP NYC.

All things considered

The biggest challenge of making the plugin fully Gutenberg compatible? “We had to embrace the future of WordPress while not losing users who weren’t fully embracing Gutenberg.” (Yet.)

In a simpler world, Gutenberg adoption would be binary. Either a site is taking advantage of the new software, or it’s not. However, in practice, business cases are nearly always more complex. In this case, many enterprise users have selectively enabled Gutenberg on some but not all of their content types within the same site. This creates a tricky scenario for plugin developers who need to ensure their product’s functionality across a dozen different platform scenarios.

Rethinking the metabox

Inspired by Yoast and Jetpack, Alley opted for the popular sidebar approach to integrating Gutenberg functionality directly into the plugin interface. Now, editors can configure Apple News settings in four sleek collapse/expand panels which replace the cumbersome metabox.

The end goal for this project was simple: provide a better experience for editors using the Apple News plugin. Achieving this goal was anything but simple, and in his talk, Kevin walks through Alley’s approach to updating the plugin–including all the things they broke along the way.

BigWP is our enterprise WordPress meetup series. It brings together developers, business leads, and product people who work with high-scale WordPress applications every day. To be the first to find out about the next enterprise WordPress event in New York, join the meetup group. You’ll find groups for other cities there as well.

Find all of the talks in the BigWP NYC November 2019 playlist.

Bringing Xbox to the block editor

Note: This is part of a series of posts highlighting talks from the BigWP San Francisco meetup at the Henry J Kaiser Family Foundation on the evening of November 6.

The block editor, part of the project known as Gutenberg, is one of the biggest changes to WordPress core software in over a decade and a half. It brings unprecedented agility for enterprises to customize media-rich content directly within the WordPress editor.

WordPress VIP featured partner agency Reaktiv recently worked with Xbox to build custom blocks that leverage Xbox’s existing design components to streamline workflows. Together, these new blocks reduce manual effort, speed up time to publish, and deliver a better user experience.

Reaktiv CEO Josh Eaton gives talk at Big WP SF on using custom Gutenberg blocks for Xbox

The day of BigWP SF, Reaktiv CEO Josh Eaton was celebrating Xbox’s successful launch on Gutenberg. In his presentation, Josh walked attendees through Reaktiv’s approach to implementing the block editor on four of the entertainment company’s regional sites.

So far, the project includes eight new custom blocks, including Countdown timer which adds a stopwatch-style ticker alongside sale items and automatically eliminates the entire post once the deal has expired.

Josh shared his biggest piece of advice for transitioning to the new block editor: iterate, iterate, iterate. With an enhanced ability to sync styling in the front and back ends, Gutenberg facilitates new processes that were previously impossible (or at the very least, cumbersome) in the old editor. If you’d like to explore what’s possible for the block editor in your organization, please get in touch.

You can see Josh’s full talk here:

BigWP is our enterprise WordPress meetup series. It brings together developers, business leads, and product people who work with high-scale WordPress applications every day. To be the first to find out about the next enterprise WordPress event in San Francisco, join the meetup group. You’ll find groups for other cities there as well.

Find all of the talks in the BigWP SF November 2019 playlist.

How implementing dark mode in WordPress boosted 9to5’s sites

Note: This is part of a series of posts highlighting talks from the BigWP San Francisco meetup at the Henry J Kaiser Family Foundation on the evening of November 6.

WordPress VIP featured partner 10up recently worked with media company 9to5 to add light and dark mode support to its most popular sites, including 9to5Mac and 9to5Google. Jake Goldman, founder and president of 10up, took the stage at BigWP SF to discuss the project and provide a practical primer on supporting native, OS-level dark and light settings.

As of this year, all major operating systems and browsers have begun to support the ability to view different display modes (light and dark), based on user preference.

Far beyond aesthetics, dark mode is a major factor in improving accessibility for users who suffer from eye strain or other vision difficulties. Additionally, enabling dark and light mode options empowers users to personalize their experience with your content–which can improve engagement.

