📥 Hello, and greetings from the Central Office!
Great plugins are not just about new features. A large part of May was spent making our existing code safer, more compliant, and easier to maintain long-term.
Our developers tackled input sanitization, output escaping, direct file access protection, and WordPress coding standards (WPCS/PHPCS) compliance across multiple plugins. These are not glamorous changes, but they are the foundation everything else builds on.
On the infrastructure side, we fixed CircleCI pipeline issues, resolved dependency conflicts, upgraded our Docker build environment, and improved overall deployment reliability. Less firefighting means more time building. 🔥
🎥 Did you know we have a YouTube channel focused on WordPress security?
We share step-by-step tutorials on how to secure your site and protect your content.
⚡️ Watch our latest video:
Export WordPress Posts to PDF
👉 Explore the full channel:
youtube/@wpdefenselab
Don’t miss the next one 🚀
Get two hours of your day back.
Lindy texts you a meeting brief before every call: who you're meeting, what you discussed last time, what's still open. 1 minute setup. Try it free.
Welcome to WP Defense Lab — your weekly brief on the WordPress news that impacts your business.
This week, the UK forced Google to offer publishers a formal opt-out from AI search features - and Google's response shows exactly why that right is nearly unusable.
In WP Radar: the WP Engine v. Automattic discovery fight takes a new turn in court, Kinsta releases self-serve bot controls for WordPress hosting, WordPress launches the Protect The Shire supply chain security initiative, and LinkedIn surpasses rivals as the most-cited domain across AI search platforms.
Google Gave Publishers an Opt-Out. Almost No One Can Use It.
The UK's CMA forced Google to offer publishers a formal right to leave AI search features. Google kept them opted in by default, withheld the click data needed to evaluate the decision, and gave publishers nine months to wait.
Google's AI opt-out for publishers arrived last week through a ruling from the UK's Competition and Markets Authority.
The CMA ordered Google to give publishers an opt-out from AI Overviews, AI Mode, AI summaries in Discover, and AI model training.
Google published a blog post the same day saying it will roll out the toggle globally through Search Console, not just to UK sites.
On paper, that is the most significant regulatory constraint placed on Google's AI search expansion since the features launched.
The Toggle Without the Data
Publishers who want to evaluate the opt-out face one immediate problem: Google has not provided AI-specific click data in Search Console.
Search impressions for AI features exist. Clicks from AI features do not.
Stuart Forrest, former global audience development director for Bauer Media Group, described the bind directly: "If this were opt-in, Google would have to prove to us why we should let them use our content. Instead, they keep us in by default and don't give us the click data we need to know if AI search is actually hurting our business."
Google has nine months to implement the CMA's requirements fully. Publishers making the opt-out decision now are doing it without the measurement layer to evaluate the trade-off.
The Opt-Out vs. Opt-In Distinction
The CMA mandated an opt-out, not an opt-in.
Default inclusion means publishers who do nothing remain in AI features. Those who want out must actively opt out and absorb the revenue uncertainty of doing so.
An opt-in system would require Google to justify why publishers should permit their content to feed AI features.
That negotiation never happened. The CMA settled for the right to leave.
What Opting Out Actually Costs
Publishers who pull the toggle stop appearing in AI Overviews, AI Mode, and AI training datasets.
What happens to their organic rankings is not disclosed - Google has not stated whether opting out of AI features affects core search indexing. That unknown is the mechanism of dependency.
Publishers cannot calculate the trade-off because they do not have the variables needed to run it.
Multiple publishers told Digiday they will not exercise the opt-out until they have AI-specific click data. The right is formally available and practically unusable for any publisher with meaningful Google traffic.
The Infrastructure Position This Exposes
The Google AI opt-out fight reveals the cost of borrowed distribution. When Google is your primary traffic source, a regulatory opt-out from a Google feature is not real negotiating power - it is permission to self-harm.
The content publishers produce trains AI models and drives engagement for Google's products. The traffic flowing back is conditional, unmeasured, and declining.
The sites that could absorb experimenting with the opt-out already have direct traffic channels - email subscribers, brand search, membership revenue, referral networks - that reduce dependence on any single Google surface.
The sites that cannot run that experiment are the ones most exposed to whatever AI features do to clicks, with no data to track the effect.
The Question Left Open
What percentage of your traffic currently comes from Google's AI-enhanced surfaces?
If you do not know - and Google has not given you the tools to find out - that is the gap the CMA ruling was designed to close, and has not yet.
This week in WP Radar: the WP Engine discovery fight reaches a new ruling, Kinsta adds WordPress-native bot control, WordPress launches a supply chain security initiative for its entire plugin repository, and LinkedIn becomes the dominant AI search citation source for professional content.
Mullenweg Found 'Evasive' in WP Engine Deposition. A federal court found Mullenweg appeared to be evasive during his three-day deposition in WP Engine v. Automattic, and ordered WP Engine to disclose a redacted sentence from an internal strategy deck. Automattic claims the sentence shows WP Engine considered paying for a WordPress trademark license - the same license it now argues it never needed. Discovery outcomes in this case will establish how the WordPress trademark can be enforced against hosting companies.
Kinsta Releases WordPress Bot Controls at No Extra Cost. Kinsta launched Bot Protection built into MyKinsta, giving WordPress site owners four preset traffic control levels, a managed allow list for WooCommerce and standard WP paths, and a dedicated toggle to block AI crawlers entirely. Bot traffic now accounts for more than half of all web traffic, with AI crawler activity up 300% in the last year. The feature is included on all plans with no support ticket required.
WordPress Launches Supply Chain Defense for All Plugins. WordPress announced Protect The Shire, an initiative to audit and secure all code in its plugin and theme directories, plus a 24-hour delay before updates reach WordPress auto-update channels. The delay targets supply chain attacks, where attackers acquire legitimate plugins and push malicious payloads through the update mechanism. The repository holds 60,000+ plugins; the audit layer runs behind the scenes, with success measured by attacks that never reach users.
LinkedIn Surpasses All Sources in AI Search Citations. LinkedIn jumped from outside the top 20 to the #1 most-cited domain across major AI search platforms, rising to #5 on ChatGPT for professional queries in three months, according to research from Profound. What AI engines are citing is individual posts and articles from professionals, not company pages. For B2B creators and site owners selling services, LinkedIn now operates as a parallel AI retrieval layer - AI tools surface professional credibility signals from LinkedIn before citing owned-site content.
15% of daily traffic disappeared from English Wikipedia articles exposed to Google AI Overviews, according to a 2026 study of 161,382 matched article-language pairs.
For WordPress publishers, the warning is not about Wikipedia. It is about the answer layer forming above the open web. If AI summaries can satisfy informational searches before users click through, search-dependent WordPress sites face a new kind of visibility problem: useful enough for Google to summarize, but visited less often by the users Google serves. That makes AI search a distribution risk, not just an SEO feature.
That’s all for this week!
Michael - Operator @WP Folio - now WP Defense Lab. Same Plugins. Different Name.