WordPress, Automattic, and Mullenweg. The Long Autopsy of a Benevolent Dictatorship.

Every open-source project eventually faces the same question. Who actually owns this thing? For most projects the answer is boring — a foundation, a working group, a board of trustees with quarterly minutes nobody reads. For WordPress the answer is a man. A man who also owns the company that sells the hosting. And the company that sells the plugins. And the trademark licence. And the keys to the plugin directory. The arrangement was fine for two decades because the man was charming and the software was free. Then 2024 happened.

Genesis. A fork, a teenager, and a blog post nobody re-reads.

In 2003 a piece of blogging software called b2/cafelog was rotting. Its original author had drifted. Two users — a nineteen-year-old Matt Mullenweg from Houston and a developer called Mike Little from Stockport — forked the codebase, renamed it WordPress, and shipped version 0.7. The software was GPL, the community was small, and the ambition was modest. It was a blog tool. That is the entire founding myth, and most of the people quoting it have never read the actual announcement post.

By 2005 Mullenweg had dropped out of university, moved to San Francisco, and founded Automattic — a private company built to commercialise services around the open-source project. He also created the WordPress Foundation in 2010, a US nonprofit that holds the WordPress trademark. The Foundation licenses the trademark to Automattic. Automattic pays the Foundation. The Foundation has, for most of its existence, had a board consisting of Matt Mullenweg and people who work with Matt Mullenweg. This is not a conspiracy theory. It is in the public filings.

The split brain. WordPress.org versus WordPress.com.

Here is the bit that confuses every new user and most journalists. WordPress.org is the open-source project — the software you download, the plugin directory, the theme repository, the support forums. WordPress.com is a commercial hosting product run by Automattic. They share a name, a logo, and a founder. They do not share a legal entity. WordPress.org is operated, hosted, and paid for by Automattic via Mullenweg personally, with no formal governance document explaining who decides what. The infrastructure is donated. The decisions are not minuted. For twenty years this was charmingly informal. Then it became a problem.

“WordPress.org just belongs to me. There's no public ownership.”

That is a direct quote from Mullenweg, given on a podcast in 2024 while the governance crisis was actively unfolding. It is not a slip. It is the actual legal position. The .org domain is registered to him personally. The community contributing to the project for two decades was, it turned out, contributing to an asset owned by one individual. Nobody had read the small print because there was no small print.

Evolution. Plugins, themes, and the great commercial overlay.

From 2005 to roughly 2015, WordPress ate the web. The plugin directory turned a blogging tool into a CMS, then a forum, then an e-commerce platform once WooCommerce arrived in 2011. Automattic acquired WooCommerce in 2015 for a reported thirty million dollars in stock. That acquisition put the company on a path from blogging concierge to enterprise commerce vendor, which is a different business with different incentives. The open-source project drifted to follow.

Gutenberg, the block editor, launched in 2018 as the strategic answer to a market full of page builders. It was technically ambitious and politically clumsy. Long-term contributors objected to the rushed merge into core. A fork called ClassicPress was launched in protest. Nobody uses ClassicPress at scale, but its existence is the canary — the first time a meaningful slice of the community concluded that the project's direction was being set by Automattic's commercial roadmap rather than community consensus.

Full Site Editing followed in 2022. We have written its autopsy separately. The summary: a multi-year reinvention of how WordPress builds pages, shipped without a deprecation path for the ecosystem that depended on the previous model. The market response was to ignore it. Page builders kept selling. Gutenberg kept being optional in practice. The strategic gap between core and community widened.

The disputes nobody wanted to call disputes.

Long before 2024, there was friction. The Tavern, an industry blog covering the project, was acquired by Audrey Capital — Mullenweg's personal investment vehicle — in 2011. Coverage softened. Editors came and went. The community noticed. Several long-serving core contributors quietly stepped back over the years citing burnout, opacity, or polite versions of 'I do not enjoy this anymore.'

