WordPress needs to catch up to the web 🔗 **Source:** [WordPress needs to catch up to the web](https://progressplanner.com/catch-up-to-the-web/) > [!note]+ Document Notes > tags: [WordPress, FAIR, Supply-Chain-Security] > author: Joost de Valk > source: Progress Planner > reference: [https://progressplanner.com/catch-up-to-the-web/] > date created: 2025-11-14 00:00 > > # 🏷️ Title: WordPress needs to catch up to the web > <!-- deep-read:sections start --> ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - Include links cited in or relevant to the article. ## 📝 Summary - What happened. - Argues WordPress must move from centralized, Subversion-era infrastructure to decentralized, verifiable, standards-based distribution; introduces FAIR and a modern glossary plugin. - Why it matters. - Security, compliance (e.g., EU CRA), resilience, and developer velocity depend on modern supply chain practices and web standards. - Key stakeholders. - WordPress core, plugin/theme authors, hosts, site owners, EU-regulated businesses. - Risks and tradeoffs. - Governance complexity, migration costs, compatibility burdens, ecosystem fragmentation if standards are weak. - Bottom line. - “Built for 2005, running in 2025” no longer works; adopt federated repos, signatures, provenance, and native web APIs to lead again. ## 📖 Main Content - Core arguments - Centralized directories were brilliant in 2005; today’s web favors distributed, verifiable systems. FAIR proposes “Federated and Independent Repositories” with signatures, provenance, and SBOM to reduce single-point-of-failure risk and meet compliance. - Modern browser capabilities (HTML Popover API, CSS Anchor Positioning) can replace legacy patterns (jQuery tooltips, shortcodes). A new glossary plugin demonstrates this. - Signs of progress include WordPress Playground (WebAssembly) and an incoming Abilities API for AI integrations. - Context/definitions - Subversion is centralized; Git and modern registries are distributed. - CRA pushes verifiable integrity, updates, and traceability. - Uncertainties - How fast WordPress.org can evolve governance, standards adoption across the plugin ecosystem, and the exact scope/timeline for Abilities API rollout. ### 🗒️ Notes - “The web it was built for doesn’t exist anymore.” - Centralization created “a single point of failure… governance bottlenecks.” - FAIR: decentralized repos with cryptographic signatures, provenance, future SBOMs; enables compliance and accountability. - Glossary plugin: swaps jQuery/shortcodes for native [HTML Popover API](https://developer.mozilla.org/en-US/docs/Web/API/Popover_API) and [CSS anchor positioning](https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_Anchor_Positioning). - Progress: [WordPress Playground](https://developer.wordpress.org/playground/) (WebAssembly), Abilities API targeted for WP 6.9 to support AI-ready infra. - “Modern WordPress should be truly democratic, modern, and standards-driven.” ## 📚 References - EU’s [Cyber Resilience Act overview](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act) - Apache [Subversion](https://subversion.apache.org/) - [WordPress Playground](https://developer.wordpress.org/playground/) - MDN: [HTML Popover API](https://developer.mozilla.org/en-US/docs/Web/API/Popover_API) - MDN: [CSS Anchor Positioning](https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_Anchor_Positioning) - WordPress 6.9 roadmap/field notes (pending official link) ## 🗣️ Paraphrase - Paragraph A paraphrase. - WordPress’s centralized plugin/theme hubs were great historically, but the modern web expects distributed, verifiable software delivery. - Paragraph B paraphrase. - FAIR introduces a federated network with cryptographic verification, provenance, and SBOMs to improve security, compliance, and resilience. ## 📰 Newsletter WordPress needs to match the modern web. Joost de Valk calls for decentralizing distribution with FAIR—think signed packages, provenance, and future SBOMs to satisfy security and CRA-era compliance. He also ships a standards-first glossary plugin using the HTML Popover API and CSS Anchor Positioning—no jQuery required. Signs of momentum: WordPress Playground (WASM) and an Abilities API slated for 6.9 to enable AI-ready features. Resources: explore the Playground, review CRA requirements, and audit your plugins’ supply chain posture. - Learn: WordPress [Playground](https://developer.wordpress.org/playground/) - Standards: [HTML Popover API](https://developer.mozilla.org/en-US/docs/Web/API/Popover_API), [CSS Anchor Positioning](https://developer.mozilla.org/en-US/docs/Web/CSS/CSS_Anchor_Positioning) - Policy: [EU CRA](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act) ## ✅ Action Items #### DevRel - Publish demos: FAIR-signed package flow; glossary plugin