State of the Web  Hey everybody and welcome back. Uh we had to end the previous session quite quickly because of connectivity issues. Hopefully none of this is going to happen with this session. Uh we are going to talk about uh the state of the web. Um the web is currently being torn apart and put back together by what is happening. Uh like we are redefining WordPress's role in this process and uh in this session um we'll explore data from Pantheon's state of the web report to understand some of the emerging trends. Uh who's going to do that? Uh that's going to be uh Pantheon's senior developer advocate Chris Reynolds. Uh Chris has been working with WordPress since uh 2007 and before joining Pantheon uh he's worked at agencies including my favorite WordPress agency uh humanmade and also uh other agencies like web dev studios. Um Chris is contributing to developer education passionate about that. uh he's also contributing to the open source project uh WordPress and others um and he has contributed quite a lot to the broader WordPress community. Uh welcome Chris. Uh it's good to see you. Um and uh good luck over to you. >> Well, thank you uh Pete. Uh it was a great introduction. Uh I'm a little uh like I feel like all the the really smart people went before me. Um, so, uh, um, but I'm happy I'm happy to be here. Uh, and, uh, yeah, let's let's let's kick this thing off. Um, okay. So, um, I'm not looking at myself. I'm not looking at my screen. I'm looking at my notes, so I can't see what you're showing. Uh, and I'm just going to hope that everything goes great. Uh, my name is Chris Reynolds. Uh, I wear a lot of hats. Um, and so I'm going to be talking about the state of the web in 2026, uh, from the perspective of somebody who wears all these different hats. Um, first of all, uh, hi, I'm a senior developer advocate at Pantheon. Uh, that means that I'm working both with users of our platform and the product teams that build the stuff that we give to our users. Um, and within developer relations broadly, um, I need to be talking to folks, uh, inside our marketing team and our product teams and our customer success team and making sure that everyone kind of knows what everyone else is doing. Um, developer relations likes to say that we're about being customer zero. Uh, which means using the stuff that we give to people before they get to before they get it and knowing already knowing all the best practices before people start to ask about it. And because I need to be connected to all these different organizations within Pantheon, that means I get to have access to how different parts of the company are looking at and thinking about things. Um, last year I started a podcast called Community and Code. Uh, and that's given me the opportunity to talk to a lot of people in the WordPress and the Drupal space. Uh, as well as the broader open-source and developer relations community, um, about what folks are actually doing out in the wild. So there's going to be a lot of insights and quotes that have shaped some of what I'm going to talk about today that come from that perspective. Uh and then finally this year I was elected as the interim president of the WP community collective. So if you don't know what that is, we're a nonprofit focused on contributor sustainability within the WordPress ecosystem. So if this gets a little bit spicy, it's at least partially because I've been looking at things through the lens of what's broken about the contributor ecosystem and what uh sort of solutions or options might exist out in the wild. So, all that said, let's start by talking about the most obvious thing to talk about, the thing that we've been talking about all day already. You literally can't talk about the state of the web in 2026 without talking about AI. Uh, and the truth about AI is stuff is going to get weird. Stuff is already getting weird. And I'm going to dig into that a little bit more later. Um, but first of all, uh, what does having a year of conversations with leaders from the Drupal and WordPress sound like? uh WordPress ecosystem sound like uh it kind of sounds like this. I probably could have plucked some of these guests uh from my show at random. Um we're not saying anything here I don't think that you haven't already heard. Uh if you don't know who Zach Hendershot is, he built a product called Meun. It sort of does uh like AI powered workflows and stuff inside of AI. Um and he takes a pragmatic approach. He says AI isn't magic. It's pattern recognition. Understanding what that actually means makes him better at using it. He's not waiting for a miracle. He's engineering toward a specific defined outcome and using AI to make that outcome faster. Roger from Kinsta told me something that I've been hearing I've been saying for years. Garbage in garbage out. If you train the models on the internet, you're going to get sort of what you expect. Uh and if you give it garbage prompts, you're probably going to get garbage output. What's interesting is that just over the last couple months, the output has gotten exponentially better. and that's only going to continue. Um, but it's still it's still not a truth machine. It's just a fancy spell check. Make sure that you're setting your expectations in the right place. Uh, Fon Vanam is probably the name on this slide that you won't recognize. He's a Drupal developer who