📥 Hello, and greetings from the Central Office!
Supporting customers is about more than answering tickets. It's helping solve complex hosting, licensing, and security issues when they arise.
Customer Success in Action
Some highlights from June included resolving a cache related issue that exposed protected files publicly, helping customers recover access after migrations and account issues, processing billing corrections and subscription requests quickly, and collaborating with customers to diagnose a licensing edge case involving custom database prefixes.
Every ticket is an opportunity to improve both our products and the customer experience.
🎥 Did you know we have a YouTube channel focused on WordPress security?
We share step-by-step tutorials on how to secure your site and protect your content.
⚡️ Watch our latest video:
How to Recover a Deleted Page in WordPress
👉 Explore the full channel:
youtube/@wpdefenselab
Don’t miss the next one 🚀
Welcome to WP Defense Lab — your weekly brief on the WordPress news that impacts your business.
This week: Newsweek lost 75% of its traffic and is still posting record revenue, proof that pageview-dependent monetization and owned monetization are two entirely different businesses.
In WP Radar: a WordPress trade secret dispute, a backdoor campaign that compromised thousands of sites, new AI defaults quietly shaping website behavior, infrastructure changes affecting AI crawlers, and a workflow that turns private community knowledge into searchable content.
Newsweek Lost 75% of Its Traffic. Its Revenue Still Grew.
Programmatic ad revenue collapsed with the traffic. Two acquisitions and a newsletter list didn't.
Newsweek's traffic fell nearly 75% in a single year, a collapse that came with layoffs across its sales, rankings, and video teams and the departure of two senior executives.
Chief executive Dev Pragad's response to that number was not a turnaround plan for traffic. It was a different revenue mix entirely: Newsweek is on pace to surpass $100 million in revenue for the first time in its 93-year history, with total revenue growth projected at 10% or more in 2026, up from roughly 3% the year before.
Both numbers are true at once, and that is the entire point.
The publishing division built on programmatic advertising is expected to decline 20% to 25% this year, according to Pragad.
Two businesses grafted onto the company over the past two years grew fast enough to more than cover the gap. Since taking over in 2018, Pragad said, Newsweek has generated more than $500 million in cumulative revenue at profit margins around 20%.
Where the Money Actually Moved
AdPrime, the healthcare-focused ad-tech platform Newsweek acquired in mid-2025 without raising outside capital, is pacing to triple its revenue this year, from $14.8 million to more than $40 million, at a profit margin above 10%.
That single acquisition is on track to generate roughly 40% of total company revenue in its first full year under Newsweek ownership.
Nexus, the B2B division housing rankings and events, is growing just under 20% year over year, with rankings up about 15% and events between 40% and 50%.
After a key sponsor dropped out and forced an event cancellation, Newsweek rebuilt its events strategy around a delegate-fee model designed to attract five or six sponsors per event instead of one or two, spreading the risk that used to sit with a single anchor sponsor.
Video revenue outside of programmatic deals is expected to grow roughly tenfold this year, anchored by a seven-figure sponsored franchise and a social operation with 2.4 million TikTok followers generating high-six-figure revenue.
What Still Runs on Search
None of this repairs the publishing division itself, which Pragad has deliberately walled off so rankings and events revenue cannot subsidize it.
What keeps that division standing is an eight-figure syndication business unaffected by search rankings, plus a newsletter list of just under 2 million free subscribers that Pragad intends to convert into paid subscriptions growing 20% this year.
Even that has a ceiling.
Pragad acknowledged the full rollout of Google's AI-generated search results hasn't arrived yet, and when it does, the audience could shrink considerably further.
Owning a newsletter list and a syndication contract doesn't reverse a search algorithm decision. It just determines what's left standing when the algorithm moves.
The Version of This Playbook a WordPress Owner Can Run
Most WordPress publishers cannot acquire a healthcare ad-tech firm or stand up a B2B events division.
