To deploy a website with Devin, create a new project or open an existing one in Devin Desktop, then prepare […]
The post How to deploy a website with Devin: step-by-step guide appeared first on Hostinger Tutorials.
To deploy a website with Devin, create a new project or open an existing one in Devin Desktop, then prepare […]
The post How to deploy a website with Devin: step-by-step guide appeared first on Hostinger Tutorials.
[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.
Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, testing secure WordPress hosting, does the marketing match the reality?
If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.
If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.
So on the podcast today we have Maciek Palmowski. Maciek is based in Poland and works at Patchstack, one of the companies in the WordPress ecosystem dedicated specifically to security. At Patchstack, Maciek collaborates with other security professionals on industry reports, bug bounty programmes, and solutions for agencies, product owners, and hosting companies aiming to secure their client sites.
I met up with Maciek at WordCamp Europe, and we discussed his presentation there. It examined the claims of secure hosting made by many WordPress hosting providers. He describes how Patchstack set out to test these claims with real world penetration testing, using 30 known plugin vulnerabilities across multiple hosts. Employing standardised methodologies and validating their results independently.
The findings are sobering. The majority of WordPress specific attacks still get through, and there’s a significant gap between the marketing hype and real protection.
The conversation starts with Maciek’s background, and how his journey in the WordPress security space led to a focus on the promises made by hosts.
From there, the discussion gets into the research approach, the selection of well-known vulnerabilities, consistent testing across different hosting environments, and the surprising result that even hosts with identical security tooling produce drastically different outcomes, showing it’s not just about the tools you use, but how you use them.
We talk about the Swiss cheese model of security, every layer will have holes, so you need multiple overlapping defences, and honest communication from hosts about their limitations.
We also explored whether an industry-wide standard, or badge, for secure hosting is feasible or even desirable, given how easy it is for strong marketing claims to outpace reality.
AI also enters the conversation, increasing both the speed and sophistication of attacks, and making patching, and processes, even more important, especially as the volume of vulnerabilities continues to rise and the time to exploitation drops.
If you’re interested in understanding what secure hosting really means, how to ask intelligent questions of providers, and the realities of WordPress security in 2026, this episode is for you.
If you’d like to find out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.
And so without further delay, I bring you Maciek Palmowski.
[00:03:56] Maciek Palmowski: I am joined on the podcast by Maciek Palmowski. Hello Maciek.
Perfect. You did great.
[00:04:01] Nathan Wrigley: For some reason, your name has got into my head. A lot of the people that I interview, I struggle with their name, and I continue to struggle, but for some reason, I established many years ago that was how to say your name. And I think I’ve done it correctly ever since then.
[00:04:16] Maciek Palmowski: Yes you did. You’re almost having the typical Polish accent, so you’re doing great.
[00:04:21] Nathan Wrigley: So we are at WordCamp Europe, which is in Krakow, or Krakow, I don’t know how.
[00:04:26] Maciek Palmowski: Krakow.
[00:04:27] Nathan Wrigley: Thank you, that was good. And the reason Maciek is correcting my pronunciation is because Maciek is actually from Poland, which I suppose means that this is a bit of a, well, it’s like a home game to you.
[00:04:37] Maciek Palmowski: In a way so, but it’s also like a bit of a shame because I do like travelling when WordCamp Europe’s are happening. And, you know, just hopping on the train and going to Krakow, it was like a, I mean it’s cool because, yeah, the venue’s amazing, everything is great, but still I’m staying home, so yeah.
[00:04:53] Nathan Wrigley: Yeah, mixed feelings. So Maciek has done, or is going to do a presentation at WordCamp EU. Have you done it yet?
[00:05:02] Maciek Palmowski: I will do it tomorrow.
[00:05:04] Nathan Wrigley: Okay. And are you all set, are you one of these like really prepared people that has all the slides done, or are you last minute?
[00:05:11] Maciek Palmowski: Everything is ready. I already did one version of it at the Checkout Summit in Palermo, so.
[00:05:17] Nathan Wrigley: Oh I see. So you’ve had a sort of dry run of elsewhere.
[00:05:19] Maciek Palmowski: Of course.
[00:05:20] Nathan Wrigley: Excellent. So the presentation, which is going to be the focus of today’s conversation, is called Testing the promise, does secure hosting deliver? And I may as well read the blurb because it was a reasonably short one.
So it says, secure hosting, in quotes, is everywhere in WordPress. What does it actually protect against? We put this claim to the test with real penetration testing. 30 known vulnerabilities, multiple hosting providers, standardised methodology, validated by independent observers. The findings reveal a critical gap between marketing and reality. WordPress specific attacks succeed most of the time. That’s quite an alarming sentence. This talk shares the complete results and explains why generic security fails.
So, we’ll get into that in a moment. But as with all people, when I’m talking to them about security, I guess it’s good to establish who you are, and what your credentials are and what you’ve done, and how is it that you get to talk about security with authority. So over to you really, a little moment to give us your bio and tell us about you.
[00:06:20] Maciek Palmowski: Okay. So I work at Patchstack, and Patchstack is one of those few companies in WordPress space that are doing a lot in terms of security. We are constantly running this bug bounty for the whole ecosystem. We have quite a few solutions for both clients and hosting companies, and I work there right now. My role is, if I remember, the Growth Team Engineer, something like this.
But yeah, I do spend a lot of time working with other security people. So when we are working on all the reports, when we are checking the data, I’m also part of those teams that are working on it. So yeah, I think I know a thing or two about what is happening behind the scenes when it comes to WordPress security.
[00:07:02] Nathan Wrigley: Yeah, thank you. Always good to get that established though, right at the outset.
Patchstack is a company which is not a host though, I suppose that’s important to mention at the beginning. It’s a company which is in the security space, very much in the WordPress space, but perhaps more broad than WordPress, I’m not sure. But not a hosting company.
But obviously your presentation focuses its aim on hosting, I guess because that’s one of the places where the claim about security is most often made. You know, you’ll go to a, the landing page of hosting Company X, and you’ll see somewhere fairly near the top, secure hosting, or something along those lines. And you’ve decided to examine that in fine detail and look at these 30 vulnerabilities.
I guess really just tell us about this test and what it is that you decided to do and some of the items that came out of that.
[00:07:50] Maciek Palmowski: Okay, so maybe let’s start with how it even started, right? Because there was a trigger. At some point we published one report about the state of WordPress security. We tweeted about this. We got the response from none other than Matt Mullenweg, who kind of asked a very interesting question, but isn’t hosting companies taking care of this already?
And this was, kind of at this moment when we were, we thought that we know the answer that, no they aren’t. But to be honest, we didn’t have any broader proof about this.
We knew how it’s working at some hosting companies, but we could say that it was more of an anecdotal evidence that we had. So this was kind of the trigger that made us, okay, let’s check this. But not with one partner or two partners, but with more hosting companies.
So we did this research twice. First we just did kind of a beta run because we weren’t sure about the result and, is it even a good idea to go deeper inside of it? And during our first run, we were already very surprised because like the methodology was very simple. We just installed vulnerable plugins and we checked if we would be able to use the vulnerability. Because if the hosting is claiming that, we got your back, we are making your website secure, we have this and that, this means that they should protect against it. So it was as simple as that.
And when we were doing our first test, we were quite surprised because we saw, if I remember, that 80% of the attacks went through. 80% of the attacks. So our first reaction was, okay, we are doing something wrong. Okay, this was only few hosting companies, less plugins, but still the result were so surprising for us because we thought that, okay, that the problem exists, but it’s not that big of a problem. But it was.
So that’s why we did the second test. And this is about which the, my talk will be mostly when we tested more hosting companies, more plugins. And we saw that the problem still exists.
Of course it was, in some cases 70 few percent. So still, it’s a huge problem, especially if we are talking about some companies that are literally saying, you don’t have to install anything additional when it comes to security on your website. We got your back. They don’t. We found a lot of interesting things, but still the problem exists.
[00:10:21] Nathan Wrigley: So just deep diving into that a little bit, when tests like this are done, there’s obviously, the claim might be levelled, you know, obviously Patchstack would, this kind of maybe benefits Patchstack, if you know what I mean.
So let’s just sort of clear up what the test involved. So presumably the plugins that you chose are ones where it’s publicly known that there’s a vulnerability in this component or this particular file or what have you. So is that the case? This is stuff that, longstanding understanding that there’s a problem here.
[00:10:51] Maciek Palmowski: Yes. We only use the plugins that we had all the proof of concepts. So we know how have the vulnerability happened, what was the attack vector? They were all reported through our bug bounty programme, because that’s why we had the proof of concept. Yeah, and that’s it.
It was, like I said, it was as simple as that. We had a really broad mix of all the plugins. How many? It was 30 something of those plugins, if I remember. Different ones. Some were connected with WooCommerce. So, like a very broad selection of them. Different vulnerability types. So we try to mix it up as much as possible.
[00:11:27] Nathan Wrigley: Was the situation for each hosting company the same though? In other words, was the things that you did in one hosting environment the exact same as you did in another hosting environment? No. You mixed that up a bit as well.
[00:11:38] Maciek Palmowski: I mean we used all the same plugins, like the methodology was always the same. But we got totally different results. Even if, and this was one of the most interesting findings, because very often hostings will put a logo of some company that takes care of security. For example, say, Cloudflare. And despite using the same stack for security, they got different results.
[00:12:02] Nathan Wrigley: Interesting.
[00:12:03] Maciek Palmowski: So it turns out, in many cases, it’s not about the tools that you are using, it’s how you are using them, which was very interesting. And we did everything. We tried to enable every feature, every security features on those hosting, to kind of give them a chance to kind of make sure that they are defending the most as they can.
And the result in most cases was very simple. They were doing quite well with the generic ones like uploads, patch reversal, things like this, which are very generic in PHP. But with those WordPress specific attacks, they just failed miserably.
[00:12:44] Nathan Wrigley: That’s so interesting. The word secure hosting, which you’ll see all over the place, it feels a bit like using the word healthy on food. There’s no real definition of what healthy is. You know, a company selling chocolate could probably pretend that it’s healthy compared to something else.
[00:13:04] Maciek Palmowski: Like here, healthy chocolate is exactly, like in some cases secure hosting.
[00:13:07] Nathan Wrigley: Right. So what do you take from this then? I mean basically, is your survey saying that whenever you see the word secure hosting, be sceptical?
[00:13:16] Maciek Palmowski: Yes.
[00:13:16] Nathan Wrigley: Okay. As simple as that.
[00:13:18] Maciek Palmowski: It’s as simple as that. Because one of the things that we were always promoting, security is not a plugin, it’s not a one button thing. Security is a process. It’s layers.
And that’s kind of why we, especially after this report starting kind of using the term, Swiss cheese layer model. Because every layer will fail in some way. That’s also why you still need all the security solutions that hosting provides, because they do have a lot of interesting solutions against those generic attacks.
Because they’re doing really great when it comes to those generic ones. And that’s great because some of the attacks will be already dealt with. So whatever passes to the second layer, it has less work to do because a lot of it was already stopped at the first layer. The second layer should be something more WordPress specific that understand what is installed. And with this it can catch also a lot of it.
But still, you have to be prepared that, because again, this layer also isn’t perfect. Because there are zero days vulnerabilities, there are custom code, there are a lot of things that can happen, that your website will be hacked. I mean, weak password. Simple as that. That’s why you also need to have a layer, which will be more of what to do if everything else fails. Because you do need to know that you have to inform your clients, all the GDPR related things. How to kind of, I don’t know, use the backups.
In short you need to have procedures. You have to be prepared before the attack happens. Because let’s be honest, asking some lawyers about, what should we send to our clients? The moment when, well, the milk is already spilled. It’s like the worst moment to think about it. Especially that, hey, your website was just hacked. It’s not just a technical problem, it’s also a business problem. Again, with those GDPRs and everything.
So yeah, the more layers, the better. You still need to remember, every layer can fail in some place. That’s why the more, the better.
[00:15:29] Nathan Wrigley: Would you like to see a standard industry-wide definition of something like a badge or, I don’t know, let’s say for example, that you put the word secure hosting on your website, that has to actually stand for something.
Because obviously coming from the background that you do with a broad oversight on what that is, you have a vast amount of data at your disposal. You can see all of this kind of stuff. But every company can make the claim that our food is healthy, our hosting is secure. But I don’t know, in the model that we’ve got where any company can put anything they like on a website, I don’t really know how you do that, but some sort of accreditation or something. I don’t know.
[00:16:08] Maciek Palmowski: Honestly, it’s really difficult because as I said before, a lot of companies using the same tools were failing in different ways. So that’s a problem. On the other hand, like sometimes the, those stupid things like weak passwords. And it doesn’t matter that you had a, let’s call it a certified secure hosting, you still failed because your password was weak, you know? So, also certificates like this can backfire because some people might think I have a secure hosting, I don’t have to worry about things. And then you have 10 admin accounts for everyone.
[00:16:43] Nathan Wrigley: Is there is there something, some mark of that description that you, personally, that you go looking for though? Is there some credentialing system which you think actually does carry some weight? So for example, I don’t know, like the insurance space or the accountancy space or something like that. You have to have that accreditation in order to do business. Is there something like that? Is there a mark which hosting companies can apply for which you could have some confidence in it?
[00:17:13] Maciek Palmowski: Okay. So for sure one of those things would be, and I don’t want to say it as an advertisement, but it is a thing that you see that the hosting is thinking a bit better about security, kind of looking if they are a Patchstack partner. Because this kind of automatically means that they do have this WordPress, the security WordPress layer. So that’s already a good sign.
So yeah, I would start with this. I think that’s kind of one of the simplest ways, but again, Patchstack isn’t the only solution that does it. So looking for partners of such companies might be the best way to start because having those Patchstack aware security solutions built in, into the hosting is a really good sign.
[00:18:05] Nathan Wrigley: Yeah, okay. Now, the inevitable conversation in the year 2026 is AI. It doesn’t matter which area of WordPress you’re talking about. AI manages to get in somewhere. I am presuming that the landscape in terms of security only got more complicated because of AI. Because I’m imagining that attacks that needed to be conceived by a human can now be conceived in a fraction of the time by an AI agent. But not just one, maybe a dozen or a thousand or whatever it may be.
Let’s just talk about that for a moment. It feels almost as if AI and security are like, that’s a real systemic problem for the future of the entire industry. Because these things can happen so fast, a plugin vulnerability is discovered by an AI agent. It then discovers the attack surface, implements the attack all in a matter of seconds, possibly. What’s the position? Like, how do we stay calm basically in the year 2026?
[00:19:09] Maciek Palmowski: So the problem already existed around a year ago, because a year ago when we did our State of WordPress Security Report, we already saw that vulnerabilities are being used after around five hours after kind of being published. So five hours. That’s the first thing, because we still have a lot of people that say, yeah, just update your WordPress weekly and you’re good to go. No, you’re not. Looking at this number, you have five hours.
[00:19:39] Nathan Wrigley: Okay. Let’s just parse that at the moment. So the vulnerability is published. So there’s a whole thing there, like the vulnerability may well have been discovered prior to being published, so that’s a whole other thing.
[00:19:52] Maciek Palmowski: So first the vulnerability is discovered. Then at least how it works on, with our bug bounty. We inform the vendor they have, let’s say around a month to fix it. When they fix it, we publish everything and, yeah.
[00:20:09] Nathan Wrigley: Okay, so from the moment you publish, you can then detect that that is being leveraged within a space of five hours.
[00:20:17] Maciek Palmowski: Yes.
[00:20:17] Nathan Wrigley: Okay, that’s really interesting.
[00:20:19] Maciek Palmowski: But there is a problem. There is a really big problem. So if the vendor doesn’t respond, we still publish it.
[00:20:26] Nathan Wrigley: How long do you give them? Is it like.
[00:20:27] Maciek Palmowski: It is the one month.
[00:20:28] Nathan Wrigley: Okay, thirty days.
[00:20:30] Maciek Palmowski: Of course, if they reach out that there is some problem, they need like extra days. But in most cases, we’re talking about the vendors that just don’t respond at all. We publish it anyway.
But the problem is that, from all the vulnerabilities that were discovered last year, 50% weren’t patched at the moment of publishing about it. 50%.
[00:20:50] Nathan Wrigley: So half of the plugins where there was a known vulnerability, the vendor had been informed, they’d had this 30 day window. Half of them made no amendment to their code.
[00:21:01] Maciek Palmowski: Exactly.
[00:21:02] Nathan Wrigley: Okay. Wow, okay.
[00:21:03] Maciek Palmowski: Again, going back to this classical, yeah, just update your WordPress regularly. No.
[00:21:08] Nathan Wrigley: No, that’s a really different surface, isn’t it?
[00:21:11] Maciek Palmowski: It doesn’t work on so many levels. Because not only the problem is with the fact that, still the famous five hours, which also, it’s five hours now. It was much longer a few years ago. On the other hand, yeah, most of those, I mean around half of it aren’t patched, so the attacks will happen quicker than it get patched. So yeah, there is a lot of problems like this. And also the problem with security is that it’s really difficult to sell.
[00:21:39] Nathan Wrigley: It’s like insurance, isn’t it?
[00:21:40] Maciek Palmowski: Yeah. But insurance, okay, you see your car, your house, it’s real. It’s real, you kind of see it. The only category of websites that it’s much easier to kind of explain is e-commerce.
[00:21:54] Nathan Wrigley: Yes. You can feel the tightening on your wallet.
[00:21:56] Maciek Palmowski: They literally see the money. They can kind of really, okay, one hour of my website not working equals this and this Z?otys or Euros or whatever. So that’s easier to explain. But for most people, yeah, security, meh.
[00:22:11] Nathan Wrigley: Yeah. That’s really interesting. So you mentioned, about this survey, you mentioned that fully 80% of your penetration testing resulted in something. What were the sort of, the high level items? Apart from that 80% figure. What were some of the other, because you said there were a few interesting things that dropped out of it. Can you mention anything else?
[00:22:31] Maciek Palmowski: So like I said, one of the things was that we learned that, despite using the same tools, we got different results. That was also a surprise for us.
[00:22:39] Nathan Wrigley: So let’s just figure that out. So at hosting company A, we’ve got a WordPress website with the same collection of plugins in. Hosting company B, exactly the same as far as you can make it the same, but things are different.
[00:22:52] Maciek Palmowski: No, no, they are, for example, they’re using for security the same tools.
[00:22:56] Nathan Wrigley: Right, okay.
[00:22:57] Maciek Palmowski: So in theory, if they’re using the same tools, we should have exactly the same results.
[00:23:03] Nathan Wrigley: So does that then point to a different set of configurations on the backend, or is it more curious than that? You just don’t quite know what’s going on.
[00:23:12] Maciek Palmowski: I mean because it’s not something that they will tell us. But yeah, in most cases, it’s all about configuration because the fact that you’re using a tool, it’s also important how you use a tool.
Also, with security is very often about, is something easy to use or is something secure? And kind of finding the balance. So some of the companies probably had a bit more aggressive configuration, which is better from the security point of view, but probably more often result in some annoying side effects for the user.
Also what, this was one of the most interesting things, but also what was very interesting because we contacted every company afterwards and we informed them that we did the test. Here are the results, what went through, what was blocked. And some of the companies did an amazing job of fixing whatever they could. On the other hand, we saw that some of the companies, because we did some extra tests later just to check what they did with our report, did nothing.
That’s one of the things about security in general, not about the hosting, about even having vulnerability in your plugin. That’s normal that we make mistakes. We’re humans, right? So that’s normal. What’s important is how we deal with them. If you have a problem and you fix it as quickly as possible, as good as possible, that’s great because you learn from your mistakes, you fix it, and you move on. Perfect. Good job. Now you are in a much better position than before. But if you get this, you look at it and you say, ah, this is fine, that’s the worst behaviour from the security point of view that you can have.
[00:24:57] Nathan Wrigley: I’m going to ask you not to name names here, but were some of the companies familiar to us?
[00:25:05] Maciek Palmowski: For sure, because we did test the biggest ones. But there is a reason why we didn’t want to name them, and it wasn’t about that we were afraid that I know someone will get mad or whatever. It was more about this weird side effect that could happen.
Some users would think, my hosting isn’t on this list, so probably I’m secure. Probably you’re not, you just weren’t in the test. Because we also did some site checks and everything. And we saw that a lot of those problems happen at most of the hosting companies. And like I said, the more important part was how did they reacted after getting the report. Like I said, it was a more common problem that we even thought.
[00:25:43] Nathan Wrigley: Do you, obviously, you know, caveat all of this with the fact that you work for Patchstack and what have you, do you see it even as the role of a hosting company to have any position on security publicly? Or would you prefer them not to make grand claims about things that you believe they can’t necessarily substantiate?
I don’t really know where I’m going with that question, but I’m just wondering if there’s just a sense that the language that’s being used is too strong. You know, secure hosting implies we’ve got all the padlocks, and the padlocks are there and you’ve got nothing to worry about. You’ve found a different picture. So I’m just wondering whether or not you would just prefer that the hosting companies stop talking about this altogether.
[00:26:27] Maciek Palmowski: I do think that’s, one of the biggest problem here is about the claims, the bold claims, the whole marketing around it. Sometimes even you can find documentation of some of them that, yeah, you don’t need to install any third party tool because we got you covered. We checked it, no they didn’t. So that’s kind of the problem.
It’s really more about the, how they market it. If they would say, okay, so we have a really performant hosting that does this, this and this. When it comes to security, kind of do it yourself. I mean we are providing this layer, but the rest is up to you. And that’s okay. That’s an honest claim. We are not doing everything for you. We are doing this part, but this is up to you. This would be much better.
I know that from the marketing point of view, it doesn’t sound as good as, we got all the security that you can imagine, don’t have to worry about this. Because that’s kind of the thing that very often managed hosts trying to sell, that you don’t have to worry about things. You just have to focus on whatever you have, writing content, selling stuff. If you have a e-commerce, whatever, that’s it. That’s kind of the only thing you should think of. Not about performance, because we got your back. Not about security, again, we got your back. And if you are paying for a managed hosting and suddenly they would start having like this different way of messaging to, it’s not that obvious that we have your back in everything. That would be very difficult for them.
So now it’s kind of the problem that, because everyone is kind of using this messaging, everyone else also has to. And also if we think about how a lot of those algorithms, look like that algorithms love bold claims. They want something white or black, not grey. And the truth is, most of the things we are talking about, it doesn’t matter, security, SEO performance, it’s everything in the grey zone. That’s why a lot of developers can end their talk with, yeah, it depends. There is no right or wrong. It depends because there are so many things you have to think about.
I could say that, and this is my kind of thing that, most of the websites that people have should be static. They don’t need even WordPress at all. This is a horrible claim if you’re a manager of a WordPress hosting, right? So that’s the thing. But it all depends on so many things, but yeah, the messaging is important.
[00:29:08] Nathan Wrigley: Yeah, if you were, on a personal level, if you were going out there looking and let’s say, if you can somehow put your job hat to one side, what would be the kind of things that you would be looking for? What questions would you be asking related to security if you were to be going to these companies?
From everything that you said, obviously it’s not black, it’s not white, it’s definitely grey. So every setup has some way of being vulnerable. But what are the kind of intelligent questions that you would be bringing to hosts to get some reassurance that at least they appear to know what they’re doing, even if they can’t make the claim that they’re a hundred percent cast iron, water tight? What might be some intelligent questions to start asking?
[00:29:49] Maciek Palmowski: One of the best questions you can ask is just, is there any solution in your security stack that is WordPress aware? Not the general one. Because if they only start talking about some web firewall, things like this, it’s already kind of a red flag. Because this is, overall, if we’re talking about firewalls, that’s not the correct layer about which, this is the generic one.
So this is the main question. How do you take care of WordPress specific attacks? Simple question. And if they will start responding, yeah, that we have this web application firewall that, in most cases this will be a sign that, no, we are not talking about the correct layer. That’s not it. It’s probably not aware about what is happening in WordPress.
[00:30:40] Nathan Wrigley: Okay. So given that this is a WordPress podcast, and we are at a WordPress event, that would be the beginning of your questioning is demonstrate that something in your stack is specific to WordPress.
[00:30:52] Maciek Palmowski: Exactly.
[00:30:53] Nathan Wrigley: Okay. And beyond that, is there any questions that, so let’s imagine that they come back with, yes, we have something specific, it’s WordPress. What would be sort of sensible follow up questions?
[00:31:00] Maciek Palmowski: I mean you can kind of start off about, okay, what exactly you are using? Because there is a limited amount of tools that are really WordPress aware. So if they will answer with kind of a product name, that’s kind of the easy way that then you can check it on your own. But that’s kind of the thing. Is it WordPress aware?
[00:31:19] Nathan Wrigley: Does it worry you in some way that there’s this perception out there that WordPress is insecure? You know, if you ask a thousand people, you’d maybe get 800 saying, oh WordPress, you know, we’re not touching that with a barge pole.
Do you worry that content like this, that you are putting out, that that might fuel that fire? Does it concern you in any way that it might lean into the argument that, I don’t know, somebody can link to that blog post from a rival CMS, or a SaaS platform, which does something similar to WordPress? Where do you sit on that?