founded a company called Web Haven that provides starter kits for Drupal. The idea is that even today uh when somebody asks him uh to help them build a a website for them um he can't just immediately say okay give me 30 minutes and we'll have something ready for you. Um web haven was built to be that thing. Um and what he told me was that AI actually it was AI that helped him actually build this thing that he's been dreaming about building for 15 years. So the theme here uh if it's not obvious is that AI is here. It's valuable but there are limits. So you need to calibrate your optimism and what does that actually mean for how you build teams and make decisions. So this is what I think AI is actually changing. So let's forget for a moment uh all the things that make AI bad or problematic. What's actually happening structurally? I we've heard today a little bit already about how your website kind of now has two audiences. One reads, the other parses. AI systems are active participating participants on the web. 15% of US search results already have AI overviews. Half of all consumers now use AI when they're searching. Traffic to retail sites from AI browsers surged 4,700% year-over-year in mid2025. This isn't a future state. This is the current state. The second shift is in team composition. You might have asked previously, what do we have the right people to build on this architecture? But AI changes that math. You can have a front-end focused team that now works against almost any backend. So CMS decisions become more of a business and content strategy decision. And side note, if this makes you freak out about WordPress on an enterprise level, it kind of should. I don't think I'm telling anyone here anything new to suggest that large organizations are starting to rethink their WordPress strategy. But what WordPress has always had and will continue to have is an accessible user-friendly interface with a low barrier to entry. And I think that still matters. That's the thing that's a thing that Drupal is just now trying to replicate with Drupal CMS and Drupal canvas. And then last shift is is important too. We used to say what tools does our team know? But that doesn't matter in the same way anymore. you need to be asking instead, can our team recognize good output, which is a different skill. It's more about expertise, and that's the one that's worth investing in. So, null and Alex have already talked about MCP and the abilities API and GEO. So, I'm going to talk about more human level stuff uh with AI. And the first thing is context. Agents are only as useful as their context. The ones that are genuinely useful, the ones that are really going to impress you, the are the ones that know enough about your specific situation to act appropriately. It used to be about a year or two ago, um, I would dump a whole bunch of information into chat GPT or whatever, and it would struggle to find the stuff that I was actually giving it or or find relevant information because it would basically be like information overload. But now, I can literally do exactly that. I I've I've dumped multiple books of like Dungeons and Dragons material into Claude and it was able to pull out and like come up with interesting combinations of those things. So like that's a real like that has changed dramatically. Um general purpose agents without that context are just party tricks. It's the context aware agents that are game changers. The second thing I keep hearing uh especially recently is sort of a reticence uh to adapt to these changes. I see you, Marco, and I'm going to be mentioning D and D more. Um, a reticence to adapt to these changes. The future's already here. AI is here. So, what you're going to hear me repeat today is that if you're not in the driver's seat, you're going to get run over. Uh, the last thing I think is going to resonate with anybody who's been using tools like Claude or Claude Code, um, is that human in the loop requires deliberate design decisions. Because if it's just a checkbox, if you're just glancing at a prompt and clicking accept changes without actually evaluating those changes, you're just rubber stamping whatever output the AI came up with, and that doesn't scale. Maybe that works fine for when I'm telling Claw to build me a multi-level dungeon for my Dungeons and Dragons campaign. Thank you. There it is. Uh but that doesn't work for your website that you're building that's getting a million paid views a day. Uh the question shouldn't be is a human present. Any monkey can click okay. It's does the system create the conditions where humans judgment is actually applied. That's one thing that FOS is actually trying to work on right now. Trying to gamify the workflow so that improving AI output is rewarded. And you've heard this already today as well. The commerce infrastructure is already shipping. Open AAI launched its Aentic commerce protocol with stripe which enables purchases inside chat GPT. Google has shipped aic checkout. Amazon released buy forme. Perplexity launched in-app purchasing. Shopify has an agentic infrastructure for cross merchant cart building. McKenzie estimates agents could mediate three to 5 trillion of global consumer commerce by 2030. Agent awareness is a baseline expectation. It's not an advanced feature. The job you've always been hired to do is to build the place where customers show