to need a photographer anymore so that was your point photography yeah but also creating variations I don't need to take a picture of in five different colors I can just instantly create it in five different colors I don't need Photoshop, I don't need anyone else to take care of that for me but in addition to that I think that over time and this isn't I think over time our expectations of content, media and images is going to change we are going to expect more extravagant images, more extreme images because that's some of the capabilities that AI produces so over time we're going to expect that and want more of that so I think our styles are going to change also over time it's going to take time but I think our expectations and styles will also change that would be pretty sweet I have so many like half-assed photos that if I could just take my photo feed it to AI and it could be back and be like here's a great product photo of nearly the same thing and now I don't have to worry about copyright infringement and I don't have to worry about is this really my content it's just elevating the quality of what I'm producing can you imagine in e-commerce you sell a shirt like this shirt and you sell it in five colors you don't have to take the pictures anymore I mean so many things also approaching different markets different countries like different kind of product presentations have different focuses if you could use AI to provide those kind of background images or settings and have basically I was called localized product pictures would be super also for websites we use a lot of banners and everything have that honestly banner generation would be so sweet yeah what about so on our side we produce as an agency our arm we do a lot of work with government we do a lot of work with education where accessibility is really important wordpress cares a lot about accessibility puts a huge amount of effort to making sure and it's an ongoing journey but we all know that the biggest challenge in accessibility isn't actually wordpress it's convincing the users of wordpress to fill out all tags and to have the correct color contrast and all the challenges that come to creating great products you know I think there's a lot of opportunity in AI to fill a lot of those gaps that humans have been spending the time on yeah we were discussing yesterday that when you need to write the alt tag for an image AI could do that automatically mid journey for example most of you have used it to generate images but you can also give it an image and it will describe the image for you so after that you can use that description and fill it automatically and that's been around for years it's not something new so in terms of accessibility there's also a revolution because it can give you a checklist of things that you haven't done and propose let me do those for you automatically do you want to change something here because it knows that they are not pretty much done I mean there's plugins out there that are already starting to do this with varying degrees of success I know the Yoast team is probably working on stuff like this I know the class of AI from 10 up a lot of this type of work and so I think we're getting to the point where there will be solutions out of the box I just like to see that in core I don't see why that has to be a third party solution that feels like some WordPress should do in terms of democratizing and making it really accessible is there what about I mean search and personalization one of my critiques of WordPress search is behind lots of other solutions that exist in the world where do we go in terms of just making it really easy to find and understand things do you have any active projects or work I know we've got stuff the thing that we've tried with search because our knowledge based on tutorials are based on WordPress and we're pretty much using it as a headless platform is that when you put AI in there it's very difficult to measure and the other thing is that it's kind of slow because we're not just trying to give you here is a link of your search like that post we're trying to correlate that information to the user to see if that's the best result and it gets sluggish at this time you know how if you're using right now it's much slower than 3.5 and I think that if it needs to be done properly it needs to be part of core as you said because if you're just thinking a third-party API for that it's going to be even slower so I don't have the vision to tell you how it's going to work to be honest because it can be obviously part of WordPress itself but the foundation needs to be laid there and I think that those language models the larger language models that we are querying right now years from now that will be a commodity like you won't have to go to OpenAI specifically or BART, there will be so many open source models that you can run on commodity hardware so on every single server which is running a WordPress website you will have a decent model which can do that for you and we're already seeing that with the release of Meta's latest model that had to be released slowly but it kind of leaked right now people are innovating super quickly and building things on top of it and I think that's going to be the future in a couple of years like you will have a language model running on every single server and it's going to be local for that server and it's going to work well for specific tasks I mean that's like if you think of something like WooCommerce or BigCommerce you know as a shop owner the ability to go in like hey what are my top selling products and I don't like have to query or find something hard to find and I don't remember what that brought like a natural language experience to get reports surface it right away that would be so awesome that would be amazing I want somebody build that for me oh yeah and then implement like really act on it too what is the best selling product do I need to like do inventory management you can use AI for that too just my inventory just my pricing all that that's really something super cool I think it gets interesting when you mix that and the first conversation we had around site building yes so if you can get to the point where you have a co-pilot AI an agent that can look at how your data is performing your shops performing and be like hey here are top three pages let's rejigger those let's run three you know the unit you were talking about feed AI that can do multi you know and some of that can do multi-variate tests and there's no reason you as a human need to figure these out like the if you've got you know like cadence will have the ability to build out full pages for