📥 Hello, and greetings from the Central Office!
Here's part two of our September recap, our monthly look at what the team actually built. This week: the releases.
⚡ Six plugin releases went out in September:
Password Protect WordPress Pro now handles very large sites. The Whitelisted Roles setting used to load every user at once. Now it loads only what it needs and lets you search by name, username or User ID. We tested it on sites with more than 110,000 users.
Prevent Direct Access Gold added WPML Media Translation support, so files uploaded separately in each language can be protected too.
Password Protect WordPress Free 1.9.25 fixed a Sitewide Login Form label that wouldn't save in the Customizer. A customer reported it, and we fixed and shipped it.
Protect WordPress Videos and the PDA ActiveCampaign Integration also received updates.
Next up: a speed boost for pages with lots of passwords. In our tests, a page with 90 passwords went from about 13 seconds to half a second.
Welcome to WP Defense Lab — your weekly brief on the WordPress news that impacts your business.
This week in WP Defense Lab: bot traffic can consume the resources your visitors need, even when nobody is attacking your site. We examine where the load comes from and how to decide what gets access.
In WP Radar: an exclusive .wordpress domain proposal, Jetpack’s latest tools, AI licensing, and changing creator deals.
📣 Did you know we have a YouTube channel focused on WordPress security and best practices?
🚀 Watch our latest tutorial: How to Add WooCommerce Variation Images (No Plugin)
👉 Explore the full channel:
youtube/@wpdefenselab
Privacy-first email. Built for real protection.
End-to-end encrypted, ad-free, and open-source. Proton Mail protects your inbox with zero data tracking.
Your Next Performance Problem Might Be a Crawler
A traffic spike sounds like good news until your site slows down and customer activity stays flat. Before paying for more hosting capacity, check who is making the requests and what they keep asking your server to do.
Kinsta’s analysis of more than 10 billion requests found crawlers repeatedly visiting variations of the same URLs. In one 24-hour period, ClaudeBot generated 3.75 million requests to add-to-cart URLs across the infrastructure analyzed.
That is a hosting workload with no corresponding shopping intent.
The Page Matters as Much as the Bot
A cached article can be inexpensive to serve. A cart, search, or filtered product page can trigger PHP processing and database work. Repeated requests to those pages compete with real visitors for resources.
That makes total traffic a poor guide to the problem. The useful question is where automated requests concentrate and whether those requests are making the site harder to use.
Give Access a Business Reason
Kinsta’s response framework weighs three things: the bot’s value, its resource cost, and the consequences of restricting it.
Allow useful traffic. Challenge uncertain requests with an additional verification step. Block clearly abusive or disproportionately costly activity. Apply rules to specific paths where possible, preserving access for essential crawlers and integrations.
Check What Your Rules Changed
After making changes, watch server performance, legitimate crawler access, and essential site functions. Tighten rules if the pressure continues; add exceptions if useful traffic gets caught.
Start with one concrete request to your host: identify the automated traffic placing the most load on your site and the URLs it hits.
Treat crawler access as an operating decision: what does it contribute, what does it consume, and where does it belong?
100+ ChatGPT Prompts to Revolutionize Your Day
Supercharge your productivity with HubSpot's comprehensive guide to Chat GPT. This free resource is your fast track to AI mastery:
Industry-Specific Use Cases: 15+ real-world applications across various sectors
Productivity Guide: 21 best practices to 10x your efficiency with AI
Prompt Powerhouse: 100+ ready-to-use prompts for immediate implementation
Challenge Buster: Overcome common AI hurdles with expert strategies
Plus, in-depth sections on email composition, content creation, customer support, and data analysis.
WP RADAR
This week in WP Radar: an exclusive .wordpress domain proposal, new Jetpack tools, and shifting economics for publishers and creators.
Automattic Seeks Exclusive .wordpress Domain. Automattic applied to run .wordpress as a closed top-level domain in ICANN’s first application round since 2012. Registration would be limited to Automattic and its affiliates, leaving independent WordPress businesses unable to get an address. The proposal awaits review alongside more than 1,600 other applications.
Jetpack 16.3 Adds Video And Booking Blocks. Jetpack’s latest release adds VideoPress playlist blocks and a Zoom scheduler that lets visitors book meetings without leaving a WordPress post. It also expands Jetpack AI’s connections to other AI apps. Together, the additions bring more video and scheduling functionality into your existing site.
Court Ruling Strengthens Publisher Licensing Claims. A ruling against AI training on copyrighted material gives publishers more support for licensing claims, including markets they haven’t yet developed. The case doesn’t concern generative AI directly, but its reasoning on training and market harm could influence pending disputes over how AI companies use publishers’ work.
Creator Economy Splits Into Two Separate Markets. Top creators increasingly negotiate upfront deals and creative partnerships like media companies. Nano and micro creators, meanwhile, are being purchased programmatically like ad inventory. Both markets are growing, but the distinction matters: one group negotiates the relationship, while the other gets bought at scale.
83% of European YouTube Creators Rely on Recommendations
YouTube’s 2026 European Economic Impact Report says 83% of creators surveyed rely on recommendation algorithms to grow and earn revenue. Of those, 71% say reduced visibility would hurt their livelihood. For publishers expanding into video, that’s a business risk: your content stays online while audience access changes. Your website and email list give viewers another way to find you.
That’s all for this week!
Michael - Operator @WP Folio - now WP Defense Lab. Same Plugins. Different Name.