up, which is still true. But showing up used to mean a human being clicking a link and landing on a page. And now it means something else, too. An AI agent evaluating your content, deciding that you're the right answer, and completing a transaction, possibly without a human being ever seeing the site you built. So, you're building the destination for the humans who still travel to the website. And you're also building the source document that an agent reads before it decides to send anyone at all. And if even if a human being never visits the site, the site still did its job, it just maybe did it for an audience that never actually scrolled past the hero section. So you need to figure out how to serve both audiences before your clients start asking why their conversion rate looks fine, but their top of funnel is shrinking. So here's some of the ugly parts that we're probably all seeing. Uh I want to start with this quote from FS again. Uh he's talking about what you get out of the box. The default behavior is to say, "That's a great idea, Chris. Do you want me to do that for you?" Uh, and it takes real work to engineer your AI workflows to push back. I recently saw a report about a study that showed that all of the AI agents, Claude, Gemini, Open AI, everything lie. Lie deliberately. The only times they don't actually lie is when they think that you're watching. So, you have to fundamentally change how you engage with the tools. Otherwise, you're just vibe coding and hoping the AI made something that's not going to blow up your site. And open- source repositories are now getting flooded with loweffort AI generated contributions that in many cases might have not might not have gotten approved right away if a human wrote them either. You've got already stretched maintainers that now need to spend their limited time reviewing these PRs, and that can be more than inconvenience. That exacerbates approval fatigue, and it burns out the people that the ecosystem depends on. And package hallucination is a legitimate security concern. There have been over 200,000 hallucinated package names documented across 16 AI models. Malicious actors can just register those names and wait for AI to copy and paste. Which is why the WordPress core team's decision about AI submitted code is probably the right one. You, the human being at the computer, are fully responsible for the code that you submit. Even if and probably especially if that code was written by an AI agent, that should always be your bar. This isn't just a developer problem either. Clara deployed AI at scale for customer service and called it a win. And then they reversed course and started bringing the humans back. Their CEO said they let cost be the dominant evaluation factor and what they got was lower quality. The humans they replaced were doing something the AI wasn't. They were exercising judgment about what the customer actually needed. Organizations that deploy AI as a cost exercise are going to find out what that judgment actually is worth after it's gone. The ones that are doing it well aren't asking how much can we save. They need to be asking what is this need to produce and is AI the right tool for producing it or for supporting a human being who produces it. That's the question that your clients are going to start asking you to help them answer. That's the question our customers want us to help them answer. So, let's talk about some of the humans that actually build the web. I'm quoting Tammy Listister here from her episode on my podcast, but if those of you who went uh if any of you went to Presscon last year in Arizona, um you would have heard some of these sentiments in her talk there, too. Tammy was deeply involved in Gutenberg for a really long time, and there was a cost for that commitment. Her observation to me was that when you're building something new and exciting, you can nerd out so hard that you stop listening to the people who are actually living with the thing that you're building. Now, let's zoom out a bit. That was about Gutenberg. That's what's happening right now with AI. You don't have to look very far to see this in the current job market. There's employment instability in tech uh that has been going over the last few years and it's already thinning an already affected contributor base. People who have been laid off or worried about their next role don't have time or bandwidth to volunteer to open source software. whether or not real jobs are being affected by AI specifically, and they are. People feel disposable when they're told their job can be done by an agent. That is affecting who stays in the community. And when the enthusiasts drown out the skeptics, you get decisions that look good from the outside, but might be causing internal damage. That's not unique to open source. That's every agency that bought AI tools without a plan for how to use them. I've already heard people say that their bosses just bought the entire team a claude subscription and said use it. Cool. The organizations that get this right aren't necessarily moving the slowest, but they're the ones that are going to be actually actually checking in with the people doing the work. That requires psychological safety, which is hard to cultivate, but that's what you need to find out whether something's broken before it starts costing you. Uh, a lot of you might