[00:31:51] Maciek Palmowski: That’s a really difficult question. And this is one of the questions that when I talk on non WordPress events, I love to ask people. Is WordPress secure? And in most cases, I see that most of the room is, yes, it’s unsecure for sure. And I’m like, no, that’s not true. WordPress is secure. Every year there is just a few minor vulnerabilities in Core. That’s it. The problem is, of course, that WordPress on its own lacks some functionality. That’s why we install plugins.
And here we enter another problem because, okay, every year we have like thousands of those vulnerabilities in general in plugins. On the other hand, we have thousands of plugins. So kind of statistics will always look bad. But that’s why every time when you want to select a new plugin, you need to do some research. Yeah, I know it’s boring and everything but, hey, now we have AI, you can do it much quicker. It can help you a lot.
But looking at all those databases, for example, we have one database, WPScan has. There are those databases of WordPress vulnerabilities that occur to every plugin. And you can see, is the plugin you’re interested in had a lot of vulnerabilities? On the other hand, how it kind of looked historically. It’s not just about the number of them. In general, it requires some research.
And yeah, if we are just like looking at this, and this kind of vibe that right now we have that we are just about really bold opinions stated quickly that will fit one TikTok, yeah, WordPress is in a horrible position because, let’s be honest, it’s like, if you have, I’m not sure how many seconds does a TikTok movie has?
[00:33:39] Nathan Wrigley: I think 30.
[00:33:40] Maciek Palmowski: Okay, let’s say 30. So it will sound much better that you will say, yeah, WordPress is unsecure, which is not entirely true because it depends again. One of the most boring, especially again for those algorithms and everything, it’s a grey zone.
Because we are collaborating with a lot of companies that are making plugins, and we see how their security flow looks like. How they are dealing with vulnerabilies that are discovered. And honestly, I’m amazed how well some of those companies are doing it. They are very serious about it. They understand how important it is. For them it’s something very important.
[00:34:22] Nathan Wrigley: I suppose WordPress is a victim of its own success in that sense. And it would be a bit like, I guess a good analogy might be if you’ve got a car manufacturer and they produce a thousand cars a year and you compare them to Ford who make, let’s say, I don’t know, 20 million a year. And the question is, well, whose cars break down more often?
[00:34:41] Maciek Palmowski: Yeah. Do we look at the percentage of the number?
[00:34:44] Nathan Wrigley: Right. And if you say, well, 400,000 Fords broke down last year, and one of these other manufacturer, you can immediately see why there’s a problem there. And that I think is the landscape in which WordPress is often painted. The reason there’s lots of publications like yours bringing out WordPress information is because it’s the most popular thing. It makes sense to write about the most popular thing and to try to find the vulnerabilities and disclose them in a sensible way. So I don’t know what we do with that. It is just the way it is.
[00:35:15] Maciek Palmowski: I would also say there is one more interesting aspect because WordPress is considered unsecure because of the plugins. But what’s funny, for example, Elementor is also considered unsecure because there are plugins for Elementor. This is a very weird moment when the thing that brought WordPress to its bigger success, security wise, is its biggest problem right now.
Because WordPress did a lot of, I mean it was always great to, being as it’s kind of, let’s call it entry level CMS. For many people, it was also the way how they began the adventure with PHP development because it was so easy. Now we kind of have the, all the consequences of being that easy.
[00:36:06] Nathan Wrigley: Yeah, in a sense, this is going to sound ridiculous, we should be glad that there’s people talking about WordPress vulnerabilities, because it means the project is successful. And it also means that it’s, there’s an industry of WordPress security solutions, and there are people who take this very seriously and dedicate their lives to it. And you may not find that in some of these other ones, you know, some of the smaller CMSs and things like that.
I think we’ve probably hit about the sweet spot for the amount of time. But Maciek, I don’t know if there was anything in that report that you have got lined up in your presentation that I never got to. If there was a particular thread that you wanted to pull. If there is, go for it.
[00:36:46] Maciek Palmowski: No, I think we covered all the important things. And as you kind of said, this AI aspect, this will change so many things.
[00:36:55] Nathan Wrigley: Yeah, we’ll come back in two years and this conversation will be a very different thing.
[00:36:57] Maciek Palmowski: Oh, I think even in few months which will be very interesting. Yeah, so this aspect, it’s really very surprising. And I think that everyone who is right now kind of giving somewhere a talk about AI and security is in a very difficult spot because.
[00:37:14] Nathan Wrigley: Yeah, your content is going to look stale quickly.
[00:37:16] Maciek Palmowski: Yeah because you know it’s like, but a week ago everything changed. Yeah, I have to rewrite everything.
[00:37:20] Nathan Wrigley: Speaking of which, by the time that this goes out, hopefully you have managed to give out your presentation at WordCamp Europe. I will link to it and anything else that we’ve mentioned today in the WP Tavern post. So go and check that out. But I will specifically link to the wordpress.tv version of your presentation, which no doubt will have been created by then. So Maciek, thank you for chatting to me today. Good luck. I hope presentation goes well.
[00:37:43] Maciek Palmowski: Thank you. Thank you so much. Yes. I might need a bit because, you know, it’s WordCamp Europe. It’s a big conference.
[00:37:49] Nathan Wrigley: It is, yeah. Good luck. I hope that you manage to stay calm.
[00:37:52] Maciek Palmowski: Thank you.
On the podcast today we have Maciek Palmowski.
Maciek is based in Poland and works at Patchstack, one of the companies in the WordPress ecosystem dedicated specifically to security. At Patchstack, Maciek collaborates with other security professionals on industry reports, bug bounty programs, and solutions for agencies, product owners, and hosting companies aiming to secure their client sites.
I met up with Maciek at WordCamp Europe in Kraków, and we discussed his presentation there. It examined the claims of “secure hosting” made by many WordPress hosting providers. He describes how Patchstack set out to test these claims with real-world penetration testing, using 30 known plugin vulnerabilities across multiple hosts, employing standardised methodologies, and validating their results independently. The findings are sobering. The majority of WordPress-specific attacks still get through, and there’s a significant gap between the marketing hype and real protection.
The conversation starts with Maciek’s background and how his journey in the WordPress security space led to a focus on the promises made by hosts. From there, the discussion gets into the research approach: the selection of well-known vulnerabilities, consistent testing across different hosting environments, and the surprising result that even hosts with identical security tooling produced drastically different outcomes, showing it’s not just about what tools you use, but how you use them.
We talk about the “Swiss cheese” model of security, every layer will have holes, so you need multiple, overlapping defenses, and honest communication from hosts about their limitations. We also explored whether an industry-wide standard or badge for “secure hosting” is feasible or even desirable, given how easy it is for strong marketing claims to outpace reality.
AI also enters the conversation, increasing both the speed and sophistication of attacks, and making patching and processes even more important, especially as the volume of vulnerabilities continues to rise and the time to exploitation drops.
If you’re interested in understanding what “secure hosting” really means, how to ask intelligent questions of providers, and the realities of WordPress security in 2026, this episode is for you.
Testing the promise: does secure hosting deliver? – Maciek’s presentation at WordCamp Europe 2026. It includes the video of the presentation.
[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.
Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, testing secure WordPress hosting, does the marketing match the reality?
If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.
If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.
So on the podcast today we have Maciek Palmowski. Maciek is based in Poland and works at Patchstack, one of the companies in the WordPress ecosystem dedicated specifically to security. At Patchstack, Maciek collaborates with other security professionals on industry reports, bug bounty programmes, and solutions for agencies, product owners, and hosting companies aiming to secure their client sites.
I met up with Maciek at WordCamp Europe, and we discussed his presentation there. It examined the claims of secure hosting made by many WordPress hosting providers. He describes how Patchstack set out to test these claims with real world penetration testing, using 30 known plugin vulnerabilities across multiple hosts. Employing standardised methodologies and validating their results independently.
The findings are sobering. The majority of WordPress specific attacks still get through, and there’s a significant gap between the marketing hype and real protection.
The conversation starts with Maciek’s background, and how his journey in the WordPress security space led to a focus on the promises made by hosts.
From there, the discussion gets into the research approach, the selection of well-known vulnerabilities, consistent testing across different hosting environments, and the surprising result that even hosts with identical security tooling produce drastically different outcomes, showing it’s not just about the tools you use, but how you use them.
We talk about the Swiss cheese model of security, every layer will have holes, so you need multiple overlapping defences, and honest communication from hosts about their limitations.
We also explored whether an industry-wide standard, or badge, for secure hosting is feasible or even desirable, given how easy it is for strong marketing claims to outpace reality.
AI also enters the conversation, increasing both the speed and sophistication of attacks, and making patching, and processes, even more important, especially as the volume of vulnerabilities continues to rise and the time to exploitation drops.
If you’re interested in understanding what secure hosting really means, how to ask intelligent questions of providers, and the realities of WordPress security in 2026, this episode is for you.
If you’d like to find out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.
And so without further delay, I bring you Maciek Palmowski.
[00:03:56] Maciek Palmowski: I am joined on the podcast by Maciek Palmowski. Hello Maciek.
Perfect. You did great.
[00:04:01] Nathan Wrigley: For some reason, your name has got into my head. A lot of the people that I interview, I struggle with their name, and I continue to struggle, but for some reason, I established many years ago that was how to say your name. And I think I’ve done it correctly ever since then.
[00:04:16] Maciek Palmowski: Yes you did. You’re almost having the typical Polish accent, so you’re doing great.
[00:04:21] Nathan Wrigley: So we are at WordCamp Europe, which is in Krakow, or Krakow, I don’t know how.
[00:04:26] Maciek Palmowski: Krakow.
[00:04:27] Nathan Wrigley: Thank you, that was good. And the reason Maciek is correcting my pronunciation is because Maciek is actually from Poland, which I suppose means that this is a bit of a, well, it’s like a home game to you.
[00:04:37] Maciek Palmowski: In a way so, but it’s also like a bit of a shame because I do like travelling when WordCamp Europe’s are happening. And, you know, just hopping on the train and going to Krakow, it was like a, I mean it’s cool because, yeah, the venue’s amazing, everything is great, but still I’m staying home, so yeah.
[00:04:53] Nathan Wrigley: Yeah, mixed feelings. So Maciek has done, or is going to do a presentation at WordCamp EU. Have you done it yet?
[00:05:02] Maciek Palmowski: I will do it tomorrow.
[00:05:04] Nathan Wrigley: Okay. And are you all set, are you one of these like really prepared people that has all the slides done, or are you last minute?
[00:05:11] Maciek Palmowski: Everything is ready. I already did one version of it at the Checkout Summit in Palermo, so.
[00:05:17] Nathan Wrigley: Oh I see. So you’ve had a sort of dry run of elsewhere.
[00:05:19] Maciek Palmowski: Of course.
[00:05:20] Nathan Wrigley: Excellent. So the presentation, which is going to be the focus of today’s conversation, is called Testing the promise, does secure hosting deliver? And I may as well read the blurb because it was a reasonably short one.
So it says, secure hosting, in quotes, is everywhere in WordPress. What does it actually protect against? We put this claim to the test with real penetration testing. 30 known vulnerabilities, multiple hosting providers, standardised methodology, validated by independent observers. The findings reveal a critical gap between marketing and reality. WordPress specific attacks succeed most of the time. That’s quite an alarming sentence. This talk shares the complete results and explains why generic security fails.
So, we’ll get into that in a moment. But as with all people, when I’m talking to them about security, I guess it’s good to establish who you are, and what your credentials are and what you’ve done, and how is it that you get to talk about security with authority. So over to you really, a little moment to give us your bio and tell us about you.
[00:06:20] Maciek Palmowski: Okay. So I work at Patchstack, and Patchstack is one of those few companies in WordPress space that are doing a lot in terms of security. We are constantly running this bug bounty for the whole ecosystem. We have quite a few solutions for both clients and hosting companies, and I work there right now. My role is, if I remember, the Growth Team Engineer, something like this.
But yeah, I do spend a lot of time working with other security people. So when we are working on all the reports, when we are checking the data, I’m also part of those teams that are working on it. So yeah, I think I know a thing or two about what is happening behind the scenes when it comes to WordPress security.
[00:07:02] Nathan Wrigley: Yeah, thank you. Always good to get that established though, right at the outset.
Patchstack is a company which is not a host though, I suppose that’s important to mention at the beginning. It’s a company which is in the security space, very much in the WordPress space, but perhaps more broad than WordPress, I’m not sure. But not a hosting company.
But obviously your presentation focuses its aim on hosting, I guess because that’s one of the places where the claim about security is most often made. You know, you’ll go to a, the landing page of hosting Company X, and you’ll see somewhere fairly near the top, secure hosting, or something along those lines. And you’ve decided to examine that in fine detail and look at these 30 vulnerabilities.
I guess really just tell us about this test and what it is that you decided to do and some of the items that came out of that.
[00:07:50] Maciek Palmowski: Okay, so maybe let’s start with how it even started, right? Because there was a trigger. At some point we published one report about the state of WordPress security. We tweeted about this. We got the response from none other than Matt Mullenweg, who kind of asked a very interesting question, but isn’t hosting companies taking care of this already?
And this was, kind of at this moment when we were, we thought that we know the answer that, no they aren’t. But to be honest, we didn’t have any broader proof about this.
We knew how it’s working at some hosting companies, but we could say that it was more of an anecdotal evidence that we had. So this was kind of the trigger that made us, okay, let’s check this. But not with one partner or two partners, but with more hosting companies.
So we did this research twice. First we just did kind of a beta run because we weren’t sure about the result and, is it even a good idea to go deeper inside of it? And during our first run, we were already very surprised because like the methodology was very simple. We just installed vulnerable plugins and we checked if we would be able to use the vulnerability. Because if the hosting is claiming that, we got your back, we are making your website secure, we have this and that, this means that they should protect against it. So it was as simple as that.
And when we were doing our first test, we were quite surprised because we saw, if I remember, that 80% of the attacks went through. 80% of the attacks. So our first reaction was, okay, we are doing something wrong. Okay, this was only few hosting companies, less plugins, but still the result were so surprising for us because we thought that, okay, that the problem exists, but it’s not that big of a problem. But it was.
So that’s why we did the second test. And this is about which the, my talk will be mostly when we tested more hosting companies, more plugins. And we saw that the problem still exists.
Of course it was, in some cases 70 few percent. So still, it’s a huge problem, especially if we are talking about some companies that are literally saying, you don’t have to install anything additional when it comes to security on your website. We got your back. They don’t. We found a lot of interesting things, but still the problem exists.
[00:10:21] Nathan Wrigley: So just deep diving into that a little bit, when tests like this are done, there’s obviously, the claim might be levelled, you know, obviously Patchstack would, this kind of maybe benefits Patchstack, if you know what I mean.
So let’s just sort of clear up what the test involved. So presumably the plugins that you chose are ones where it’s publicly known that there’s a vulnerability in this component or this particular file or what have you. So is that the case? This is stuff that, longstanding understanding that there’s a problem here.
[00:10:51] Maciek Palmowski: Yes. We only use the plugins that we had all the proof of concepts. So we know how have the vulnerability happened, what was the attack vector? They were all reported through our bug bounty programme, because that’s why we had the proof of concept. Yeah, and that’s it.
It was, like I said, it was as simple as that. We had a really broad mix of all the plugins. How many? It was 30 something of those plugins, if I remember. Different ones. Some were connected with WooCommerce. So, like a very broad selection of them. Different vulnerability types. So we try to mix it up as much as possible.
[00:11:27] Nathan Wrigley: Was the situation for each hosting company the same though? In other words, was the things that you did in one hosting environment the exact same as you did in another hosting environment? No. You mixed that up a bit as well.
[00:11:38] Maciek Palmowski: I mean we used all the same plugins, like the methodology was always the same. But we got totally different results. Even if, and this was one of the most interesting findings, because very often hostings will put a logo of some company that takes care of security. For example, say, Cloudflare. And despite using the same stack for security, they got different results.
[00:12:02] Nathan Wrigley: Interesting.
[00:12:03] Maciek Palmowski: So it turns out, in many cases, it’s not about the tools that you are using, it’s how you are using them, which was very interesting. And we did everything. We tried to enable every feature, every security features on those hosting, to kind of give them a chance to kind of make sure that they are defending the most as they can.
And the result in most cases was very simple. They were doing quite well with the generic ones like uploads, patch reversal, things like this, which are very generic in PHP. But with those WordPress specific attacks, they just failed miserably.
[00:12:44] Nathan Wrigley: That’s so interesting. The word secure hosting, which you’ll see all over the place, it feels a bit like using the word healthy on food. There’s no real definition of what healthy is. You know, a company selling chocolate could probably pretend that it’s healthy compared to something else.
[00:13:04] Maciek Palmowski: Like here, healthy chocolate is exactly, like in some cases secure hosting.
[00:13:07] Nathan Wrigley: Right. So what do you take from this then? I mean basically, is your survey saying that whenever you see the word secure hosting, be sceptical?
[00:13:16] Maciek Palmowski: Yes.
[00:13:16] Nathan Wrigley: Okay. As simple as that.
[00:13:18] Maciek Palmowski: It’s as simple as that. Because one of the things that we were always promoting, security is not a plugin, it’s not a one button thing. Security is a process. It’s layers.
And that’s kind of why we, especially after this report starting kind of using the term, Swiss cheese layer model. Because every layer will fail in some way. That’s also why you still need all the security solutions that hosting provides, because they do have a lot of interesting solutions against those generic attacks.
Because they’re doing really great when it comes to those generic ones. And that’s great because some of the attacks will be already dealt with. So whatever passes to the second layer, it has less work to do because a lot of it was already stopped at the first layer. The second layer should be something more WordPress specific that understand what is installed. And with this it can catch also a lot of it.
But still, you have to be prepared that, because again, this layer also isn’t perfect. Because there are zero days vulnerabilities, there are custom code, there are a lot of things that can happen, that your website will be hacked. I mean, weak password. Simple as that. That’s why you also need to have a layer, which will be more of what to do if everything else fails. Because you do need to know that you have to inform your clients, all the GDPR related things. How to kind of, I don’t know, use the backups.
In short you need to have procedures. You have to be prepared before the attack happens. Because let’s be honest, asking some lawyers about, what should we send to our clients? The moment when, well, the milk is already spilled. It’s like the worst moment to think about it. Especially that, hey, your website was just hacked. It’s not just a technical problem, it’s also a business problem. Again, with those GDPRs and everything.
So yeah, the more layers, the better. You still need to remember, every layer can fail in some place. That’s why the more, the better.
[00:15:29] Nathan Wrigley: Would you like to see a standard industry-wide definition of something like a badge or, I don’t know, let’s say for example, that you put the word secure hosting on your website, that has to actually stand for something.
Because obviously coming from the background that you do with a broad oversight on what that is, you have a vast amount of data at your disposal. You can see all of this kind of stuff. But every company can make the claim that our food is healthy, our hosting is secure. But I don’t know, in the model that we’ve got where any company can put anything they like on a website, I don’t really know how you do that, but some sort of accreditation or something. I don’t know.
[00:16:08] Maciek Palmowski: Honestly, it’s really difficult because as I said before, a lot of companies using the same tools were failing in different ways. So that’s a problem. On the other hand, like sometimes the, those stupid things like weak passwords. And it doesn’t matter that you had a, let’s call it a certified secure hosting, you still failed because your password was weak, you know? So, also certificates like this can backfire because some people might think I have a secure hosting, I don’t have to worry about things. And then you have 10 admin accounts for everyone.
[00:16:43] Nathan Wrigley: Is there is there something, some mark of that description that you, personally, that you go looking for though? Is there some credentialing system which you think actually does carry some weight? So for example, I don’t know, like the insurance space or the accountancy space or something like that. You have to have that accreditation in order to do business. Is there something like that? Is there a mark which hosting companies can apply for which you could have some confidence in it?
[00:17:13] Maciek Palmowski: Okay. So for sure one of those things would be, and I don’t want to say it as an advertisement, but it is a thing that you see that the hosting is thinking a bit better about security, kind of looking if they are a Patchstack partner. Because this kind of automatically means that they do have this WordPress, the security WordPress layer. So that’s already a good sign.
So yeah, I would start with this. I think that’s kind of one of the simplest ways, but again, Patchstack isn’t the only solution that does it. So looking for partners of such companies might be the best way to start because having those Patchstack aware security solutions built in, into the hosting is a really good sign.
[00:18:05] Nathan Wrigley: Yeah, okay. Now, the inevitable conversation in the year 2026 is AI. It doesn’t matter which area of WordPress you’re talking about. AI manages to get in somewhere. I am presuming that the landscape in terms of security only got more complicated because of AI. Because I’m imagining that attacks that needed to be conceived by a human can now be conceived in a fraction of the time by an AI agent. But not just one, maybe a dozen or a thousand or whatever it may be.
Let’s just talk about that for a moment. It feels almost as if AI and security are like, that’s a real systemic problem for the future of the entire industry. Because these things can happen so fast, a plugin vulnerability is discovered by an AI agent. It then discovers the attack surface, implements the attack all in a matter of seconds, possibly. What’s the position? Like, how do we stay calm basically in the year 2026?
[00:19:09] Maciek Palmowski: So the problem already existed around a year ago, because a year ago when we did our State of WordPress Security Report, we already saw that vulnerabilities are being used after around five hours after kind of being published. So five hours. That’s the first thing, because we still have a lot of people that say, yeah, just update your WordPress weekly and you’re good to go. No, you’re not. Looking at this number, you have five hours.
[00:19:39] Nathan Wrigley: Okay. Let’s just parse that at the moment. So the vulnerability is published. So there’s a whole thing there, like the vulnerability may well have been discovered prior to being published, so that’s a whole other thing.
[00:19:52] Maciek Palmowski: So first the vulnerability is discovered. Then at least how it works on, with our bug bounty. We inform the vendor they have, let’s say around a month to fix it. When they fix it, we publish everything and, yeah.
[00:20:09] Nathan Wrigley: Okay, so from the moment you publish, you can then detect that that is being leveraged within a space of five hours.
[00:20:17] Maciek Palmowski: Yes.
[00:20:17] Nathan Wrigley: Okay, that’s really interesting.
[00:20:19] Maciek Palmowski: But there is a problem. There is a really big problem. So if the vendor doesn’t respond, we still publish it.
[00:20:26] Nathan Wrigley: How long do you give them? Is it like.
[00:20:27] Maciek Palmowski: It is the one month.
[00:20:28] Nathan Wrigley: Okay, thirty days.
[00:20:30] Maciek Palmowski: Of course, if they reach out that there is some problem, they need like extra days. But in most cases, we’re talking about the vendors that just don’t respond at all. We publish it anyway.
But the problem is that, from all the vulnerabilities that were discovered last year, 50% weren’t patched at the moment of publishing about it. 50%.
[00:20:50] Nathan Wrigley: So half of the plugins where there was a known vulnerability, the vendor had been informed, they’d had this 30 day window. Half of them made no amendment to their code.
[00:21:01] Maciek Palmowski: Exactly.
[00:21:02] Nathan Wrigley: Okay. Wow, okay.
[00:21:03] Maciek Palmowski: Again, going back to this classical, yeah, just update your WordPress regularly. No.
[00:21:08] Nathan Wrigley: No, that’s a really different surface, isn’t it?
[00:21:11] Maciek Palmowski: It doesn’t work on so many levels. Because not only the problem is with the fact that, still the famous five hours, which also, it’s five hours now. It was much longer a few years ago. On the other hand, yeah, most of those, I mean around half of it aren’t patched, so the attacks will happen quicker than it get patched. So yeah, there is a lot of problems like this. And also the problem with security is that it’s really difficult to sell.
[00:21:39] Nathan Wrigley: It’s like insurance, isn’t it?
[00:21:40] Maciek Palmowski: Yeah. But insurance, okay, you see your car, your house, it’s real. It’s real, you kind of see it. The only category of websites that it’s much easier to kind of explain is e-commerce.
[00:21:54] Nathan Wrigley: Yes. You can feel the tightening on your wallet.
[00:21:56] Maciek Palmowski: They literally see the money. They can kind of really, okay, one hour of my website not working equals this and this Z?otys or Euros or whatever. So that’s easier to explain. But for most people, yeah, security, meh.
[00:22:11] Nathan Wrigley: Yeah. That’s really interesting. So you mentioned, about this survey, you mentioned that fully 80% of your penetration testing resulted in something. What were the sort of, the high level items? Apart from that 80% figure. What were some of the other, because you said there were a few interesting things that dropped out of it. Can you mention anything else?
[00:22:31] Maciek Palmowski: So like I said, one of the things was that we learned that, despite using the same tools, we got different results. That was also a surprise for us.
[00:22:39] Nathan Wrigley: So let’s just figure that out. So at hosting company A, we’ve got a WordPress website with the same collection of plugins in. Hosting company B, exactly the same as far as you can make it the same, but things are different.
[00:22:52] Maciek Palmowski: No, no, they are, for example, they’re using for security the same tools.