There were arguments about the JSON REST API in 2016, about Gutenberg in 2018, about the pace of Full Site Editing in 2022, and about a recurring theme — that the project's decision-making was concentrated in one office in San Francisco while the labour was distributed across the planet. None of these were existential. They were the normal grumbles of a maturing project. The grumbles stopped being normal in September 2024.

WP Engine. The fight that broke the spell.

WP Engine is a managed WordPress host. Large, profitable, owned by private equity since 2018, hosting roughly two hundred thousand sites. For years it coexisted with Automattic. Both companies built businesses on the same open-source foundation. Both contributed code, though not in equal proportion. Then, at WordCamp US in September 2024, Mullenweg delivered a keynote titled — and this is the actual title — 'Ecosystem Thinking,' in which he publicly described WP Engine as 'a cancer to WordPress.'

The objections were several. WP Engine disabled post revisions by default to save database load. WP Engine's contribution to core development was, in Mullenweg's calculation, a tiny fraction of Automattic's. WP Engine used 'WP' in its branding while licensing nothing from the Foundation. The keynote escalated to a demand. Pay Automattic a substantial ongoing fee for a trademark licence, or face consequences.

WP Engine declined. Within days, WordPress.org blocked WP Engine's servers from accessing the plugin and theme update infrastructure. Customers of a major host could no longer receive security updates through the official channel. Then WordPress.org took control of a popular plugin called Advanced Custom Fields — owned by WP Engine, used by millions of sites — and forked it into a new plugin called Secure Custom Fields, distributed under the original plugin's slug to existing users. The mechanism used was a clause in the plugin directory guidelines that had, until that moment, been read as a tool for handling abandoned or malicious plugins, not for resolving commercial disputes.

“The plugin directory is editorial. We can do what we want with it.”

Paraphrasing, but accurately. The position taken was that WordPress.org is a private property operated at the discretion of its owner, and that the community had no procedural claim on its policies. This was, as a matter of fact, correct. It was also the precise opposite of what most contributors had assumed for twenty years.

The legal weather. Filed, not concluded.

WP Engine filed suit in US federal court in October 2024, alleging a range of claims including extortion, tortious interference, and computer fraud. Automattic and Mullenweg responded. A preliminary injunction was granted in December 2024 requiring WordPress.org to restore WP Engine's access to the plugin infrastructure and to stop the Secure Custom Fields swap. The court did not rule on the underlying merits. It ruled that the disruption to WP Engine's customers, in the period before trial, was severe enough to warrant intervention.

Separately, Automattic experienced what it described as an 'alignment offer' in October 2024 — employees were offered a generous severance package if they disagreed with the company's direction on the WP Engine dispute. Reports at the time put the take-up at around eight percent of staff, including several long-serving senior engineers. A second alignment offer followed weeks later. The pattern was clear. Disagreement was being offered the door.

We are not going to characterise the merits of the litigation here, because it is live and because nothing good comes from a small blog speculating about active proceedings. What is fact: a major commercial dispute between two of the largest companies in the WordPress economy is being adjudicated in court rather than in the community, and the community has discovered, in real time, that it has no procedural standing in either venue.

The governance hole, made visible.

The 2024 events did not create the governance problem. They illuminated it. Every other comparable open-source project has, over the years, professionalised its governance. The Linux Foundation runs Linux. The Apache Software Foundation runs Apache. The Eclipse Foundation runs Eclipse. These are imperfect organisations with their own dramas, but they have boards, bylaws, dispute resolution procedures, and a separation between the project's assets and any single individual's personal holdings.

WordPress has the WordPress Foundation, which holds the trademark and very little else. It has no formal authority over the source code, the plugin directory, the .org infrastructure, the release schedule, or the contributors. All of those are operated at the personal discretion of one individual, with Automattic as the primary funder. There is no path by which a contributor, a sponsoring company, or a long-time community member can escalate a dispute to a body that is not, ultimately, the same person.

• →The trademark is held by a foundation effectively controlled by Mullenweg.
• →The .org domain is registered to Mullenweg personally.
• →The plugin directory is operated at the discretion of Mullenweg, with no published appeals process.
• →The release process is led by 'release leads' appointed by Mullenweg.
• →The contributor community has no formal voting mechanism on any of the above.