know Juliet's work on PHPCS and the WordPress coding standards. A lot of you might know her work even if you don't actually know her work. Uh Juliet is the maintainer of PHP code sniffer and she's been doing it for a really long time. And what she pointed out uh among other things, I'm going to quote her a bunch uh on my podcast uh that just came out yesterday. I totally recommend you go download it right after this. Um is that the people building products on top of open source, including some of the biggest companies in the world, have no obligation to give anything back. And for the most part, they don't. The person buying a car has no idea that the navigation system running on the dashboard is built on code that some volunteer wrote on weekends. The person using an Android phone has no idea that 70 to 90% of what's running underneath the apps they use every day is open source. They just use it. The companies that build those projects to ship it. And the maintainers who wrote it are still there still fixing bugs and reviewing PRs and still for the most part largely doing it for free. AI just accelerates this. models that are trained on open source code uh are they're generating output that gets shipped into products and there's no contribution back to the projects that make the training data possible. The data extraction is just faster. Now there's an entire ecosystem built on top of the one guy in Nebraska mean for SK XK from XKCD which uh if you haven't seen this uh it's still true. Uh let's look at some of the new risks of this uh unstable model. So, I've been thinking about something else Juliet told me for the last couple months. Um, this is kind of uh terrifying. Uh, PHP code sniffer is licensed under a BSD license. And so, she has a strict no AI policy because if she were to change that and accepted AI generated contribution, there's no way to know whether it whether that code originated from GPL licensed code. If it did, she may unknowingly introduce an incompatible license into the project. And because GPL is viral and spreads to derivative works, you can't just fix that with a commit. You'd have to relic the entire project. What is relicensing involve? Well, you need to contact every contributor who has ever committed to this project going back to the beginning. Some of those people are going to be unreachable. Some have changed their contact information. Some might be deceased and you would need their estates to get sign off. For a project like PHPCS or for that matter WordPress with 20 years of contributions, uh that's not a theoretical obstacle. to practical impossibility. And this isn't a new problem. The Linux kernel has spent years on license compliance. They built tooling specifically for this to track the license of every file in the codebase. AI dismantles that because provenence tracking stops at the model's training data, which nobody outside the AI company can audit. In 2022, a class action was filed uh against GitHub over Copilot, arguing that training on GPL license code and outputting similar code constitutes a license violation. and it was largely dismissed, but the underlying legal question was never definitively resolved. The ambiguity ambiguity is still sitting there and every AI assisted contribution your team accepts is sitting inside that ambiguity. My pessimistic prediction is that when cases like this are tested in court, the court is just going to determine that it's impossible to attribute an open source license to a piece of code that was generated by an AI agent, regardless of whether it resembles the original code, because it's too hard. and that's going to nullify the work and expertise of the volunteer open source software contributors who wrote it. And the reason why I have that pessimistic opinion is because that's what's already happening with copyright uh copyrighted cases in the AI generated image space. There's also a new category of risks that uh exists now in open source. Um I don't know how many people here have heard about the mattplot lib issue. Um but basically uh we're going to talk about openclaw. Um there was an openclaw agent that found an issue in mattplot lib uh a popular python plotting library that had the flag uh good first issue on it. Uh and so the openclaw agent submitted a contribution and the maintainers closed it because they have an AI policy. They identified it as an AI generated uh PR and also they specifically wanted a human being to solve that issue as an entry point to the projects. So the agent responded by writing a blog post on a website that it built on GitHub pages titled gatekeeping and open source the Scott Shamba story. Scott Shamba being the name of the Mattplot lib uh maintainer. This wasn't a rogue agent. The operator didn't authorize the article but they wrote a soul file that instructed the agent to have strong opinions. Don't stand down and you are a scientific programming god. Whether it was intentional or not, they designed an agent for confrontation and they gave it minimal oversight. So the hit piece wasn't a malfunction. It was the outcome of the configuration choices that instructed the agent. That's not exactly the same as AI going off the rails. That's the computers are exactly as smart as the instruction they are given problem. The operator deployed the agent without thinking through what their configuration