you now and so if you could basically tie that into the take that I and say hey every period of time look at the performance try something experiment with it see if this has a better result and that result doesn't have to be financial although obviously that that's an easier thing to measure so last is a as a wrap up to respect our time we've we've talked about some things that are being built some some wishes what are you hoping over the next year that either people in this room that the community watching online that the community builds either in core or as independent products like what kind of solutions are you looking forward to seeing thanks one of the things that's really important is we're having a very in-depth conversation with a lot of you who understand AI and how it fits into our lives but I think the majority of the population has not adopted it yet so I think it's very important to help the community help everyone outside adopt AI better so making it more accessible for them making it more of a commodity so that we can become more innovative in society but I think and I can't say credit for this this is something our Chief Product Officer said is that currently we're looking at AI to replace functions that we are performing ourselves so we're looking for AI to make our lives easier to improve our workflow but I think the next step is understanding what does AI empower us to do that we could have never done before that we could have never even imagined before and I think that's where things become very very interesting and I would want to see more of that take yeah so we people usually overestimate what we can do for one hour for one year and underestimate what we can do for 10 years still waiting for my self-driving car yeah so I have two answers for that question first one is the professional one obviously we've discussed how AI will help the end users build their own websites with just requests like I want the church website to be in the exact form and it just picks it up for you and builds it the next step is actually using an agent to help you run your business like let's give an example with the e-commerce like give me a report of the best selling products that suggest three things that I can do to sell more or give me analysis of something and after that not just that but give it a go and it iterates in order to achieve that go so that's the professional thing and my personal wish is that the AI should be able to do my taxes for me and deal with the government because that's a whole shit of work WordPress is on it brother if it's powered by WordPress immediately you get 40% coverage of everyone on earth God you stole my answer so I'm gonna skip to you while I think I mean to be really honest for any of you who've worked with business intelligence tools they're painful you know and even like Google analytics like the average person to go in there and actually get any insight out of it is really hard it's pages and pages and numbers and queries and not I don't want to that I just want to have a conversation and so like honestly I would love to see our community start to build tools whether it's in the e-commerce space or whether it's in content space that looks at how my community is engaging looks at my content looks at my stuff and says hey try this or hey we've noticed that if you're a plugin owner all your sites that have WooCommerce and have your plugin at this have these characteristics you might want to put more focus on this part of your product and can create insights that allow you to create better solutions like that to me would be transformative. Oh totally you took part of my answer yeah with the community for me like there's two like looking in e-commerce at a shop yeah I would love to have that kind of AI that really optimizes my stores tells me from the beginning this is what I need does it analyzes improves optimize it maybe even have that automatic translation into different language so I have a store in English okay have AI launch the same one in you know Spain Greece that would be awesome for community because we work a lot with community development community feedback it is super hard to get the right sentiment get the right data and I so agree power bi not to say anything back but it's a difficult tool and so it would be super cool just to have a overall analyze the community sentiment community feedback aggregated and provides recommendations on improvement on and maybe even helps us yeah react to a lot of that and optimize love that for me as a business owner like we use so many tools in our business it starts with WordPress website contact form lms analytics CRM and the list can just go on right so for me it would be awesome if there is a just a slack bot or some sort of AI tool where I could just ask question and get insights for my business right now I have to open that page visit that website click 10 times and open 10 things and find that number right so wouldn't it be awesome if I could just say hey how many visitors did I get for my this website in last 24 hours or something like that I mean to realistically like even just to sit like we were talking about search if there was a native AI interaction with the content in a WordPress like I broke my leg three months ago I had to go through a whole conversation chart to just figure out how to navigate that and all the answers I didn't need a human to tell me they were all buried in a you know in a core of a manual it would have been great if I could have just gone to a chat bot and be like broke my leg what do I do oh well you're gonna we'll actually screw it we'll fill out the forms for you don't worry about it we'll get you how much PTO do you need doctor says three weeks okay filed for you all good like I think accessible which we all have in an internal wiki and act on it as a simple agent internally and make our lives better so with that there are a ton of sessions over the next day and a half today and tomorrow on on how to leverage for accessibility for block building for go mob them learn experiment get like real creative I think the biggest thing we don't know today is what's actually even possible yet we're we're in just your discovery phase within this but you're gonna get really surprised so that thank you just to be on the safe side here we are thank you so much for this incredibly interesting conversation people if people want to ask you questions they can grab you in the in the hallway track so here's your gifts thank you so much again in the meantime before you leave and just reminding you that lunch is served from more or less now until two o'clock and it's on three levels so it's on the