AdultZone

Archives

Open Channels FM: The Hidden Dependency Problem in Open Source Infrastructure

When we think about what keeps the Internet humming, most of us imagine massive data centers and super-fast connections. Fewer people realize that our everyday digital experiences often depend on the efforts of a very small group of individuals. Recent analysis revealed that in many essential open source projects, just one or two people are […]

#237 – Robert Abela on WordPress Security and the Battle Against AI Threats

Transcript [00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley. Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, the state of WordPress security in 2026, and the battle against AI threats. If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players. If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you, and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there. So on the podcast today we have Robert Abela. Robert has been working in IT security for 25 years, ranging from antivirus software to web security scanners, and for the past decade has been running Melapress. A company focused on WordPress security plugins, particularly around user visibility, authentication, activity logs, and 2FA. Robert is here to talk about the 2026 WordPress security survey. This is an annual project now in its fourth, or fifth, year gathering data from a wide range of WordPress professionals across agencies, enterprise teams, freelancers, and product owners. The conversation today is focused on the biggest security challenges and trends facing WordPress users in 2026. We start off with some sobering stats. Over 67% of survey respondents reported experiencing at least one security incident in the past year, and concerns about WordPress security remain high, especially among less technical users. We chat about the disconnect between awareness of security threats and actually taking steps to mitigate them, such as breach recovery plans and team training. The discussion also explored the different types of risks that worry site owners. Site downtime, defacement, reputational damage, data loss, and even legal compliance issues. How the shakeout depends on the type of site, whether it’s e-commerce membership, a news outlet, or a simple brochure site. We also talk about the tendency for even experienced WordPress users to take a reactive approach, only addressing vulnerabilities after something has gone wrong. Towards the end of the episode, we discuss the rising impact of a AI on security, the explosion of AI facilitated vulnerabilities, and the shifting landscape of risk and response. There’s a healthy dose of reality, some optimism about the tools and best practises available, and plenty of good advice, especially for smaller teams and freelancers who may not have access to enterprise level resources. If you care about keeping your WordPress sites secure, or want to understand where the community’s biggest concerns and opportunities are in 2026, this episode is for you. If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast where you’ll find all the other episodes as well. And so without further delay, I bring you Robert Abela. I am joined on the podcast by Robert Abela. Hello, Robert. [00:03:48] Robert Abela: Hello Nathan. Thanks for having me. [00:03:50] Nathan Wrigley: You’re very welcome. Nice to have you with us. We’re going to chat today about internet security, but we’re going to be looking back over the past year, so the year 2026. Robert, can tell us a little bit about the company he founded, works for, and so on. It’s called Melapress, you can find out about that in just a moment. But I would like to draw your attention to something which is going to really be the fulcrum of what we talk about. It is their 2026 WordPress Security Survey. Now, the easiest way to get that is probably to go to wptavern.com, search for the episode with Robert in it, and I will make sure it is linked in the show notes there. But it might be a good idea to read it, because in about 10 minutes, you’re going to be able to capture absolutely everything that we’re talking about today, and you’ll get all of the data and, what have you. But that’s going to be the point of this episode, summarizing what happened in the security space in WordPress in 2026. Robert, I guess there are a few areas in the WordPress space where it’s pretty important to know that we know, that you know, what you’re talking about when it comes to security, because we don’t want to have a lot of hot air from somebody who’s not experienced. So it’s an opportunity for you really to give us your bio and tell us a little bit about what you’ve been doing in the WordPress space, particularly around security, the companies you’ve worked for, the things that you’ve founded and so on. So over to you, Robert. [00:05:07] Robert Abela: Thanks. I’ve been working in IT security for twenty-five years. I’ve always worked for software companies, software startups which worked in security industry. We used to do antivirus software, web security scanners, et cetera. I’ve had different positions. I started as systems engineer, QA, product management, project management, almost any field. Anyway, and the last ten years I founded Melapress, and it’s a WordPress plugin business, and basically we develop a number of security plugins for WordPress. The security we do, we don’t do the typical firewall malware, et cetera, like the other, brands. We mostly focus on user visibility and authentication. So basically we have an activity logs plugin, and we also have a plugin for 2FA, passkeys et cetera. So we are focusing much more, on what happens post login once someone logs into WordPress, rather than the whole hardening and protection. [00:05:56] Nathan Wrigley: Thank you for that. So anybody that’s interested, anything that we mention today, including the URLs of the companies that Robert has just mentioned, so Melapress, you’ll be able to find those in the show notes as