[00:22:56] Nathan Wrigley: Right, okay.
[00:22:57] Maciek Palmowski: So in theory, if they’re using the same tools, we should have exactly the same results.
[00:23:03] Nathan Wrigley: So does that then point to a different set of configurations on the backend, or is it more curious than that? You just don’t quite know what’s going on.
[00:23:12] Maciek Palmowski: I mean because it’s not something that they will tell us. But yeah, in most cases, it’s all about configuration because the fact that you’re using a tool, it’s also important how you use a tool.
Also, with security is very often about, is something easy to use or is something secure? And kind of finding the balance. So some of the companies probably had a bit more aggressive configuration, which is better from the security point of view, but probably more often result in some annoying side effects for the user.
Also what, this was one of the most interesting things, but also what was very interesting because we contacted every company afterwards and we informed them that we did the test. Here are the results, what went through, what was blocked. And some of the companies did an amazing job of fixing whatever they could. On the other hand, we saw that some of the companies, because we did some extra tests later just to check what they did with our report, did nothing.
That’s one of the things about security in general, not about the hosting, about even having vulnerability in your plugin. That’s normal that we make mistakes. We’re humans, right? So that’s normal. What’s important is how we deal with them. If you have a problem and you fix it as quickly as possible, as good as possible, that’s great because you learn from your mistakes, you fix it, and you move on. Perfect. Good job. Now you are in a much better position than before. But if you get this, you look at it and you say, ah, this is fine, that’s the worst behaviour from the security point of view that you can have.
[00:24:57] Nathan Wrigley: I’m going to ask you not to name names here, but were some of the companies familiar to us?
[00:25:05] Maciek Palmowski: For sure, because we did test the biggest ones. But there is a reason why we didn’t want to name them, and it wasn’t about that we were afraid that I know someone will get mad or whatever. It was more about this weird side effect that could happen.
Some users would think, my hosting isn’t on this list, so probably I’m secure. Probably you’re not, you just weren’t in the test. Because we also did some site checks and everything. And we saw that a lot of those problems happen at most of the hosting companies. And like I said, the more important part was how did they reacted after getting the report. Like I said, it was a more common problem that we even thought.
[00:25:43] Nathan Wrigley: Do you, obviously, you know, caveat all of this with the fact that you work for Patchstack and what have you, do you see it even as the role of a hosting company to have any position on security publicly? Or would you prefer them not to make grand claims about things that you believe they can’t necessarily substantiate?
I don’t really know where I’m going with that question, but I’m just wondering if there’s just a sense that the language that’s being used is too strong. You know, secure hosting implies we’ve got all the padlocks, and the padlocks are there and you’ve got nothing to worry about. You’ve found a different picture. So I’m just wondering whether or not you would just prefer that the hosting companies stop talking about this altogether.
[00:26:27] Maciek Palmowski: I do think that’s, one of the biggest problem here is about the claims, the bold claims, the whole marketing around it. Sometimes even you can find documentation of some of them that, yeah, you don’t need to install any third party tool because we got you covered. We checked it, no they didn’t. So that’s kind of the problem.
It’s really more about the, how they market it. If they would say, okay, so we have a really performant hosting that does this, this and this. When it comes to security, kind of do it yourself. I mean we are providing this layer, but the rest is up to you. And that’s okay. That’s an honest claim. We are not doing everything for you. We are doing this part, but this is up to you. This would be much better.
I know that from the marketing point of view, it doesn’t sound as good as, we got all the security that you can imagine, don’t have to worry about this. Because that’s kind of the thing that very often managed hosts trying to sell, that you don’t have to worry about things. You just have to focus on whatever you have, writing content, selling stuff. If you have a e-commerce, whatever, that’s it. That’s kind of the only thing you should think of. Not about performance, because we got your back. Not about security, again, we got your back. And if you are paying for a managed hosting and suddenly they would start having like this different way of messaging to, it’s not that obvious that we have your back in everything. That would be very difficult for them.
So now it’s kind of the problem that, because everyone is kind of using this messaging, everyone else also has to. And also if we think about how a lot of those algorithms, look like that algorithms love bold claims. They want something white or black, not grey. And the truth is, most of the things we are talking about, it doesn’t matter, security, SEO performance, it’s everything in the grey zone. That’s why a lot of developers can end their talk with, yeah, it depends. There is no right or wrong. It depends because there are so many things you have to think about.
I could say that, and this is my kind of thing that, most of the websites that people have should be static. They don’t need even WordPress at all. This is a horrible claim if you’re a manager of a WordPress hosting, right? So that’s the thing. But it all depends on so many things, but yeah, the messaging is important.
[00:29:08] Nathan Wrigley: Yeah, if you were, on a personal level, if you were going out there looking and let’s say, if you can somehow put your job hat to one side, what would be the kind of things that you would be looking for? What questions would you be asking related to security if you were to be going to these companies?
From everything that you said, obviously it’s not black, it’s not white, it’s definitely grey. So every setup has some way of being vulnerable. But what are the kind of intelligent questions that you would be bringing to hosts to get some reassurance that at least they appear to know what they’re doing, even if they can’t make the claim that they’re a hundred percent cast iron, water tight? What might be some intelligent questions to start asking?
[00:29:49] Maciek Palmowski: One of the best questions you can ask is just, is there any solution in your security stack that is WordPress aware? Not the general one. Because if they only start talking about some web firewall, things like this, it’s already kind of a red flag. Because this is, overall, if we’re talking about firewalls, that’s not the correct layer about which, this is the generic one.
So this is the main question. How do you take care of WordPress specific attacks? Simple question. And if they will start responding, yeah, that we have this web application firewall that, in most cases this will be a sign that, no, we are not talking about the correct layer. That’s not it. It’s probably not aware about what is happening in WordPress.
[00:30:40] Nathan Wrigley: Okay. So given that this is a WordPress podcast, and we are at a WordPress event, that would be the beginning of your questioning is demonstrate that something in your stack is specific to WordPress.
[00:30:52] Maciek Palmowski: Exactly.
[00:30:53] Nathan Wrigley: Okay. And beyond that, is there any questions that, so let’s imagine that they come back with, yes, we have something specific, it’s WordPress. What would be sort of sensible follow up questions?
[00:31:00] Maciek Palmowski: I mean you can kind of start off about, okay, what exactly you are using? Because there is a limited amount of tools that are really WordPress aware. So if they will answer with kind of a product name, that’s kind of the easy way that then you can check it on your own. But that’s kind of the thing. Is it WordPress aware?
[00:31:19] Nathan Wrigley: Does it worry you in some way that there’s this perception out there that WordPress is insecure? You know, if you ask a thousand people, you’d maybe get 800 saying, oh WordPress, you know, we’re not touching that with a barge pole.
Do you worry that content like this, that you are putting out, that that might fuel that fire? Does it concern you in any way that it might lean into the argument that, I don’t know, somebody can link to that blog post from a rival CMS, or a SaaS platform, which does something similar to WordPress? Where do you sit on that?
[00:31:51] Maciek Palmowski: That’s a really difficult question. And this is one of the questions that when I talk on non WordPress events, I love to ask people. Is WordPress secure? And in most cases, I see that most of the room is, yes, it’s unsecure for sure. And I’m like, no, that’s not true. WordPress is secure. Every year there is just a few minor vulnerabilities in Core. That’s it. The problem is, of course, that WordPress on its own lacks some functionality. That’s why we install plugins.
And here we enter another problem because, okay, every year we have like thousands of those vulnerabilities in general in plugins. On the other hand, we have thousands of plugins. So kind of statistics will always look bad. But that’s why every time when you want to select a new plugin, you need to do some research. Yeah, I know it’s boring and everything but, hey, now we have AI, you can do it much quicker. It can help you a lot.
But looking at all those databases, for example, we have one database, WPScan has. There are those databases of WordPress vulnerabilities that occur to every plugin. And you can see, is the plugin you’re interested in had a lot of vulnerabilities? On the other hand, how it kind of looked historically. It’s not just about the number of them. In general, it requires some research.
And yeah, if we are just like looking at this, and this kind of vibe that right now we have that we are just about really bold opinions stated quickly that will fit one TikTok, yeah, WordPress is in a horrible position because, let’s be honest, it’s like, if you have, I’m not sure how many seconds does a TikTok movie has?
[00:33:39] Nathan Wrigley: I think 30.
[00:33:40] Maciek Palmowski: Okay, let’s say 30. So it will sound much better that you will say, yeah, WordPress is unsecure, which is not entirely true because it depends again. One of the most boring, especially again for those algorithms and everything, it’s a grey zone.
Because we are collaborating with a lot of companies that are making plugins, and we see how their security flow looks like. How they are dealing with vulnerabilies that are discovered. And honestly, I’m amazed how well some of those companies are doing it. They are very serious about it. They understand how important it is. For them it’s something very important.
[00:34:22] Nathan Wrigley: I suppose WordPress is a victim of its own success in that sense. And it would be a bit like, I guess a good analogy might be if you’ve got a car manufacturer and they produce a thousand cars a year and you compare them to Ford who make, let’s say, I don’t know, 20 million a year. And the question is, well, whose cars break down more often?
[00:34:41] Maciek Palmowski: Yeah. Do we look at the percentage of the number?
[00:34:44] Nathan Wrigley: Right. And if you say, well, 400,000 Fords broke down last year, and one of these other manufacturer, you can immediately see why there’s a problem there. And that I think is the landscape in which WordPress is often painted. The reason there’s lots of publications like yours bringing out WordPress information is because it’s the most popular thing. It makes sense to write about the most popular thing and to try to find the vulnerabilities and disclose them in a sensible way. So I don’t know what we do with that. It is just the way it is.
[00:35:15] Maciek Palmowski: I would also say there is one more interesting aspect because WordPress is considered unsecure because of the plugins. But what’s funny, for example, Elementor is also considered unsecure because there are plugins for Elementor. This is a very weird moment when the thing that brought WordPress to its bigger success, security wise, is its biggest problem right now.
Because WordPress did a lot of, I mean it was always great to, being as it’s kind of, let’s call it entry level CMS. For many people, it was also the way how they began the adventure with PHP development because it was so easy. Now we kind of have the, all the consequences of being that easy.
[00:36:06] Nathan Wrigley: Yeah, in a sense, this is going to sound ridiculous, we should be glad that there’s people talking about WordPress vulnerabilities, because it means the project is successful. And it also means that it’s, there’s an industry of WordPress security solutions, and there are people who take this very seriously and dedicate their lives to it. And you may not find that in some of these other ones, you know, some of the smaller CMSs and things like that.
I think we’ve probably hit about the sweet spot for the amount of time. But Maciek, I don’t know if there was anything in that report that you have got lined up in your presentation that I never got to. If there was a particular thread that you wanted to pull. If there is, go for it.
[00:36:46] Maciek Palmowski: No, I think we covered all the important things. And as you kind of said, this AI aspect, this will change so many things.
[00:36:55] Nathan Wrigley: Yeah, we’ll come back in two years and this conversation will be a very different thing.
[00:36:57] Maciek Palmowski: Oh, I think even in few months which will be very interesting. Yeah, so this aspect, it’s really very surprising. And I think that everyone who is right now kind of giving somewhere a talk about AI and security is in a very difficult spot because.
[00:37:14] Nathan Wrigley: Yeah, your content is going to look stale quickly.
[00:37:16] Maciek Palmowski: Yeah because you know it’s like, but a week ago everything changed. Yeah, I have to rewrite everything.
[00:37:20] Nathan Wrigley: Speaking of which, by the time that this goes out, hopefully you have managed to give out your presentation at WordCamp Europe. I will link to it and anything else that we’ve mentioned today in the WP Tavern post. So go and check that out. But I will specifically link to the wordpress.tv version of your presentation, which no doubt will have been created by then. So Maciek, thank you for chatting to me today. Good luck. I hope presentation goes well.
[00:37:43] Maciek Palmowski: Thank you. Thank you so much. Yes. I might need a bit because, you know, it’s WordCamp Europe. It’s a big conference.
[00:37:49] Nathan Wrigley: It is, yeah. Good luck. I hope that you manage to stay calm.
[00:37:52] Maciek Palmowski: Thank you.
On the podcast today we have Maciek Palmowski.
Maciek is based in Poland and works at Patchstack, one of the companies in the WordPress ecosystem dedicated specifically to security. At Patchstack, Maciek collaborates with other security professionals on industry reports, bug bounty programs, and solutions for agencies, product owners, and hosting companies aiming to secure their client sites.
I met up with Maciek at WordCamp Europe in Kraków, and we discussed his presentation there. It examined the claims of “secure hosting” made by many WordPress hosting providers. He describes how Patchstack set out to test these claims with real-world penetration testing, using 30 known plugin vulnerabilities across multiple hosts, employing standardised methodologies, and validating their results independently. The findings are sobering. The majority of WordPress-specific attacks still get through, and there’s a significant gap between the marketing hype and real protection.
The conversation starts with Maciek’s background and how his journey in the WordPress security space led to a focus on the promises made by hosts. From there, the discussion gets into the research approach: the selection of well-known vulnerabilities, consistent testing across different hosting environments, and the surprising result that even hosts with identical security tooling produced drastically different outcomes, showing it’s not just about what tools you use, but how you use them.
We talk about the “Swiss cheese” model of security, every layer will have holes, so you need multiple, overlapping defenses, and honest communication from hosts about their limitations. We also explored whether an industry-wide standard or badge for “secure hosting” is feasible or even desirable, given how easy it is for strong marketing claims to outpace reality.
AI also enters the conversation, increasing both the speed and sophistication of attacks, and making patching and processes even more important, especially as the volume of vulnerabilities continues to rise and the time to exploitation drops.
If you’re interested in understanding what “secure hosting” really means, how to ask intelligent questions of providers, and the realities of WordPress security in 2026, this episode is for you.
Testing the promise: does secure hosting deliver? – Maciek’s presentation at WordCamp Europe 2026. It includes the video of the presentation.
[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.
Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, building trust and collaboration in the hosting industry with the Secure Hosting Alliance.
If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.
If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you, and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.
So on the podcast today, we have David Snead. David has been involved in the hosting industry since 1999, starting out as legal counsel for one of the earliest shared hosting companies, and going on to work with over 50 others. He helped found the i2Coalition, serve as in-house counsel for cPanel and WebPros, and now leads the Secure Hosting Alliance.
If you’re listening to this podcast, I’m sure that many of you will have worked closely with hosting companies. Perhaps you run an agency, or business, that depends on the reliability, ethics, and security of hosting providers. David is here to talk about cross-industry collaboration in the hosting world, specifically around improving security, professionalism, and communication between hosts.
The conversation focused on why, and how, the Internet Infrastructure Forum, or IIF, is building a framework for real-time intelligence sharing and abuse reporting, aiming to help the entire ecosystem detect and prevent attacks faster than adversaries can adapt.
David talks about the challenges hosting companies face, especially smaller ones, in keeping up with security, and how this evolving project hopes to ease this by sharing actionable, non-proprietary abuse information across registrars, hosting providers, DNS services, and more.
He discusses the growth of both the Secure Hosting Alliance and the IIF, the business case for collaboration, and the nuances of legal and technical information sharing across borders.
If you’re in hosting, run a web agency, or just want to know how the backbone of the web is working to stay more secure and connected, this episode is for you.
If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.
And so, without further delay, I bring you David Snead.
I am joined on the podcast by David Snead. Hello David.
[00:03:20] David Snead: Hello.
[00:03:21] Nathan Wrigley: Very nice to have you with us. David’s got a really interesting background, and a really interesting, I’m going to use the word project. I don’t know if that’s the right word. It feels like it’s got more solidity and it’s got a lot more history than that. It’s something which is, I think going, but we’ll find out a little bit more about it. It’s all about the hosting industry and trying to get hosts to, I guess communicate with each other in ways going forwards.
[00:03:44] David Snead: That is a part of it. There are really two goals and one is to level up the ethics and professionalism in the hosting industry. And the second is to facilitate more comradery and interaction among hosts. Something that folks felt occurred in the early 2000s, and with all the consolidation that occurred went away. And so that’s something that we’re also trying to facilitate.
[00:04:16] Nathan Wrigley: Okay. So given that we’re going to be talking about hosting, I guess it’s a good idea to paint your credentials and find out a little bit more about you. So a short opportunity to just tell us a little about you and your background in WordPress and hosting specifically, I suppose.
[00:04:29] David Snead: Sure. So I have been working in the hosting industry since 1999. As I often say, I was working in the hosting industry when hosting was cool. It is not so cool anymore. In fact most people don’t really pay attention to it.
You know, and I started as a lawyer for a hosting company, and I was in-house counsel for a company that actually owned a hosting company and was one of the earliest hosting companies that specialised in shared hosting. And so I was their general counsel. And for some reason it stuck, and I’ve just kind of turned it into a career.
So after that I had a private practise as a lawyer and I worked with probably 50 different hosting companies, mostly writing policies that nobody ever reads, which makes me super fun at parties.
And then from there, my friend Christian Dawson and I formed the i2Coalition as a response to some legislation in the US that would’ve been kind of the death nail for internet providers. So we started the i2Coalition. I then went in-house for cPanel and worked at cPanel and WebPros for 10 years, and then started the Secure Hosting Alliance.
[00:05:52] Nathan Wrigley: Okay. So you’ve got all all the history. That’s pretty good. You know, if we’re going to talk about hosting.
[00:05:57] David Snead: All the hosting history in one person. That’s kind of a very scary idea, no?
[00:06:02] Nathan Wrigley: But that’s excellent. So do you still offer counsel? Is that still, so you haven’t sort of sidestepped and do half of the week on a sort of more technical basis? It’s still the legal side that you’re involved in.
[00:06:13] David Snead: I do. Right now I’m doing mostly M&A work for, it’s weird. So I don’t know if anybody has ever said this to you before, but web hosting is kind of like the Hotel California. It’s like, once you start in the web hosting industry, you never leave. And so I have all these clients from 15 years ago who are now running like little baby hosts, and they’re talking to bigger hosts and they want to get acquired. So I’m doing some of that now. I am not writing any of the policies that nobody ever reads because that was just, I did that for too long.
[00:06:51] Nathan Wrigley: There were too many moments parties.
[00:06:53] David Snead: Yes, exactly. Yeah.
[00:06:55] Nathan Wrigley: Okay, so I’m going to read into the record the title and the blurb that went with the presentation that you are doing or done.
[00:07:02] David Snead: I did it yesterday.
[00:07:03] Nathan Wrigley: Okay, we’ll get into that in a moment. So the title is coordinating the fight, cross industry collaboration, and the blurb goes as follows. WordPress hosting threats cross company lines. When one provider falls victim, the entire ecosystem suffers. This session explores how the Internet Infrastructure Forum, or IFF, enables hosting providers, registrars and registries to coordinate abuse response through real time intelligence sharing. Learn how operational collaboration helps responsible operators detect and stop attacks faster than adversaries can adapt. And why working together produces results no single provider could achieve alone.
When I read that, immediately was, yeah, that’s a really sensible idea. Why are we separately, as hosting companies, I say we, I mean the hosting companies. Why are they all trying to do the same work over and over again, separately? When presumably this aspect of the work, the security bit is something they all have in common.
[00:08:05] David Snead: Right? So that’s the fundamental question, right? So the IIF is a voluntary organisation that is made up of everyone in the infrastructure stack. So from registrars, registries, DNS providers, hosting providers, cloud providers, everyone in the stack. So it is facilitated by the Internet and Jurisdiction Foundation. They’re based in Paris, and they’re the actually the secretariat for it.
And what it’s designed to do is create a common way for everyone who’s in the infrastructure stack to share information about abuse and abuse issues. And it’s one of the fundamental problems that you referred to is everybody is operating in a silo, right? And that’s mostly because that’s the way the internet is architected, right?
So the internet is architected, so it’s distributed, right? Registrars and registries basically do their own thing with domain names. They might have a small hosting component or maybe a cloud component, but by and large, all they do is domain names.
Hosting providers probably resell domain names, but they’re not part of that industry. And so how do they all coordinate? And that’s what the IIF is trying to facilitate, is more information sharing among the participants.
[00:09:39] Nathan Wrigley: Well I imagine some of the hosting companies are probably fairly good. You know, they’ve got a giant customer base. Let’s imagine hosting company X over there, they’ve got millions of customers. They’ve got a huge budget that they can put over to, let’s say, security things. Well that’s all well and good, brilliant. But then there are other companies who are much scrappier. You know, they maybe have only a few thousand customers. And so their budget for the exact same work is going to be reduced.
How will this work? Is it going to be like a subscription service basically? Will you have a membership, which is in some way equal to the number of clients that you’ve got? Will there be some expectation that, okay, we’ll look at your revenue, your membership will be equivalent to a percentage of your revenue? How will that all work?
[00:10:20] David Snead: We don’t know. This is a very early stage project. Right now we are in a prototype phase where we have just figured out what information folks should submit to the secretariat.
So the way it works is, you submit the information that you collect for a particular abuse issue to the secretariat, who then enriches it with all the other information that’s been submitted and sends it to the right person.
So a great example is, let’s say a registrar reported a phishing domain. They turn off the phishing domain and they have maybe a timestamp, an IP address where it was submitted from. They submit that to the secretariat, who then finds the hosting company who is providing the services for the hosting and says, this came in about this particular site. Can you take action on that? So that’s the way it works.
Right now it’s very early stage. It’s in the first phase of a test, and we’re going to look at whether the way we’ve architected it, or the way the group has architected it, actually makes sense.
[00:11:39] Nathan Wrigley: Is this going to be then a sort of slow on ramp whereby you bring a few companies in at the beginning, hopefully. And then one or two more and iron out the wrinkles, and then some more and some more? Because I imagine, if you just threw the switch, everybody’s in, a lot could go wrong at that point. And I’m guessing there’s going to be more of a slow on ramp.
[00:12:00] David Snead: So you’ve pointed out my particular frustration with the IIF, and the reason that the secretariat is moving slowly, right? So fortunately, or unfortunately, based on my cultural background, I’m just sitting here going, this needs to move faster. We need to have everybody involved, we need to have all the hosts involved, we need to have all the registrars and registries. And other folks who are a little bit more skilled in this type of work say, no, we need to figure out what we’re doing and that requires a small number of people.
The phase that we’re in right now is looking for more folks who are interested in sitting at the table and being part of the discussion. Particularly in the hosting industry and in the web design and marketing industry. Those are folks who don’t generally participate in these kind of industry led collaboration exercises. And that’s the reason that I’m at WordCamp, is to talk to web designers, marketing agencies about why they should participate in something like this.
[00:13:13] Nathan Wrigley: So this really isn’t bound in any way to WordPress, is it? It just so happens that WordPress has a significant chunk of the internet, so this is a good place to start. But if you happen to be a, I don’t know, Drupal user, or you’re just into writing PHP code or whatever it may be, this is still applicable. There’s no real WordPress layer to this. This is just a good place for you to come because, well, there’s probably, what, 30 hosts, 100 yards away from us out there.
[00:13:37] David Snead: I know. And I haven’t seen all of them yet.
[00:13:39] Nathan Wrigley: Yeah, there’s work to do. But agnostic to any platform, basically.
[00:13:42] David Snead: It is completely platform agnostic, yeah.
[00:13:43] Nathan Wrigley: Okay. Okay, that’s interesting. But WordPress is a, is certainly a good place to start.
Now, I’m imagining, if I was a hosting company and I was the chief executive, I definitely have some questions for you in terms of, okay, we’re going to share our valuable intel with you, what are you going to do with that? How can we trust you? How do we know that the sharing is going to be done effectively and what have you?
So I guess really what I’m getting to is, what is the assurances or checks and balances that you, in the end, will hope to offer the host? That you can assure them that, look, if you hand us this body of work, you don’t need to think about it again. You can trust us to do it honourably, effectively, collaboratively. You get where going.
[00:14:26] David Snead: Yeah, yeah. And I suspect that you wanted to be a lawyer at some time, because that’s one of the issues that we’re facing. Information that can be shared freely, as an example, in the United States, might not be capable of being shared so freely in the European Union, or in Brazil, or in India or someplace like that.
So one of the things that’s being done, not by me, but by another group, another working group that’s part of this, is analysing the legal issues around information sharing.
The information that’s being shared, to answer the proprietary and confidentiality question, is not proprietary or confidential information. So it’s things like timestamps, domain names, IP addresses for the initial abuse submission. Things like that that really don’t indicate some sort of company confidential information. And it’s further abstracted into xarf, which is a language that’s used for abuse reporting, that we all can share. And so I think that the only thing that would be of concern is whether that information is personal information that’s subject to jurisdictional restrictions around the world.
[00:15:48] Nathan Wrigley: Would the idea be that this organisation would do the remedial work? So is there any notion that, let’s say for example, some sort of security problem was discovered by hosting company A over there, and they share that intel with you. Maybe the question is kind of asking, will you then appoint people to figure out what the patch is for that? Or is your idea just to, oh, red flag, we’ve got this problem, now you all know about it. Is it just information sharing as opposed to fixes?
