WP Weekly 295 – Back - CourtneyR.dev's 2nd Brain

WP Weekly 295 – Back ![rw-book-cover](https://thewpweekly.com/wp-content/uploads/2026/05/wp-weekly-image-295.png) 🔗 **Source:** [WP Weekly 295 – Back](https://thewpweekly.com/issue-295/) > [!note]+ Document Notes > tags: [wordpress, wordpress-7-1, ai-bot-traffic, website-security, abilities-api, wordpress-business] > author: Davinder Singh Kainth > source: The WP Weekly > reference: https://thewpweekly.com/issue-295/ > date created: 2026-06-22 > > # 🏷️ Title: WP Weekly 295 — Back: Delayed Plugin Updates, AI Bot Traffic, Top Plugin Authors >  ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [📚 References](#-references) - [🗣️ Paraphrase](#-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) - [🧱 Refactor Appendix](#-refactor-appendix) ### 🔗 References - [WordPress.org — 24-hour auto-update delay](https://wordpress.org/news/2026/06/pts/) - [Kinsta — AI & Bot Traffic report](https://kinsta.com/ai-bot-traffic/) - [GoDaddy — Annual Cybersecurity Report](https://www.godaddy.com/resources/news/godaddy-annual-cybersecurity-report) - [Roadmap to WordPress 7.1](https://make.wordpress.org/core/2026/06/19/roadmap-to-7-1/) - [The Repository — Awesome Motive breach widens](https://www.therepository.email/awesome-motive-breach-widens-as-uncanny-automator-confirms-customer-data-theft-monsterinsights-users-hit-with-phishing-campaign) ## 📝 Summary - **What happened.** WP Weekly issue 295 (Davinder Singh Kainth) returns after a WordCamp Europe 2026 hiatus with a dense curated digest of WordPress ecosystem news: WordPress 7.1 release prep, a temporary 24-hour delay on plugin/theme auto-updates, a wave of Abilities-API/MCP product integrations, two notable security/traffic studies, and several business moves. - **Why it matters.** Three threads in this issue are structurally significant rather than incremental: (1) the **24-hour auto-update delay** signals WordPress.org institutionalizing an AI-assisted security-review window; (2) the **Abilities API** is rapidly becoming the default integration surface (SEOPress, Stream, WPForms, SureCart all shipped support this issue); and (3) **AI bot traffic** is now a first-order infrastructure cost (Kinsta: 1 in 31 visits is an AI bot). - **Key stakeholders.** Plugin/theme authors (auto-update delay + Abilities API), hosts (AI bot load), site owners (security, breach exposure), the WP project (7.1 squad, market-share decline), and the commercial ecosystem (Progress Planner acquisition, SiteGround controversy). - **Risks and tradeoffs.** The digest is promotional by format (sponsor blocks, affiliate links throughout) and reports vendor studies (Kinsta, GoDaddy) without independent verification. Market share is down (33%, from 36%), and two security stories — the widening Awesome Motive breach and SiteGround's 1M forced installs — point to trust strain. - **Bottom line.** A "state of the ecosystem" snapshot: WordPress is consolidating an AI-integration layer (Abilities API/MCP) and a security-review posture (update delay) at the same moment it faces measurable market-share erosion and bot-traffic cost — the platform is professionalizing under pressure. ## 📖 Main Content ### 🗒️ Notes #### Core / WordPress 7.1 - **24-hour auto-update delay**: WordPress.org adds a temporary 24-hour hold before plugin/theme updates distribute via auto-update, creating a window for security review "including the use of AI-assisted tools that can operate continuously." This is the load-bearing core item — it changes the update threat model from "instant propagation" to "reviewed propagation." - WordPress **7.1 release squad** announced, Anne McCarthy as lead; **Roadmap to 7.1** focuses on AI, Admin, APIs, Blocks. - **WP 7.0.1** general release scheduled July 9, 2026. - **Gutenberg 23.4** React 19 plans **reverted** for now (recurring theme — React 19 upgrade keeps getting deferred). #### The Abilities API adoption wave (the real trend this issue) - **SEOPress 10.0** — Abilities API support; free version lets an agent read/update SEO title, meta description, indexing rules; Pro adds redirects, schema, keywords, AI-generated meta. - **Stream 4.2** — exposes its audit log as WordPress Abilities; any MCP-aware client (Claude Desktop, Claude Code, Cursor, ChatGPT) can read and act on it ("ask your audit log a question"). - **WPForms** — new write support for the Abilities API. - **SureCart MCP enhancements**, **CortexWP AI** (debugs plugin/site/server, asks permission before changes), **GTmetrix MCP server** (perf data into Claude/Codex/Cursor). - Read together: the Abilities API + MCP is becoming the standard machine-interface for WordPress plugins this quarter. #### Security & traffic studies - **Kinsta AI & bot traffic** (10B+ requests analyzed): 300%+ bot-traffic surge in one year; **1 in 31 web visits is an AI bot**; one bot generated **3.75M "add to cart" hits in 24 hours**. - **GoDaddy Annual Cybersecurity Report** (932,641 threat detections across 834,661 infected sites, 2025): general malware **41.5%**, SEO spam **35.2%**, malicious redirects **21.7%**, unwanted ads **1.1%**, defacements **0.5%**. - **Awesome Motive breach widens**: Uncanny Automator confirms customer data theft; MonsterInsights users hit with a phishing campaign (Rae Morey / The Repository). - **llms.txt study** (Ahrefs): **97% of llms.txt files never get read** by bots or humans. #### Numbers & business - **WordPress powers 33% of the web in 2026, down from 36%** (GravityKit) — measurable market-share erosion. - **Top plugin authors** (WP Beacon, 35,789 listed): Syed Balkhi, Automattic, Yoast, Elementor, WordPress.org, Rock Lobster, LiteSpeed, Brainstorm Force, Updraft, Google. - **Progress Planner acquired by Your.Online** — Joost de Valk & Marieke van de Rakt join to lead AI capabilities. - **SiteGround AI plugin** controversy — ~1M forced installs (Mark Zahra / WP Mayor). - **Pressship** (Automattic) — CLI plugin-publishing project for WordPress.org. #### Community - **Support Eric Binnion** — long-time Automattic engineer facing stage-4 esophageal cancer; Anne McCarthy organized a GoFundMe. - WordCamp US 2026 (Phoenix, Aug 16–19); WordCamp Asia 2027 (Penang); WCEU 2027 (Málaga). WordCamp India 2027 host-city applications open. - Notable: **Courtney's own Airo Builder "new look site in minutes" video** is featured in the YouTube section. ## 📚 References - [WordPress.org news — 24-hour update delay](https://wordpress.org/news/2026/06/pts/) - [Make WordPress Core — Roadmap to 7.1](https://make.wordpress.org/core/2026/06/19/roadmap-to-7-1/) - [Kinsta — AI bot traffic report](https://kinsta.com/ai-bot-traffic/) - [GoDaddy — Annual Cybersecurity Report](https://www.godaddy.com/resources/news/godaddy-annual-cybersecurity-report) - [Ahrefs — llms.txt study](https://ahrefs.com/blog/llmstxt-study) - [GravityKit — WordPress market share 2026](https://www.gravitykit.com/wordpress-market-share-2026/) - [The Repository — Awesome Motive breach widens](https://www.therepository.email/awesome-motive-breach-widens-as-uncanny-automator-confirms-customer-data-theft-monsterinsights-users-hit-with-phishing-campaign) - [XWP — Stream 4.2 ships the Abilities API](https://xwp.co/stream-4-2-ships-the-abilities-api-ask-your-audit-log-a-question/) ## 🗣️ Paraphrase - The newsletter returns from a WordCamp Europe break with a packed issue centered on WordPress 7.1 prep and a temporary 24-hour auto-update delay meant to open a security-review window. - A cluster of plugins shipped Abilities API / MCP support this issue (SEOPress, Stream, WPForms, SureCart), making agent-readable WordPress data the quarter's dominant integration pattern. - Two studies quantify the security/traffic landscape: Kinsta finds AI bots now account for roughly 1 in 31 visits with a 300%+ yearly surge, and GoDaddy's report breaks down malware categories across ~835k infected sites. - Business moves include Your.Online acquiring Joost and Marieke's Progress Planner to lead AI, and a SiteGround controversy over ~1M forced AI-plugin installs. - The issue also flags WordPress's market share slipping to 33% from 36%, the widening Awesome Motive breach, and a community fundraiser for Eric Binnion. ## 📰 Newsletter **WordPress grows an AI nervous system — and a 24-hour pause button** This WP Weekly is a "state of the platform" snapshot worth your attention. The headline isn't any single plugin — it's two structural shifts happening at once. First, WordPress.org