Developer & DevOps guy Building https://nitter.cf/t.co/WSQ78rlpYv & https://nitter.cf/t.co/t5zKvuasVN
Berlin, Deutschland
Joined March 2016
- Tweets2.3K
- Following340
- Followers1.3K
- Likes3.2K
An impressive firewall at the front.
Direct access to the server around the back.
An interesting floor plan. 😂
An edge firewall may be working perfectly while your WordPress origin remains reachable through another hostname or connection.
Ask your host to verify that the origin enforces the intended access restrictions.
When a plugin vulnerability appears, check whether a relevant firewall rule exists and is enabled. Its protection depends on the traffic it inspects and the attacks it recognizes.
Keep the patch or removal task open until the vulnerable software has been addressed.
A firewall rule can buy useful time. Use it to apply the fix.
Patrick Posner retweeted
We’re sponsoring CMS Conf 2026! 🎉
WordPress, headless CMS, AI, and modern web development, all at one conference.
📍 Gdynia, Poland
📅 November 12–14
I really like the idea of bringing different CMS communities together instead of staying in our own little bubbles.
Sadly, I won’t be able to make it in person this year, but we’re happy to support the event!
The organizers also gave us a 40% discount code to share:
🎟️ cmsconf40
Check it out: cmsconf.com
"We might need it again.”
The unofficial motto of the inactive WordPress plugin list.
Deactivation stops normal loading. The files remain on your server, and depending on the code, some vulnerabilities may still be reachable.
If a plugin has finished its job, check dependencies, export any settings or data you need, take a backup, and uninstall it.
Anything you deliberately keep still needs updates and someone responsible for it.
A surprisingly useful feature in your security toolkit: the DELETE button. 😂
We’re sponsoring CMS Conf 2026! 🎉
WordPress, headless CMS, AI, and modern web development, all at one conference.
📍 Gdynia, Poland
📅 November 12–14
I really like the idea of bringing different CMS communities together instead of staying in our own little bubbles.
Sadly, I won’t be able to make it in person this year, but we’re happy to support the event!
The organizers also gave us a 40% discount code to share:
🎟️ cmsconf40
Check it out: cmsconf.com
Your WordPress plugin list can become a small museum of past decisions.
- A campaign from 2022.
- A migration tool.
- Three plugins you tested before choosing a fourth.
Every one still installed needs someone responsible.
For each plugin, check what it does, whether anything depends on it, who maintains it, and who owns its updates. Look for duplicated features (looking at you, form plugins) and unresolved security advisories.
There's no magic safe number. A recent release and a million installations don't guarantee security either.
Start with the plugin nobody remembers installing. Save anything you need, check dependencies, and remove unnecessary code.
Patrick Posner retweeted
Ollie OS — Designed for humans, optimized for agents, built for the frontier. This is WordPress like you've never seen it before, and it's coming soon.
olliewp.com/ollie-os
The PHP vulnerability affected everyone in the WordPress ecosystem (and beyond that!).
Many people (including me) had a long, exhausting day, and that's fine; keeping our customer sites and data secure is (and should be) our top priority.
But it really pisses me off to see certain hosting providers claim they were safe "immediately" and use that to make a few extra sales.
Instead of doing this bullshit, why not make it accessible to everyone? Tons of reputational damage around WP could have been prevented (and yes, I know it was PHP and not WP).
You know what?
Zero of our customers have been impacted AT ALL; their static versions kept running, we disabled booting up WP during the patch implementation, and that's it.
Do I comment under every post that "We have been safe immediatly"? No, because we are all in this together, making the web a better (and safer) place - at least I thought so.
Sorry, I'm just a bit tired.
This is serious.
I'm already hovering my finger over the upgrade button to upgrade all Studio instances right away.
Sometimes, I'm really glad we are less impacted because our sites aren't running all the time 😅
Maybe it's time to reconsider your WordPress stack: simplystatic.com/tutorials/t…
Patrick Posner retweeted
I rebuilt Roots & Fruit as a static site that costs $0/month on Cloudflare Pages.
But I didn't ditch WordPress.
I start with my CDS (Core Design System). It has a WordPress compiler that generates a theme, stylesheets, and patterns. I've open-sourced it so you can fork it and adapt it to your own brand.
Then I build locally. When I'm ready to publish, Simply Static generates the static site, and Cursor deploys it to Cloudflare. That means that Studio is my staging.
I really like this separation of concerns. I keep WordPress for what it's good at: content management, semantic layouts, and plugins that let me extend the site programmatically.
But I don't have to pay to host all that infrastructure, and I don't need PHP running on a public server just to serve HTML, CSS, and a little JavaScript.
WordPress is a great platform for AI-assisted web development, and I think people need to take its strengths more seriously.
My CDS + WordPress setup gives an AI agent the guidelines, components, and context it needs to build something accurate and compelling, consistently and reliably.
I wrote up the whole process, with GitHub links so you can adopt the approach and make it your own.
rootsandfruit.com/articles/s…
Patrick Posner retweeted
Automattic has also released a beta WordPress plugin for Spacefast, its newly soft-launched agent-first hosting service, that publishes static snapshots of WordPress sites or rebuilds headless projects when content changes.
→ github.com/spacefast/wordpre…
(h/t: @therepositorywp)
Uptime is binary. Your website responds, or it doesn’t.
Our Website health is much broader:
• redirects still work
• pages remain indexable
• performance hasn’t dropped
• URLs haven’t broken
• SEO metadata is still correct
A site can be online and still have plenty wrong.
Patrick Posner retweeted
We're super excited to announce Statamic Summit 2027 🎉
It's a relationship-forward conference for anyone building with Statamic. We'll have talks, workshops, breakout groups, shared meals, & three nights under the same roof. Of a castle. 🏰
Hope to see you there!
statamicsummit.com
Backups and rollbacks solve different problems.
A backup restores your CMS and data.
A rollback restores the version visitors were seeing.
That's why we handle both with static.studio
The easiest way to decide whether a WordPress site can go static:
Look at what visitors need to do.
Reading pages? Easy.
Forms? Solved.
Search? Solved.
Logged-in dashboards, carts, or highly personalized content?
Good luck! 😂
We use WordPress to run simplystatic.com.
The public website isn’t WordPress.
WordPress handles:
• writing
• editing
• media
• SEO
• publishing
The public site is the static result (including several fancy JS apps).
We’ve been running our own site this way for years.