skull coach us whole which is on level one they trained the balcony on level plus one and also at 230 there's another WP connect session which is in the Triante balcony and it's about coming back to in person events how the community lived this phase in 2022 and what to expect for 2023 so see you there and remember that the sessions start again at two o'clock bye bye enjoy your lunch I mean we've got Yo's here today and we're going to ask him some questions so I guess the big topic at the moment that everyone's talking about is AI there's a lot of chat there's a lot of chat and you're also an SEO guru so I guess broadly what's your have you been taken by surprise of how quickly this has hit us I guess well I've been mostly surprised by Google's response to it I it so chat GBT came and suddenly everyone was in panic and it was hilarious to see that and also a bit frightening in that they really seem to have been caught a bit by surprise yeah it's interesting I think it has many many implications of things that we can do with it that are awesome it also has many implications of things that we're going to do with it that are going to be fairly bad for everyone involved yeah so fake news was a problem already it's not going to get any smaller with this yeah and I think that's going to be hard to bustle for Google for a while because suddenly it's not just fake news it's fake everything so recipes reviews whatever you want suddenly all becoming a lot harder to realize like what's real what's not and I saw that Google are starting to experiment with generated changing the search interface so the top bits going to potentially start to use chat to VP like answers how do you I guess a few questions one is do you view that as a good thing to how do you how do you view that's going to affect content creators and actually three how do you think that will affect the SEO business community I think the answers are actually all connected because I view that not necessarily as a good thing okay mostly because these models are not built to generate truth they're built to generate text which is something totally different and I think that we we've been so trained to think that what we find on Google is true yeah and that is a very scary thought and those those large language models just generate the next word I mean they it's it's like what's the most logical word is next it's not like what is the right answer to this question yeah I hope that they all iterate and make it actually good but so far and what we're seeing from the early people that have access there's a lot of nonsense in the results and well I hope we get rid of that before it becomes really adopted mainstream then the problem is that once they start generating their text the question is how do they send traffic back to the websites that they based their answers on and so far the answers that I've seen to that question are not very positive so I think little features snippets maybe and some of them have some links etc but I think overall traffic will go down and so Google will become less of a referring source which is not good for anyone it's certainly not good for sites that rely on that traffic to make money to be able to generate more good content the problem then becomes if more of those models don't work then there's less new good content to train the AI on and it sort of becomes a self-defeating thing and do you think Google's business model is going to hold it back from for example the Google search page is being kind of broken for a while really I mean in terms of the I see a lot of searches where actually the page is almost like paid ads right, so it feels like it's kind of been broken for a while the thing is is that broken though I think it's actually working quite well in terms of their business okay but from the user sort of search intent experience so for a normal user if they get what they want from those paid ads they're perfectly happy right so if Google succeeds at actually giving results that are good and get paid for it then they're actually doing a quite good job I don't think they're always doing that and I think that if they struggle with that too much then they leave room for competition which I sort of like Bing was the first to have chat GBT in their interface that's also why Google is now trying to push it so hard because suddenly they get beaten and I love that because we've had Google dominance for far too long it's not good for a company to be that dominant that long I think that will bring improvements I think there's a lot that we could do with AI in all sorts of ways that can help all of us I think we have to realize also that we need to maybe train people and what they can believe and can't believe on the web and with that it also becomes more important who wrote a piece of content a generic post about SEO is worth a whole lot less than a post written about SEO by John O'Eldersen a colleague from Yoast in the past who had a SEO there I mean if he writes something and you want to read that, you're noted you're reading his opinion if you're reading a generic piece of content whose opinion is that and what is it based on is actually true so the author becomes more important and that in a way is very good for us in the WordPress ecosystem because suddenly blogging becomes a thing again do you have any discrete advice for content creators who are starting to leverage AI in terms of the content they're producing would you say go for it or would you say hold off and don't use it so I think it's a good tool if you make it generate too much text then you need to check every fact that's in there so that's a bit hard because the things that you won't check because they seem so logical will be false I mean the first time I had chat GPT generate a bio for me it said that I was an investor in rank math and while I appreciate that that is a plugin company as well I actually did not invest in rank math so it is like it's confidently wrong a lot yeah and it is very confident in how it works those things and that means you have to check everything but at the same time having it help you create summaries could be very worthwhile so if you were going to predict a year or two years out of what this all looks like for us what do you have a vision of what that might can you start to piece what that might look like I think that's hard actually it's moving so fast I think that what we're seeing so far in the general world the like generic text creation is only a tiny bit of what's to come if you look at the AI agent space a bit that is super exciting you can create an agent you can ask it to do something like research a topic and it will come back