[00:16:17] David Snead: Yeah, it’s the latter. So the thing that we’re solving for right now, so there’s just one issue that, one abuse issue, that we’re testing out and it’s issues related to fake shops. And so the fake shop issue is the test abuse issue for the project, and where folks are sharing information. It’s a particular problem right now with credentials harvesting. And so that’s what we’re trying to look at.
[00:16:43] Nathan Wrigley: And how has the conversations that you’ve had thus far, how have they gone? Has this been warmly received or are you facing a little bit of pushback?
[00:16:50] David Snead: So, look, I’ll be very direct with you. If something isn’t just an immediate threat to them, it’s very difficult to conceptualise why you should participate. And I am pretty used to answering that question simply based on the political work that I do with the i2Coalition. But once you talk about, so let’s use fake shops as an example. Fake shops, and you’re providing services to fake shops, actually has an impact on your bottom line.
So if you are providing, let’s say, payment processing to an entity that is running a fake shop, it very easily can make your credit card processing charges higher. It ends up eating bandwidth. It will tax your abuse resources.
One of the things that you referred to initially is, you know, larger hosts have a lot of money. I wouldn’t say they have a lot of money, but they have more bandwidth to handle a vast fire hose of abuse issues. Most smaller hosting companies might only get five or six abuse issues in a month. But if you have a fake shop, that’s going to generate a huge amount of abuse, and it’s taking away resources that you can use to actually grow your business. So that argument actually is relatively persuasive in getting folks to pay attention.
I find that the business argument around abuse is a much more compelling discussion than kind of moral persuasion. I don’t think moral persuasion works in the context of a community that is trying very hard just to keep their heads above water.
[00:18:42] Nathan Wrigley: It feels to me from what you’ve just said, and I could be reading too much between the lines, but it feels to me as if a good target audience would be smaller hosts to begin with, simply because they’re probably going to be more receptive because they have less bandwidth themselves. And so would welcome anything that can make the burden of sharing this information easier. So 10 of the small hosts combined is, well, it’s much bigger than each of them individually would be, whereas I suppose you’ll have to get a critical mass of them on board until maybe some of the bigger hosts start to look at you with favourable eyes, let’s say that.
[00:19:15] David Snead: Well, so we have some pretty large hosting companies who are participating. So as an example, both GoDaddy and Newfold are participating. But we also have smaller hosts. But I agree with you, the information that’s being provided, particularly since it is actionable, realistic information that can be adapted for bespoke systems, is invaluable, right?
So if you only get five or six abuse complaints and you get an abuse complaint, and you can go to the secretariat and say, we got a complaint about this domain, and the secretariat says, here’s what the registrar did. Here’s what Cloudflare did. Here’s the information they provided us. And you can use that to make a decision on how to address that problem. It saved you hours and hours and hours of research time.
[00:20:09] Nathan Wrigley: Technically speaking, what would the conduit of information both toward you and away from you look like? So if I’m hosting company X, how are you imagining that I will supply you with that information? But also, if I’m just looking for information from you on a daily, weekly basis, whatever it may be, how do I receive that? Is this like a, I don’t know, a website or an API or?
[00:20:33] David Snead: It’s an API. So it’s a file. It’s just a general file download.
[00:20:37] Nathan Wrigley: Right, okay. So it’s readily available 24/7?
[00:20:40] David Snead: Right. That’s the goal. Right now it’s not, but the goal is to kind of figure out a way to make something like that possible.
[00:20:47] Nathan Wrigley: Yeah, okay. I also suppose that the hosting companies, whilst this is good for their business if they can minimise costs and hand a lot of this work over to you, there’s a part of them which would also probably like to put some sort of badge on their website to say, this is what we’re doing. We’re part of this alliance, for want of a better word. Is that something that you are looking to develop as well, you know, some sort of credentialing system to demonstrate that you’re in this?
[00:21:12] David Snead: So that’s not something that the IIF is working on. It’s something that the Secure Hosting Alliance does. The Secure Hosting Alliance has a trust seal that we give to hosts who fulfil our Trust Seal Certification provisions. But that’s not something that the IIF does.
Talking about like why, other than business reasons, folks should participate in this, one of the things that is going on that I would suggest that most hosts know about, is there’s a little bit of a moral panic going on in the world about what contents you have. And regulation is actually a very real thing for the hosting industry, who has not ever been regulated. This is the time where you can say, hey, this is what we’re doing, right? We’re dealing with issues. This way a trust seal is the same thing, right? It’s something that you can say, we are actually taking steps to make the internet a better place.
[00:22:18] Nathan Wrigley: I think if you are a general agency owner or, I don’t know, just a freelancer, hosting is one of those things that you, once you’ve done it once, you’re in it for the long haul until something goes wrong. But you’re also browsing around for any tiny indication of why is this host slightly different? You know, what is it that they’re doing that, I don’t know, is faster? What is it that they’re doing that’s more secure? So it feels to me if you had a credentialing system and I began to hear about it and see it pop up again and again, it would be one of the metrics which I would weigh up when looking at hosting.
[00:22:51] David Snead: I would think so. One of the things that a trust seal does is it indicates that there’s been some vetting of the host. That someone has determined the things that are important to the hosting industry and are important to the web design industry. The agency industry are also important to the host.
Great example of that is one of the provisions of the Secure Hosting Alliances’ Trust Seal Certification is that a contract is presented to the customer before they sign up, which is super customer friendly.
One of the things as a lawyer that you hear about all the time when people are dissatisfied with their services is, yeah, well, I never saw that contract. Or it was just a hyperlink in an email that I got. That’s one of the differentiators for a Trust Seal certified host is that the contract is actually presented to them, to the customer beforehand.
[00:23:57] Nathan Wrigley: So in terms of the WordPress crowd, is this a thing that you are pitching only to hosts? Like when you step out of here, are you trying to have conversations only with hosts? Or is there some bit of the WordPress community, the freelance, the agency owners? Are you trying to communicate with them just to scope out what they need?
[00:24:15] David Snead: So for both the Secure Hosting Alliance and for the IIF, it is that. I really enjoy talking to agencies and developers about whether this is important to them, or why it might be important to them.
[00:24:31] Nathan Wrigley: In terms of how long this project’s been going, I’ve only heard of it because of your participation here, but I don’t know if you’ve been banging this gong for a decade or, I mean you’ve been in the industry for long enough to have been banging it for decades. Is this a new initiative or is this something which has a long and storied history?
[00:24:49] David Snead: So the Secure Hosting Alliance has only been active for a year, a little bit over a year. I’ve been talking about abuse for a long time, but the Secure Hosting Alliance has only been around for a year.
[00:25:01] Nathan Wrigley: And have you, in that year, got any intuitions that you’ll be here for another year? Is it basically going in the right direction?
[00:25:09] David Snead: It is going in the right direction. So we started out with two or three charter members. We now have 25 hosting members. We have three security vendors who are members as well. We have, I think, 17 Trust Seal Certified members, and we’re launching in 2027 a trust seal for security vendors who provide services to hosting companies.
[00:25:40] Nathan Wrigley: I know that several owners of hosting companies listen to this podcast. They may very well be the people that you’ve spoken to already, but if they are not, and they are people who would like to investigate this further, I suppose the thing that’s going to be in their head is, okay, Nathan and David, you’ve explained what I’ll get out of it, what do I need to put into it? So is this an annual financial commitment? How does it all work from that point of view?
[00:26:02] David Snead: Yeah, so you become a member of the i2Coalition. And so the Secure Hosting Alliance is a working group of the i2Coalition. So you would be a general member and you would participate in the Secure Hosting Alliances’ working groups. You also have the ability to participate in the i2Coalition as a whole, which is a much larger trade association that represents almost everyone in the internet infrastructure vertical. Mostly doing policy work, primarily in the US and the EU. Although there’s, we’re doing some work in India right now as well.
[00:26:40] Nathan Wrigley: And does membership allow you to steer the future of the project? I know that lots of chefs in the kitchen results in terrible food, but that, I fear, is something that could happen. You’ve got 87 members, 260 members. And then the 260 members all start to bicker and, you know, we want this, no. You see how it goes.
[00:26:59] David Snead: I do.
[00:26:59] Nathan Wrigley: What’s the position there? You know, is there sort of gated levels of membership? How are you organising all of that?
[00:27:04] David Snead: There are not. The membership is based on self-reported revenue. The membership is not horrifically expensive from my perspective. And I think that that, most of our members would say that it is, it’s actually relatively affordable, particularly for the small to medium sized hosts. And registrars or design agencies, anyone who’s participating.
The question about, who’s running the show, comes up quite a bit. We haven’t really faced that issue, particularly in the Secure Hosting Alliance. Folks seem to get along. But the organisation runs on the idea of rough consensus. And so decisions end up not being controlled by one member or not. Some of the i2Coalition has some very large companies who everybody knows about, who get along with startups, and folks against whom they compete directly. And policies still get made. The organisation still moves forward.
[00:28:11] Nathan Wrigley: Yeah, I guess you’re in a space where, obviously all of these hosting companies commercially are vying for everybody else’s business. But in this particular situation, that is not the case. Nobody’s vying for their websites to be less secure. They all want the same level of security. So at least in that sense, you would hope that consensus could be maintained even if, commercially, the two companies that are in the room, the 10 companies that are in the room might be commercially at loggerheads with each other. At least on this they could agree. That would be the hope, I suppose, anyway.
[00:28:47] David Snead: It seems to be, not only the hope, but the actual way that things work. You ask about how compromise is reached. What comes to mind is I have a much different concept of privacy than, particularly when I was at WebPros, than other folks in the i2Coalition had. And another company just called me up and we worked through our disagreements about how privacy should be handled within the i2Coalition and were able to move forward.
The industry I’ve found to be hugely collaborative, particularly the hosting industry. Everybody knows what their competitor is doing. But when it comes to addressing an issue like, how are we going to deal with abuse as a community? Folks come together. CEOs of hosting companies while they compete tend to be relatively good friends.
As I said at the very beginning, it really is like the Hotel California, right? You come in as a CEO of a hosting company, you grow it and you sell it to another company. All of a sudden you’re at the bottom again with a server in your grandma’s basement, you know, trying to start again.
[00:30:08] Nathan Wrigley: It’s a really curious effort. I suppose really at the bottom of this entire podcast is your endeavour to be heard and to reach out and get some conversations going. So with that in mind, where do people find the information about this? So maybe there’s a website that we could mention. But also, is there a specific place where you hang out? Is there a place where you would like to be contacted most?
[00:30:33] David Snead: Sure. So our website is hostingsecurity.net. I’m not too afraid of getting too much spam. So folks can email me at snead@i2coalition.com And the two is the numeral two. So it’s snead@i2coalition.com. And I’m happy to answer questions.
In terms of hanging out, I am at most industry conferences in the hosting industry. In the WordPress industry, I’ll be at WordCamp US. We also participate very heavily in ICANN. So there is an i2Coalition member at every single ICANN meeting.
[00:31:12] Nathan Wrigley: So if you go to wptavern.com and you search for the episode with David Snead, S-N-E-A-D, you’ll be able to find those details. I’ll put everything into the show notes. So anything that I missed? Was there a particular focus that we didn’t touch?
[00:31:26] David Snead: No, this is actually one of the most thorough podcasts I’ve been on recently.
[00:31:31] Nathan Wrigley: That’s love to hear it. Well, David Snead, thank you very much for joining me today.
[00:31:35] David Snead: Glad to be here. Thanks for having me.
On the podcast today we have David Snead.
David has been involved in the hosting industry since 1999, starting out as legal counsel for one of the earliest shared hosting companies and going on to work with over 50 others. He helped found the i2Coalition, serve as in-house counsel for cPanel and WebPros, and now leads the Secure Hosting Alliance.
If you’re listening to this podcast, I’m sure that many of you will have worked closely with hosting companies. Perhaps you run an agency or business that depends on the reliability, ethics, and security of hosting providers. David is here to talk about cross-industry collaboration in the hosting world, specifically around improving security, professionalism, and communication between hosts.
The conversation focused on why and how the Internet Infrastructure Forum (IIF) is building a framework for real-time intelligence sharing and abuse reporting, aiming to help the entire ecosystem detect and prevent attacks faster than adversaries can adapt.
David talks about the challenges hosting companies face, especially smaller ones, in keeping up with security, and how this evolving project hopes to ease this by sharing actionable, non-proprietary abuse information across registrars, hosting providers, DNS services, and more. He discusses the growth of both the Secure Hosting Alliance and the IIF, the business case for collaboration, and the nuances of legal and technical information sharing across borders.
If you’re in hosting, run a web agency, or just want to know how the backbone of the web is working to stay more secure and connected, this episode is for you.
[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.
Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, building trust and collaboration in the hosting industry with the Secure Hosting Alliance.
If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.
If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you, and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.
So on the podcast today, we have David Snead. David has been involved in the hosting industry since 1999, starting out as legal counsel for one of the earliest shared hosting companies, and going on to work with over 50 others. He helped found the i2Coalition, serve as in-house counsel for cPanel and WebPros, and now leads the Secure Hosting Alliance.
If you’re listening to this podcast, I’m sure that many of you will have worked closely with hosting companies. Perhaps you run an agency, or business, that depends on the reliability, ethics, and security of hosting providers. David is here to talk about cross-industry collaboration in the hosting world, specifically around improving security, professionalism, and communication between hosts.
The conversation focused on why, and how, the Internet Infrastructure Forum, or IIF, is building a framework for real-time intelligence sharing and abuse reporting, aiming to help the entire ecosystem detect and prevent attacks faster than adversaries can adapt.
David talks about the challenges hosting companies face, especially smaller ones, in keeping up with security, and how this evolving project hopes to ease this by sharing actionable, non-proprietary abuse information across registrars, hosting providers, DNS services, and more.
He discusses the growth of both the Secure Hosting Alliance and the IIF, the business case for collaboration, and the nuances of legal and technical information sharing across borders.
If you’re in hosting, run a web agency, or just want to know how the backbone of the web is working to stay more secure and connected, this episode is for you.
If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.
And so, without further delay, I bring you David Snead.
I am joined on the podcast by David Snead. Hello David.
[00:03:20] David Snead: Hello.
[00:03:21] Nathan Wrigley: Very nice to have you with us. David’s got a really interesting background, and a really interesting, I’m going to use the word project. I don’t know if that’s the right word. It feels like it’s got more solidity and it’s got a lot more history than that. It’s something which is, I think going, but we’ll find out a little bit more about it. It’s all about the hosting industry and trying to get hosts to, I guess communicate with each other in ways going forwards.
[00:03:44] David Snead: That is a part of it. There are really two goals and one is to level up the ethics and professionalism in the hosting industry. And the second is to facilitate more comradery and interaction among hosts. Something that folks felt occurred in the early 2000s, and with all the consolidation that occurred went away. And so that’s something that we’re also trying to facilitate.
[00:04:16] Nathan Wrigley: Okay. So given that we’re going to be talking about hosting, I guess it’s a good idea to paint your credentials and find out a little bit more about you. So a short opportunity to just tell us a little about you and your background in WordPress and hosting specifically, I suppose.
[00:04:29] David Snead: Sure. So I have been working in the hosting industry since 1999. As I often say, I was working in the hosting industry when hosting was cool. It is not so cool anymore. In fact most people don’t really pay attention to it.
You know, and I started as a lawyer for a hosting company, and I was in-house counsel for a company that actually owned a hosting company and was one of the earliest hosting companies that specialised in shared hosting. And so I was their general counsel. And for some reason it stuck, and I’ve just kind of turned it into a career.
So after that I had a private practise as a lawyer and I worked with probably 50 different hosting companies, mostly writing policies that nobody ever reads, which makes me super fun at parties.
And then from there, my friend Christian Dawson and I formed the i2Coalition as a response to some legislation in the US that would’ve been kind of the death nail for internet providers. So we started the i2Coalition. I then went in-house for cPanel and worked at cPanel and WebPros for 10 years, and then started the Secure Hosting Alliance.
[00:05:52] Nathan Wrigley: Okay. So you’ve got all all the history. That’s pretty good. You know, if we’re going to talk about hosting.
[00:05:57] David Snead: All the hosting history in one person. That’s kind of a very scary idea, no?
[00:06:02] Nathan Wrigley: But that’s excellent. So do you still offer counsel? Is that still, so you haven’t sort of sidestepped and do half of the week on a sort of more technical basis? It’s still the legal side that you’re involved in.
[00:06:13] David Snead: I do. Right now I’m doing mostly M&A work for, it’s weird. So I don’t know if anybody has ever said this to you before, but web hosting is kind of like the Hotel California. It’s like, once you start in the web hosting industry, you never leave. And so I have all these clients from 15 years ago who are now running like little baby hosts, and they’re talking to bigger hosts and they want to get acquired. So I’m doing some of that now. I am not writing any of the policies that nobody ever reads because that was just, I did that for too long.
[00:06:51] Nathan Wrigley: There were too many moments parties.
[00:06:53] David Snead: Yes, exactly. Yeah.
[00:06:55] Nathan Wrigley: Okay, so I’m going to read into the record the title and the blurb that went with the presentation that you are doing or done.
[00:07:02] David Snead: I did it yesterday.
[00:07:03] Nathan Wrigley: Okay, we’ll get into that in a moment. So the title is coordinating the fight, cross industry collaboration, and the blurb goes as follows. WordPress hosting threats cross company lines. When one provider falls victim, the entire ecosystem suffers. This session explores how the Internet Infrastructure Forum, or IFF, enables hosting providers, registrars and registries to coordinate abuse response through real time intelligence sharing. Learn how operational collaboration helps responsible operators detect and stop attacks faster than adversaries can adapt. And why working together produces results no single provider could achieve alone.
When I read that, immediately was, yeah, that’s a really sensible idea. Why are we separately, as hosting companies, I say we, I mean the hosting companies. Why are they all trying to do the same work over and over again, separately? When presumably this aspect of the work, the security bit is something they all have in common.
[00:08:05] David Snead: Right? So that’s the fundamental question, right? So the IIF is a voluntary organisation that is made up of everyone in the infrastructure stack. So from registrars, registries, DNS providers, hosting providers, cloud providers, everyone in the stack. So it is facilitated by the Internet and Jurisdiction Foundation. They’re based in Paris, and they’re the actually the secretariat for it.
And what it’s designed to do is create a common way for everyone who’s in the infrastructure stack to share information about abuse and abuse issues. And it’s one of the fundamental problems that you referred to is everybody is operating in a silo, right? And that’s mostly because that’s the way the internet is architected, right?
So the internet is architected, so it’s distributed, right? Registrars and registries basically do their own thing with domain names. They might have a small hosting component or maybe a cloud component, but by and large, all they do is domain names.
Hosting providers probably resell domain names, but they’re not part of that industry. And so how do they all coordinate? And that’s what the IIF is trying to facilitate, is more information sharing among the participants.
[00:09:39] Nathan Wrigley: Well I imagine some of the hosting companies are probably fairly good. You know, they’ve got a giant customer base. Let’s imagine hosting company X over there, they’ve got millions of customers. They’ve got a huge budget that they can put over to, let’s say, security things. Well that’s all well and good, brilliant. But then there are other companies who are much scrappier. You know, they maybe have only a few thousand customers. And so their budget for the exact same work is going to be reduced.
How will this work? Is it going to be like a subscription service basically? Will you have a membership, which is in some way equal to the number of clients that you’ve got? Will there be some expectation that, okay, we’ll look at your revenue, your membership will be equivalent to a percentage of your revenue? How will that all work?
[00:10:20] David Snead: We don’t know. This is a very early stage project. Right now we are in a prototype phase where we have just figured out what information folks should submit to the secretariat.
So the way it works is, you submit the information that you collect for a particular abuse issue to the secretariat, who then enriches it with all the other information that’s been submitted and sends it to the right person.
So a great example is, let’s say a registrar reported a phishing domain. They turn off the phishing domain and they have maybe a timestamp, an IP address where it was submitted from. They submit that to the secretariat, who then finds the hosting company who is providing the services for the hosting and says, this came in about this particular site. Can you take action on that? So that’s the way it works.
Right now it’s very early stage. It’s in the first phase of a test, and we’re going to look at whether the way we’ve architected it, or the way the group has architected it, actually makes sense.
[00:11:39] Nathan Wrigley: Is this going to be then a sort of slow on ramp whereby you bring a few companies in at the beginning, hopefully. And then one or two more and iron out the wrinkles, and then some more and some more? Because I imagine, if you just threw the switch, everybody’s in, a lot could go wrong at that point. And I’m guessing there’s going to be more of a slow on ramp.
[00:12:00] David Snead: So you’ve pointed out my particular frustration with the IIF, and the reason that the secretariat is moving slowly, right? So fortunately, or unfortunately, based on my cultural background, I’m just sitting here going, this needs to move faster. We need to have everybody involved, we need to have all the hosts involved, we need to have all the registrars and registries. And other folks who are a little bit more skilled in this type of work say, no, we need to figure out what we’re doing and that requires a small number of people.
The phase that we’re in right now is looking for more folks who are interested in sitting at the table and being part of the discussion. Particularly in the hosting industry and in the web design and marketing industry. Those are folks who don’t generally participate in these kind of industry led collaboration exercises. And that’s the reason that I’m at WordCamp, is to talk to web designers, marketing agencies about why they should participate in something like this.
[00:13:13] Nathan Wrigley: So this really isn’t bound in any way to WordPress, is it? It just so happens that WordPress has a significant chunk of the internet, so this is a good place to start. But if you happen to be a, I don’t know, Drupal user, or you’re just into writing PHP code or whatever it may be, this is still applicable. There’s no real WordPress layer to this. This is just a good place for you to come because, well, there’s probably, what, 30 hosts, 100 yards away from us out there.
[00:13:37] David Snead: I know. And I haven’t seen all of them yet.
[00:13:39] Nathan Wrigley: Yeah, there’s work to do. But agnostic to any platform, basically.
[00:13:42] David Snead: It is completely platform agnostic, yeah.
[00:13:43] Nathan Wrigley: Okay. Okay, that’s interesting. But WordPress is a, is certainly a good place to start.
Now, I’m imagining, if I was a hosting company and I was the chief executive, I definitely have some questions for you in terms of, okay, we’re going to share our valuable intel with you, what are you going to do with that? How can we trust you? How do we know that the sharing is going to be done effectively and what have you?
So I guess really what I’m getting to is, what is the assurances or checks and balances that you, in the end, will hope to offer the host? That you can assure them that, look, if you hand us this body of work, you don’t need to think about it again. You can trust us to do it honourably, effectively, collaboratively. You get where going.
[00:14:26] David Snead: Yeah, yeah. And I suspect that you wanted to be a lawyer at some time, because that’s one of the issues that we’re facing. Information that can be shared freely, as an example, in the United States, might not be capable of being shared so freely in the European Union, or in Brazil, or in India or someplace like that.
So one of the things that’s being done, not by me, but by another group, another working group that’s part of this, is analysing the legal issues around information sharing.
The information that’s being shared, to answer the proprietary and confidentiality question, is not proprietary or confidential information. So it’s things like timestamps, domain names, IP addresses for the initial abuse submission. Things like that that really don’t indicate some sort of company confidential information. And it’s further abstracted into xarf, which is a language that’s used for abuse reporting, that we all can share. And so I think that the only thing that would be of concern is whether that information is personal information that’s subject to jurisdictional restrictions around the world.
[00:15:48] Nathan Wrigley: Would the idea be that this organisation would do the remedial work? So is there any notion that, let’s say for example, some sort of security problem was discovered by hosting company A over there, and they share that intel with you. Maybe the question is kind of asking, will you then appoint people to figure out what the patch is for that? Or is your idea just to, oh, red flag, we’ve got this problem, now you all know about it. Is it just information sharing as opposed to fixes?
[00:16:17] David Snead: Yeah, it’s the latter. So the thing that we’re solving for right now, so there’s just one issue that, one abuse issue, that we’re testing out and it’s issues related to fake shops. And so the fake shop issue is the test abuse issue for the project, and where folks are sharing information. It’s a particular problem right now with credentials harvesting. And so that’s what we’re trying to look at.
[00:16:43] Nathan Wrigley: And how has the conversations that you’ve had thus far, how have they gone? Has this been warmly received or are you facing a little bit of pushback?
[00:16:50] David Snead: So, look, I’ll be very direct with you. If something isn’t just an immediate threat to them, it’s very difficult to conceptualise why you should participate. And I am pretty used to answering that question simply based on the political work that I do with the i2Coalition. But once you talk about, so let’s use fake shops as an example. Fake shops, and you’re providing services to fake shops, actually has an impact on your bottom line.
So if you are providing, let’s say, payment processing to an entity that is running a fake shop, it very easily can make your credit card processing charges higher. It ends up eating bandwidth. It will tax your abuse resources.
One of the things that you referred to initially is, you know, larger hosts have a lot of money. I wouldn’t say they have a lot of money, but they have more bandwidth to handle a vast fire hose of abuse issues. Most smaller hosting companies might only get five or six abuse issues in a month. But if you have a fake shop, that’s going to generate a huge amount of abuse, and it’s taking away resources that you can use to actually grow your business. So that argument actually is relatively persuasive in getting folks to pay attention.
