In partnership with
📥 Hello, and greetings from the Central Office!
As part of our effort to be more transparent with our community, we’re continuing to share small behind the scenes updates on what our team has been improving each month. Here’s another quick look at recent progress. 🚀
•Improved plugin security with stronger nonce verification, sanitization, and escaping practices
• Aligned multiple plugins with WordPress Coding Standards for better long term stability
• Enhanced cookie validation and strengthened XSS protections
• Improved debug handling by limiting logs to development environments only
• Refactored and standardized code structure across several plugin modules
A lot of this work happens quietly in the background, but it plays a huge role in keeping everything reliable and secure.
🎥 Did you know we have a YouTube channel focused on WordPress security?
We share step-by-step tutorials on how to secure your site and protect your content.
⚡️ Watch our latest video:
Import WooCommerce Product Categories in Bulk
👉 Explore the full channel:
youtube/@wpdefenselab
Don’t miss the next one 🚀
Welcome to WP Defense Lab — your weekly brief on the WordPress news that impacts your business.
This week, AI scrapers officially crossed from nuisance to infrastructure - except the infrastructure they built runs entirely on your IP. A Digiday investigation exposes the scraper economy as a $1 billion industry where publishers collect zero.
In WP Radar: WordPress marketshare keeps sliding as Astro's weekly downloads hit 2.5 million, Google starts surfacing Reddit quotes in AI answers, WP agencies rethink operations around AI vision documents, and VidCon hands its title sponsorship to an AI monetization startup for the first time.
Want to get the most out of ChatGPT?
ChatGPT is a superpower if you know how to use it correctly.
Discover how HubSpot's guide to AI can elevate both your productivity and creativity to get more things done.
Learn to automate tasks, enhance decision-making, and foster innovation with the power of AI.
AI Scrapers Claimed Your Content. They Just Rebranded It as Infrastructure.
The scraper economy hit $1 billion - and publishers collected nothing. Now the same operators are calling themselves "agentic infrastructure," and the extraction math has not changed.
Publishers have spent years fighting the ad tech tax. Header bidding, supply chain complexity, 40-60% take rates from intermediaries.
At least the ad tech middlemen sent revenue back. The AI scraper economy does not.
A Digiday investigation frames the problem directly: AI data brokers are running demand-side platforms for content that charge a 100% fee.
One publishing exec put it plainly: "We've got all these 30, 40, 50 startup DSPs for content, but they're taking a 100% fee. That is the market that we are seeing emerging now."
Chris Dicker, CEO of Candr Media, went further. "With scrapers, the value extraction is total. They're taking 100% of the content, paying 0%, and then in some cases using that content to create competing products that remove the publisher entirely. It's not a tax, it's a hostile takeover funded by our own IP."
The $1 Billion Extraction Economy
Media analyst Matthew Scott Goldstein's report on the "scraper economy" identified this as a $1 billion industry, citing Mordor Intelligence data. Publishers make nothing from it.
Goldstein named 21 active vendors, including Firecrawl, Exa, Tavily, Brave, You.com, Perplexity Sonar, and Bright Data. TollBit's running vendor index tracks nearly 40 operators total.
The bad-faith behavior compounds the economics.
Some operators deploy stealth crawlers that evade robots.txt no-crawl directives. Others publicly announce they will not honor those directives. The few defensive tools publishers have - rate limiting, IP blocking, no-crawl declarations - are being systematically defeated.
The Rebranding Play
Scrapers are now rebranding as "agentic infrastructure" to continue operating at scale without the liability of the word "scraper."
Goldstein described the shift explicitly: "The scraper economy is being rebranded as agent infrastructure, and while the technology is getting sharper and the enterprise pitch is getting cleaner, the underlying economics have not changed."
The rebranding matters because it signals these operators are preparing for enterprise sales cycles and institutional investment. The same extraction economics, dressed in product language that sounds like B2B software.
The Owned-Infrastructure Difference
WordPress site owners have more control than large publishers who syndicate content through portals and feed networks.
You control your robots.txt directly. You can target specific crawler identities. You are not fighting through intermediary layers where scrapers tell you the problem "lies with the portal's settings."
But the same gap exists: your content powers AI models and agentic workflows, and your revenue from that value is zero.
The Digiday report notes that licensing deals are "driven less by recognition of value and more by platforms moving to limit legal exposure." The ownership argument is compelling. It has not moved the compensation needle.
What Actually Changes the Math
The scraper economy does not self-correct through better articulation of publisher value. It shifts when legal exposure math changes - court decisions, regulatory action, or coordinated blocking that makes extraction costly enough to negotiate around.
What are you currently blocking, and what accessed your content in the last 90 days? Check your server logs against the 40-vendor list Goldstein and TollBit are tracking.
Speak the email. Send the email.
Talk through your reply and get polished, professional text ready to paste. Wispr Flow strips filler, fixes grammar, and formats everything. 89% sent with zero edits. Works everywhere.
This week in WP Radar: WordPress marketshare declines as Astro's download momentum accelerates, AI reveals unexpected structural advantages in the WordPress architecture, and more.
WordPress Slips to 42.2% as Astro Hits 2.5M Downloads - WordPress peaked at 43.6% marketshare in mid-2025 and now sits at 42.2% - a 1.4% decline that understates the real problem. The Search Engine Journal analysis shows Astro downloads grew 100% year-over-year to 2.5 million per week. The framing has shifted: Joost de Valk, founder of Yoast SEO, wrote that "people never wanted a CMS - they want a website." That reframe is the tell.
WP Architecture Has Unexpected AI-Era Advantages - The Repository Newsletter makes the case that WordPress's structured content foundations position it well for AI-integrated workflows. The argument runs counter to the marketshare anxiety: a platform built around structured metadata, REST API access, and a mature plugin layer may hold more AI-era utility than pure performance numbers suggest. Infrastructure familiarity counts in agentic environments.
WP Agencies Use AI to Rebuild Internal Operations - Matt Schwartz of Inspry, an Atlanta WordPress agency founded in 2011, outlined how agencies are deploying AI behind the scenes - not just in site-building. He introduced the concept of an AI vision document: a guardrails framework for where and how AI factors into agency operations. The shift is agencies using AI to streamline SOPs, client communication, and support while keeping humans in the loop for critical decisions.
Google Feeds Reddit Quotes Into AI Answers - Google updated AI search to pull excerpts from Reddit threads, web forums, and blog discussions into AI Overview responses. A New York Times analysis cited in TechCrunch's reporting found AI Overviews correct 9 of 10 times - which sounds good until you factor in Google's query volume, where that miss rate produces hundreds of thousands of inaccurate results per minute. For owned-site operators, Reddit commentary now competes with your content for AI citation placement.
Half Baked cut 30-day subscriber churn by 57% - from 7% to 3% - by deleting their onboarding form entirely.
The Growth In Reverse case study on Half Baked, a startup ideas newsletter, found that a longer onboarding survey correlated directly with higher early churn among paid-channel subscribers.
Removing every question cut the rate in half within 30 days. For newsletter operators running paid acquisition, the friction that feels like data collection is actually subscriber attrition in disguise.
That’s all for this week!
Michael - Operator @WP Folio - now WP Defense Lab. Same Plugins. Different Name.