to you with stuff I think that using stuff like that will become a major driver of innovation but also of making people more productive it's already like there's large companies out there that have built their own coding models to make their developers more work faster and work better and you see people saying things like hey 30 to 40% faster more code being committed by the same amount of developers I think that can actually resolve some of our scarcity issues so I think there's a lot of good I was watching this Ted talk about the Khan Academy and he was talking about the fact that every kid could potentially have their own personalized tutor so I think there's great things that we will be able to do with it it'll take some time so just a couple of final questions this is a negative question there's been a lot of catastrophizing around AI and governments are getting involved in trying to put guardrails so do you worry about some of that stuff or do you think that's overblown I think the guardrails I need it and my worry is that governments are not moving fast enough okay the guardrails are needed we need to also train people a bit more in what is this actually and which things are they doing and which things are they which things are they are we telling people that that AI is good for and is not good for there's a bit of a a worry there it's interesting because it's just hit my kids at school because Snapchat introduced an AI so suddenly all the kids in all the schools in England now know there's this thing I don't know I think there's already quite a few Macbeth type reviews and stuff being written by chat GBT so I think organizationally it's interesting how schools are going to be forced to change really quickly same with government so they're going to try and stop it which I think is weird that's not how this works but use it right is also hard so yeah it's going to be an interesting thing I'm not necessarily very thinking that the world is going to blow but I do think it needs guardrails and do you think, final question the big worry for me is always being around this single like we're creating information systems used to be distributed and then we started to centralize them with things like Google this feels like a further consolidation of like we're creating this super brain that we go to for our single source of truth but then I kind of start to investigate the fact that we might have different LLMs I think we'll end up with lots and lots of different LLMs and that's actually better than having one bit Google I think well one of the things that I think should be regulated is like when you work with an LLM you need to know what's in it and that should be like public knowledge and if you know what's in it then you know what you can use it for and I think that that is something that there's no visibility on that at all no right now there's not and I desperately hope that we'll get laws very quickly they say okay if you're an open AI type company you have to tell us what's in your model and then some publishers will start complaining like hey but why are we not getting paid for this and that's the discussions we need to have brilliant thank you so much my pleasure was it good? yeah it was good for all the watching live stream audience went crazy when I asked this question just so you know so yeah welcome for all of you who are like here for the first time this is how we do it you know this is the size and the hey this is the size of the regular work in Europe I would say so yeah joker aside so we have in this afternoon session we have lightning talks two lightning talks and for you who are not we don't know what the lightning talks are those like 15 minute sessions with no questions but you can reach out to our amazing speakers after catching like in a hallway or outside or whatever so yeah our first speaker is actually a musician and a songwriter so with his band called helica which is now back from sabbatical thank you Dario for bringing that one in he comes from Slovenia and he's going to talk about AI using like translations but I'm not going to do it you're going to explain all of it so a big round of applause for Dario hello thank you so let's talk about translating your site WordPress site with AI let's see quickly about me that's me an old photo I work for an undergo systems company you probably know us by our plugin for translating your site and toolset as Milan said I live in Slovenia with my family my wife and my daughter Gloria hi Gloria if you're watching and what I do is I lead the content team so everything with writing like announcements technical documentation you know partnership articles everything that's content that's my team and obviously when we talk about AI today this is something that interests me right so let's start about AI translations today to tell you about what I think about AI translations today I need to go 3 years back when I was first really really kind of blown away by AI translations there's this site I often visit it's foobies.net it's about like art photography digital art so I came up with an article with great photos it's nice but it's French I don't speak French so Chrome tells me like do you want me to translate this page for you and I said sure and it does and it's just like great it's like talking about art which is not always an easy topic not always easy language and it was great and this was 3 years ago look this is not the text I saw that day but I just wanted to show you so this is in French or as they say it's all Greek to me so you know let me just read you one sentence the first sentence how to recreate in a scenographic exhibition the unique atmosphere that reigns in the masterpieces of filmmaker Stanley Kubrick pretty nice I don't know if I wrote that in English I would be kind of proud it's nice okay so that's my point that's kind of like that was 3 years ago that I was blown away and we've gone so far from there and with with chatGPT and everything going on you can only imagine where we are today so how does it work I wanted to tell you like all about it but it's really complex and it can get very technical and you could actually have a whole talk about how AI translations and AI works in general maybe even five talks so just very generally it's like neural networks learning from vast amount of language data and finding kind of statistical probabilities of like what comes next and that's how it works in essence there are tons of articles there so if you you're into this just google it you'll find tons of it but language is complex so you know it's hard to predict everything right so the thing is today for what we usually do like the sites