I find that the business argument around abuse is a much more compelling discussion than kind of moral persuasion. I don’t think moral persuasion works in the context of a community that is trying very hard just to keep their heads above water.
[00:18:42] Nathan Wrigley: It feels to me from what you’ve just said, and I could be reading too much between the lines, but it feels to me as if a good target audience would be smaller hosts to begin with, simply because they’re probably going to be more receptive because they have less bandwidth themselves. And so would welcome anything that can make the burden of sharing this information easier. So 10 of the small hosts combined is, well, it’s much bigger than each of them individually would be, whereas I suppose you’ll have to get a critical mass of them on board until maybe some of the bigger hosts start to look at you with favourable eyes, let’s say that.
[00:19:15] David Snead: Well, so we have some pretty large hosting companies who are participating. So as an example, both GoDaddy and Newfold are participating. But we also have smaller hosts. But I agree with you, the information that’s being provided, particularly since it is actionable, realistic information that can be adapted for bespoke systems, is invaluable, right?
So if you only get five or six abuse complaints and you get an abuse complaint, and you can go to the secretariat and say, we got a complaint about this domain, and the secretariat says, here’s what the registrar did. Here’s what Cloudflare did. Here’s the information they provided us. And you can use that to make a decision on how to address that problem. It saved you hours and hours and hours of research time.
[00:20:09] Nathan Wrigley: Technically speaking, what would the conduit of information both toward you and away from you look like? So if I’m hosting company X, how are you imagining that I will supply you with that information? But also, if I’m just looking for information from you on a daily, weekly basis, whatever it may be, how do I receive that? Is this like a, I don’t know, a website or an API or?
[00:20:33] David Snead: It’s an API. So it’s a file. It’s just a general file download.
[00:20:37] Nathan Wrigley: Right, okay. So it’s readily available 24/7?
[00:20:40] David Snead: Right. That’s the goal. Right now it’s not, but the goal is to kind of figure out a way to make something like that possible.
[00:20:47] Nathan Wrigley: Yeah, okay. I also suppose that the hosting companies, whilst this is good for their business if they can minimise costs and hand a lot of this work over to you, there’s a part of them which would also probably like to put some sort of badge on their website to say, this is what we’re doing. We’re part of this alliance, for want of a better word. Is that something that you are looking to develop as well, you know, some sort of credentialing system to demonstrate that you’re in this?
[00:21:12] David Snead: So that’s not something that the IIF is working on. It’s something that the Secure Hosting Alliance does. The Secure Hosting Alliance has a trust seal that we give to hosts who fulfil our Trust Seal Certification provisions. But that’s not something that the IIF does.
Talking about like why, other than business reasons, folks should participate in this, one of the things that is going on that I would suggest that most hosts know about, is there’s a little bit of a moral panic going on in the world about what contents you have. And regulation is actually a very real thing for the hosting industry, who has not ever been regulated. This is the time where you can say, hey, this is what we’re doing, right? We’re dealing with issues. This way a trust seal is the same thing, right? It’s something that you can say, we are actually taking steps to make the internet a better place.
[00:22:18] Nathan Wrigley: I think if you are a general agency owner or, I don’t know, just a freelancer, hosting is one of those things that you, once you’ve done it once, you’re in it for the long haul until something goes wrong. But you’re also browsing around for any tiny indication of why is this host slightly different? You know, what is it that they’re doing that, I don’t know, is faster? What is it that they’re doing that’s more secure? So it feels to me if you had a credentialing system and I began to hear about it and see it pop up again and again, it would be one of the metrics which I would weigh up when looking at hosting.
[00:22:51] David Snead: I would think so. One of the things that a trust seal does is it indicates that there’s been some vetting of the host. That someone has determined the things that are important to the hosting industry and are important to the web design industry. The agency industry are also important to the host.
Great example of that is one of the provisions of the Secure Hosting Alliances’ Trust Seal Certification is that a contract is presented to the customer before they sign up, which is super customer friendly.
One of the things as a lawyer that you hear about all the time when people are dissatisfied with their services is, yeah, well, I never saw that contract. Or it was just a hyperlink in an email that I got. That’s one of the differentiators for a Trust Seal certified host is that the contract is actually presented to them, to the customer beforehand.
[00:23:57] Nathan Wrigley: So in terms of the WordPress crowd, is this a thing that you are pitching only to hosts? Like when you step out of here, are you trying to have conversations only with hosts? Or is there some bit of the WordPress community, the freelance, the agency owners? Are you trying to communicate with them just to scope out what they need?
[00:24:15] David Snead: So for both the Secure Hosting Alliance and for the IIF, it is that. I really enjoy talking to agencies and developers about whether this is important to them, or why it might be important to them.
[00:24:31] Nathan Wrigley: In terms of how long this project’s been going, I’ve only heard of it because of your participation here, but I don’t know if you’ve been banging this gong for a decade or, I mean you’ve been in the industry for long enough to have been banging it for decades. Is this a new initiative or is this something which has a long and storied history?
[00:24:49] David Snead: So the Secure Hosting Alliance has only been active for a year, a little bit over a year. I’ve been talking about abuse for a long time, but the Secure Hosting Alliance has only been around for a year.
[00:25:01] Nathan Wrigley: And have you, in that year, got any intuitions that you’ll be here for another year? Is it basically going in the right direction?
[00:25:09] David Snead: It is going in the right direction. So we started out with two or three charter members. We now have 25 hosting members. We have three security vendors who are members as well. We have, I think, 17 Trust Seal Certified members, and we’re launching in 2027 a trust seal for security vendors who provide services to hosting companies.
[00:25:40] Nathan Wrigley: I know that several owners of hosting companies listen to this podcast. They may very well be the people that you’ve spoken to already, but if they are not, and they are people who would like to investigate this further, I suppose the thing that’s going to be in their head is, okay, Nathan and David, you’ve explained what I’ll get out of it, what do I need to put into it? So is this an annual financial commitment? How does it all work from that point of view?
[00:26:02] David Snead: Yeah, so you become a member of the i2Coalition. And so the Secure Hosting Alliance is a working group of the i2Coalition. So you would be a general member and you would participate in the Secure Hosting Alliances’ working groups. You also have the ability to participate in the i2Coalition as a whole, which is a much larger trade association that represents almost everyone in the internet infrastructure vertical. Mostly doing policy work, primarily in the US and the EU. Although there’s, we’re doing some work in India right now as well.
[00:26:40] Nathan Wrigley: And does membership allow you to steer the future of the project? I know that lots of chefs in the kitchen results in terrible food, but that, I fear, is something that could happen. You’ve got 87 members, 260 members. And then the 260 members all start to bicker and, you know, we want this, no. You see how it goes.
[00:26:59] David Snead: I do.
[00:26:59] Nathan Wrigley: What’s the position there? You know, is there sort of gated levels of membership? How are you organising all of that?
[00:27:04] David Snead: There are not. The membership is based on self-reported revenue. The membership is not horrifically expensive from my perspective. And I think that that, most of our members would say that it is, it’s actually relatively affordable, particularly for the small to medium sized hosts. And registrars or design agencies, anyone who’s participating.
The question about, who’s running the show, comes up quite a bit. We haven’t really faced that issue, particularly in the Secure Hosting Alliance. Folks seem to get along. But the organisation runs on the idea of rough consensus. And so decisions end up not being controlled by one member or not. Some of the i2Coalition has some very large companies who everybody knows about, who get along with startups, and folks against whom they compete directly. And policies still get made. The organisation still moves forward.
[00:28:11] Nathan Wrigley: Yeah, I guess you’re in a space where, obviously all of these hosting companies commercially are vying for everybody else’s business. But in this particular situation, that is not the case. Nobody’s vying for their websites to be less secure. They all want the same level of security. So at least in that sense, you would hope that consensus could be maintained even if, commercially, the two companies that are in the room, the 10 companies that are in the room might be commercially at loggerheads with each other. At least on this they could agree. That would be the hope, I suppose, anyway.
[00:28:47] David Snead: It seems to be, not only the hope, but the actual way that things work. You ask about how compromise is reached. What comes to mind is I have a much different concept of privacy than, particularly when I was at WebPros, than other folks in the i2Coalition had. And another company just called me up and we worked through our disagreements about how privacy should be handled within the i2Coalition and were able to move forward.
The industry I’ve found to be hugely collaborative, particularly the hosting industry. Everybody knows what their competitor is doing. But when it comes to addressing an issue like, how are we going to deal with abuse as a community? Folks come together. CEOs of hosting companies while they compete tend to be relatively good friends.
As I said at the very beginning, it really is like the Hotel California, right? You come in as a CEO of a hosting company, you grow it and you sell it to another company. All of a sudden you’re at the bottom again with a server in your grandma’s basement, you know, trying to start again.
[00:30:08] Nathan Wrigley: It’s a really curious effort. I suppose really at the bottom of this entire podcast is your endeavour to be heard and to reach out and get some conversations going. So with that in mind, where do people find the information about this? So maybe there’s a website that we could mention. But also, is there a specific place where you hang out? Is there a place where you would like to be contacted most?
[00:30:33] David Snead: Sure. So our website is hostingsecurity.net. I’m not too afraid of getting too much spam. So folks can email me at snead@i2coalition.com And the two is the numeral two. So it’s snead@i2coalition.com. And I’m happy to answer questions.
In terms of hanging out, I am at most industry conferences in the hosting industry. In the WordPress industry, I’ll be at WordCamp US. We also participate very heavily in ICANN. So there is an i2Coalition member at every single ICANN meeting.
[00:31:12] Nathan Wrigley: So if you go to wptavern.com and you search for the episode with David Snead, S-N-E-A-D, you’ll be able to find those details. I’ll put everything into the show notes. So anything that I missed? Was there a particular focus that we didn’t touch?
[00:31:26] David Snead: No, this is actually one of the most thorough podcasts I’ve been on recently.
[00:31:31] Nathan Wrigley: That’s love to hear it. Well, David Snead, thank you very much for joining me today.
[00:31:35] David Snead: Glad to be here. Thanks for having me.
On the podcast today we have David Snead.
David has been involved in the hosting industry since 1999, starting out as legal counsel for one of the earliest shared hosting companies and going on to work with over 50 others. He helped found the i2Coalition, serve as in-house counsel for cPanel and WebPros, and now leads the Secure Hosting Alliance.
If you’re listening to this podcast, I’m sure that many of you will have worked closely with hosting companies. Perhaps you run an agency or business that depends on the reliability, ethics, and security of hosting providers. David is here to talk about cross-industry collaboration in the hosting world, specifically around improving security, professionalism, and communication between hosts.
The conversation focused on why and how the Internet Infrastructure Forum (IIF) is building a framework for real-time intelligence sharing and abuse reporting, aiming to help the entire ecosystem detect and prevent attacks faster than adversaries can adapt.
David talks about the challenges hosting companies face, especially smaller ones, in keeping up with security, and how this evolving project hopes to ease this by sharing actionable, non-proprietary abuse information across registrars, hosting providers, DNS services, and more. He discusses the growth of both the Secure Hosting Alliance and the IIF, the business case for collaboration, and the nuances of legal and technical information sharing across borders.
If you’re in hosting, run a web agency, or just want to know how the backbone of the web is working to stay more secure and connected, this episode is for you.
[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.
Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case managed WordPress hosting and AI hosting innovation.
If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.
If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.
So on the podcast today, we have Malcolm Peralty. Malcolm has been immersed in the WordPress ecosystem for 20 years, starting out as a full-time blogger and working his way through tech roles in project management, agencies, and even a stint in the Drupal space. These days, Malcolm is bringing his experience back to WordPress, serving as a technical account manager at Pressable, a managed WordPress hosting company.
Malcolm shares how he found his way from early forays with WordPress to managing large scale hosting environments. He talks about the lure of the Drupal world, and why he’s ultimately returned to WordPress and Pressable.
We discuss what technical account management means at Pressable, how his role differs from sales and support, focusing instead on long-term strategy for clients, performance optimization, and bridging the gap between customer needs and the underlying WP Cloud infrastructure. We hear how Pressable proactively helps clients, sometimes even advising them to downgrade their plan if optimizations mean they need fewer resources.
We go behind the scenes in Pressable, getting into how hardware considerations, plugin bloat, WooCommerce or LMS sites, and customer handholding, all come together inside one company. Malcolm gives us a candid look at performance challenges, the way hosts interact with infrastructure teams, and why education around WordPress performance is so tough, even as competing platforms prioritise speed at all costs.
We also look into the future. What are the cutting edge trends in hosting? Like database replication, virtual clusters, and especially the rise of AI within the hosting experience. Malcolm explains Pressable’s upcoming MCP, an AI powered control panel that promises to let you deploy, and manage, wordPress sites using natural language.
We explore how AI will impact everything from customer support to site deployment, potential pitfalls, and the challenge of balancing automation with human relationships.
If you’re curious about the state of managed WordPress hosting today, the interplay of tech, support, and AI, or just want to know what’s happening behind the curtain, this episode is for you.
If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.
And so without further delay, I bring you Malcolm Peralty.
I am joined on the podcast by Malcolm Peralty. Hello, Malcolm.
[00:03:55] Malcolm Peralty: Hi there. How you doing today?
[00:03:56] Nathan Wrigley: Yeah. Very nice to have you with us on the podcast today. Malcolm’s got a really interesting story. He’s done a lot, a lot of it kind of maps to things that I’ve done in my life. But it’s a tech podcast, generally we talk about WordPress, but I think we’re going to talk about hosting, AI, and possibly other CMSs.
But before we do, a moment for you, Malcolm, just to introduce yourself and give us your potted bio, I guess centering around your relationship with technology, WordPress, CMSs, that kind of thing.
[00:04:22] Malcolm Peralty: Yeah. So first off, I like to always say that I’m Canadian. I think that actually kind of gives us some insight into a little bit about how I think. And I live just outside of Toronto, Ontario, Canada right now, and I’ve been in the WordPress, around the WordPress space for going on 20 years.
I started with WordPress 0.72, so before the 1.0 release. And I was a full-time blogger, talking about WordPress for several years, and kind of stumbled into using some of my tech skills to work in and around technology with WordPress, and then project management. And because of project management, I’ve been able to work with agencies that build like smartphone apps and other CMS systems, and custom CMSs for customers. But I’ve always kind of kept a toe in the WordPress world as much as possible.
[00:05:11] Nathan Wrigley: Yeah, and you firmly landed back in the WordPress world working for Pressable, which we’ll talk about in a moment. But you had a bit of a foray in the Drupal, Acquia world, I think. The word Acquia may not mean a great deal to people listening to this podcast, but it’s kind of the equivalent, I suppose the best mapping would be Automattic over on the Drupal side. What was your experience with Drupal? How come you’re not still fully on the Drupal side of things?
[00:05:35] Malcolm Peralty: Yeah, so that was kind of a strange one for me. I didn’t expect to have a position in the Drupal world. I had done some like Drupal project management before, a lot of like moving Drupal sites to WordPress or like revising a Drupal site, or adding a smartphone app to a Drupal site. But that was mostly, again, as like a project manager or a site builder, not as like someone who really understood the engineering behind Drupal.
But a long time friend of mine reached out and said, hey, would you ever be interested in a job at Acquia working at the Drupal mothership, so to speak? And the position was a technical account manager, which thankfully leans more on my skills as a project manager and someone who understands web hosting than someone who understands Drupal. So I was able to use the combination of 20 years of skills in the space to actually make a good go at it.
And I think one of the big reasons why I was so enticed and interested by the position is, honestly, Drupal jobs pay better than WordPress jobs. And it’s horrible and sad to say, but I think it was a really important factor in my determination on where my career was moving. If it wasn’t for the fact that Pressable came along when it did, and basically offered me a similar kind of pay scale, I’d probably still be in the Drupal space and who knows for how long.
[00:06:55] Nathan Wrigley: Yeah, that’s really interesting. I was a big Drupal user for many years but just found it was, there was a lot of things that I didn’t need that Drupal did, that WordPress could do. And so I firmly moved ship away from Drupal. Well, I think it was when Drupal finally went to version eight, so many, many years ago. Something like 2015 or something like that. And I certainly haven’t looked back.
So Pressable, you may need to go and Google that if you’re listening to this podcast. You may have heard that name before, but it is a hosting company, I guess managed hosting, dedicated hosting for WordPress websites. My understanding is they don’t do anything else. Pressable simply work with WordPress. But what’s your role over there? Let’s begin there.
[00:07:37] Malcolm Peralty: Yeah, so I’m a technical account manager. I’m the second technical account manager that Pressable has hired. They’re trying to build out a technical account management discipline. For those that haven’t heard the term technical account management before, you might think it’s like a sales role or something like that with a technical bent, and that’s not it at all.
We’re basically, you know, like WordPress and WordPress hosting strategists, right? So we’re thinking about like, what does your website look like a year from now, two years from now? What technologies do you need to be aware of? What end of lifes will come up that you might need to develop against? What plugins and tools are you using and how performant are they, and are there more performant options in the mix that might work for you? And so that’s really kind of the role that we take at Pressable.
Right now a lot of it is also kind of the pre-sales, right? Like which tier of service or product will your website fit into? What kind of customisations or optimisations might you want to make in moving over to the Pressable platform? And so we kind of go through all of that with customers of kind of a certain scale and size.
[00:08:36] Nathan Wrigley: So do you, as part of the job description then, do you monitor existing websites that are on the platform already and look for, let’s say things like bottlenecks, where something’s going wrong? The client may not be aware of it, but you can then sort of inject yourself, begin a conversation and say look, you’ve got this suite of plugins, that’s great, but we’ve noticed that improvements could be made here, there, and the other. And here’s a suggestion for something that maybe will get rid of that problem.
[00:09:02] Malcolm Peralty: We do get to do a little bit of that, not as much as I would like. My long-term hope would be that, much like Acquia, much WordPress VIP, TAM would be like a subscription service that customers of a certain tier would be able to sign up for, and have like that consistent access and that consistent monitoring where, like on a monthly basis, you know, we’d go through our client list and like double check all of them.
Right now we’re sometimes a point of escalation for support if need be, where they’re like, this problem’s going to take more than an hour to solve. Maybe the solutions team and the TAMs can kind of take a look at this and dive deep into it. We also kind of monitor the data coming in from our server instances. And, yeah, we’ll sometimes kind of cherry pick some of the ones that are standing out as not working as well as they should be, or using more resources than they should be, just as a point of like general optimisation, right?
It’s funny because our role helps both the customer because, again, we don’t care about the money side, right. So we’ll come in and be like, here’s the optimisations you need to make. Now you don’t need even as quite a big a plan as you have maybe. Maybe you need to downsize your plan now because we’ve helped you optimise your website.
But from a resourcing perspective on the Pressable side, it’s also advantageous because one, it makes the company look good to be proactive in that way. And two, it helps for server resources, right? We have our own cloud, WP Cloud, which is our own server stack. It’s not AWS, it’s not Google Cloud. And so optimising resources can allow us to have resources available for other people who maybe are bursting because of a big sale or front page of Reddit or something like that. So we’re always looking at those optimisations as an opportunity on both.
[00:10:37] Nathan Wrigley: Do you, as part of your role, get to sort of interface somewhere between the customer, the people who pay you to have hosting and the hardware side of WP Cloud? Because presumably on the WP Cloud side of things, there’s a hardware layer. There’s literally people putting boxes into racks and putting the cables in and what have you.
Because my understanding is WP Cloud is owned, well, it’s not AWS, let’s call it that. It’s not Google’s Cloud infrastructure. It’s not any of those other things. It’s managed, known by whom, you can tell us in a moment. But do you get to have a conversation, say, look, we’ve noticed that this bit of hardware isn’t as performant as maybe something else? Or, look, here’s some new thing that’s been released onto the market, can we get a dozen of those and try that out?
[00:11:17] Malcolm Peralty: For sure. And as Pressable continues, try to move towards the higher end of mid market to try to acquire customers that are using WooCommerce or learning management systems, we’re finding those platform opportunities where we’re providing like, here’s what we’re seeing, you know, here’s all this data that we’re collecting. Here’s what we think this means. Here’s what maybe our competitors have done, or what our customers have noticed on competitor platforms. How can we either like negate the advantages of other platforms? Or how can we find ways to make ourselves even better than them? Or, here’s what we’re already doing, great, is there any fine tuning that we can do to like eek out that extra little bit of performance?
We try not to be too prescriptive with the WP Cloud team because they really are the experts in the hardware. But we bring a lot of that WordPress knowledge to bear and say like, this is what we’re seeing from a WordPress perspective, what can you do on a hardware and software on the server perspective to kind of make this work even better?
[00:12:12] Nathan Wrigley: It’s a difficult juggling act to perform in a way, isn’t it? Because on the one hand, we’re always talking about how performant WordPress can be, and on the other hand, we’re always talking about plugins and themes and the fact that amassing those will slow things down. You know, you throw in an LMS or WooCommerce or something like that and suddenly the website is going to be a different animal, let’s put it that way.
And so on the one hand, trying to pitch WordPress as performant, and then on the other hand, there’s this whole bit that you are dealing with where the performance is somewhat under question. I’ve always thought that’s a difficult challenge. And certainly in terms of marketing that and making the public understand that, okay, there’s the performance on one side, but we can manage that on the other side. I think that’s a really difficult thing to do because you’re trying to communicate something incredibly technical to presumably a whole load of people, some of whom aren’t technical at all.
[00:13:03] Malcolm Peralty: And even worse, a lot of other competing hosts will hide a lot of issues and faults and sins that customers have made on their website through like heavily used Redis setups that like just make it seem like their website is so much faster than it actually is. Or they’ll buy hardware that is, you know, has like the fastest CPUs. And so from you as a single user testing your website, you might say, wow, my website is so fast on this other platform, but when I move it to this company, now it feels slow. But you’re not doing a test at scale. You’re doing an individual test, right?
So you go on that hardware and you put like 25, 100, 1,000 users going through a checkout process, and all of a sudden your website is slow as molasses and starts falling over. Whereas on the platform that quote, unquote, seems slower, it’s so much more resilient and able to handle that load.
So there’s so much nuance here and so many things that we’re dealing with and a lot of the job ends up being at customer education because it’s very easy in the commodity hosting space to be like, I’m going to move to this other company because they seem faster. And that really shouldn’t be your single goal. It should be understanding your website. But a lot of small business owners, medium sized business owners, even large business owners don’t really necessarily want to understand how their website is built and how their pages are built and these kinds of things.
And it’s funny you mentioned about the WordPress performance thing because sometimes I want to be like, just do this one thing for me, right? On our platform, turn off all your plugins, go back to the default theme, tell me how fast your website loads because guess what, it’s probably going to load pretty darn fast, right?
The problem I have is the customers that have 50, 60, 70 plus plugins, and two of them are different like builder tools, which is unfortunately the bane of my existence. No offence to like Elementor and Divi and Beaver Builder and all these companies that are making these tools to help people have their dream website on the internet. But man, are they ever heavy and slow when you’re trying to create a performant website these days?
And so, you know, I’m often having these conversations about, what is most important to you? And understanding as well that search engines like Google, and search engine companies believe that performance is a big deal because that’s how they manage their own infrastructure, right? If a website is slow, then they can’t really crawl it effectively and understand what’s going on with it. So that plays into a lot of the conversations that I have as well. And it’s never easy.
[00:15:23] Nathan Wrigley: Yeah, I imagine it’s not. I mean, I don’t know if the goal of Pressable is to make it such that you show up with your website, pay your monthly subscription, whatever it may be, and kind of that’s it. We will take it from here. I don’t know if that’s the goal. Or if it’s more of a, we will have a conversation with you, we will make recommendations and over a period of time, we will come to some sort of happy medium where, you know, what you’ve got is what you are happy with and it’s also performant from our side.
So I don’t know how much of a conversation is there. Any website that I’ve ever brought to Pressable has been fairly straightforward. I’ve installed it, it’s worked exactly as I had anticipated, and so I’ve never really had to get into it. But, you know, a website with 10,000 SKUs, and a million visitors a day, presumably there has to be some handholding going on there.
[00:16:09] Malcolm Peralty: Yeah, I think the big point of delineation is the cacheability of a site, right? So the ability for us to serve it without building the pages from scratch. If you have a brochure site, if you have a marketing site, if you are, you know, the only thing on your website that’s like a real user interaction is some buttons and maybe a form to submit, like a contact form or a marketing related form, your website is going to run perfectly on Pressable without any kind of handholding, without any kind of consultation. You’re going to be able to upload it and know it’s going to be resilient to whatever traffic you receive, and even like power outages in entire halfs of countries won’t bring your website down.
If that’s the kind of experience you want, those plan tiers exist and they work great. And we have agencies that throw thousands of websites on Pressable’s platform in that kind of umbrella without any kind of issue or concern or question.
I think the consultative part comes in when you’re starting to do things like I mentioned before, learning management systems, e-commerce systems, merch drops, custom contests. If you’re doing anything that basically has a different user experience based on adding something into a cart, or like completing a module of learning that needs to be tracked and following the user, typically this means that it’s going to be uncached, which means that it’s going to rebuild that page from scratch, and that requires a fair bit of resources.