That part of Newsweek's math is not replicable at smaller scale.
The structural lesson underneath it is: revenue tied to programmatic display advertising is revenue tied to pageviews, and pageviews are precisely what AI search removes first.
That exposure is identical whether you run a 93-year-old magazine or a five-year-old WordPress site with a display ad plugin as your only monetization layer.
What WordPress ownership actually controls is which revenue mechanisms sit on top of your own domain before the traffic drops. A membership plugin charging subscribers directly. A syndication or licensing deal for your archive. A newsletter list you own outright rather than rent from a platform.
None of that requires Newsweek's balance sheet. It requires deciding your revenue mix while your traffic is still healthy enough to fund the transition, not after.
If your organic traffic fell 75% next year, how much of your revenue would still be standing, and which parts of it would still depend on Google sending someone to your homepage first?
Stop typing what you could say in 10 seconds.
Wispr Flow turns your voice into clean, professional text inside any app. Emails, Slack, client updates — speak once, send without editing. 4x faster than typing.
WP RADAR
This week in WP Radar: a WordPress trade secret dispute, a backdoor campaign that compromised thousands of sites, AI defaults quietly shaping website behavior, infrastructure-level bot protection, and a workflow that turns private community knowledge into searchable content.
Court Halts WordPress Tool Over Trade Secret Claim. A Delaware court has temporarily blocked CloudLinux from launching AutopilotWP, a WordPress maintenance product, after Seahawk Global alleged the tool was built using its misappropriated product strategy and trade secrets. CloudLinux calls the suit meritless and says it will defend itself fully. The case is a reminder that competitive product strategy in the WordPress hosting space carries real legal exposure, not just market risk.
Backdoor Crew Hit 25,195 WordPress and Joomla Sites. A misconfigured server exposed a crew running WP-SHELLSTORM, a webshell brokerage that targeted 1.4 million WordPress and Joomla domains and confirmed 25,195 compromises. The top producer, a bug in the Breeze caching plugin, alone backdoored more than 17,000 sites. No zero-day was required. If you run WordPress, patch Breeze and Ninja Forms now and check for the listed CVEs.
A Plugin Default Just Wrote Your AI Strategy. AIOSEO, a plugin running on more than 3 million WordPress sites, now generates an llms.txt file by default, even though no major AI system has confirmed it reads the format. Site owners are publishing a description of their content they never wrote or reviewed. WebMCP, a competing browser standard, requires deliberate setup instead of a checkbox, which is exactly why fewer sites have adopted it yet.
Kinsta Splits Bot Defense From Cloudflare Stack. Kinsta analyzed more than 10 billion requests across its WordPress-hosted infrastructure and found automated traffic breaking cache and hitting dynamic endpoints at scale. Its new Bot Protection runs on Cloudflare's detection engine but adds WordPress-specific defaults, reclassifying high-volume AI crawlers even when Cloudflare's own list marks them verified. The tradeoff: hosts, not site owners, now decide how AI crawlers get treated on your WordPress infrastructure.
One Automated Workflow Replaced 20 Hours a Week. A community lead fielding 80 Slack questions a week was spending 15 to 20 hours turning the best of them into social posts, on top of a full-time job. A pipeline built on the Buffer API now scans the channels, drafts replies for approval, and turns the public-worthy answers into scheduled posts automatically. The output people already search for stops sitting behind a login no search engine can reach.
56.4% of news publishers now block at least one AI crawler in robots.txt, according to web data firm HasData.
That means nearly half of publishers still let every AI crawler through by default, whether they meant to or not. Robots.txt is one of the few AI-era decisions a WordPress site owner controls outright, unlike search visibility itself, which no publisher gets to set. Sitting at 56.4% adoption means blocking crawlers is now the more common choice, not the fringe one.
That’s all for this week!
Michael - Operator @WP Folio - now WP Defense Lab. Same Plugins. Different Name.