code walkthrough. - Run workshops on package signing, provenance, and SBOM for WP devs. - Create quickstarts: GitHub Actions templates for signing and attestations. - Campaign: “Modern WordPress Supply Chain” series; attribute via UTM + doc downloads. - Community office hours on migrating from jQuery tooltips to Popover API. #### OSPO - Policy: require signature + provenance for internal WP plugins/themes. - Compliance: CRA readiness checklist; monthly scans and license reviews. - Security: intake + embargo policy; artifact signing and attestations. - SBOM: standard format (CycloneDX) and freshness SLO. - Developer support: clinic hours for signing toolchains; legal guardrails. - Engagement: fund FAIR pilot repos; operator agreements with hosts. - Strategy: quarterly OKRs on signed coverage and repo federation adoption. #### Community - Maintainers: roadmap clinics; release hygiene with signed artifacts. - Contributors: “first issue” rotations on standards migration. - Sponsors: tie funding to verifiable-security milestones; publish impact reports. - Ecosystem: cross-project incident drills; coordinated disclosures. #### WordPress - Core: prioritize package verification interfaces; performance budgets. - Core Performance: profiling for signing overhead; dashboards. - Core AI: guardrails, eval sets, Abilities API pilots. - Core Program Team: cross-team rituals; dependency tracking; retros. - Mobile: offline UX; telemetry review. - Playground: browser labs for reproducible supply chain bugs. - Community: meetup kits and WordCamp talks on FAIR and CRA. - Training: lesson paths on modern web APIs and provenance. - Marketing: narratives on “from centralized to federated.” - Support: KB on signing errors and provenance troubleshooting. - Design: UX for trust signals (signature status, maintainer lineage). - Documentation: examples-first patterns; style guide for web standards. - Photos/TV/Polyglots/etc.: align moderation, captions, translation coverage. - Meta: .org roadmap for federation APIs and reliability SLAs. - CLI: commands for verify/sign/provenance; smoke tests. - Hosting: shared checklists; reliability telemetry. - Tide: scoring transparency; reduce false positives; plugin outreach. - Openverse/Themes/Plugins: review throughput; mentoring; provenance checks. #### The WPOCC - Programs: microgrants and stipends for maintainers adopting signing. - Projects: governance clinics; documentation sprints on federation. - Funding: matched grants for FAIR-compliant repos; transparent ledgers. ### FAIR - Technical independence: local metadata, provenance, and signature verification. - Policies: funding transparency, anti-capture covenants, sunset clauses. - Governance artifacts: charters, operator agreements, conformance scorecards. ## 🧪 Hypotheses - Federated repos with signatures reduce plugin supply-chain incidents by ≥30% within a year. - Displaying provenance and maintainer lineage increases install conversions by ≥10%. - Native Popover/Anchor implementations cut glossary JS payloads by ≥80% with no UX regressions. - Abilities API accelerates AI feature adoption in plugins by ≥25% within two releases. ### 📊 Methodology - Interrupted time series on incident rates pre/post FAIR adoption. - A/B test plugin directory UI with provenance signals vs control. - Performance/UX study: legacy jQuery tooltip vs Popover API. - Adoption telemetry: number of plugins using Abilities API over time. ### ❓ Questions - What minimal standard should define a FAIR-compliant repository? - How will federation handle trust, revocation, and dispute resolution? - What UI conveys software integrity without overwhelming users? ### 🔮 Future Research - Standardized attestations for WordPress packages. - Host-integrated verification pipelines. - Human factors in trust signals for non-technical admins. ### 💡 Implications - Practice: default signed releases with visible trust badges. - Policy: CRA-aligned update and disclosure cadences. - Security: provenance-first build pipelines. - Education: curricula on modern web APIs and supply-chain hygiene. - Funding: grants tied to verifiable security outcomes. ### 🧠 Learning Styles Assessment - Reading level: Flesch-Kincaid Grade ≈ 10–11. #### 👀 Visual learners - Present: conceptual contrasts (centralized vs federated). - Improve: diagrams of FAIR flows; trust badge UI mockups. #### 🔊 Aural learners - Present: none. - Improve: 3-minute audio summary; podcast segment. #### 🗣️ Verbal learners - Present: clear definitions; examples. - Improve: glossary of supply-chain terms. #### 🧩 Kinesthetic learners - Present: none. - Improve: hands-on lab: sign/verify a plugin. #### 🧠 Logical learners - Present: causal argument for decentralization. - Improve: decision trees; RACI for governance. #### 🧑‍🤝‍🧑 Social