📥 Hello, and greetings from the Central Office!
We believe customers deserve to know what happens behind the scenes, not just what gets shipped. Over the next few weeks, we'll be sharing a transparent look at what our team has been working on to keep your sites secure, stable, and supported.
Security First
June was a major month for security.
We resolved a high severity security vulnerability (CVSS 8.8) in PPWP, closed multiple security reports in collaboration with WordPress.org and Patchstack, fixed six unauthenticated REST endpoint vulnerabilities in PDA Gold, and continued code hardening and WordPress coding standards improvements across multiple extensions.
Keeping your protected content secure remains one of our highest priorities, and we're grateful to the security researchers and customers who help make our products stronger.
🎥 Did you know we have a YouTube channel focused on WordPress security?
We share step-by-step tutorials on how to secure your site and protect your content.
⚡️ Watch our latest video:
Stop Updating WordPress Passwords Every Month
👉 Explore the full channel:
youtube/@wpdefenselab
Don’t miss the next one 🚀
Welcome to WP Defense Lab — your weekly brief on the WordPress news that impacts your business.
This week, Jellyfish research confirms what should alarm every creator building on borrowed infrastructure: more than 25% of AI chatbot responses now cite YouTube creator content.
In WP Radar: publishers prep sites for AI agents, bot traffic passes 51%, rival agents choose different website surfaces, HubSpot proves owned media at 50M scale, and Riverside turns recordings into newsletters.
Your Content Powers 25% of AI Chatbot Responses
Jellyfish's research reveals who the AI citation economy actually works for, and it is not the creators powering it.
Marketing firm Jellyfish examined AI chatbot responses across major platforms and found that more than 25% of prompts receive answers referencing YouTube creator content.
In the CPG category alone, more than one million unique YouTube videos are cited by AI chatbots in the U.S. every single day.
In financial services and consumer electronics, that figure reaches nearly 50%.
ChatGPT, Claude, DeepSeek, Meta AI, and Perplexity are all pulling from the same pool of creator-built content.
Who Captures the Value
YouTube captures the referral upside.
By the start of 2026, YouTube had surpassed Reddit as the top referral destination in AI chatbot responses. Every citation strengthens YouTube's position as the platform AI companies approach for licensed content partnerships.
For individual creators, the math runs differently. Their videos appear in chatbot responses. Their channel gains AI visibility.
No compensation flows from the AI companies extracting and serving that content to millions of queries per day.
The Consent Problem
YouTube has made it easier for creators to opt out of AI training, but creator content is already embedded in models trained before those controls existed.
A class action filed earlier this year alleged that Amazon, Apple, and OpenAI use scraping tools specifically designed to bypass YouTube's access restrictions.
Consent frameworks created after the fact do not reverse training decisions already made.
The content was built on YouTube's platform, under YouTube's rules, and AI companies changed what those rules meant without asking the people who built it.
What Platform Publishing Strips From Creators
A creator publishing exclusively on YouTube has one real choice: accept the terms or stop publishing.
There is no robots.txt control at the creator level. No ability to allow search crawlers while rejecting AI training use.
The platform controls infrastructure access entirely.
This is risk-shifting in its clearest form: creators invested the labor, YouTube and AI companies capture the extraction value, and creators bear the reputational risk when AI models misquote or misrepresent their work at scale.
The Long-Form Signal Worth Reading
The Jellyfish data found that AI chatbots prefer content from "niche creators with videos longer than 10 minutes."
That preference mirrors what content publishers have known about search for years: depth compounds differently than short-form volume.
A 15-minute tutorial targeting a specific topic generates different citation signals than a 60-second clip optimized for algorithmic engagement.
Creators building depth-first content strategies are already making the infrastructure choice that aligns with where AI citation is heading.
The Practical Question
How much of your published content lives exclusively on platforms where someone else controls the infrastructure and extraction rules?
The 25% citation rate for YouTube creators will not translate into creator revenue until licensing frameworks catch up.
Until they do, publishing exclusively on borrowed platforms means subsidizing the AI economy's content needs without a seat at the negotiation table.
Leads don't wait for business hours.
With Wati, every message across Instagram DM, Messenger, WhatsApp, SMS, RCS, and web chat gets an instant AI-powered response. Automations qualify leads, route conversations, and log everything automatically, so your team only steps in when it’s time to close.
This week in WP Radar: publishers prep sites for AI agents, bot traffic passes 51%, rival agents choose different website surfaces, HubSpot proves owned media at 50M scale, and Riverside turns recordings into newsletters.
Time Converts Its Entire Website to Markdown for AI Agents - Time blocked all AI bots by default, then whitelisted approved bots to redirect them to markdown versions of all its pages. TollBit, the conversion tool used, claims a 90% reduction in token volume per page compared to HTML. WordPress publishers can replicate this pattern by controlling bot access at the server level and serving structured content through a separate delivery path.
Bot Traffic Crossed 51% of All Web Requests - Imperva's 2025 Bad Bot Report found automated activity reached 51% of all web traffic for the first time, with Kinsta's own analysis of over 10 billion requests confirming AI bot traffic surged 300% in a single year. WordPress site owners measuring performance from analytics dashboards are looking at an incomplete picture: roughly half of server requests are now from software, not humans.
Chrome Acts on Your Site. Siri Only Reads It. - Google's Chrome Auto-Browse ships on Android at the operating-system level and navigates websites to complete tasks: filling forms, booking appointments, and running comparisons. Apple's new Siri AI reads web content to compose answers but does not visit sites to act on them. WordPress site owners now face two distinct optimization targets simultaneously: clean, readable content for Siri-class agents and functional task flows for Chrome-class agents. These are different investments with different returns.
HubSpot's 50-Million-Person Media Engine Proves the Model - HubSpot built a media operation reaching 50 million people monthly inside a software company, with editorial independence and owned distribution as the stated competitive advantages. The pattern mirrors what newsletter operators running subscription models already understand: audience relationship quality outweighs raw traffic volume. Software companies are building better media businesses than most media companies.
Riverside Adds Newsletter Publishing to Its Recording Tools - Riverside, which has raised over $60 million, now lets creators turn recordings into newsletters using AI conversion sent directly from the app. For creators who already produce audio or video, this compresses a separate publishing step. The practical question is what you give up by bundling email inside a recording platform versus owning that infrastructure outright.
40% of recent copyright filers would reduce or stop registrations entirely if fees increase, per a Copyright Alliance survey. Copyright registration is technically voluntary but practically essential for any creator who wants to pursue infringement damages in court.
The Copyright Alliance is pushing the U.S. Copyright Office to adopt small entity fees, subscription models, and graduated pricing to lower the barrier. Creators who skip registration because it costs too much are one infringement incident away from discovering they lack the legal standing to pursue damages.
That’s all for this week!
Michael - Operator @WP Folio - now WP Defense Lab. Same Plugins. Different Name.