we build at least in my experience and from my colleagues and friends like AI translations today are great they will cover you completely you know there are exceptions of course like science and medicine and you know law that's all that kind of has its own like intricacies so there you would probably want something human like a human review ok now my opinion is like I can talk to you about how AI translations are great for like whole two days and it doesn't matter unless there's a why ok and you need a why like why would you do it ok so here's me trying to kind of tell you why in my opinion ok the obvious why is like reach your larger audience ok so you know if you translate tools you're from a country that has like 10 million people maybe you can translate to a bigger audience 100 million people people are proven by like science research that they prefer buying and shelling out cash in their own language ok so conversions and sales are better you get better SEO because now you're not ranking only in like your language or the default language you're ranking in more languages so that's better for you of course and you boost your brand awareness because if you're present in a company sorry in a country that you know you're not translated to your it doesn't make sense like imagine here in Greece having like I don't know Microsoft without being translated to Greek it's kind of weird right it wouldn't work at all and of course user experience is better it's definitely better most of the people prefer doing stuff in their own native language so it makes sense but in practice ok the why in practice so this is where I live now in Slovenia so Slovenia is a beautiful country that has 2 million people ok so that's 1 million less than Athens the whole like city you know so it's it's a small country like with not too many people so how do we reach more people by translation ok so let's add Croatia I don't know if I mentioned I'm a region for Croatia so I translate my site to creation now I'm from 2 to 6 million Hungarian 16 million plus Austria they speak German so I put 25 millions but actually many more millions of people speak German so it's more and Italy it's 84 million so we went from 2 million in Slovenia to just neighboring countries to translate to and we can now reach 84 million people of course you don't reach them all like anything else but you have a much larger pool of people much larger audience to work with and finally it's not only about just translating so when you go to other markets for example I'll stick with my kind of example I'm from Croatia I now live for a long time in Slovenia and I know both countries I have my networks I have my friends but even with all of this if I want to expand my company to Croatia from Slovenia if I don't translate it to Croatian it doesn't make sense it won't work no matter my network no matter my reach and no matter that we used to be in the same country we used to be in Yugoslavia together and our languages are both Slavic similar but also pretty different and another part of this why that I would like to share is why AI translations because you can use human translation you can do it yourself but AI translations today are super fast super affordable and super accurate so that's that part of the why now how do we do it in WordPress because we're here all into WordPress right so how do we use AI to translate our WordPress sites you need two things first you need to decide which engine you want to use there are a lot of options there I mentioned them and then you need a plugin because as you know WordPress core doesn't have multilingual features yet I will touch upon that in my last slide so let's choose a translation engine first we won't choose I will just tell you about it Deepel, Google, Translate Microsoft Azure you have Amazon and a bunch of other options okay and the thing is they're all great really so there are tiny differences like between some language pairs and like you know but they're really good so you choose from what you need but in my experience in kind of our experience as a company who do stuff related to translations Deepel has the edge okay it's leading the pack a bit okay but it's not like by a big margin but I would choose Deepel and then you need to choose a multilingual plugin so you know what I would suggest there but so you have options I think that's great you have options you're not stuck with solutions there are multiple solutions there so you have WPML you have Wiglot, GTranslate TranslatePress Polylang you know there are a lot of options okay so how do you choose my suggestion is think about what you need okay I know pricing is important to everyone myself included but don't let it like kind of only that you guide you because look for what you need really so first does it support the engine you want to use be careful because not all the plugins support all of the engines you know so if you want a specific one be sure it's that translation management it sounds a bit abstract but it's actually very simple and very important what can you do with your translations can you send them to not just AI but to other people to your friends to reviewers like this is important you may not know it once you decide to start building a multilingual site but with a bit of kind of research online you will know what they mean and then we come to pricing which I mentioned and there are two prices of course plugin and AI translations so be careful because some options start free but if you want very basic kind of features it kind of adds up and then you are kind of in the very expensive area and finally do you need a human review it depends it depends but like many many people do want it so you know if that's important definitely look which plugins allow you to review and edit AI translations again not all of them do so how does it actually look like of course it depends on what plugin you use so this is from WPML as you can see it's very simple it's like a dashboard and this mode that is on the screenshot is actually where WPML takes care of everything it translates in the background all the posts all the pages whatever you tell it to and when you add, edit it just works okay but you don't need to use WPML or other plugins like that you can also tell it no I just want to translate this and this and this and this and be in charge of what goes on this is for example for translate press you can see like translation the English original language on the left side and the translation on the right and most of the plugins allow you to edit translations but not all so be careful there and also if you need a full blown translation editor which I very much