learners - Present: community examples. - Improve: cohort-based adoption sprints. #### 🧘‍♀️ Solitary learners - Present: reflective takeaways. - Improve: self-check quizzes on CRA and signing. #### 🌿 Naturalistic learners - Present: ecosystem analogies. - Improve: lifecycle-minded maintenance checklists. ### 📊 Accessibility Assessment #### Screen reader semantics - Present: headings; likely basic landmarks. - Improve: descriptive alt text; language attributes. #### Keyboard navigation - Present: native Popover supports focus handling. - Improve: ensure focus traps avoided; visible focus states. #### Contrast and readability - Present: likely adequate contrast. - Improve: verify 4.5:1 body text; line-height 1.5+. #### Text resizing and reflow - Present: responsive layout. - Improve: 200% zoom tests; prefers-reduced-motion. #### Media and captions - Present: text article. - Improve: audio summary with transcript. #### Forms and interactions - Present: glossary popovers. - Improve: inline validation patterns for site forms. #### Standards reference - Map gaps to WCAG 2.2 AA: 1.4.3, 2.4.7, 1.4.10, 2.2.2, 4.1.2. ### 🌍 DEIB Assessment #### Cultural breadth - Present: global web framing. - Improve: multilingual examples; translation links. #### Inclusive language - Present: neutral tone; minimal jargon. - Improve: plain-language summaries of CRA and FAIR. #### Neurodiversity support - Present: chunked sections. - Improve: more consistent callouts and icons. #### Representation - Present: general community references. - Improve: highlight diverse maintainers and locales. #### Psychological safety - Present: respectful critique. - Improve: community guidelines and moderated Q&A links. ### ✅ Logical Validity #### Strong reasoning - Causal: centralization → single point of failure → risk; aligns with distributed systems theory. - Inductive: examples (Playground, Abilities API) indicate modernization is feasible. #### Fallacies - Potential hasty generalization from glossary plugin experiences; mitigate with broader plugin audit data. #### Tone of voice - Constructive, pragmatic, mildly urgent: “built for 2005, running in 2025.” ### 🛡️ DARVO Analysis - Deny: none; acknowledges progress. - Attack: none; critiques systems, not people. - Reverse victim/offender: none; frames ecosystem responsibility and solutions. ## 🎯 Conclusion - Bottom line: WordPress should adopt federated distribution with verifiable integrity and lean into native web standards, moving from centralized legacy patterns to resilient, compliant, and developer-friendly infrastructure. - Next steps: pilot FAIR-compliant repos, surface provenance in UX, ship Abilities API, and replace legacy JS UI patterns with modern browser capabilities. ## 🧱 Refactor Appendix (append after 🎯 Conclusion) ### 📚 Literature Split Pad - Purpose: Stage Konik CEE units that become per-source Literature notes. - Split level: H3. - Include verbatim quotes under 25 words and a [view highlight] link. ### [H1] WordPress distribution modernizes via federation > [!quote] [WordPress needs to catch up to the web](https://progressplanner.com/catch-up-to-the-web/) by [[Joost de Valk]] via [[Progress Planner]]. Published 2025-11-14. Accessed 2025-11-14. > “FAIR replaces dependence with resilience.” Two lines: FAIR proposes signed, provenance-rich packages; reduces single point of failure. [view highlight](https://progressplanner.com/catch-up-to-the-web/#H1) #xref #articleseed ID:rw_[MISSING] ### [H2] Native web APIs replace legacy patterns > [!quote] [WordPress needs to catch up to the web](https://progressplanner.com/catch-up-to-the-web/) > “It uses modern web APIs like the HTML Popover API and CSS Anchor positioning…” Two lines: move from jQuery tooltips/shortcodes to Popover/Anchor for simpler, accessible UI. [view highlight](https://progressplanner.com/catch-up-to-the-web/#H2) #xref ID:rw_[MISSING] --- ### 🔖 Atomic Split Pad (Zettel Candidates) #### [Z1] Signed federation reduces plugin supply-chain risk - Holds when repos enforce signatures and provenance checks. - Pointer: article’s FAIR section; CRA references. - Links: [[Software-Supply-Chain]] [[Federation]] #### [Z2] Native Popover improves glossary UX with less JS - Applies to tooltip/definition UI in WP sites. - Pointer: glossary plugin example. - Links: [[Web-Standards]] [[Accessibility]] --- ### ✏️ Fleeting Queue (Extract by Selection) - [F1] Draft a FAIR conformance checklist—context/https://progressplanner.com/catch-up-to-the-web/ #fleeting #inbox - [F2] Prototype signature verification in WP-CLI—context/https://progressplanner.com/catch-up-to-the-web/ #fleeting #inbox - [F3] Replace jQuery tooltips with Popover in docs—context/https://progressplanner.com/catch-up-to-the-web/ #fleeting #inbox --- <!-- deep-read:sections end -->