•
Oct. 13, 2024
The open-source WordPress ecosystem has been a cornerstone of the web for more than two decades, powering millions of websites and providing the foundation for countless plugins and themes. However, recent disputes between WordPress founder Matt Mullenweg and hosting provider WP Engine have taken center stage, culminating in a significant move by Mullenweg to "fork" one of WP Engine's most popular plugins: Advanced Custom Fields (ACF).
This confrontation has raised serious questions about plugin ownership, governance within the WordPress community, and the future of commercialized plugins on the platform. The heart of the controversy is a deepening ideological divide between WordPress' open-source ethos and WP Engine’s commercial ventures, which now threatens to reshape the dynamics of one of the web’s most influential ecosystems.
This article provides an in-depth look at the current dispute, the history behind it, and what it means for the future of WordPress, WP Engine, and the millions of developers and users who rely on plugins like Advanced Custom Fields.
At the center of the controversy is Advanced Custom Fields, a widely-used plugin that allows WordPress users to add customized fields to their post and page editor screens, thus offering extended flexibility in managing content types and layouts. For years, ACF has been a go-to tool for developers looking to build custom solutions within the WordPress environment.
WP Engine, a major player in the managed WordPress hosting space, acquired ACF as part of its acquisition of Delicious Brains in 2022. This acquisition gave WP Engine control over several important plugins, including ACF, further cementing its position in the WordPress ecosystem as not just a hosting provider but also a plugin developer.
The relationship between WP Engine and Matt Mullenweg’s Automattic, the company behind WordPress.com and other related ventures, began to deteriorate in recent years. Mullenweg has been vocal about his concerns regarding WP Engine’s approach to WordPress, particularly their branding and alleged exploitation of the WordPress trademark. In August 2024, he publicly described WP Engine as a "cancer to WordPress," citing concerns that the company's branding misled users into thinking it was officially associated with the WordPress project.
The dispute came to a head in October 2024 when Mullenweg announced that WordPress would be forking the ACF plugin, creating a new version called Secure Custom Fields (SCF). According to Mullenweg, this move was necessary due to WP Engine’s failure to address security concerns within ACF and its focus on commercial upsells, which he felt were in direct conflict with WordPress’ mission of free, open-source software.
Mullenweg's decision to fork ACF and release Secure Custom Fields under the WordPress.org repository was seen as a drastic but necessary step. In his public statement, Mullenweg explained that WP Engine had failed to act on a security issue within ACF, prompting the WordPress team to take matters into their own hands.
The forking of ACF is significant not only because of the plugin’s popularity but also because it represents a rare instance in WordPress' history where a plugin is forcibly taken over by the WordPress leadership. As Mullenweg himself acknowledged, "This is a rare and unusual situation brought on by WP Engine's legal attacks." He emphasized that WordPress does not anticipate this happening to other plugins but felt compelled to act in this particular case for the sake of public safety and the community’s well-being.
In response, the ACF team, now part of WP Engine, took to social media to voice their frustration. They described the move as “unilateral” and unprecedented in WordPress’ 21-year history, claiming that the plugin had been “forcibly taken away from its creator without consent.” The ACF team expressed disappointment that the core principle of the open-source community—collaborative development with respect for original creators—had been violated. They also warned of the dangerous precedent this action could set for the future of plugin governance within WordPress.
Despite the outcry, Mullenweg pointed to WordPress’ plugin guidelines, which clearly state that WordPress.org reserves the right to remove or take control of a plugin if it poses a security risk or fails to comply with community standards. According to WordPress, these actions were fully within the scope of the guidelines, though it was acknowledged that this was an extraordinary situation.
At the heart of the dispute between WordPress and WP Engine is a fundamental conflict over the role of commercialization within the WordPress ecosystem. While WordPress is, at its core, an open-source platform driven by volunteers, contributors, and a spirit of community, it has also become a massive commercial enterprise. Companies like WP Engine and Automattic have built thriving businesses on top of the WordPress infrastructure, offering hosting, plugins, themes, and other services that add value to the core platform.
The friction between open-source principles and commercial interests has always existed within the WordPress ecosystem, but the rapid commercialization of WordPress-related products has exacerbated these tensions in recent years. Mullenweg has been a staunch advocate for preserving the integrity of the open-source project, even as companies like WP Engine seek to monetize the ecosystem.
WP Engine’s acquisition of popular plugins like ACF has added to these concerns, as many in the community worry that the plugin landscape could be dominated by a few large players with commercial interests. Mullenweg’s criticism of WP Engine’s branding and business practices is tied to a broader fear that the WordPress ecosystem could become too commercialized, undermining the collaborative spirit that has driven its growth for over two decades.
The conflict between WordPress and WP Engine has also spilled into the legal arena, with both parties exchanging cease-and-desist letters. WP Engine has accused Mullenweg of threatening to take a "scorched earth nuclear approach" unless the company agreed to pay to license the WordPress trademark. Mullenweg, in turn, has criticized WP Engine for its branding and marketing practices, which he claims mislead users into believing the company is officially affiliated with WordPress.
This legal back-and-forth has added another layer of complexity to the dispute, with both sides accusing each other of undermining the WordPress ecosystem. Mullenweg's decision to fork ACF and block WP Engine from updating the plugin on WordPress.org was seen by some as an escalation of the conflict, though Mullenweg maintains that the move was driven primarily by security concerns.
As of now, WP Engine remains banned from updating ACF on WordPress.org, meaning that users of the free version of the plugin will need to seek alternative methods for updates and security patches. WP Engine has offered a workaround for users who want to continue using ACF, though this workaround only applies to free users, as Pro users will continue to receive updates directly from the ACF website.
Looking ahead, it remains to be seen how the two versions of ACF—Advanced Custom Fields and Secure Custom Fields—will coexist. The community is divided, with some siding with WP Engine’s stance on plugin ownership and others supporting Mullenweg’s decision to fork the plugin in the name of security and public safety.
For users of ACF, the decision to switch to Secure Custom Fields or continue using the original plugin may come down to a matter of trust. Do they trust WP Engine to continue developing ACF in the best interest of the community, or do they believe that WordPress’ intervention was necessary to protect users from potential security risks?
For WordPress itself, the move to fork ACF could set a precedent for future interactions with commercial plugin developers. If WordPress is willing to take over a popular plugin like ACF in the name of security, what does this mean for other plugin developers who rely on WordPress.org as a distribution platform?
The conflict between WordPress and WP Engine has brought to light some of the core tensions within the WordPress ecosystem—between open-source collaboration and commercialization, between community-driven development and corporate interests. As WordPress continues to grow and evolve, these tensions are likely to persist, and how they are managed will have a significant impact on the future of the platform.
For now, the fork of Advanced Custom Fields serves as a reminder that even in a community as large and diverse as WordPress, the balance between protecting user safety and respecting the rights of developers is delicate and, at times, contentious.
As Matt Mullenweg and WP Engine continue their battle over the direction of WordPress, the larger community will be watching closely to see how this dispute unfolds and what it means for the future of the open-source platform that powers over 40% of the web.