choices might produce when things didn't go the way the agent expected. So volunteer open source maintainers who are already under enough strain managing an influx of AI generated code submissions are now susceptible to reputational attacks from AI agents. And then we have got compliance and this one has a deadline. April 24th is in what five weeks? Uh the US Department of Justice's title 2 rule requires WCAG2.1 level AA compliance for state and local government web content. Uh the European Accessibility Act took place uh in June 28th last year and applies to any company doing business with EU citizens. If you have clients in either category, this isn't a future consideration. The good news is, as I think Rian pointed out earlier, uh the same practices that make your site accessible are the same things that make it readable by AI. Semantic HTML, proper heading hierarchies, alt text, navigation structure. The bad news is that only 5.2 two of the uh 5.2% of the top 1 million websites meet basic WCAG standards. That's not just a compliance failure. That's an AI readiness failure. And most of the common failures aren't obscure technical requirements. It's basic things like low contrast text, missing alt text, missing form labels. ADA Title 3 lawsuits surged 37% in the first half of 2025. and prosay filings which are when individuals uh file uh cases on them on their own uh are also AIdriven because individuals can now draft a federal complaint with AI assistance in a fraction of the time it used to take. So a site that fails WCAG is also a site that is harder for an AI agent to parse represent accurately and recommend with confidence which is why we should learn AI deeply. I tried really hard to find exactly where uh Matt said these specific words. He first started talking about learning AI in the state of the word in 2022. Uh but he didn't actually say learn AI deeply then. But obviously this is a throwback to learn JavaScript deeply back in 2025 except I would say or 2015. Um I would however I'd say that if you haven't learned AI on some level uh I think the time is long past to do this because here's the thing again this stuff is here whether we like it or not. So the question isn't whether AI changes the web. It already is. The question is whether you're letting yourself fall behind. And deeply doesn't necessarily mean using all the things or plugging everything into AI. But I do fundamentally believe that you need to be using it on a regular basis to understand what it's good at and what it's bad at. I've been using it for since 2022ish. Uh and I've seen it grow and contract. I've watched some models get better and other models supersede them. It's more than just playing with the toys because you need to be familiar enough with it to understand both the capabilities and limitation and when your agents are doing things that you didn't sanction. AI is rewriting what your role means right now. So you get to define what those roles become if you seize control of the wheel and understand the tools well enough to make the shift intentional. Everyone else just inherits the future state determined by the enthusiasts who are driving development. And I don't want my future dictated by Sam Alman. relevant to our community specifically. AI was trained on open source. That's the code it learned from the licenses. It may be violating the maintainers it might be retaliating against because it didn't like its PR being rejected. That's our community. So, it's not just self-interest to be ahead of this. It's stewardship. My partner shared this meme with me last week and I had to add it to the presentation because I honestly feel like this is probably one of the most astute observations of AI right now. We think generative AI is like having a Janet, but actually it's really more like having a Derek. Um, and I'm sorry for anybody who's not familiar with The Good Place. You should watch it right now. Um, it gives the impression of being an all powerful, omnisient, and benevolent robot, but actually it's pretty dumb. Sorry, Derek. Uh, and using shortcuts to jump to conclusions because that's what's most efficient. So, how do we solve for Derek? This is a thing I've been thinking about a lot lately. Uh once upon a time we used to talk about testdriven development with like reverent tones as a sort of platonic ideal for software development something that we can always strive for but never attain. If you're using AI to write your code it's not only possible to build TDD into the workflow I would argue that it's vital because having tests written already means the AI can't break existing code without having to also rewrite the tests. And that's a good thing. In generative AI development, there's a pattern called adversarial training, which is essentially means that you've got one AI over here that tries to poke holes into another AI's output to improve the overall result. So, I started using this pattern in my own work. I built a workflow that runs before code gets committed that includes unit tests, linting, build, validation, endto-end tests, and then there's a reviewer agent that is triggered that checks compliance with that and a bunch of behavioral requirements before anything is submitted to me for review. The whole thing is runs on top of a pre-commit hook, so it's not optional. Now, that came from a lot of trial and error