The good news? Dark mode is relatively easy to enable. It took 10up only about 30 people hours to set up five sites on the 9to5 network that shared an overarching layout.

In this talk, Jake walks through two approaches to achieve similar results. First, a CSS path to deliver content in light or dark mode based on a user’s predefined settings. Next, a JavaScript method to allow users to toggle between light and dark mode on their own, which defaults to user device settings.

Watch Jake’s full talk below:

BigWP is our enterprise WordPress meetup series. It brings together developers, business leads, and product people who work with high-scale WordPress applications every day. To be the first to find out about the next enterprise WordPress event in San Francisco, join the meetup group. You’ll find groups for other cities there as well.

Find all of the talks in the BigWP SF November 2019 playlist.

How to scale a WordPress development team

Note: This is part of a series of posts highlighting talks from the BigWP New York meetup at The New York Post on the evening of June 11.

We often hear about scaling WordPress sites, but what about scaling your WordPress developers?

At BigWP NYC, Aaron Jorbin, Director of Editorial Technology at Penske Media Corp (PMC), shared his approach to growing a successful team.

According to Aaron, there are various models for finding the right people for a team, like T-shaped people and tree-shaped people. But what about Rorschach-shaped people?

When Aaron conducts job interviews, he prioritizes candidates who value learning. His number one priority? Building a team of people who are able to find creative solutions, rather than clever solutions. To do so, Jorbin has a few recommendations. These include proactively identifying weak spots (like a lack of diversity) and encouraging each person to find their “superpower.”

Watch Aaron’s full talk here:

BigWP is our enterprise WordPress meetup series. It brings together developers, business leads, and product people who work with high-scale WordPress applications every day. To be the first to find out about the next enterprise WordPress event in New York, join the meetup group. You’ll find groups for other cities there as well.

Find all of the talks in the BigWP NYC June 2019 playlist.

How TechCrunch built a subscription tier on WordPress

Note: This is part of a series of posts highlighting talks from the BigWP San Francisco meetup at Eventbrite on the evening of June 26.

In February 2019, TechCrunch leveraged WordPress architecture to launch a subscription tier paywall, Extra Crunch. Sam Singer, Lead Software Engineer at TechCrunch, delivered a talk at BigWP SF that gave an overview of the project’s process, architecture, and challenges.

Image of Sam Singer on stage at BigWP SF discussing Extra Crunch, TechCrunch's paywall built on WordPress
Sam Singer delivers a presentation at BigWP SF on building a successful subscription tier on WordPress.

TechCrunch wanted to make the product experience better for its core audience. Additionally, they wanted to give this audience a chance to support high-quality journalism. To that end, Extra Crunch subscribers have ad-free access to premium content, as well as the ability to get in touch with writers directly.

Extra Crunch’s launch followed one year after TechCrunch’s major redesign, which saw the launch of a semi-decoupled WordPress and React web application. Subsequently, Sam’s team was able to build upon the existing WordPress architecture to add payment processing and content paywall capabilities. As a result, Extra Crunch readers can support the creation of more evergreen content and deep-dive journalism.

Watch Sam’s full talk below:

BigWP is our enterprise WordPress meetup series. It brings together developers, business leads, and product people who work with high-scale WordPress applications every day. To be the first to find out about the next enterprise WordPress event in San Francisco, join the meetup group. You’ll find groups for other cities there as well.

Find all of the talks in the BigWP SF June 2019 playlist, or individual posts here:

How Credit Karma leveraged WordPress to jump start a secure testing strategy

Note: This is part of a series of posts highlighting talks from the BigWP San Francisco meetup at Eventbrite on the evening of June 26.

Credit Karma, is a financial tech brand championing financial progress for all. For them, security is an important consideration. This summer, April Aaronson, Growth Technology Manager at Credit Karma, took the stage at BigWP SF to talk about how they keep security in mind without sacrificing growth.

April Aaronson of Credit Karma holds a mic on stage in front of a group of seated people at BigWP SF
April Aaronson shared at BigWP SF how Credit Karma leverages WordPress for secure testing

Credit Karma has scaled its business by expanding beyond free credit scores: they demystify finances for their members. To accomplish this, they provide financial calculators, editorial content, and other tools to help consumers better understand their financial standing.