is adding a **24-hour delay** before plugin and theme auto-updates go out, explicitly to open a security-review window for "AI-assisted tools that can operate continuously." That's a quiet but real change to the update threat model: the ecosystem is trading instant propagation for reviewed propagation, right as the Awesome Motive breach keeps widening (Uncanny Automator data theft, MonsterInsights phishing). Second, the **Abilities API** had a breakout issue — SEOPress, Stream, WPForms, and SureCart all shipped support, so your audit log, SEO fields, and forms are now things an MCP client (Claude, Cursor, ChatGPT) can read and act on. If you build plugins, that's your new integration surface. Meanwhile the numbers tell a sobering story: WordPress is down to **33% of the web (from 36%)**, AI bots are now **1 in 31 visits** (Kinsta), and one bot fired **3.75M "add to cart" hits in a day** — bot traffic is a line item now, not a nuisance. And a human note in all the product churn: Automattic's Eric Binnion is fighting stage-4 cancer, with a community GoFundMe running. (Bonus: Courtney's own Airo Builder build video made the issue's YouTube picks.) ## ✅ Action Items #### DevRel - Developer advocacy: a talk/demo on "shipping Abilities API support" using SEOPress/Stream as worked examples; the agent-readable-plugin pattern is the quarter's story. - Education: workshop on the 24-hour auto-update delay — what it changes for release timing and security review. - Developer experience: a reference "expose your plugin to MCP via the Abilities API" recipe. - Developer marketing: clip the Kinsta "1 in 31 visits is an AI bot" stat as evergreen explainer content. - Community management: amplify the Eric Binnion GoFundMe; coordinate a community support push. - Internal/external/cross-project: track Abilities API adoption as an ecosystem-health signal. #### OSPO - Policy & Governance: guidance on the auto-update delay window and AI-assisted plugin review. - License Compliance: verify licenses on the wave of new free-repo plugins before recommending (Rank Bix, Zyre, CodingBunny, ShortPixel AI Alt Text). - Security Management: incorporate the Awesome Motive breach + GoDaddy malware categories into supply-chain risk guidance. - Software Inventory: catalog which installed plugins now expose Abilities API surfaces (new attack/automation surface). - Developer Support: consultation on building Abilities API endpoints safely (permission gating, least privilege). - Community Engagement: fund independent verification of the Kinsta/GoDaddy vendor studies. - Strategic Alignment: treat "AI bot traffic cost" as a tracked infrastructure metric. #### Community - Maintainers: adopt the 24-hour review window into release hygiene. - Contributors: a "first issue" to add Abilities API support to an existing plugin. - Sponsors: support the Binnion fundraiser and WordCamp India 2027 host-city effort. - Ecosystem: coordinate a shared bot-traffic mitigation playbook for hosts and site owners. #### WordPress - Core: monitor whether the 24-hour delay measurably reduces malicious-update propagation. - Core Performance: publish bot-traffic load baselines so sites can budget for the Kinsta-reported surge. - Core AI: the Abilities API adoption wave is the AI surface — document patterns and security guidance. - **Core Program Team:** coordinate messaging on the auto-update delay so authors aren't surprised by release timing. - Mobile: Not applicable to this source. - Playground: a Playground demo of an Abilities-API/MCP interaction would teach the pattern well. - Community: WordCamp session ideas — "AI bot traffic" and "build agent-ready plugins." - Training: learning path on the Abilities API for plugin developers. - Marketing: address the 33%-from-36% market-share narrative head-on. - Support: anticipate site-owner questions about AI bot load and the update delay. - Design: Not applicable to this source. - Documentation: examples-first Abilities API guide; document the auto-update delay behavior. - Photos / TV / Openverse: Not applicable to this source. - Polyglots: glossary for "Abilities API," "MCP," "auto-update delay," "AI bot traffic." - Accessibility: note the WP Buffs × Equalize Digital partnership; Oxygen