suggest that you kind of go with a solution that has it it will help you a lot because it saves time it's kind of like a translation tool for you it has glossary and stuff and this is the question so how do we get it reviewed be careful because not all of them allow you to do this like there are plugins that allow you like okay you can edit translation by yourself okay but like if we take that site for example I don't speak French so how can I review French language so obviously I need to invite someone it can be like a user a friend so this is what I would definitely keep in mind when going with like translating your site with AI and so here's the point it's not all about websites because we are WordPress community we do many more things so we build teams teams for clients teams for the ecosystem we build plugins also for clients we build plugins for for everyone you know free freemium premium whatever so how do we translate it and I can tell you from our experience we have been translating our own plugins for years and it's a pain in the behind and it's super expensive like we went the professional translation route and it's thousands of dollars it takes time it's you know it's just like complicated okay so what I want to just like mention here today is that we built a free tool for everyone on this site ptc.doubleclinl.org and it's free and it will stay free and this is the first iteration that we wanted to share with the community and please if you if you're into this if you need this to translate your team plugin you know use it and let us know you know your thoughts feature request whatever because this is the first iteration we are already working on better stuff like for it there will be like in premium later but this stays free and we are already starting to use it for ourselves and it's really nice so this is what I wholeheartedly suggest and let me know how it goes so in the end what's the future of multilingual WordPress I don't know that's the thing so Gutenberg phase 4 promises these multilingual features I don't know what's being discussed what's being decided probably not too much yet because we still have phase 3 you know so it's some time away so it will take a bit of time but by the fact that Jetpack just released an AI assistant in their own plugin I have a feeling that multilingual phase of WordPress will and should definitely include some sort of AI integration because it's the only logical thing and I'm sure that like people who will be working on it will you know they will they will know what to do so but it's for us to see how it goes and I'll be happy to if anyone knows more please let me know so that's it thank you very much thank you thank you Dario this is a small gift we have for you thanks a lot thank you Milan thank you so much for your time and thank you for the tool thank you for sharing so our next speaker is a huge horror fan we're gonna learn about how to harness AI to enhance the accessibility of our website and resulting in increased user engagement and better overall user experience that's it Sarah take it huge round of applause for Sarah please thank you can you hear me are we all tired of the AI yet or okay I promise this one is gonna be quite specific and it's light, short and I want to ask questions so please be ready okay that's my last one oh you got the spoilers okay sorry that's all yeah okay first thing I want to tell you that my slides they are with a little help of some AI tools and it's not relevant to talk about them but I put some notes on there can you read it yeah so if you want about any of them you can just ask me later okay so a little bit of background my name is Sarah he said I'm from Norway but I'm actually from Brazil and I'm 36 now and I've been coding since I'm 16 I'm a full stack senior developer and I'm a created coder on the side apparently I cannot make all the emojis work so I have I start working with WordPress 10 years ago when I moved from Brazil to Norway and I'm a partner in a company called Guinness Design and it's probably the northern most WordPress agents in the world we are in Tromsø really really really up so Tromsø is a very peculiar place there are three weird things I want to tell you about my place where I live the first one that we have northern lights all the time like in winter when it's dark and we have midnight sun right now like there's no night just sun 24 hours and the third weird thing is that the European web directive is such a strict way in Norway that it's literally illegal to have inaccessible websites any of the reasons here okay you know that right yeah so worst case scenarios you get you get 15,000 per day euros to pay and we saw it happen it's like it's like there is random controls but they only make them big companies so it's not like for everyone but it's pretty tough and even though the responsibilities of the companies is always fall upon us as agents and content creators so we at Guinness we had to like oh my god we need to step up our game normally accessibility was like our afterthought but then it became like it had to be part of every step of our process right so how do we do that and do you guys think Norway is exaggerating hold the thought okay let's talk about something fun for change yeah AI so specifically generating AI so there is like countless of AI tools popping up every day like AI can write and can write really good I heard from Yuvanova Harike that's his name like that's really on point that AI is hacking the operationing system of human civilization which is language so it's yeah AI can compose music AI can code and me as a developer I think we talk about this AI as well but like how many developers here have tried co-pilot yeah and co-pilot together in combination of chat it is like super cool right it's amazing but yeah AI can also illustrate that's like the most fun thing we can do for now can we really see the full picture now I don't think so right like we we still like for sure is changing our way of working as designers developers and coders and content creators actually but we cannot actually grasp the capabilities of AI even the developers they are like keeping surprise of what the outcomes and the speed of they are learning like even to keep up with AI I'm signed up for all the newsletters and then for papers and then like we cannot just read what's going on like every day there's news and there's something and then bad good no so it's it has this overwhelming feeling right it's like we cannot keep up do you guys have this feeling too about AI it's like who has it okay good we are on the same page so that is this frustrating feeling and then this I cannot keep up with