We’ve optimised a lot of things to make sure that we can do that effectively, but again, the conversation comes into play, if you add in Facebook for WooCommerce plugin that breaks cache on every page load, then we have to work with our customers to understand like what that means, and what the trade-offs are, and what replacements might exist to make it so that we can cache the majority of sessions so that they can stick within their resource utilisations that we expect them to use.
Most companies, including Pressable will sell on like the number of visits to the website, but also another piece is the amount of workers, right? So these are the little pieces of software behind the scenes that actually complete all of the things that users are requesting, right? Serving up images and web pages and shopping carts and stuff like that.
We have a really cool model where we have one worker per one VCPU, which basically means you get your own dedicated highway for that worker. He’s his own little car on his own little highway lane. Where a lot of companies will do like 40 workers to one VCPU. So imagine 40 cars on one lane highway, versus five cars on a five lane highway. So the way that we process things is a little bit different as well, and so that requires a little bit of education on our side.
[00:18:32] Nathan Wrigley: I think there’s this whole mysterious scientific laboratory kind of impression to hosting, if you know what I mean? I’m imagining a room, a laboratory, sort of white walls and everything, with a bunch of people wearing white overalls with pens neatly lined up in their top pocket, and obsessing about these acronyms. Well, this isn’t an acronym, but you mentioned workers.
But you’ve got things like Redis, you’ve got things like edge caching and all of this kind of stuff. And honestly, to me, a lot of that is a bit of a puzzle. And I don’t know how you educate the public about those things other than just saying, just don’t worry about it. We’re here for you. We’ll deal with that complexity.
But also, I’m curious to know what kind of innovations are there still to be done? Now obviously we’re sort of crystal ball gazing a little bit here, but I am curious about where is the bleeding edge of server technology and hosting technology? What are the things which are just a little bit over the horizon, but are of interest, which may drop in the next year, two years, three years, something like that?
[00:19:34] Malcolm Peralty: Yeah, I would say we’re seeing a lot of web assembly type efforts, which is kind of interesting, which is, yeah, I don’t know if anyone’s ever seen, there’s a WordPress Playground site where you can have like WordPress basically running in a browser. You don’t have to install it anywhere. It just exists in your browser as like this ephemeral install of WordPress that you can play with and do stuff with, and then export to a real install of WordPress if you’re interested.
I think that is a super impactful and interesting technology, and we’ll see probably more of that in the next little while, and how hosts can kind of play into that. I think that we’ll also see better caching technology, better database technology, but also I think better replication technology. So everyone knows that a lot of WordPress kind of exists within the database, and so if you want to have high availability, you need to be able to have that database exist in multiple places. But if you’re doing transactions on your like primary database for like e-commerce, you’re like buying products and you have, Malcolm bought a t-shirt from my website, he wants this size and he wants it shipped here, we need to now replicate that to any other like high availability databases that we have. That replication right now is very old technology in a lot of ways, and it’s not as optimised as we would like it to be. So there’s a latency that exists there in replicating that to other places.
Acquia and some of the other companies I worked for, that latency could be really high or really low depending on how it was configured, right? How long do we kind of keep that data there before we send it over?
We try to do as much real-time streaming at Pressable as possible to make it so like, you know, within like two seconds, the data is now in that replication. And so if your primary goes down, you’ve lost maybe a second or two seconds of data. On some websites, even that can be really bad, right? Because if you, let’s say you’re doing a big product drop and you have 10,000 people wanting to buy tickets to your concert, and you lose two seconds of data, that could be hundreds of transactions that just evaporate into the ether. So better ways of syncing that data across, and managing that relationship between multiple servers I think is going to be a big transition that we see in the marketplace.
We’re already seeing the idea of virtual clusters. So multiple data centres pretending to be like one local server. So then we don’t have that same feel of migrating or syncing data between locations, it just pretends it’s all kind of in the same place. So I think that will be kind of interesting to see because again, that adds more resiliency. And I think, everyone that I’ve ever talked to, if you say like, how long are you okay with your website being down? Even if it’s not a moneymaking website, you’ll hear them say something like, I don’t know, maybe an hour at most, right? So finding ways to make websites more resilient is going to be important.
And then I think just a better understanding just from top to bottom on what’s happening with a website, right? So we have a lot of logging, but it’s not necessarily the best at auditing. So, for example, if Nathan came on my website and got access to it and deleted a plugin, I might not have the best tools right now to be able to say, oh, it was this IP address at this time, he logged into this user, he did this action, and have that complete picture to be able to kind of quickly and easily reverse.
We kind of depend on backups right now a lot of the time, and I hate that. Or we depend on like trying to fish through logs and make those connections using our human brains. All of that is just a really poor solution and I think AI will hopefully help with some of that, and I’m looking forward to having more of this like very specific picture of every action that has on a website without, again, adding a whole bunch of load to the server environment or a whole bunch of data storage requirements that makes it really impossible for organisations to kind of have all this information, right?
Because if I start auditing every action that I’m taking on a website that I have access to, and you think of Pressable having multiple thousands of websites, hosting platforms, you can imagine the amount of data we’d then need to record, right? So data compression becomes super important, or the ability to kind of infer things based on data that we’re seeing becomes important. The amount of work that I do in like looking through logs would make your eyes kind of pop out of your head. It’s brutal sometimes. And logs have never been very user friendly.
So again, another area that AI has been helping us with is like, okay, pull out the things that are potentially the most impactful, the most interesting, the things that stand out over like a statistics, probability kind of system.
[00:23:48] Nathan Wrigley: Yeah, I think what’s really curious about everything that you’ve just said is, so there’s this kind of impression for people who are just casual users of WordPress that you go to a hosting company, it’s a bunch of files and it’s a database, how hard can it be?
And then you’ve just given us a bit of a window into, well, this is how hard it can be, because there’s so many scenarios. And the typical mom and pop store where, like you said, an hour’s downtime might not be the end of the world, and most of the things can be cash and all that kind of thing. Well, that stands in real contrast to the, I don’t know, the gigantic megacorp .com company that’s doing 8,000 transactions every couple of minutes and there’s millions of dollars going through. And there’s just a whole other layer of things going on there.
And so you see the word Pressable and you think, hosting company, pretty straightforward. And I think it’s really interesting that you get an opportunity to come on and say, well, actually, no, there’s this other layer. There’s all this stuff going on in the background. There’s all of this technology. We’re thinking about the future. You know, we’ve got different geographical locations where things are housed, and we’re trying to speed that up so that there are all these different clusters. It sounds complicated, essentially. I’ll boil it down to that.
So I am a Pressable customer and when I go into the Pressable admin, I sort of log in and, you know, I’m presented with the usual array of different options. I would say that there’s more than probably somebody like me is requiring, but there it is anyway. You know, there’s lots of different options for tweaking this, that, and the other thing.
What I’m trying to sort of draw an analogy to is that it can be a little bit overwhelming if your day job isn’t to deal with a website. You log in and, what is this? What does this menu even exist? There’s probably ways of Googling it and finding it out. But I know that in the near future, Pressable is going to be launching sort of like an AI component to the hosting side of things. An MCP, you’ve described it as Pressable’s MCP. And then in parentheses, get AI to do things related to your hosting, whether that’s WooCommerce or WordPress or performance optimisation or whatever it would be.
So this is interesting. And I’m just curious as to how deep are you going to allow the AI to go? We all know that the AI, any AI can hallucinate. So I’m curious as to know what kind of things are you unleashing for the AI? Is it just a case of, okay, I would like the light theme now, please? Or does it penetrate much deeper than that?
[00:26:10] Malcolm Peralty: So it’ll be in phases over the next little while, we’ll unveil these features and what connections that we have. But eventually the expectation is, anything that you could do or click on as a user in the control panel, an AI could also act on and do as well. So a great example that we’ve been giving our agency partners is if you, let’s say, are working on code for a customer’s website, you could say to the AI built into your Visual Studio Code or your GitHub or whatever, hey, spin up another sandbox site, push this code, update the database, pull from production, all the files, and let me know when this is complete.
And the MCP will go and it will spin up a new sandbox site, a new WordPress install, with a new domain name attached to it. It will grab your code and push it up to that website. It’ll go to production and grab the files from the wp-content uploads folder, and sync it over to this new staging site or sandbox site that you’ve asked for. And then it’ll say, hey, by the way, it’s now ready for testing.
And you’ve done this all with natural language as a command behind the scenes. Or, let’s say you’re running a thousand sites, tell me all the websites that need like a Gravity Forms plugin update. And it will go and it’ll check all of your websites in the Pressable platform and give you a list of like, hey, here are the ones with Gravity Forms updates. And you could say, okay, update them for me please. And it’ll go back and it’ll do that job.
[00:27:24] Nathan Wrigley: So I guess the goal is to make it straightforward to use natural language to do a variety of tasks. Now obviously there’s got to be some serious guardrails around this because, you know, it would be very easy to inadvertently type, delete all of my, that’s a bad example but you get point. You know, what are the contraints?
[00:27:43] Malcolm Peralty: Yeah, please don’t use dangerously skip permissions, for example. So a lot of the AI tools that already exist have some human in the loop questioning. Are you sure you want me to do this? Are you sure you want me to do this kind of thing? And kind of seek their approval. We’re also talking about what, if anything, we’re really going to do on our side about that? We have pretty solid backup solutions put in place. So maybe if you, you know, accidentally said, clear out all of my platform, and it deleted all of your websites, you could then hopefully say, can you actually restore from backups all of those sites and have it restore from backups all of those sites.
So, you know, we keep hourly backups of database, daily of the WordPress file system, so there is that. Also our main WordPress install is simlinked, which means that you can’t actually change any of the core files. So even if you told it to delete WordPress, it can’t actually do that piece of it. So your WordPress install would still exist, but all your plugins and uploads and database would all be gone. But you could just restore them again using natural language.
So there are some guide rails that we can put in, but at the end of the day like, you’ll be able to connect whatever AI tool you’re using. Maybe you have Ollama with a local AI tool on your computer. Maybe you’re using Claude or Codex or something else. You’ll be able to use any of those AI tools. And so some of it is really on the person using it to put in some of those guardrails and those human and loop things. And I would recommend having a like system prompt that basically says like, before you do anything destructive, check with me first. Not that it won’t automatically do some of that, but it’s just good to have a secondary layer.
[00:29:13] Nathan Wrigley: And how are you exposing these capabilities to, let’s say Claude or whatever it may be? So what does that interaction look like? How is it that certain capabilities are available, but others are maybe not, and so on.
[00:29:25] Malcolm Peralty: Yeah, I mean I like to think of an MCP kind of like USB/API for AI. So we’re basically just making those kind of endpoints available to the MCP, or making like those API endpoints available to AI, so that it can undertake things on your behalf. So like our whole control panel is basically APIs all the way down, so to speak. So it’s not very hard to kind of hook those things up.
I think the harder part is making sure that the AI understands what these controls, what these APIs do, what they expect to receive, what they expect to give back, and what that all means. And once all of those kind of definitions are in place, then it’s pretty easy.
[00:30:05] Nathan Wrigley: I think one of the curious things for me is being inside, let’s say the Pressable UI where I’m navigating with a mouse and I’m clicking on things, everything is very intentional. You know, I go to a thing, and I do a thing, and I get a prompt to say, are you sure you want to do this thing? And I say, yes. And so it goes. And so every single thing that I do requires an interaction with me.
I suppose, with an AI, you could concatenate a variety of things. Maybe the AI has some sort of misunderstanding along the way, or you type things in such a way that it’s not entirely clear. And then kind of unpicking, okay, what just happened? It’s really easy to unpick that in the UI because you can say to the support rep, well, I did this, and then the site died. Okay, we know what happened there.
Whereas with this cascade of things, which is done with natural language, presumably this is where your logging, that you described earlier, comes in. There isn’t really a question there, but I’m curious as to what that process is. The capacity for many dominoes to fall from just one simple prompt, I suppose as a point of concern for you guys, because you are going to have to be unpicking all of this on the backend when things, which they inevitably will, go wrong.
[00:31:16] Malcolm Peralty: For sure. And I mean this is one of those areas though where we’re ahead of the curve. I think a lot of companies will be adding these kinds of things. But from an AI perspective, I mean, since October or November of last year, we’ve seen the skills and abilities and understanding of the top tier AI tools just jump exponentially. So the number of mistakes or concerns that we have have gone down in that same vein.
Our support team has also been trained up in a lot of these. And we’ve been testing a lot of these MCP pieces for a long time now. So we feel pretty confident that those that enable this and that have a good understanding of what this means and how to use it won’t make too many mistakes or have too many concerns or issues.
You know, again, we’re targeting a lot of our agency partners that are developers that already kind of live and breathe this stuff. So they’re also used to being able to untangle and knot if they tie themselves in one. So I don’t expect someone with their like first WordPress website on Pressable to enable MCP and start using it.
I really think this is most valuable to agencies or companies at scale. You know, if you’re running one website, you probably don’t need this, but if you’re running like 10, 100, 1,000 websites, then this tooling becomes very helpful. Because you can have like a, maybe do it on one site and now then replicate that same thing you just did across all of the sites I manage.
[00:32:33] Nathan Wrigley: I don’t really know how to phrase this question, but I’ll give this a go. At the moment, presumably you have a fairly solid relationship with your customers. You know, if something goes wrong, you log in, you enable the chat widget, you have that conversation. There’s this backwards and forwards, okay, great. And maybe there’s lots of clients that you get that you never have that interaction with.
But I’m just curious how that relationship over time might change with the advent of AI. And what I mean by that is, it’s almost like you’re not talking to humans anymore. And because of that, you start to have a different impression of the company that you are dealing with. Okay, it’s just some sort of AI entity, I don’t need to worry about it so much. Maybe loyalty starts to come into question because there’s no humans there anyway.
So again, it’s very hard to encapsulate what I’m saying, but presumably from a marketing point of view, there has to be some moment at which you say, okay, there’s too much AI now. We’re no longer a bunch of humans presenting ourselves to the world. We just look like a bunch of robots. Do you know what I’m saying there? Does any of that land?
[00:33:34] Malcolm Peralty: It does. I will say, we have those conversations internally. The expectation is always going to be like, when we add a new feature, it’s going to be added for humans first and then added to our AI tooling. But the only way that you can compete in the modern marketplace is to take advantage of some of the tools and opportunities we’ve been given with AI. As difficult as it is, there’s probably a business case, you know, I’m sure there will be businesses that will target people saying like, we don’t use AI for support, we don’t have AI integrations, we’re a completely human business. But I think the difficulty will be like scaling and competing in the modern marketplace.
And like a lot of the agencies we’re talking to are expecting this. They’re pushing us towards this because they’re looking to reduce their time to delivery, right? They want to be able to sit in a coffee shop with a customer, get a brief of the business, give that brief to, you know, an AI tool that transcribes their voice to words, and then have it go through this whole system of setting up a hosting sandbox for the website, set up WordPress, select a theme that matches their expectations, set up the brand colours, and almost have like a proof of concept at the end of a meal with a customer, that was assisted by AI.
And if they can’t do that first step of setting up a sandbox or a staging site for the customer, then we’re not part of that conversation at all. They’re going to go where there is that feature and that functionality, and Pressable won’t be part of that conversation at all.
And as end users, I mean, having AI assist with the things that agencies or higher touchpoint customers need, gives us that flexibility now to be available for the $25 a month customers who actually need the handholding and support from a human that we just couldn’t do otherwise, right? It just doesn’t scale properly at that price point.
So I think this could be advantageous to both sides if it’s used right and done right. But I definitely agree, there’s landmines that we have to kind of be cautious of and avoid, and we have to be very careful about how we apply this. And I think the key thing is always making sure that everything that we do is human first, and then AI enhanced, rather than AI first and human supplemented. It’s just a hard line to walk.
[00:35:37] Nathan Wrigley: It’s so interesting that conversation you’ve just described in the cafe where, by the end of the cup of coffee, you’ve got yourself a website based upon a conversation you were having moments before. The collapse of the timeline there. You know, we used to think that this five minute install was a big thing. Now it’s like the five minute website that’s fully ready to go, you know, or at least some simulation of a website. May not be the finished one but, you know, you’ve got a staging site ready, with a theme that’s adjacent to what you want to do, with some content that might replicate what you want to do. And it all took place in less time than it took you to finish a single coffee. And that’s so interesting. And you have to armour yourself against that.
That raises another question of course, which is how far you, your tentacles go into the website itself. Because traditionally hosting companies really didn’t concern themselves with the website, apart from the fact that the website was available and, you know, we can see what your plugins are and yada, yada. But it does sound like we’re straying into theming, and possible content creation and things like that. So I don’t know if that falls into the roadmap a bit as well.
So maybe there’s a future where you can, with the AI sort of say, I’d like to swap out my theme. It’s Christmas time, give me a Christmas theme. But we’re doing that in the hosting environment. We’re not necessarily having to log into the website. Again, do you sort of see where I’m going with that?
[00:37:03] Malcolm Peralty: Yeah, and I foresee for sure, but the integrations with AI that WordPress 7.0 already has, and the discussions for 7.1 make me believe that Pressable’s MCP will be able to talk to WordPress’s AI integration and do that from end to end. So, I mean we could already do it with the MCP, like adjusting database values and stuff like that, but that’s not what I would consider an ideal way of doing this.
But like I said, with the changes that are happening in WordPress Core, I definitely foresee like a complete end-to-end solution. You know, one AI talking to another, who then carries that task forward, reports back to the Pressable MCP and lets us know that theme change is done, those plugin updates are done, the content change is done. And again, all from that initial prompt, you know, maybe in your Visual Studio Code, which is just crazy to me.
[00:37:45] Nathan Wrigley: I am so used to basically not going back to the hosting until there’s a problem. You know, I go to the login URL for the website in question, I log in, I move around the WordPress UI, create a post, publish a post, schedule something, whatever, upload some assets. You get the idea.
And the idea of that not being the modus operandi for everybody will be so interesting, because it’s going to shatter that experience of, you know, you could watch a YouTube video to figure out the thing because everybody does the thing in the same way.
But it feels like we’re heralding a future where no two people are going to have the exact same experience. You know, you may be creating content through a text editor, which then somehow gets uploaded, or the text editor merely creates a prompt, and then the theme is swapped or amended because you’ve typed in some prompt.
So, you know, my UI, my IDE, my text editor, my version of WordPress, maybe I might build my site entirely differently to you. So that’s fascinating and slightly worrying at the same time because, how do you support that? Not just Pressable, but how does the community support it when we’ve got an infinite number of ways to create a blog post?
[00:38:55] Malcolm Peralty: And not just a blog post, but everything.
[00:38:57] Nathan Wrigley: Yeah, right, everything. Yep.
[00:38:58] Malcolm Peralty: Maybe you say you want this Christmas theme. Maybe it doesn’t select a theme and change the colours, maybe it writes a whole new CSS for the theme you have. Or maybe it writes a whole new theme, or maybe it writes a plugin that automatically switches it around Christmas time. Like it doesn’t have to pull off the shelf from the theme marketplace or the plugin marketplace that already exists. It can create something wholly new and specific for you.
Maybe it writes a whole new block for you, rather than trying to pull together three or four blocks to be able to create the output that you’re looking for. And some of these things for sure are not going to necessarily be super performant or super secure, especially initially, right? Maybe a year or two from now, once the AI is even smarter than it is today, or has a better understanding of WordPress than it does today. Maybe it will kind of think more about security and performance than it does right now. But you’re going to have these people deploying things that are not the ideal outcome, or ideal solution, or ideal anything. It’s just works for them right now.
And it’s funny, I always hear people talk about maintenance, right? How are we going to maintain all this AI code? We, humans are not going to maintain all this AI code. AI is going to maintain and update all this AI code. And so the joke of it is, if you come along and your host comes back to you and says, hey, your website’s running like a dog. You’re not going to spend half a day or a day trying to troubleshoot anymore. You’re just going to say, hey, AI, why is my website running poorly? Fix it or give me a list of things that need to be fixed, or what have you.
I at Pressable am already like using AI to basically write scripts that run through like two dozen WP-CLI commands, another two dozen like database commands, and some like full code searches. Give me a quick report on anything that needs to be optimised, right? So I didn’t write that script from scratch, I didn’t write that code from scratch to do that. I directed an AI to be able to create that for me. And now as the human in loop, I’m interpreting the data that it’s collected, but I can foresee a future very near where I say, hey, AI now interpret all this data you’ve collected and send a summary to the customer on what they need to change or do. Go and act on my behalf and make these changes.
[00:40:49] Nathan Wrigley: That’s so interesting. So there’s a couple of things. The first one is that it feels almost like we’re heralding in a future in which the WordPress UI maybe is not seen by everybody. So a good example would be, I have a Mac. I rarely use the Mac. I use things on the Mac. You know, I’m using a browser. I use a text editor. I use the application that we’re using to record. I’m not really using the Mac. I hope that lands, if you understand what I mean. I switch it on, but the Mac kind of just goes into the background and I use a bunch of things, which, they’re on the screen because I’ve got a Mac.
[00:41:25] Malcolm Peralty: And I would say like 90% of it’s probably a browser at this point, right?
[00:41:28] Nathan Wrigley: Right, right.
[00:41:30] Malcolm Peralty: It’s a website that you go to. You can do Slack in a browser. You can do what we’re doing today in a browser. Pretty much most things that I do live in a browser. There’s very few applications that I actually need to load on my machine day to day because everything can exist in a browser. I think that paradigm will just be for the next generation, or for the transition that’s happening now, the new paradigm will be everything just lives in an AI application. Whether it’s installing your computer or whether it’s also in a browser. It’ll just be AI.
[00:41:54] Nathan Wrigley: Yeah, so it is analogous to that. It’s just this idea that the WordPress UI, that’s the only method that anybody has had, maybe that will be something that a bunch of people use, but it won’t be familiar to everybody because there’s no need for it.
And the other thing that you mentioned is, I suppose I would use any of the stuff that you’ve described, but there’s the one caveat. And the one caveat is I have to know that I can walk it back. I have to know that there is a way for me to undo every mistake that I just made because I got carried away. I sat down, got a bit carried away on a Saturday afternoon, made a bunch of tweaks. I really regret it. I want to know that I can go back and unpick that stuff and for it to be a seamless unpicking. So backups, I guess is the most straightforward way of doing that.
[00:42:40] Malcolm Peralty: And audit logs, right? So like one of the things that I’ve done is, in my system instructions, I do put, before you do anything else, backup the file system, backup the database and create a, like a markdown file that’s going to be step by step, everything that was done, everything that you thought so that I can then review it. And that really helps me kind of get an understanding of the tasks it took and maybe why it took them, to help me refine future attempts, right?
So going back to what we’re doing in hosting, like we’re always trying to think through, like you mentioned, everything is very specific and clickable, and we want to make sure that the AI understands exactly kind of what to click on, or what to select. And having that auditing is super important for that.
[00:43:19] Nathan Wrigley: And that’s the point, isn’t it? It’s a human readable or parsable log of everything. Something where, you know, you’ve got millions of data points in the audit log, but I can actually drill down into that in a meaningful way. Because it may be that I only want to undo a portion of what I did. I’m happy with some things, but I would like to go back. An audit log, as you’ve said, it’s fairly mind numbing stuff.
But we are going to be producing so many more amendments if all we have to do is speak because you can easily, you know, imagine it. I want the Christmas theme. No, not that one. Try something else. No, there’s too much red in that. Swap the red for the blue. And Father Christmas, I’d like him on the homepage but, no, a different one. In 12 seconds we’ve got thousands and thousands of things that have happened.
[00:44:06] Malcolm Peralty: I will say though, how much of that do you remember doing manually, right? Like I’ve gotten to the end of that kind of thought process and gone, wait, there was like a theme like two or three themes ago that actually was, a little bit of customisation could have been cool. What was that theme?
Even as a human, I’ve had lapses in memory when I’m quickly producing outcomes where I can’t necessarily roll it back so easily. So at least with an audit log, you’ll have a much better understanding of what was done and when. Human memory is also failable.
[00:44:30] Nathan Wrigley: Yeah, and I guess it’ll be interesting to see how much of that burden companies like Pressable take on. Like, you mentioned backups, maybe it will become de rigueur for you every few seconds whilst there’s interactions with MCPs. Look, we’re just going to go belt and braces. Every time you do something, which we detect is fairly sizable, we’re just going to take a backup, even though you never asked us to just in case. You know, those kind of things.
And have a UI to surface information so that the audit log is readable and those kind of things. And that’s all ahead of you. So it doesn’t exist moment, but it’ll certainly be things that will need to be tooled and invented in the future, I would’ve imagined.
[00:45:10] Malcolm Peralty: I mean, one of the hard parts, this might be transitioning the conversation a little bit, one of the hard parts is, you mentioned that AI is creating all these artefacts, and now all these potential backups. AI is already like indexing all of these websites and creating a lot of web traffic, and a lot of load on servers, for example. We had a recent instance where an AI bot went to a website and kept on adding different products to the cart and removing them. Well, every time it added a product to a cart was now an uncachable session.