Builder accessibility reality-check. - Meta: Not applicable to this source. - CLI: note Automattic's Pressship CLI plugin-publishing project. - Hosting: bot-traffic mitigation is now a host-level concern (Kinsta data). - Tide / Themes / Plugins: the new-plugin wave is repo signal; the auto-update delay is a Plugins-team policy change. #### The WPOCC - Programs: a fellowship on agent-ready (Abilities API) plugin development. - Projects: documentation sprint on the auto-update delay and AI security-review window. - Funding experiments: microgrant for independent reproduction of the Kinsta/GoDaddy studies. ### FAIR - Technical independence: agent-readable plugin data via an open API (Abilities API) is an independence-aligned surface — document governance. - Policies and covenants: transparency on which vendor studies are independently verified vs marketing. - Productized governance artifacts: a "plugin update security-review" checklist for the 24-hour window. ## 🧪 Hypotheses - H1: The 24-hour auto-update delay measurably reduces successful malicious-update propagation without materially slowing legitimate security patches. - H2: Plugins that ship Abilities API support see higher retention/engagement than comparable plugins without it, as agentic workflows favor machine-readable surfaces. - H3: AI bot traffic (per Kinsta) imposes a measurable hosting-cost increase that shifts pricing or rate-limiting policies across managed hosts within 12 months. - H4: WordPress market-share decline (36%→33%) correlates with migration to static/JS stacks and hosted site builders rather than with a single competitor. - H5: The Awesome Motive breach measurably increases site-owner adoption of activity-logging/security plugins (e.g., Stream, Melapress) in the following quarter. - H6: llms.txt's 97% non-read rate persists until a major AI crawler formally commits to honoring it. ## 📊 Methodology - H1: pre/post analysis of malicious-update incident rates around the delay's introduction, controlling for total update volume. - H2: cohort comparison of plugins with vs without Abilities API support on active-install retention and support-ticket profiles. - H3: host-level cost telemetry (compute/bandwidth per site) segmented by measured bot-traffic share. - H4: migration-tracking survey + technographic crawl data correlating CMS departures with destination stacks. - H5: install-trend analysis of security/logging plugins indexed to breach-disclosure dates. - H6: crawler-log study measuring actual llms.txt fetch rates across major AI user agents. ## ❓ Questions - Does a 24-hour delay create its own risk window (known-vulnerable versions left live a day longer) that offsets the review benefit? - Is the Abilities API surface being shipped with adequate capability/permission gating, or is it widening the attack surface faster than it's being secured? - How much of the 36%→33% decline is real migration versus measurement/methodology change at the survey source? - Are vendor security studies (Kinsta, GoDaddy) measuring representative populations, or only their own (skewed) customer base? ## 🔮 Future Research - Independent reproduction of the Kinsta AI-bot-traffic figures across non-Kinsta infrastructure. - A longitudinal study of Abilities API adoption and its security incident profile. - Analysis of whether the auto-update delay shifts attacker behavior (e.g., toward zero-day exploitation before review). - Tracking WordPress market share with a transparent, consistent methodology over multiple years. ## 💡 Implications - **Practice:** Plugin authors should plan for the 24-hour delay in release timing and prioritize Abilities API support as a default integration. - **Policy:** WordPress.org is institutionalizing AI-assisted security review; expect governance norms around the review window. - **Security:** AI bot traffic and the widening Awesome Motive breach make activity logging, least-privilege, and supply-chain vigilance baseline requirements. - **Education:** Curricula should cover the Abilities API/MCP surface and bot-traffic mitigation as core skills. - **Funding models:** Bot-traffic cost and AI-feature expectations pressure host pricing and plugin business models alike. ## 🧠 Learning Styles