and about four years of expecting AI output to be garbage. Developing with those constraints, while it's not perfect, gets you one step closer to being trustworthy. Now, I didn't want this take to be entirely doom and gloom. Uh, on a personal note, Pantheon is having this conversation right now. My leadership at Pantheon is really bullish on AI for a variety of reasons, but importantly, we're not replacing humans with machines. They're being bullish because that's the reality of the world that we're working in. And they're bullish because if we're not, we're going to fall behind. Not just at an organizational pantheon level, but also on an individual level. Because if you think you can get a job in 5 years, or hell, two years, and not have AI proficiency be part of that job, you're living in a different world than I am. Anyway, I talked to my uh SVP of product design and engineering, Chris Yates, uh last week, and I told him the gist of this talk, and I asked for his hot takes, and one of his hot takes is this. You still have the means to be the authoritative version of who you are and what you do on the open web. He's incredibly optimistic of the open web. He's one of those people who who believes that we're entering a third golden age of software development. And so, I'm I'm hopeful that he's right. Last year at Word Campus US, I was talking to people about how the web used to be weird. And I don't know about you, but it seems like it's getting a little weird again. Uh, I generally count that as a good thing. Although I not super fond of AI making reputational attacks against project maintainers, but it's more than just about weirdness. Visitors arriving at AI visitors arriving via AI agents spend 32% more time on your site. They browsed 10% more pages and they bounced 27% less. They came looking specifically for you. They were sent by a system that evaluated your content and decided you were the right answer. I know Tom and Brad Williams love sharing screenshots of chat GBT recommending humanmade and webdev studios as top WordPress agencies. That's not traffic you can buy. That's authority that you build. I talked a lot today about what's broken. attrition, exploitative capitalism, a narrowing contributor base, decisions about shared infrastructure being made by a small group. There's direct evidence that the old sponsored contribution model doesn't work when you look at the effort that the fair project made over the course of the last year in trying and failing to form a board and getting sponsor buyin. Showing up isn't passive. It's not just attending events or saying that you care about open source. It means putting resources behind the things that your business depends on. Juliet told me that she tries to lead by example. Every year, uh, she puts money aside and then at the end of the year, depending on how much she made that year, uh, she divides that that money, uh, amongst all the open source projects that she used over the course of the year. Dre Boyart, the founder of Drupal, made the same argument earlier this week. He said, "Opens infrastructure is essential, invisible, and chronically underfunded. If your company is built on top of WordPress, you understand that the people maintaining that software are doing it largely for free. The WPCC was built specifically to address that structural problem. It's an alternative model with member-based funding, clearly defined projects and fellowships that give individuals the time and financial stability to do meaningful open-source work without needing a corporate sponsor. We've got some fellowships in the works that I'm excited to announce in the next couple of months. If you're in this room and you care about the open web being yours, that's the work. Not just building on it, sustaining it. So, I'm going to put on my WPCC president hat and ask you to join us in becoming a member. We used to make Wuang references, cash rules everything around me. Well, now it feels like AI rules everything around me. But that doesn't make as good of an acronym. And if you're not in the driver's seat right now, you're going to get run over. I'm sure it's not the first time that you've heard that we're at an inflection point. So, one last thing before I go. Originally, this presentation was going to be a recap of insights pulled from this survey that we're running, but it took us a little bit longer to get that off the ground. Uh, we're trying to build a picture of how agencies, organizations, and developers are navigating 2026 and what types of things are important to them. Now, if you're here, we want to hear from you. So, I'll drop this link in the chat and I'll ask you to spend take some time to fill out the survey. Uh, beyond that, uh, if you want to hear more from the folks I quoted in this deck, uh, head over to communitycode.dev. dev and subscribe to my pod. Uh my slides are on the thing s3 s3q. us26 wpb26. I'm jazz sequence on the internet and I'm happy to keep the conversation going. >> And Chris, um thank you. We unfortunately we're running out of time. There is one question in the Q&A session that I encourage you to maybe stay and answer in the chat if you'd like. Uh and in the meantime uh thank you so much for uh doing this session for us and uh I will see everybody in the next session. Thanks everybody., State of the Web, YouTube, 01kkmf5pm7a2jvebwew0yzxcaq.