And it did this millions of times over the course of a day. So we were like, okay, we got to block this bot. This is crazy. So we blocked the bot and about like 10 minutes later we start seeing the exact same traffic pattern from a completely different IP address with a completely different user agent. The bot had figured out an end way around our block and was now doing that same task again to try to, I don’t know, understand this website better, right?
The problem is, as an industry, we don’t know how to pass these costs on to customers because they think it’s kind of unfair in a way, right? Like, why should I have to pay for additional storage for all these audit logs and all these backups? For more bandwidth for my website or more resources for my website, to host or send all of my pages to these different AI bots? And it all kind of comes on us where we either have to like comp all of this technical effort that’s existing, or we have to convince clients to be okay with paying for it. And that has been a really interesting change in the dynamic with a hosting partner.
[00:46:24] Nathan Wrigley: That is so interesting. All those hidden costs, all those hidden things going on. Maybe there needs to be a luddite toggle in the UI somewhere where you just disable all of it. I want the WordPress UI, I want to do things manually. This is my preferred way of doing things.
[00:46:38] Malcolm Peralty: Block ChatGPT. Block Claude. I don’t want any of them viewing my website. Forget them.
[00:46:42] Nathan Wrigley: But it will be curious to see if there’s a subset of people who are, as you’ve described, unwilling to pay for that stuff because it’s simply something that they don’t use. They have no anticipation of using. It will be interesting to see if there’s a subset of people.
And also how clever these technologies become to disrupt things like that. You know, malicious actors out there who managed to come up with a million different ways to circuit around the blocks that you put on. And it will be interesting to see if just the cost of being online does rise with the advent of AI.
I mean, certainly the storage of all of these things is certainly going to rise. The conversations with the AI is certainly adding a financial cost. You know, there’s lots of hardware being built at the moment and there’s a cost to that. Certainly isn’t cheap. But whether or not we can cope with that, and whether or not your price points can keep up with that, and whether customers are going to pay for it.
Okay, there we go. That is so interesting. There’s so much stuff to dive into there. We could probably talk for another hour or so, but there we go. So, Malcolm, if anybody wants to reach out to you or learn more about Pressable, I guess, where would we reach out to you? Do you do social media or whatever it may be?
[00:47:51] Malcolm Peralty: I try not to. For Pressable, it’s pressable.com. For myself, I’d prefer you go through my personal website, which is my last name, .com. So peralty.com. And if you do want to get me on social media, honestly, really the only one I’m ever on is LinkedIn and I only kind of connect with people that I actually connect with. And then Twitter or X or whatever it’s called, I passively view from time to time. But honestly, the best other places would be, you know, you could probably find me on one of the WordPress Slack communities, for example, if you’re really interested.
[00:48:18] Nathan Wrigley: Okay, so Peralty, peralty.com. If you are driving a car listening to this and you can’t write it down, then go to wptavern.com, search for the episode with Malcolm Peralty in it, we will have all of the links that were suggested and talked about during this episode right on the episode show notes. So, Malcolm, thank you so much for chatting to me today and peeling back the curtain a little bit on the hosting over at Pressable. Thank you.
[00:48:42] Malcolm Peralty: I appreciate it. Appreciate it so much. Thank you for having me.
On the podcast today we have Malcolm Peralty.
Malcolm has been immersed in the WordPress ecosystem for nearly 20 years, starting out as a full-time blogger and working his way through tech roles in project management, agencies, and even a stint in the Drupal space. These days, Malcolm is bringing his experience back to WordPress, serving as a technical account manager at Pressable, a managed WordPress hosting company.
Malcolm shares how he found his way from early forays with WordPress to managing large-scale hosting environments. He talks about the lure of the Drupal world, and why he ultimately returned to WordPress and Pressable.
We discuss what technical account management means at Pressable, how his role differs from sales and support, focusing instead on long-term strategy for clients, performance optimisation, and bridging the gap between customer needs, and the underlying WP Cloud infrastructure. We hear how Pressable proactively helps clients, sometimes even advising them to downgrade their plans if optimisations mean they need fewer resources.
We go behind the scenes in Pressable, getting into how hardware considerations, plugin bloat, WooCommerce or LMS sites, and customer hand-holding all come together inside one company. Malcolm gives us a candid look at performance challenges, the ways hosts interact with infrastructure teams, and why education around WordPress performance is so tough, even as competing platforms prioritise speed at all costs.
We also look to the future. What are the cutting-edge trends in hosting, like database replication, virtual clusters, and especially the rise of AI within the hosting experience. Malcolm explains Pressable’s upcoming MCP, an AI-powered control panel that promises to let you deploy and manage WordPress sites using natural language. We explore how AI will impact everything from customer support to site deployment, potential pitfalls, and the challenge of balancing automation with human relationships.
If you’re curious about the state of managed WordPress hosting today, the interplay of tech, support, and AI, or just want to know what’s happening behind the curtain, this episode is for you.
[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.
Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case managed WordPress hosting and AI hosting innovation.
If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.
If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.
So on the podcast today, we have Malcolm Peralty. Malcolm has been immersed in the WordPress ecosystem for 20 years, starting out as a full-time blogger and working his way through tech roles in project management, agencies, and even a stint in the Drupal space. These days, Malcolm is bringing his experience back to WordPress, serving as a technical account manager at Pressable, a managed WordPress hosting company.
Malcolm shares how he found his way from early forays with WordPress to managing large scale hosting environments. He talks about the lure of the Drupal world, and why he’s ultimately returned to WordPress and Pressable.
We discuss what technical account management means at Pressable, how his role differs from sales and support, focusing instead on long-term strategy for clients, performance optimization, and bridging the gap between customer needs and the underlying WP Cloud infrastructure. We hear how Pressable proactively helps clients, sometimes even advising them to downgrade their plan if optimizations mean they need fewer resources.
We go behind the scenes in Pressable, getting into how hardware considerations, plugin bloat, WooCommerce or LMS sites, and customer handholding, all come together inside one company. Malcolm gives us a candid look at performance challenges, the way hosts interact with infrastructure teams, and why education around WordPress performance is so tough, even as competing platforms prioritise speed at all costs.
We also look into the future. What are the cutting edge trends in hosting? Like database replication, virtual clusters, and especially the rise of AI within the hosting experience. Malcolm explains Pressable’s upcoming MCP, an AI powered control panel that promises to let you deploy, and manage, wordPress sites using natural language.
We explore how AI will impact everything from customer support to site deployment, potential pitfalls, and the challenge of balancing automation with human relationships.
If you’re curious about the state of managed WordPress hosting today, the interplay of tech, support, and AI, or just want to know what’s happening behind the curtain, this episode is for you.
If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.
And so without further delay, I bring you Malcolm Peralty.
I am joined on the podcast by Malcolm Peralty. Hello, Malcolm.
[00:03:55] Malcolm Peralty: Hi there. How you doing today?
[00:03:56] Nathan Wrigley: Yeah. Very nice to have you with us on the podcast today. Malcolm’s got a really interesting story. He’s done a lot, a lot of it kind of maps to things that I’ve done in my life. But it’s a tech podcast, generally we talk about WordPress, but I think we’re going to talk about hosting, AI, and possibly other CMSs.
But before we do, a moment for you, Malcolm, just to introduce yourself and give us your potted bio, I guess centering around your relationship with technology, WordPress, CMSs, that kind of thing.
[00:04:22] Malcolm Peralty: Yeah. So first off, I like to always say that I’m Canadian. I think that actually kind of gives us some insight into a little bit about how I think. And I live just outside of Toronto, Ontario, Canada right now, and I’ve been in the WordPress, around the WordPress space for going on 20 years.
I started with WordPress 0.72, so before the 1.0 release. And I was a full-time blogger, talking about WordPress for several years, and kind of stumbled into using some of my tech skills to work in and around technology with WordPress, and then project management. And because of project management, I’ve been able to work with agencies that build like smartphone apps and other CMS systems, and custom CMSs for customers. But I’ve always kind of kept a toe in the WordPress world as much as possible.
[00:05:11] Nathan Wrigley: Yeah, and you firmly landed back in the WordPress world working for Pressable, which we’ll talk about in a moment. But you had a bit of a foray in the Drupal, Acquia world, I think. The word Acquia may not mean a great deal to people listening to this podcast, but it’s kind of the equivalent, I suppose the best mapping would be Automattic over on the Drupal side. What was your experience with Drupal? How come you’re not still fully on the Drupal side of things?
[00:05:35] Malcolm Peralty: Yeah, so that was kind of a strange one for me. I didn’t expect to have a position in the Drupal world. I had done some like Drupal project management before, a lot of like moving Drupal sites to WordPress or like revising a Drupal site, or adding a smartphone app to a Drupal site. But that was mostly, again, as like a project manager or a site builder, not as like someone who really understood the engineering behind Drupal.
But a long time friend of mine reached out and said, hey, would you ever be interested in a job at Acquia working at the Drupal mothership, so to speak? And the position was a technical account manager, which thankfully leans more on my skills as a project manager and someone who understands web hosting than someone who understands Drupal. So I was able to use the combination of 20 years of skills in the space to actually make a good go at it.
And I think one of the big reasons why I was so enticed and interested by the position is, honestly, Drupal jobs pay better than WordPress jobs. And it’s horrible and sad to say, but I think it was a really important factor in my determination on where my career was moving. If it wasn’t for the fact that Pressable came along when it did, and basically offered me a similar kind of pay scale, I’d probably still be in the Drupal space and who knows for how long.
[00:06:55] Nathan Wrigley: Yeah, that’s really interesting. I was a big Drupal user for many years but just found it was, there was a lot of things that I didn’t need that Drupal did, that WordPress could do. And so I firmly moved ship away from Drupal. Well, I think it was when Drupal finally went to version eight, so many, many years ago. Something like 2015 or something like that. And I certainly haven’t looked back.
So Pressable, you may need to go and Google that if you’re listening to this podcast. You may have heard that name before, but it is a hosting company, I guess managed hosting, dedicated hosting for WordPress websites. My understanding is they don’t do anything else. Pressable simply work with WordPress. But what’s your role over there? Let’s begin there.
[00:07:37] Malcolm Peralty: Yeah, so I’m a technical account manager. I’m the second technical account manager that Pressable has hired. They’re trying to build out a technical account management discipline. For those that haven’t heard the term technical account management before, you might think it’s like a sales role or something like that with a technical bent, and that’s not it at all.
We’re basically, you know, like WordPress and WordPress hosting strategists, right? So we’re thinking about like, what does your website look like a year from now, two years from now? What technologies do you need to be aware of? What end of lifes will come up that you might need to develop against? What plugins and tools are you using and how performant are they, and are there more performant options in the mix that might work for you? And so that’s really kind of the role that we take at Pressable.
Right now a lot of it is also kind of the pre-sales, right? Like which tier of service or product will your website fit into? What kind of customisations or optimisations might you want to make in moving over to the Pressable platform? And so we kind of go through all of that with customers of kind of a certain scale and size.
[00:08:36] Nathan Wrigley: So do you, as part of the job description then, do you monitor existing websites that are on the platform already and look for, let’s say things like bottlenecks, where something’s going wrong? The client may not be aware of it, but you can then sort of inject yourself, begin a conversation and say look, you’ve got this suite of plugins, that’s great, but we’ve noticed that improvements could be made here, there, and the other. And here’s a suggestion for something that maybe will get rid of that problem.
[00:09:02] Malcolm Peralty: We do get to do a little bit of that, not as much as I would like. My long-term hope would be that, much like Acquia, much WordPress VIP, TAM would be like a subscription service that customers of a certain tier would be able to sign up for, and have like that consistent access and that consistent monitoring where, like on a monthly basis, you know, we’d go through our client list and like double check all of them.
Right now we’re sometimes a point of escalation for support if need be, where they’re like, this problem’s going to take more than an hour to solve. Maybe the solutions team and the TAMs can kind of take a look at this and dive deep into it. We also kind of monitor the data coming in from our server instances. And, yeah, we’ll sometimes kind of cherry pick some of the ones that are standing out as not working as well as they should be, or using more resources than they should be, just as a point of like general optimisation, right?
It’s funny because our role helps both the customer because, again, we don’t care about the money side, right. So we’ll come in and be like, here’s the optimisations you need to make. Now you don’t need even as quite a big a plan as you have maybe. Maybe you need to downsize your plan now because we’ve helped you optimise your website.
But from a resourcing perspective on the Pressable side, it’s also advantageous because one, it makes the company look good to be proactive in that way. And two, it helps for server resources, right? We have our own cloud, WP Cloud, which is our own server stack. It’s not AWS, it’s not Google Cloud. And so optimising resources can allow us to have resources available for other people who maybe are bursting because of a big sale or front page of Reddit or something like that. So we’re always looking at those optimisations as an opportunity on both.
[00:10:37] Nathan Wrigley: Do you, as part of your role, get to sort of interface somewhere between the customer, the people who pay you to have hosting and the hardware side of WP Cloud? Because presumably on the WP Cloud side of things, there’s a hardware layer. There’s literally people putting boxes into racks and putting the cables in and what have you.
Because my understanding is WP Cloud is owned, well, it’s not AWS, let’s call it that. It’s not Google’s Cloud infrastructure. It’s not any of those other things. It’s managed, known by whom, you can tell us in a moment. But do you get to have a conversation, say, look, we’ve noticed that this bit of hardware isn’t as performant as maybe something else? Or, look, here’s some new thing that’s been released onto the market, can we get a dozen of those and try that out?
[00:11:17] Malcolm Peralty: For sure. And as Pressable continues, try to move towards the higher end of mid market to try to acquire customers that are using WooCommerce or learning management systems, we’re finding those platform opportunities where we’re providing like, here’s what we’re seeing, you know, here’s all this data that we’re collecting. Here’s what we think this means. Here’s what maybe our competitors have done, or what our customers have noticed on competitor platforms. How can we either like negate the advantages of other platforms? Or how can we find ways to make ourselves even better than them? Or, here’s what we’re already doing, great, is there any fine tuning that we can do to like eek out that extra little bit of performance?
We try not to be too prescriptive with the WP Cloud team because they really are the experts in the hardware. But we bring a lot of that WordPress knowledge to bear and say like, this is what we’re seeing from a WordPress perspective, what can you do on a hardware and software on the server perspective to kind of make this work even better?
[00:12:12] Nathan Wrigley: It’s a difficult juggling act to perform in a way, isn’t it? Because on the one hand, we’re always talking about how performant WordPress can be, and on the other hand, we’re always talking about plugins and themes and the fact that amassing those will slow things down. You know, you throw in an LMS or WooCommerce or something like that and suddenly the website is going to be a different animal, let’s put it that way.
And so on the one hand, trying to pitch WordPress as performant, and then on the other hand, there’s this whole bit that you are dealing with where the performance is somewhat under question. I’ve always thought that’s a difficult challenge. And certainly in terms of marketing that and making the public understand that, okay, there’s the performance on one side, but we can manage that on the other side. I think that’s a really difficult thing to do because you’re trying to communicate something incredibly technical to presumably a whole load of people, some of whom aren’t technical at all.
[00:13:03] Malcolm Peralty: And even worse, a lot of other competing hosts will hide a lot of issues and faults and sins that customers have made on their website through like heavily used Redis setups that like just make it seem like their website is so much faster than it actually is. Or they’ll buy hardware that is, you know, has like the fastest CPUs. And so from you as a single user testing your website, you might say, wow, my website is so fast on this other platform, but when I move it to this company, now it feels slow. But you’re not doing a test at scale. You’re doing an individual test, right?
So you go on that hardware and you put like 25, 100, 1,000 users going through a checkout process, and all of a sudden your website is slow as molasses and starts falling over. Whereas on the platform that quote, unquote, seems slower, it’s so much more resilient and able to handle that load.
So there’s so much nuance here and so many things that we’re dealing with and a lot of the job ends up being at customer education because it’s very easy in the commodity hosting space to be like, I’m going to move to this other company because they seem faster. And that really shouldn’t be your single goal. It should be understanding your website. But a lot of small business owners, medium sized business owners, even large business owners don’t really necessarily want to understand how their website is built and how their pages are built and these kinds of things.
And it’s funny you mentioned about the WordPress performance thing because sometimes I want to be like, just do this one thing for me, right? On our platform, turn off all your plugins, go back to the default theme, tell me how fast your website loads because guess what, it’s probably going to load pretty darn fast, right?
The problem I have is the customers that have 50, 60, 70 plus plugins, and two of them are different like builder tools, which is unfortunately the bane of my existence. No offence to like Elementor and Divi and Beaver Builder and all these companies that are making these tools to help people have their dream website on the internet. But man, are they ever heavy and slow when you’re trying to create a performant website these days?
And so, you know, I’m often having these conversations about, what is most important to you? And understanding as well that search engines like Google, and search engine companies believe that performance is a big deal because that’s how they manage their own infrastructure, right? If a website is slow, then they can’t really crawl it effectively and understand what’s going on with it. So that plays into a lot of the conversations that I have as well. And it’s never easy.
[00:15:23] Nathan Wrigley: Yeah, I imagine it’s not. I mean, I don’t know if the goal of Pressable is to make it such that you show up with your website, pay your monthly subscription, whatever it may be, and kind of that’s it. We will take it from here. I don’t know if that’s the goal. Or if it’s more of a, we will have a conversation with you, we will make recommendations and over a period of time, we will come to some sort of happy medium where, you know, what you’ve got is what you are happy with and it’s also performant from our side.
So I don’t know how much of a conversation is there. Any website that I’ve ever brought to Pressable has been fairly straightforward. I’ve installed it, it’s worked exactly as I had anticipated, and so I’ve never really had to get into it. But, you know, a website with 10,000 SKUs, and a million visitors a day, presumably there has to be some handholding going on there.
[00:16:09] Malcolm Peralty: Yeah, I think the big point of delineation is the cacheability of a site, right? So the ability for us to serve it without building the pages from scratch. If you have a brochure site, if you have a marketing site, if you are, you know, the only thing on your website that’s like a real user interaction is some buttons and maybe a form to submit, like a contact form or a marketing related form, your website is going to run perfectly on Pressable without any kind of handholding, without any kind of consultation. You’re going to be able to upload it and know it’s going to be resilient to whatever traffic you receive, and even like power outages in entire halfs of countries won’t bring your website down.
If that’s the kind of experience you want, those plan tiers exist and they work great. And we have agencies that throw thousands of websites on Pressable’s platform in that kind of umbrella without any kind of issue or concern or question.
I think the consultative part comes in when you’re starting to do things like I mentioned before, learning management systems, e-commerce systems, merch drops, custom contests. If you’re doing anything that basically has a different user experience based on adding something into a cart, or like completing a module of learning that needs to be tracked and following the user, typically this means that it’s going to be uncached, which means that it’s going to rebuild that page from scratch, and that requires a fair bit of resources.
We’ve optimised a lot of things to make sure that we can do that effectively, but again, the conversation comes into play, if you add in Facebook for WooCommerce plugin that breaks cache on every page load, then we have to work with our customers to understand like what that means, and what the trade-offs are, and what replacements might exist to make it so that we can cache the majority of sessions so that they can stick within their resource utilisations that we expect them to use.
Most companies, including Pressable will sell on like the number of visits to the website, but also another piece is the amount of workers, right? So these are the little pieces of software behind the scenes that actually complete all of the things that users are requesting, right? Serving up images and web pages and shopping carts and stuff like that.
We have a really cool model where we have one worker per one VCPU, which basically means you get your own dedicated highway for that worker. He’s his own little car on his own little highway lane. Where a lot of companies will do like 40 workers to one VCPU. So imagine 40 cars on one lane highway, versus five cars on a five lane highway. So the way that we process things is a little bit different as well, and so that requires a little bit of education on our side.
[00:18:32] Nathan Wrigley: I think there’s this whole mysterious scientific laboratory kind of impression to hosting, if you know what I mean? I’m imagining a room, a laboratory, sort of white walls and everything, with a bunch of people wearing white overalls with pens neatly lined up in their top pocket, and obsessing about these acronyms. Well, this isn’t an acronym, but you mentioned workers.
But you’ve got things like Redis, you’ve got things like edge caching and all of this kind of stuff. And honestly, to me, a lot of that is a bit of a puzzle. And I don’t know how you educate the public about those things other than just saying, just don’t worry about it. We’re here for you. We’ll deal with that complexity.
But also, I’m curious to know what kind of innovations are there still to be done? Now obviously we’re sort of crystal ball gazing a little bit here, but I am curious about where is the bleeding edge of server technology and hosting technology? What are the things which are just a little bit over the horizon, but are of interest, which may drop in the next year, two years, three years, something like that?
[00:19:34] Malcolm Peralty: Yeah, I would say we’re seeing a lot of web assembly type efforts, which is kind of interesting, which is, yeah, I don’t know if anyone’s ever seen, there’s a WordPress Playground site where you can have like WordPress basically running in a browser. You don’t have to install it anywhere. It just exists in your browser as like this ephemeral install of WordPress that you can play with and do stuff with, and then export to a real install of WordPress if you’re interested.
I think that is a super impactful and interesting technology, and we’ll see probably more of that in the next little while, and how hosts can kind of play into that. I think that we’ll also see better caching technology, better database technology, but also I think better replication technology. So everyone knows that a lot of WordPress kind of exists within the database, and so if you want to have high availability, you need to be able to have that database exist in multiple places. But if you’re doing transactions on your like primary database for like e-commerce, you’re like buying products and you have, Malcolm bought a t-shirt from my website, he wants this size and he wants it shipped here, we need to now replicate that to any other like high availability databases that we have. That replication right now is very old technology in a lot of ways, and it’s not as optimised as we would like it to be. So there’s a latency that exists there in replicating that to other places.
Acquia and some of the other companies I worked for, that latency could be really high or really low depending on how it was configured, right? How long do we kind of keep that data there before we send it over?
We try to do as much real-time streaming at Pressable as possible to make it so like, you know, within like two seconds, the data is now in that replication. And so if your primary goes down, you’ve lost maybe a second or two seconds of data. On some websites, even that can be really bad, right? Because if you, let’s say you’re doing a big product drop and you have 10,000 people wanting to buy tickets to your concert, and you lose two seconds of data, that could be hundreds of transactions that just evaporate into the ether. So better ways of syncing that data across, and managing that relationship between multiple servers I think is going to be a big transition that we see in the marketplace.
We’re already seeing the idea of virtual clusters. So multiple data centres pretending to be like one local server. So then we don’t have that same feel of migrating or syncing data between locations, it just pretends it’s all kind of in the same place. So I think that will be kind of interesting to see because again, that adds more resiliency. And I think, everyone that I’ve ever talked to, if you say like, how long are you okay with your website being down? Even if it’s not a moneymaking website, you’ll hear them say something like, I don’t know, maybe an hour at most, right? So finding ways to make websites more resilient is going to be important.
And then I think just a better understanding just from top to bottom on what’s happening with a website, right? So we have a lot of logging, but it’s not necessarily the best at auditing. So, for example, if Nathan came on my website and got access to it and deleted a plugin, I might not have the best tools right now to be able to say, oh, it was this IP address at this time, he logged into this user, he did this action, and have that complete picture to be able to kind of quickly and easily reverse.
We kind of depend on backups right now a lot of the time, and I hate that. Or we depend on like trying to fish through logs and make those connections using our human brains. All of that is just a really poor solution and I think AI will hopefully help with some of that, and I’m looking forward to having more of this like very specific picture of every action that has on a website without, again, adding a whole bunch of load to the server environment or a whole bunch of data storage requirements that makes it really impossible for organisations to kind of have all this information, right?
Because if I start auditing every action that I’m taking on a website that I have access to, and you think of Pressable having multiple thousands of websites, hosting platforms, you can imagine the amount of data we’d then need to record, right? So data compression becomes super important, or the ability to kind of infer things based on data that we’re seeing becomes important. The amount of work that I do in like looking through logs would make your eyes kind of pop out of your head. It’s brutal sometimes. And logs have never been very user friendly.
So again, another area that AI has been helping us with is like, okay, pull out the things that are potentially the most impactful, the most interesting, the things that stand out over like a statistics, probability kind of system.
[00:23:48] Nathan Wrigley: Yeah, I think what’s really curious about everything that you’ve just said is, so there’s this kind of impression for people who are just casual users of WordPress that you go to a hosting company, it’s a bunch of files and it’s a database, how hard can it be?
And then you’ve just given us a bit of a window into, well, this is how hard it can be, because there’s so many scenarios. And the typical mom and pop store where, like you said, an hour’s downtime might not be the end of the world, and most of the things can be cash and all that kind of thing. Well, that stands in real contrast to the, I don’t know, the gigantic megacorp .com company that’s doing 8,000 transactions every couple of minutes and there’s millions of dollars going through. And there’s just a whole other layer of things going on there.