Assessment - Reading level estimate: scannable newsletter prose with dense proper-noun load (plugin/company names, version numbers); ~Flesch–Kincaid Grade 9–11. Flesch Reading Ease ~50–60. #### 👀 Visual learners - Present: section emoji headers, the issue's hero image, sponsor logos. - Improve: a chart of the GoDaddy malware-category breakdown and a timeline of 7.1 milestones. #### 🔊 Aural learners - Present: none — text digest (though it links the Accessibility Craft podcast). - Improve: a 3-minute audio recap of the issue's three structural threads. #### 🗣️ Verbal learners - Present: clear, punchy item summaries with consistent "Product + feature…" phrasing. - Improve: a glossary callout (Abilities API, MCP, llms.txt, auto-update delay). #### 🧩 Kinesthetic learners - Present: direct links to try each plugin/tool. - Improve: a hands-on "enable Abilities API on a test plugin" exercise. #### 🧠 Logical learners - Present: grouped categories (Core, SEO, AI, Security, Business) impose structure. - Improve: explicit "why this matters" tags per item; separate signal from sponsor content. #### 🧑‍🤝‍🧑 Social learners - Present: community items (Binnion fundraiser, WordCamps), social share links. - Improve: discussion prompts for the security/market-share threads. #### 🧘‍♀️ Solitary learners - Present: self-paced scan-and-click format. - Improve: a "top 3 to read this week" curation to reduce overwhelm. #### 🌿 Naturalistic learners - Present: "ecosystem" framing of the WordPress landscape. - Improve: tie bot-traffic load to energy/compute footprint. ## 📊 Accessibility Assessment #### Screen reader semantics - Present: the source is a structured HTML newsletter with headings and lists; linear reading order works. - Improve: ensure emoji in headings have accessible names and don't disrupt heading semantics; mark up the stats as a real list/table. #### Keyboard navigation - Present: standard web page with text links. - Improve: verify visible focus on the many inline links and sponsor blocks. #### Contrast and readability - Present: standard newsletter theme. - Improve: verify 4.5:1 on link colors against the busy sponsor sections. #### Text resizing and reflow - Present: responsive layout expected. - Improve: confirm sponsor logo blocks reflow without clipping at 200% zoom. #### Media and captions - Present: hero image and sponsor logos. - Improve: descriptive alt text for the issue image and each sponsor logo; captions for linked videos. #### Forms and interactions - Present: multiple newsletter sign-up forms/popups. - Improve: ensure form labels, focus order, and dismissible popups for the convertbox sign-ups. #### Standards reference - Maps to WCAG 2.2 AA: 1.1.1 (alt text), 1.3.1 (info & relationships — stats as list/table), 1.4.3 (contrast), 1.4.10 (reflow), 2.1.1 (keyboard), 2.4.6 (headings & labels), 3.3.2 (labels), 2.4.7 (focus visible). ## 🌍 DEIB Assessment #### Cultural breadth - Present: genuinely global — WordCamps across India, Uganda, Finland, Switzerland, France, Canada; international vendors. - Improve: more non-Western product/voice coverage beyond event listings. #### Inclusive language - Present: neutral, professional product-announcement language. - Improve: define dense jargon inline for newcomers (Abilities API, MCP, schema). #### Neurodiversity support - Present: consistent item structure and grouping aids scanning. - Improve: a short "if you read one thing" summary to reduce cognitive load from the high item count. #### Representation - Present: names a range of community members and a women-led acquisition (Marieke van de Rakt); flags an accessibility partnership (WP Buffs × Equalize Digital). - Improve: surface more contributor voices beyond product owners and founders. #### Psychological safety - Present: compassionate framing of the Binnion fundraiser; measured tone on controversies. - Improve: clearer separation of sponsored/affiliate content from editorial to preserve reader trust. ## ✅ Logical Validity #### Strong reasoning - Mostly descriptive/curatorial: the issue reports events and links sources rather than arguing a thesis, so its "reasoning" is editorial selection and grouping, which is coherent and well-organized. - Where it interprets (the