things that's 60% of the global population they experience every day and they are people with advantage not advantage disabilities in the world so it's like 1.3 billion people can't be able to ask vital information on a website for example that frustration feeling that's like come on just because we as developers and content creators didn't think about them so I think that now that we are related with the frustration feeling can we agree that noro is actually not so wrong on making it really hard, really strict with accessibility so because we had to keep up with our game and as earlier doctor I'm obsessive with AI so I thought that I could save you guys some time because AI could help us to to automatize things and make it think faster and then maybe our next project can be a bit more accessible but first of all what should we be checking you know like you guys know like how the rules what can we check where to go and how the areas so for that I have a tip for you and I think they are here are they here it's just open source initiative called ALIY and there's the idea is to make accessibility easier and they have this check released with everything we need and it's like it's updated if it's needed and it's so well written and easy to understand so you guys should go check it out so it's like it's super cool and then I'm going to bring you three of my favorite tools powered by AI one for design, one for code and one for content but related to accessibility of course so the first one is design I want to know how many designers are here not so many do you guys use Figma Figma XD or Sketch so have you heard about Stark just my colleagues because they use so it's a plugin you can add on your design of choice and it's going to the sidekick one it's a plugin of the plugin it scans your design and gives you tips normal tips of general contrast and stuff for accessibility but with the AI it's going to read into your context because not one fits all especially with design and accessibility but there is just a whole conversation of accessibility and design it has to be boring so now it might not need because we because AI can help you into the context of your own design so the second one it's a code so after you made your design and you feel like it's good enough you can do a prototype you can write coders here okay, yeah so we normally have our way of working that's like you put the right tags I know you guys do it right but it's still good to test it out so apart from the tests that we guys know there is this audition here which is a website a service that can send your link and then they audit and they are very specific AI powered to give you some insights and also with the context of your project and give you a full report it's super good with test it out it's amazing and what I like most on this they come with WordPress plugin that a toolbar on your website accessibility menu kind of we call how we want that it comes with some specific user needs that we might not remember or of course the user could have it on its own browser but what if he doesn't so it would just change the UI of your web we don't have to do anything and it's just gonna fix it for them so I think it's pretty cool and now a content tip for you guys do you know that for your website to be accessible it needs to be 8th grade level of your content do you guys know that so how do you know that your content is 8th grade like or of course there are specific case but in general right but how can you check that you could use a plugin that can be your assistant while you're creating code or creating content and this is probably how guys heard about this plugin it's super cute but it's actually super useful on content creating on your website you get a content generator but you can also have a chatbot that you can just double check like is this a tone good or should I change this is my target should I change my text should I change the tone and one little thing of that one that I really like that you can add your own chatbot on your project and you can train a chatbot as a client you're going to need the API key of open AI but if you already use a chat you already have a login there so you just go and get it it's not like you have to do anything more than that and this is an example of that chatbot of the website of them and that example remind me something really important when it's about AI that's written I don't know if you can read don't believe everything Neo says so right now we are in a level of AI that we cannot trust 100% right so if we're creating content please always check the source and if you are don't be afraid of AI take your jobs for now just saying and if you are generating like music or art that it's you are referencing it to some style please check copyrights and if you are coding please always check documentation because AI is cool, can be awesome but it's not Oracle of Delphi you see the Greek joke so but yeah, AI is not out that yet but if there's something that I really believe AI can help us right now is to overcome this gap of accessibility we have on websites that's like come on like instead of making AI draw a super new marketplace why don't ask them to do useful things and be more inclusive you know because and I really believe our community WordPress it's so powerful so if you work together we can totally make the internet a more inclusive place one website at a time thank you applause thank you Sarah right on time wow thank you what a great introduction we have a great talk just after we are finished with the third lightning talk please don't leave the room just yet because I will ask you the second question that you're going to need for your cards so our next speaker an amazing guy he comes from Germany and he's going to talk about the chat GPT and all the amazing things that chat GPT can help us out with the SEO so a big round of applause for Silvio hello nice to be here thanks for invaded for the speaker here in Europe now content creation with help of IA that's me I'm a middle designer and front-end developer from Cron, Cologne from Germany all about me you can find on my website now unless the power of automation but how we can start it chit in, chit out this is important for the conversation of AI for slow ring complexing tasks official intelligence needs these three of information goals expectation infos and examples with these three pieces of information you create your own prompt but what is the prompt? it's the input sense which is intended to stimulate the AI to generate a certain type of output now you learn these three topics with when you use chat GPT you can take research content structure and content