And so you see the word Pressable and you think, hosting company, pretty straightforward. And I think it’s really interesting that you get an opportunity to come on and say, well, actually, no, there’s this other layer. There’s all this stuff going on in the background. There’s all of this technology. We’re thinking about the future. You know, we’ve got different geographical locations where things are housed, and we’re trying to speed that up so that there are all these different clusters. It sounds complicated, essentially. I’ll boil it down to that.
So I am a Pressable customer and when I go into the Pressable admin, I sort of log in and, you know, I’m presented with the usual array of different options. I would say that there’s more than probably somebody like me is requiring, but there it is anyway. You know, there’s lots of different options for tweaking this, that, and the other thing.
What I’m trying to sort of draw an analogy to is that it can be a little bit overwhelming if your day job isn’t to deal with a website. You log in and, what is this? What does this menu even exist? There’s probably ways of Googling it and finding it out. But I know that in the near future, Pressable is going to be launching sort of like an AI component to the hosting side of things. An MCP, you’ve described it as Pressable’s MCP. And then in parentheses, get AI to do things related to your hosting, whether that’s WooCommerce or WordPress or performance optimisation or whatever it would be.
So this is interesting. And I’m just curious as to how deep are you going to allow the AI to go? We all know that the AI, any AI can hallucinate. So I’m curious as to know what kind of things are you unleashing for the AI? Is it just a case of, okay, I would like the light theme now, please? Or does it penetrate much deeper than that?
[00:26:10] Malcolm Peralty: So it’ll be in phases over the next little while, we’ll unveil these features and what connections that we have. But eventually the expectation is, anything that you could do or click on as a user in the control panel, an AI could also act on and do as well. So a great example that we’ve been giving our agency partners is if you, let’s say, are working on code for a customer’s website, you could say to the AI built into your Visual Studio Code or your GitHub or whatever, hey, spin up another sandbox site, push this code, update the database, pull from production, all the files, and let me know when this is complete.
And the MCP will go and it will spin up a new sandbox site, a new WordPress install, with a new domain name attached to it. It will grab your code and push it up to that website. It’ll go to production and grab the files from the wp-content uploads folder, and sync it over to this new staging site or sandbox site that you’ve asked for. And then it’ll say, hey, by the way, it’s now ready for testing.
And you’ve done this all with natural language as a command behind the scenes. Or, let’s say you’re running a thousand sites, tell me all the websites that need like a Gravity Forms plugin update. And it will go and it’ll check all of your websites in the Pressable platform and give you a list of like, hey, here are the ones with Gravity Forms updates. And you could say, okay, update them for me please. And it’ll go back and it’ll do that job.
[00:27:24] Nathan Wrigley: So I guess the goal is to make it straightforward to use natural language to do a variety of tasks. Now obviously there’s got to be some serious guardrails around this because, you know, it would be very easy to inadvertently type, delete all of my, that’s a bad example but you get point. You know, what are the contraints?
[00:27:43] Malcolm Peralty: Yeah, please don’t use dangerously skip permissions, for example. So a lot of the AI tools that already exist have some human in the loop questioning. Are you sure you want me to do this? Are you sure you want me to do this kind of thing? And kind of seek their approval. We’re also talking about what, if anything, we’re really going to do on our side about that? We have pretty solid backup solutions put in place. So maybe if you, you know, accidentally said, clear out all of my platform, and it deleted all of your websites, you could then hopefully say, can you actually restore from backups all of those sites and have it restore from backups all of those sites.
So, you know, we keep hourly backups of database, daily of the WordPress file system, so there is that. Also our main WordPress install is simlinked, which means that you can’t actually change any of the core files. So even if you told it to delete WordPress, it can’t actually do that piece of it. So your WordPress install would still exist, but all your plugins and uploads and database would all be gone. But you could just restore them again using natural language.
So there are some guide rails that we can put in, but at the end of the day like, you’ll be able to connect whatever AI tool you’re using. Maybe you have Ollama with a local AI tool on your computer. Maybe you’re using Claude or Codex or something else. You’ll be able to use any of those AI tools. And so some of it is really on the person using it to put in some of those guardrails and those human and loop things. And I would recommend having a like system prompt that basically says like, before you do anything destructive, check with me first. Not that it won’t automatically do some of that, but it’s just good to have a secondary layer.
[00:29:13] Nathan Wrigley: And how are you exposing these capabilities to, let’s say Claude or whatever it may be? So what does that interaction look like? How is it that certain capabilities are available, but others are maybe not, and so on.
[00:29:25] Malcolm Peralty: Yeah, I mean I like to think of an MCP kind of like USB/API for AI. So we’re basically just making those kind of endpoints available to the MCP, or making like those API endpoints available to AI, so that it can undertake things on your behalf. So like our whole control panel is basically APIs all the way down, so to speak. So it’s not very hard to kind of hook those things up.
I think the harder part is making sure that the AI understands what these controls, what these APIs do, what they expect to receive, what they expect to give back, and what that all means. And once all of those kind of definitions are in place, then it’s pretty easy.
[00:30:05] Nathan Wrigley: I think one of the curious things for me is being inside, let’s say the Pressable UI where I’m navigating with a mouse and I’m clicking on things, everything is very intentional. You know, I go to a thing, and I do a thing, and I get a prompt to say, are you sure you want to do this thing? And I say, yes. And so it goes. And so every single thing that I do requires an interaction with me.
I suppose, with an AI, you could concatenate a variety of things. Maybe the AI has some sort of misunderstanding along the way, or you type things in such a way that it’s not entirely clear. And then kind of unpicking, okay, what just happened? It’s really easy to unpick that in the UI because you can say to the support rep, well, I did this, and then the site died. Okay, we know what happened there.
Whereas with this cascade of things, which is done with natural language, presumably this is where your logging, that you described earlier, comes in. There isn’t really a question there, but I’m curious as to what that process is. The capacity for many dominoes to fall from just one simple prompt, I suppose as a point of concern for you guys, because you are going to have to be unpicking all of this on the backend when things, which they inevitably will, go wrong.
[00:31:16] Malcolm Peralty: For sure. And I mean this is one of those areas though where we’re ahead of the curve. I think a lot of companies will be adding these kinds of things. But from an AI perspective, I mean, since October or November of last year, we’ve seen the skills and abilities and understanding of the top tier AI tools just jump exponentially. So the number of mistakes or concerns that we have have gone down in that same vein.
Our support team has also been trained up in a lot of these. And we’ve been testing a lot of these MCP pieces for a long time now. So we feel pretty confident that those that enable this and that have a good understanding of what this means and how to use it won’t make too many mistakes or have too many concerns or issues.
You know, again, we’re targeting a lot of our agency partners that are developers that already kind of live and breathe this stuff. So they’re also used to being able to untangle and knot if they tie themselves in one. So I don’t expect someone with their like first WordPress website on Pressable to enable MCP and start using it.
I really think this is most valuable to agencies or companies at scale. You know, if you’re running one website, you probably don’t need this, but if you’re running like 10, 100, 1,000 websites, then this tooling becomes very helpful. Because you can have like a, maybe do it on one site and now then replicate that same thing you just did across all of the sites I manage.
[00:32:33] Nathan Wrigley: I don’t really know how to phrase this question, but I’ll give this a go. At the moment, presumably you have a fairly solid relationship with your customers. You know, if something goes wrong, you log in, you enable the chat widget, you have that conversation. There’s this backwards and forwards, okay, great. And maybe there’s lots of clients that you get that you never have that interaction with.
But I’m just curious how that relationship over time might change with the advent of AI. And what I mean by that is, it’s almost like you’re not talking to humans anymore. And because of that, you start to have a different impression of the company that you are dealing with. Okay, it’s just some sort of AI entity, I don’t need to worry about it so much. Maybe loyalty starts to come into question because there’s no humans there anyway.
So again, it’s very hard to encapsulate what I’m saying, but presumably from a marketing point of view, there has to be some moment at which you say, okay, there’s too much AI now. We’re no longer a bunch of humans presenting ourselves to the world. We just look like a bunch of robots. Do you know what I’m saying there? Does any of that land?
[00:33:34] Malcolm Peralty: It does. I will say, we have those conversations internally. The expectation is always going to be like, when we add a new feature, it’s going to be added for humans first and then added to our AI tooling. But the only way that you can compete in the modern marketplace is to take advantage of some of the tools and opportunities we’ve been given with AI. As difficult as it is, there’s probably a business case, you know, I’m sure there will be businesses that will target people saying like, we don’t use AI for support, we don’t have AI integrations, we’re a completely human business. But I think the difficulty will be like scaling and competing in the modern marketplace.
And like a lot of the agencies we’re talking to are expecting this. They’re pushing us towards this because they’re looking to reduce their time to delivery, right? They want to be able to sit in a coffee shop with a customer, get a brief of the business, give that brief to, you know, an AI tool that transcribes their voice to words, and then have it go through this whole system of setting up a hosting sandbox for the website, set up WordPress, select a theme that matches their expectations, set up the brand colours, and almost have like a proof of concept at the end of a meal with a customer, that was assisted by AI.
And if they can’t do that first step of setting up a sandbox or a staging site for the customer, then we’re not part of that conversation at all. They’re going to go where there is that feature and that functionality, and Pressable won’t be part of that conversation at all.
And as end users, I mean, having AI assist with the things that agencies or higher touchpoint customers need, gives us that flexibility now to be available for the $25 a month customers who actually need the handholding and support from a human that we just couldn’t do otherwise, right? It just doesn’t scale properly at that price point.
So I think this could be advantageous to both sides if it’s used right and done right. But I definitely agree, there’s landmines that we have to kind of be cautious of and avoid, and we have to be very careful about how we apply this. And I think the key thing is always making sure that everything that we do is human first, and then AI enhanced, rather than AI first and human supplemented. It’s just a hard line to walk.
[00:35:37] Nathan Wrigley: It’s so interesting that conversation you’ve just described in the cafe where, by the end of the cup of coffee, you’ve got yourself a website based upon a conversation you were having moments before. The collapse of the timeline there. You know, we used to think that this five minute install was a big thing. Now it’s like the five minute website that’s fully ready to go, you know, or at least some simulation of a website. May not be the finished one but, you know, you’ve got a staging site ready, with a theme that’s adjacent to what you want to do, with some content that might replicate what you want to do. And it all took place in less time than it took you to finish a single coffee. And that’s so interesting. And you have to armour yourself against that.
That raises another question of course, which is how far you, your tentacles go into the website itself. Because traditionally hosting companies really didn’t concern themselves with the website, apart from the fact that the website was available and, you know, we can see what your plugins are and yada, yada. But it does sound like we’re straying into theming, and possible content creation and things like that. So I don’t know if that falls into the roadmap a bit as well.
So maybe there’s a future where you can, with the AI sort of say, I’d like to swap out my theme. It’s Christmas time, give me a Christmas theme. But we’re doing that in the hosting environment. We’re not necessarily having to log into the website. Again, do you sort of see where I’m going with that?
[00:37:03] Malcolm Peralty: Yeah, and I foresee for sure, but the integrations with AI that WordPress 7.0 already has, and the discussions for 7.1 make me believe that Pressable’s MCP will be able to talk to WordPress’s AI integration and do that from end to end. So, I mean we could already do it with the MCP, like adjusting database values and stuff like that, but that’s not what I would consider an ideal way of doing this.
But like I said, with the changes that are happening in WordPress Core, I definitely foresee like a complete end-to-end solution. You know, one AI talking to another, who then carries that task forward, reports back to the Pressable MCP and lets us know that theme change is done, those plugin updates are done, the content change is done. And again, all from that initial prompt, you know, maybe in your Visual Studio Code, which is just crazy to me.
[00:37:45] Nathan Wrigley: I am so used to basically not going back to the hosting until there’s a problem. You know, I go to the login URL for the website in question, I log in, I move around the WordPress UI, create a post, publish a post, schedule something, whatever, upload some assets. You get the idea.
And the idea of that not being the modus operandi for everybody will be so interesting, because it’s going to shatter that experience of, you know, you could watch a YouTube video to figure out the thing because everybody does the thing in the same way.
But it feels like we’re heralding a future where no two people are going to have the exact same experience. You know, you may be creating content through a text editor, which then somehow gets uploaded, or the text editor merely creates a prompt, and then the theme is swapped or amended because you’ve typed in some prompt.
So, you know, my UI, my IDE, my text editor, my version of WordPress, maybe I might build my site entirely differently to you. So that’s fascinating and slightly worrying at the same time because, how do you support that? Not just Pressable, but how does the community support it when we’ve got an infinite number of ways to create a blog post?
[00:38:55] Malcolm Peralty: And not just a blog post, but everything.
[00:38:57] Nathan Wrigley: Yeah, right, everything. Yep.
[00:38:58] Malcolm Peralty: Maybe you say you want this Christmas theme. Maybe it doesn’t select a theme and change the colours, maybe it writes a whole new CSS for the theme you have. Or maybe it writes a whole new theme, or maybe it writes a plugin that automatically switches it around Christmas time. Like it doesn’t have to pull off the shelf from the theme marketplace or the plugin marketplace that already exists. It can create something wholly new and specific for you.
Maybe it writes a whole new block for you, rather than trying to pull together three or four blocks to be able to create the output that you’re looking for. And some of these things for sure are not going to necessarily be super performant or super secure, especially initially, right? Maybe a year or two from now, once the AI is even smarter than it is today, or has a better understanding of WordPress than it does today. Maybe it will kind of think more about security and performance than it does right now. But you’re going to have these people deploying things that are not the ideal outcome, or ideal solution, or ideal anything. It’s just works for them right now.
And it’s funny, I always hear people talk about maintenance, right? How are we going to maintain all this AI code? We, humans are not going to maintain all this AI code. AI is going to maintain and update all this AI code. And so the joke of it is, if you come along and your host comes back to you and says, hey, your website’s running like a dog. You’re not going to spend half a day or a day trying to troubleshoot anymore. You’re just going to say, hey, AI, why is my website running poorly? Fix it or give me a list of things that need to be fixed, or what have you.
I at Pressable am already like using AI to basically write scripts that run through like two dozen WP-CLI commands, another two dozen like database commands, and some like full code searches. Give me a quick report on anything that needs to be optimised, right? So I didn’t write that script from scratch, I didn’t write that code from scratch to do that. I directed an AI to be able to create that for me. And now as the human in loop, I’m interpreting the data that it’s collected, but I can foresee a future very near where I say, hey, AI now interpret all this data you’ve collected and send a summary to the customer on what they need to change or do. Go and act on my behalf and make these changes.
[00:40:49] Nathan Wrigley: That’s so interesting. So there’s a couple of things. The first one is that it feels almost like we’re heralding in a future in which the WordPress UI maybe is not seen by everybody. So a good example would be, I have a Mac. I rarely use the Mac. I use things on the Mac. You know, I’m using a browser. I use a text editor. I use the application that we’re using to record. I’m not really using the Mac. I hope that lands, if you understand what I mean. I switch it on, but the Mac kind of just goes into the background and I use a bunch of things, which, they’re on the screen because I’ve got a Mac.
[00:41:25] Malcolm Peralty: And I would say like 90% of it’s probably a browser at this point, right?
[00:41:28] Nathan Wrigley: Right, right.
[00:41:30] Malcolm Peralty: It’s a website that you go to. You can do Slack in a browser. You can do what we’re doing today in a browser. Pretty much most things that I do live in a browser. There’s very few applications that I actually need to load on my machine day to day because everything can exist in a browser. I think that paradigm will just be for the next generation, or for the transition that’s happening now, the new paradigm will be everything just lives in an AI application. Whether it’s installing your computer or whether it’s also in a browser. It’ll just be AI.
[00:41:54] Nathan Wrigley: Yeah, so it is analogous to that. It’s just this idea that the WordPress UI, that’s the only method that anybody has had, maybe that will be something that a bunch of people use, but it won’t be familiar to everybody because there’s no need for it.
And the other thing that you mentioned is, I suppose I would use any of the stuff that you’ve described, but there’s the one caveat. And the one caveat is I have to know that I can walk it back. I have to know that there is a way for me to undo every mistake that I just made because I got carried away. I sat down, got a bit carried away on a Saturday afternoon, made a bunch of tweaks. I really regret it. I want to know that I can go back and unpick that stuff and for it to be a seamless unpicking. So backups, I guess is the most straightforward way of doing that.
[00:42:40] Malcolm Peralty: And audit logs, right? So like one of the things that I’ve done is, in my system instructions, I do put, before you do anything else, backup the file system, backup the database and create a, like a markdown file that’s going to be step by step, everything that was done, everything that you thought so that I can then review it. And that really helps me kind of get an understanding of the tasks it took and maybe why it took them, to help me refine future attempts, right?
So going back to what we’re doing in hosting, like we’re always trying to think through, like you mentioned, everything is very specific and clickable, and we want to make sure that the AI understands exactly kind of what to click on, or what to select. And having that auditing is super important for that.
[00:43:19] Nathan Wrigley: And that’s the point, isn’t it? It’s a human readable or parsable log of everything. Something where, you know, you’ve got millions of data points in the audit log, but I can actually drill down into that in a meaningful way. Because it may be that I only want to undo a portion of what I did. I’m happy with some things, but I would like to go back. An audit log, as you’ve said, it’s fairly mind numbing stuff.
But we are going to be producing so many more amendments if all we have to do is speak because you can easily, you know, imagine it. I want the Christmas theme. No, not that one. Try something else. No, there’s too much red in that. Swap the red for the blue. And Father Christmas, I’d like him on the homepage but, no, a different one. In 12 seconds we’ve got thousands and thousands of things that have happened.
[00:44:06] Malcolm Peralty: I will say though, how much of that do you remember doing manually, right? Like I’ve gotten to the end of that kind of thought process and gone, wait, there was like a theme like two or three themes ago that actually was, a little bit of customisation could have been cool. What was that theme?
Even as a human, I’ve had lapses in memory when I’m quickly producing outcomes where I can’t necessarily roll it back so easily. So at least with an audit log, you’ll have a much better understanding of what was done and when. Human memory is also failable.
[00:44:30] Nathan Wrigley: Yeah, and I guess it’ll be interesting to see how much of that burden companies like Pressable take on. Like, you mentioned backups, maybe it will become de rigueur for you every few seconds whilst there’s interactions with MCPs. Look, we’re just going to go belt and braces. Every time you do something, which we detect is fairly sizable, we’re just going to take a backup, even though you never asked us to just in case. You know, those kind of things.
And have a UI to surface information so that the audit log is readable and those kind of things. And that’s all ahead of you. So it doesn’t exist moment, but it’ll certainly be things that will need to be tooled and invented in the future, I would’ve imagined.
[00:45:10] Malcolm Peralty: I mean, one of the hard parts, this might be transitioning the conversation a little bit, one of the hard parts is, you mentioned that AI is creating all these artefacts, and now all these potential backups. AI is already like indexing all of these websites and creating a lot of web traffic, and a lot of load on servers, for example. We had a recent instance where an AI bot went to a website and kept on adding different products to the cart and removing them. Well, every time it added a product to a cart was now an uncachable session.
And it did this millions of times over the course of a day. So we were like, okay, we got to block this bot. This is crazy. So we blocked the bot and about like 10 minutes later we start seeing the exact same traffic pattern from a completely different IP address with a completely different user agent. The bot had figured out an end way around our block and was now doing that same task again to try to, I don’t know, understand this website better, right?
The problem is, as an industry, we don’t know how to pass these costs on to customers because they think it’s kind of unfair in a way, right? Like, why should I have to pay for additional storage for all these audit logs and all these backups? For more bandwidth for my website or more resources for my website, to host or send all of my pages to these different AI bots? And it all kind of comes on us where we either have to like comp all of this technical effort that’s existing, or we have to convince clients to be okay with paying for it. And that has been a really interesting change in the dynamic with a hosting partner.
[00:46:24] Nathan Wrigley: That is so interesting. All those hidden costs, all those hidden things going on. Maybe there needs to be a luddite toggle in the UI somewhere where you just disable all of it. I want the WordPress UI, I want to do things manually. This is my preferred way of doing things.
[00:46:38] Malcolm Peralty: Block ChatGPT. Block Claude. I don’t want any of them viewing my website. Forget them.
[00:46:42] Nathan Wrigley: But it will be curious to see if there’s a subset of people who are, as you’ve described, unwilling to pay for that stuff because it’s simply something that they don’t use. They have no anticipation of using. It will be interesting to see if there’s a subset of people.
And also how clever these technologies become to disrupt things like that. You know, malicious actors out there who managed to come up with a million different ways to circuit around the blocks that you put on. And it will be interesting to see if just the cost of being online does rise with the advent of AI.
I mean, certainly the storage of all of these things is certainly going to rise. The conversations with the AI is certainly adding a financial cost. You know, there’s lots of hardware being built at the moment and there’s a cost to that. Certainly isn’t cheap. But whether or not we can cope with that, and whether or not your price points can keep up with that, and whether customers are going to pay for it.
Okay, there we go. That is so interesting. There’s so much stuff to dive into there. We could probably talk for another hour or so, but there we go. So, Malcolm, if anybody wants to reach out to you or learn more about Pressable, I guess, where would we reach out to you? Do you do social media or whatever it may be?
[00:47:51] Malcolm Peralty: I try not to. For Pressable, it’s pressable.com. For myself, I’d prefer you go through my personal website, which is my last name, .com. So peralty.com. And if you do want to get me on social media, honestly, really the only one I’m ever on is LinkedIn and I only kind of connect with people that I actually connect with. And then Twitter or X or whatever it’s called, I passively view from time to time. But honestly, the best other places would be, you know, you could probably find me on one of the WordPress Slack communities, for example, if you’re really interested.
[00:48:18] Nathan Wrigley: Okay, so Peralty, peralty.com. If you are driving a car listening to this and you can’t write it down, then go to wptavern.com, search for the episode with Malcolm Peralty in it, we will have all of the links that were suggested and talked about during this episode right on the episode show notes. So, Malcolm, thank you so much for chatting to me today and peeling back the curtain a little bit on the hosting over at Pressable. Thank you.
[00:48:42] Malcolm Peralty: I appreciate it. Appreciate it so much. Thank you for having me.
On the podcast today we have Malcolm Peralty.
Malcolm has been immersed in the WordPress ecosystem for nearly 20 years, starting out as a full-time blogger and working his way through tech roles in project management, agencies, and even a stint in the Drupal space. These days, Malcolm is bringing his experience back to WordPress, serving as a technical account manager at Pressable, a managed WordPress hosting company.
Malcolm shares how he found his way from early forays with WordPress to managing large-scale hosting environments. He talks about the lure of the Drupal world, and why he ultimately returned to WordPress and Pressable.
We discuss what technical account management means at Pressable, how his role differs from sales and support, focusing instead on long-term strategy for clients, performance optimisation, and bridging the gap between customer needs, and the underlying WP Cloud infrastructure. We hear how Pressable proactively helps clients, sometimes even advising them to downgrade their plans if optimisations mean they need fewer resources.
We go behind the scenes in Pressable, getting into how hardware considerations, plugin bloat, WooCommerce or LMS sites, and customer hand-holding all come together inside one company. Malcolm gives us a candid look at performance challenges, the ways hosts interact with infrastructure teams, and why education around WordPress performance is so tough, even as competing platforms prioritise speed at all costs.
We also look to the future. What are the cutting-edge trends in hosting, like database replication, virtual clusters, and especially the rise of AI within the hosting experience. Malcolm explains Pressable’s upcoming MCP, an AI-powered control panel that promises to let you deploy and manage WordPress sites using natural language. We explore how AI will impact everything from customer support to site deployment, potential pitfalls, and the challenge of balancing automation with human relationships.
If you’re curious about the state of managed WordPress hosting today, the interplay of tech, support, and AI, or just want to know what’s happening behind the curtain, this episode is for you.
Discover the importance of specialized WooCommerce hosting and dive deep into WP Engine’s managed WooCommerce hosting features. From high-performing live cart functionalities to Stripe Connect integration and advanced caching, WP Engine offers a comprehensive solution for eCommerce stores. Learn about its unique features, the benefits of managed hosting, and get an inside look at the user-friendly dashboard. Whether you’re starting a new store or looking to optimize an existing one, WP Engine provides the tools and support needed for a successful online business.
The post “WP Engine: WooCommerce Hosting Meets Performance” first appeared on WP Mayor.
Establishing a robust online presence is crucial for any business to reach a global audience and make more sales. However, it might be difficult to pick the best web hosting service for your needs with so many choices available. To help you make an informed decision, we’ve compiled a list of the top 10 web […]
The post 10 Best Web Hosting Providers in 2023 appeared first on Hostinger Tutorials.
Choosing between WP Engine and GoDaddy for your WordPress hosting? Dive into our comprehensive comparison of their core features, performance, security, and pricing. Discover the pros and cons of each platform, real-time speed data, and insights into their hosting dashboards. Whether you prioritize budget, speed, or security, our review will guide you to the best choice for your unique WordPress needs. Ready to make an informed decision? Let’s explore WP Engine vs. GoDaddy Managed WordPress Hosting.
The post “WP Engine vs. GoDaddy: Which One Will Supercharge Your WordPress Site” first appeared on WP Mayor.