auto-update delay as a security-review window; Abilities API as a trend), the inference from the collected items is reasonable. #### Fallacies - **Appeal to (vendor) authority / unverified statistics** — the Kinsta ("1 in 31 visits," "3.75M add-to-cart") and GoDaddy (malware-category percentages) figures are reported as fact from single-vendor studies of their own customer bases. Location: "Security Focus" section. Fix: label as vendor-internal and note the self-selection bias. - **Suppressed-interest framing (advertising)** — the digest interleaves sponsor blocks and affiliate links with editorial items without strong visual separation, which can lend product claims unearned editorial weight. Location: throughout (sponsor blocks, "ref=" links). Fix: clearly demarcate sponsored/affiliate content. - **Hasty generalization (mild)** — "97% of llms.txt files never get read" is cited as a flat fact from one study; the population and method aren't stated in the digest. Fix: scope the claim to the study's sample. #### Tone of voice - Upbeat, community-friendly, promotional-but-transparent (discloses affiliate/sponsor relationships); concise and consistently formatted. Editorial enthusiasm, not analysis. ## 🛡️ DARVO Analysis - Deny / Attack / Reverse victim-offender: **Not applicable to this source.** A curated news digest makes no accusation and mounts no defense; it reports third-party events (including the Awesome Motive breach and SiteGround controversy) neutrally rather than deflecting or reframing blame. ## 🎯 Conclusion - **Bottom line.** Issue 295 captures WordPress professionalizing under pressure: it's standing up an AI-integration layer (Abilities API/MCP adoption across SEOPress, Stream, WPForms, SureCart) and a security-review posture (the 24-hour auto-update delay) at the same moment it faces measurable market-share erosion (33%, from 36%), rising AI-bot infrastructure cost (1 in 31 visits), and a widening third-party breach. - **Next steps for readers.** (1) If you build plugins, prioritize Abilities API support and plan for the 24-hour update delay. (2) If you run sites, budget for AI bot traffic and tighten supply-chain/security hygiene in light of the Awesome Motive breach. (3) Treat the Kinsta/GoDaddy figures as directional, vendor-sourced signals, not settled facts. (4) Consider supporting the Eric Binnion fundraiser. ## 🧱 Refactor Appendix — WP Weekly 295 > Density: 2–5 Literature atoms (H3), 0–3 Permanent candidates (H4). Resonance filter on. > Tag pool: #bmf · #addendum · #xref · #articleseed · #storystem · #share · #aphorisms ### 📚 Literature Atoms (H3) #### [H1] WordPress is adding a 24-hour security-review window before auto-updates distribute > [!quote] ID:rw_pending > "WordPress.org is adding a temporary 24-hour delay before plugin and theme updates are distributed through auto-updates. The pause creates a window for security review, including the use of AI-assisted tools that can operate continuously." **Context & use**: - Changes the update threat model from instant propagation to reviewed propagation. - Pairs with the widening Awesome Motive breach as the security backdrop of the issue. **Tags**: #xref #articleseed  #### [H2] The Abilities API is becoming the default machine-interface for WordPress plugins > [!quote] ID:rw_pending > "Now the same data is also exposed as a set of WordPress Abilities, and any MCP-aware client can read and act on it: Claude Desktop, Claude Code, Cursor, ChatGPT, anything that speaks the Model Context Protocol." **Context & use**: - SEOPress, Stream, WPForms, SureCart all shipped Abilities API / MCP support in one issue. - The quarter's dominant integration pattern — agent-readable plugin data. **Tags**: #xref #articleseed  #### [H3] AI bot traffic is now a first-order hosting cost > [!quote] ID:rw_pending > "over 300% bot traffic surge in one year, 1 in 31 web visits is an AI bot, and over 3.75M 'add to cart' hits from one bot in 24 hours." **Context & use**: - Kinsta, 10B+ requests analyzed (vendor study — flag self-selection). - Reframes bot traffic from nuisance to budgeted infrastructure line item. **Tags**: #xref  ### 🧠 Permanent Candidates (H4) #### [P1] An AI-review window trades propagation speed for