In the financial technology industry, trust is critical. As a result, Credit Karma takes great care to be thoughtful about the tools and technology they use across all aspects of the business. April’s talk focused on how they leveraged WordPress to develop a testing strategy that put its 100 million members first.

Watch April’s full talk:

BigWP is our enterprise WordPress meetup series. It brings together developers, business leads, and product people who work with high-scale WordPress applications every day. Want to find out about the next enterprise WordPress event in San Francisco? Join the meetup group. You’ll find groups for other cities there as well.

Find all of the talks in the BigWP SF June 2019 playlist, or individual posts here:

Creating an open platform for 60,000 contributors with WordPress and Thrive Global

Note: This is part of a series of posts highlighting talks from the BigWP San Francisco meetup at Eventbrite on the evening of June 26.

When Ariana Huffington created Thrive Global’s behavior change platform, the goal was to build a scalable, open, publishing system… fast. In his talk at BigWP SF, John McAlester, Senior WordPress Developer at Thrive Global, talked through the wins and challenges of building a WordPress site at scale.

John McAlester presented at BigWP SF on leveraging WordPress for Thrive Global’s massive scale publishing.

Thrive Global, an open media platform focusing on wellness and productivity, leverages the power of WordPress and the REST API to make its community and branded content available to mobile apps, eLearning courses, and third-party integrations. Contributors to the platform increase brand awareness by publishing hundreds of posts per day, focusing on wellness and productivity.

On the back-end, the platform makes use of custom user roles with modified capabilities. It also has a custom sign-up flow to encourage good actors. Engineers coordinate deployments between a decoupled React app and the WordPress back-end. This approach allows their content to be repurposed in various contexts.

In the talk, John also discusses the downsides of having a decoupled frontend, and why he believes in working with core WordPress themes and user systems.

Watch the full talk here:

BigWP is our enterprise WordPress meetup series. It brings together developers, business leads, and product people who work with high-scale WordPress applications every day. To be the first to find out about the next enterprise WordPress event in San Francisco, join the meetup group. You’ll find groups for other cities there as well.

Find all of the talks in the BigWP SF June 2019 playlist, or individual posts here:

How Multidots nailed big data for the Air Jordan set

Note: This is part of a series of posts highlighting talks from the BigWP NYC meetup at The New York Post on the evening of June 11.

When Sneaker News, the “CNN of kicks,” needed to streamline their content creation, VIP partner agency Multidots rose to the challenge. At BigWP NYC, Multidots’ CEO Anil Gupta talked about how they leveraged the REST API to help Sneaker News reduce operations time by 65%.

Image of Multidots CEO Anil Gupta in orange sunglasses presenting on the REST API at BigWP NYC
Multidots CEO Anil Gupta presents on the REST API at BigWP NYC

Sneaker News needed a centralized repository for sneaker data that could seamlessly push updates to six different systems. With this in mind, Multidots leveraged the REST API to move data from this “master” repository to the various “child” applications, which included several WordPress sites.

Sneaker News publishes up to 150 new posts per month and receives millions of monthly page views. Thus, reducing 65% of operations time with an automated flow was a big win. Next up, Multidots will convert the centralised “master” repo into a decoupled WordPress instance.

Watch Anil’s talk in full to learn more:

BigWP is our enterprise WordPress meetup series. It brings together developers, business leads, and product people who work with high-scale WordPress applications every day. To be the first to find out about the next enterprise WordPress event in New York, join the meetup group. You’ll find groups for other cities there as well.

Find all of the talks in the BigWP NYC June 2019 playlist.

Ready to get started?

Drop us a note.

No matter where you are in the planning process, we’re happy to help, and we’re actual humans here on the other side of the form. 👋 We’re here to discuss your challenges and plans, evaluate your existing resources or a potential partner, or even make some initial recommendations. And, of course, we’re here to help any time you’re in the market for some robust WordPress awesomeness.