Matt: RIP Eric Binnion

For the next 30 days, a few billion of you will get an extra header in honor of Eric Binnion. The code in Nginx to do this is poetic: add_header X-Remembering “Eric Binnion <https://friendsofericbinnion.wordpress.com/>” always; Our design team will make that less AI and more humane in the coming days. Automattic.com will have a mourning band for 30 days. Eric was the 21st recipient of the Distinguished Janitor Award, Automattic’s highest honor, and in our hangs the last few months we’ve been talking about how to redefine and evolve it, which will happen internally at Automattic. One of the ideas was for the award to come with a physical memento, an etched tungsten cube. I don’t have many words so I’ll share something I wrote to Eric a few months ago when I gave him my cube when he was going through chemo. Two Totems To Take With You The first is a tungsten cube I keep on my desk. Its weight will surprise you, but tungsten is singular in having the highest melting point of any metal. That represents one of the things I admire most about you. Tungsten has an atomic number of 74, its symbol is W, and it’s also known as wolfram. My next post I’ve had in drafts for a while so please try to imagine me happy and promotional when reading it, but otherwise, I’m wrecked. Just going to soldier through because that’s what Eric always did.

OpenStation Blog: I Deleted 168,000 Lines of Comments. My AI Agent Didn’t Notice

Almost a third of our source code was comments. I deleted all of them and asked an AI agent to build the same features on both versions of the codebase, three times each. The code it wrote was just as good with or without comments. If you use agents on a real codebase and wonder whether comments help them, slow them down, or don’t matter, here’s what I found. Why I tried this In this video (around 23:07), Lauren mentions that they don’t let their agents write comments in the code. Our codebase, is the opposite: it’s full of comments, and most of them were written by agents. So I wondered: are all those comments helping the agent, or are they just extra text it has to read? The experiment in one paragraph I made a copy of the codebase with every comment removed, about 168,000 lines in total. Then I gave the same task to the same agent on both copies, three times on each, and checked the results the same way. I did this for two tasks, a small one and a bigger one. The results Every run passed every check: lint, type checks and the existing tests, plus, on the bigger task, a hidden test the agent never saw. A separate AI judge scored each result without knowing which copy it came from (more on that below). Small task: tile all open windows (score out of 19) Branch Score Tokens Cost With comments 18.3 2.18M $1.42 Without 19.0 1.71M $1.04 Bigger task: keep a window on top (score out of 23) Branch Score Tokens Cost With comments 21.7 9.06M $3.84 Without 22.0 9.12M $3.95 The numbers are averages of three runs. The score differences are within noise, and so is the cost on the bigger task. On the small task, the agent used about 22% fewer tokens without comments, which makes sense: there was simply less to read. The bigger task had a trap. The pinned state has to survive a page reload, and the PHP function that saves the window session drops any key it doesn’t know. Miss it and the feature looks fine until you reload. That’s exactly the kind of thing you’d expect a comment to help with. All six runs found it, with and without comments. Why one run is not enough My first plan was to run each branch once. I’m glad I didn’t. On the bigger task, the three runs with comments used 8.21M, 8.79M and 10.17M tokens. The three runs without comments used 7.01M, 9.70M and 10.64M. If I had picked one run from each branch, I could have written two opposite blog posts. Comparing 10.64M with 8.21M, removing comments makes the agent 30% more expensive. Comparing 7.01M with 10.17M, it makes the agent 31% cheaper. Same task, same code, same day. Agents are not deterministic. If you’re measuring one, run it more than once. How I ran it The agent: Claude Code with Opus 5.5 at high effort. Same model and settings for every run. The two codebases: our main branch, and a copy with the comments removed. I compiled both and checked that the resulting code is identical. The only comments left are the ones the tools need to work, such as lint directives and plugin headers, about 800 lines. The tasks: two real features, with the same prompt on both branches. The checks: the project’s own lint, type checks and tests. On the bigger task, also a hidden test I added after the agent finished, so it couldn’t write code just to pass it. The judge: a separate Claude session read each change and scored it against a checklist written before the runs: does it work, does it follow the project’s conventions, does it have tests, and so on. The changes were labelled with random names, so the judge didn’t know which branch each one came from. The runs: three per branch per task, alternating branches so that time of day affected both equally. My conclusion For the agent, code comments don’t make a difference to the quality of the code it writes. They don’t help, and they don’t hurt. So keep a comment or delete it based on what it does for the people reading the code, not for the agent. This doesn’t prove comments have zero effect. I tested one model, two tasks and three runs per branch, which is enough to rule out a big effect, not a small one. Next: comments made no difference, but removing our docs/ folder and AGENTS.md did. That’s the next post. Appendix: data and links The codebase with comments The codebase without comments Exactly what was removed (GitHub may only show part of it) Two of the small-task runs as pull requests: with comments, PR 974 and without comments, PR 975 Full results, all runs: results page If you want to see the experiment script and the rubrics, they are all here Lines of code, measured with scc: With Without Whole repository 765,491 597,332 Plugin source code 408,527 280,421 Plugin source code means the code that ships in the plugin (src/, includes/, apps/ and the CSS), without tests, docs, or tooling.