supply-chain safety **Claim** (one sentence, Courtney's voice): Inserting a timed, AI-assisted review window between a plugin update and its auto-distribution converts the update channel from an instant supply-chain risk into a reviewed one — buying security at the cost of a day's patch latency. **Evidence pointer**: [[#H1]] **Scope & conditions**: Holds when the review window catches malicious updates faster than the extra day exposes known-vulnerable versions; inverts for actively-exploited zero-days where any delay in patching costs more than it saves. **Links**: - [[An Ops Agent Is Only as Capable as Its System Access]] — contrasts/extends (AI-assisted review is the safety side of granting agents access) - [[The Maker Should Not Grade Its Own Homework]] — applies-in (the review window is an independent-checker gate on the update pipeline)  ### ✏️ Fleeting Queue - [F1] Watch whether Abilities API adoption produces a security-incident spike as plugins expose more write surfaces. #fleeting #inbox - [F2] Independently sanity-check the Kinsta "1 in 31 visits is an AI bot" figure against courtneyr.dev logs. #fleeting #inbox ### → Things 3 (max 2 actions) - [ ] Draft a short post on "shipping Abilities API support" using SEOPress + Stream as worked examples — #things - [ ] Add a bot-traffic line item to the courtneyr.dev hosting/perf review — #things  📄 **Full text:** [[Full Document Contents/Articles/WP Weekly 295 – Back.md|WP Weekly 295 – Back by The WP Weekly]] ## Highlights - Stream + Abilities API… 4.2v of [Stream](https://wordpress.org/plugins/stream/) comes with [Abilities API support](https://xwp.co/stream-4-2-ships-the-abilities-api-ask-your-audit-log-a-question/). Now the same data is also exposed as a set of WordPress Abilities, and any MCP-aware client can read and act on it: Claude Desktop, Claude Code, Cursor, ChatGPT, anything that speaks the Model Context Protocol. ([View Highlight](https://read.readwise.io/read/01kvqm831fh892prah3p0z03hc)) - Note: H2 — The Abilities API is becoming the default machine-interface for WP plugins; agent-readable data via MCP. SEOPress/WPForms/SureCart shipped support the same issue. - Tags: atom/literature/h2, abilities-api - 24 Hr Delay in Auto Updates…WordPress .org is adding a [temporary 24-hour delay](https://wordpress.org/news/2026/06/pts/) before plugin and theme updates are distributed through auto-updates. The pause creates a window for security review, including the use of AI-assisted tools that can operate continuously. ([View Highlight](https://read.readwise.io/read/01kvqm7zkr67qanvvvcc6j6cwr)) - Note: H1 — WordPress shifts the update threat model from instant to reviewed propagation; an AI-assisted security-review window. - Tags: atom/literature/h1, website-security, wordpress-7-1 - GoDaddy Cybersecurity Report… GoDaddy has published the [Annual Cybersecurity Report](https://www.godaddy.com/resources/news/godaddy-annual-cybersecurity-report) on the changing threat landscape for websites. This report is a result of an analysis of 932,641 threat detections across 834,661 infected websites throughout 2025. Threat spread was: general malware (41.5%), SEO spam (35.2%), malicious redirects (21.7%), unwanted ads (1.1%), and defacements (0.5%), demonstrating the range of attack categories affecting websites. ([View Highlight](https://read.readwise.io/read/01kvqm8apmy169myc5eqma84k6)) - Note: Security data — GoDaddy malware-category breakdown across ~835k infected sites (vendor study). - Tags: website-security, atom/literature/h3 - AI & Bot Traffic Reality Check… Kinsta analyzed more than 10 billion requests across its infrastructure and [compiled a report](https://kinsta.com/ai-bot-traffic/?kaid=JQIEWMOEASGI) on how AI and search bots are impacting websites, revealing the challenges for performance, server resources, and traffic management. Like over 300% bot traffic surge in one year, 1 in 31 web visits is an AI bot, and over 3.75M ‘add to cart’ hits from one bot in 24 hours. ([View Highlight](https://read.readwise.io/read/01kvqm875hy409kgm36ggdg11e)) - Note: H3 — AI bot traffic is now a first-order hosting cost (vendor study — flag self-selection). 1 in 31 visits is an AI bot. - Tags: atom/literature/h3, ai-bot-traffic