This is not necessarily bad. Benevolent dictatorships can be productive for decades — Python ran on one until Guido stepped back, and the transition was deliberate and orderly. The problem is not the structure. The problem is the absence of a succession plan, the absence of a dispute mechanism, and the recent demonstration that the structure can be used aggressively against commercial participants without warning.

Outcomes. What actually changed.

Several things broke that have not been repaired. Trust between Automattic and the broader hosting industry is materially worse. Several large agencies and product companies have publicly stated they are reducing WordPress in their stack, accelerating migrations to headless architectures, static site generators, or competing CMSes. Contributors have stepped back. The Five for the Future programme, where companies pledged contributor time, has been quietly recalibrated by several participants who concluded that contributing free labour to an asset owned by one person was, on reflection, a strange thing to be doing.

Automattic, in 2025, announced a reduction in its contribution to core development, citing the need to reinvest in its own commercial products. The community read this as retaliation for the legal pressure. The company described it as strategic refocus. Both can be true. The effect is the same — fewer paid contributors, slower releases, more dependence on volunteer labour from a community that just learned how little leverage it has.

Market share data is mixed and contested. W3Techs, the most-cited source, still shows WordPress powering roughly forty percent of the web — a figure that has plateaued for two years and is, depending on methodology, gently declining. The headline number does not capture the more interesting trend. New-build market share, especially in the agency and SaaS segments, has been moving toward Next.js, Astro, Webflow, Framer, and Shopify for some time. WordPress is not collapsing. It is ageing. The 2024 events accelerated the ageing.

Current state. A tense equilibrium.

As of mid-2026, the litigation continues. The injunction holds. WP Engine and Automattic operate in a state of armed coexistence, each accusing the other of bad faith in filings and on podcasts. WordPress.org continues to be operated under the same personal arrangement, with some cosmetic governance announcements — a contributor advisory group, a clarified appeals process for plugin directory actions — that observers describe as overdue and insufficient. The Foundation has added one or two board members. Mullenweg remains the project lead, the Automattic CEO, the Foundation president, and the personal registrant of WordPress.org.

Gutenberg work continues. Full Site Editing continues. A new initiative — the AI-assisted authoring layer announced at the 2025 State of the Word — is being built largely by Automattic engineers. Whether it ships into core or remains a commercial product on WordPress.com is, at time of writing, undecided. The decision will be made the same way every meaningful WordPress decision has been made for twenty-two years. Privately.

The honest takeaway.

WordPress is a magnificent piece of social and technical engineering. It democratised publishing for hundreds of millions of people. It created a livelihood for a generation of developers, designers, and agencies, your correspondent included. None of what follows is a dismissal of that achievement. It is an observation that the governance model which got the project to forty percent of the web is not the model that will get it through its next decade.

The 2024 dispute was not an aberration. It was the structure working as designed. The structure was designed in 2003 by a teenager and a Stockport developer who, reasonably, did not anticipate that their blog tool would one day be a critical piece of internet infrastructure. The fact that nobody has redesigned it since is the actual scandal. Not the lawsuit, not the keynote, not the alignment offers. The scandal is twenty-two years of postponed succession planning.

“The bus factor for WordPress is one. Always has been. The bus did not crash. It just stopped at a different bus stop than the community expected.”

If you are running a WordPress site today, none of this changes your Tuesday. Updates ship. Plugins work. The community forums still answer questions, mostly. If you are building a business on WordPress, it changes a lot. The question every agency, host, and product company should be asking is no longer 'how do we contribute back to the community?' It is 'what is our contingency if the project's direction stops being commercially survivable?' That is not a hostile question. It is a sensible question. The events of 2024 made it the only question.

We will keep using WordPress for the clients it suits. We will keep migrating away the ones it does not. We will keep watching the governance situation with the polite, sceptical attention it has earned. And we will keep noting, every time someone calls WordPress a 'community-led open-source project,' that the community has been led, very capably and very personally, by one man with a phone and a domain registration. That is not a moral judgement. It is the spec sheet.