Matt: Neal Stephenson Live!

Speaking of sci-fi authors, Automattic is hosting Neal Stephenson for a livestream about his new book soon, please tune in! Neal was a big influence on WordPress! I got hip to him from Tantek. In the source code of billions of pages you’ll see this: <link rel=”profile” href=”https://gmpg.org/xfn/11″> GMPG is the Global Media Protocols Group, “an experiment in Metamemetics.” Inspired, of course, by the Global Multimedia Protocol Group that owned the virtual real estate in Snow Crash’s metaverse. Eric, Tantek, and I were reacting to the idea that there should be a separate heavily-marked-up RDF or XML web, and that HTML couldn’t be extended or enriched with metadata in a way that was beautiful to both humans and machines. It was really an aesthetic war. (It later got more built out in Microformats.) We should revisit some of those principles because the web could use more distribution right now.

Open Channels FM: Open Channels FM Heading to the Web Summit 2026 in Lisboa

Next month in November, I’ll (Bob) be attending the Web Summit in Lisbon, Portugal. I have been to conferences in the past that have had attendance up to 15,000, but never one that has over 70,000 attendees. That’s a lot of people. A few months ago I applied for media creditation, unsure of their parameters […]

Matt: Board Agent

Automattic is always 5–15 years ahead of other companies, but things happen faster now. I predict other companies will start scrambling to add great writers to their boards, because, well, look at the headlines in AI. United’s board already has Walter Isaacson. Authors are awesome, akin to founders in the startup/tech ecosystem. Public offer to all the great sci-fi/etc writers out there who I’m a huge fan of (Ken Liu, Neal Stephenson, Ted Chiang, Andy Weir, Ramez Naam, Kim Stanley Robinson…) but not as close to as Hugh (I was part of him meeting his wife, officiated one of their weddings), I offer my services as your Board Agent to negotiate compensation and contracts for you! 1% fee, donated to the WordPress Foundation or Locus Magazine. I’ve become a bit of an expert in board protections, dynamics, compensation, and such. Aside: If you haven’t seen the Robert Caro / Robert Gottlieb documentary Turn Every Page, run, don’t walk to your nearest streaming service!