creation and if you have time my bonus slides my case study first one topic search this is one of the important parts in the content process to find relevant and interest topic for the target group now how you do it I call or I send to chat GPT the main goal the intentions to create numerous details and in-deep advanced articles on the topic dog and cat food and beyond so this is my example my acceptance I need to talk about topic suggestions example I give chat GPT the following instruction so the topic section into the following categories conversation conversion related topics product new topics close to the topic topics and future topics reference on the right side for example for conversion related comparing red and dry food brands and cons and the further topic maybe choosing the right food for your pet now we have found with this prompt many topics thought by the relevant categories so prompt you don't write down you can later on the website and now we want to create content for a relevant keyword maybe cat food without sugar and grains let's start with the content structure so better you formulate what you want said more likely what you want I ask can you please give me all all topic suggestions that I should describe in this detailed full guide article it's possible please structure the topics already as possible headline for advance article and write each heading information absolutely must be explained there in detail and response here's our topics headlines for example white sugar and cleanse are bad for cats or making or making your own sugar and grains free cat food you need more no problem ask for more and response more finally we want to create content now I give the following instruction write out the first headline for me I ask to address the following sub topics explanation of input importance for sugar and cleanse free diet and cat food possible head effects of sugar and grants on cats and future more I give to the instruction to all key words marked with brackets so I can found later to be following my instruction and response this article on the right side so he write me a headline a CEO friendly headline and content and all the the sub task he do it for me I have a tickle about cat food without sugar and cleanse we have time really good so my case study I make two domains one topic and two and over 100 different contents I analytics and and I make affiliate shop for cat and dog food and one is one to condensers created with chat ETP and another and another version is created by unique writers and the result is about two months and the index chat say AI version have more pages more impression more clicks better position and Google and more page views the duration time it's more the bounce rate it's smaller and action more visitors are higher more clicks on the button to the store and more sales it's critical what you do with this information so I'm finished really quickly yeah thank you can I take a picture this was really good so everybody wave thank you thank you this is a small gift for you so here it is thank you so before you leave you remember the game the postcard game we had but we discussed on the opening remarks so if you missed the first question go to the community built in the expo area so the second question is in how many languages is WordPress translated into that's the second question just say no but if you missed the first part it's in the community so yeah we take a quick break for 15 minutes and after that we continue with state of WordPress security insights from 2022 with Oliver Silt session with me I have a guest Viola Gruner she is from Germany now living in Austria this morning she had a session it's called test instead of guessing generates more leads through growth hacking hello thank you I love it it's amazing really it's so great I'm so fascinated it's my first word Camp Europe it's amazing it's your first word Camp Europe but I heard that this talk you had this morning it's not the first time on a work camp is that right? I had one in World Camp Lisbon but it was a lightning talk so it was my first big talk today yeah so now it was a big talk and it was a small talk in Lisbon yes you know why sorry okay that's so nice I thought it was worth having a larger session for that so can you share something on the information you gave on stage yes I just I can share some so thank you first that I got upgraded no not upgraded but that I had this chance to make a bigger talk out of it because yeah testing instead of guessing is a very important topic in my view because out of my experience I learned that you often think okay my God feeling says that's the right decision but if you test it you see hey wait no it's not the right decision so yeah I brought some examples and what and in these examples approved really how we are not having the results we thought so our God feeling sometimes plays a big trick you know so it's important to test and especially in marketing it's a lot of blah blah blah very often but if you are testing you can show things and it's great because you can celebrate also a not successful test because every test is a success can you give an example of how this would work yes I yes for example the sales team to add one more form field to the contact form and my God feeling said oh my God no we cannot do this one more form field will drop the conversion rate and yeah so we researched it and there are a lot of proofs that the conversion rate will drop and if you add more form fields and so yeah I said first no but then I said okay let's test this and the numbers showed something different so the conversion rate didn't drop and then what yeah then we implemented the new form field to the website so you already had the idea what to do because you did the testing yes so I had the idea because you know sometimes the sales team says hey we need this we need that and you're in a conflict but then you say okay we tested we test your idea we test your form field and then we tested it and then we saw we can implement it and we had the proof that the conversion rate is not dropping so everyone should test I think yeah so the manager was happy yeah I was the manager you were the manager of course sorry mother no no no but the founders were very happy the sales manager was very happy and the marketing team was happy no but it's not to make someone happy it's just to prove some things and the team was happy so it was not my work it was the work of this great team and it was us always together you know so do you have any other key points you shared or want to share with the people maybe something you just left out in your talk is something you want to make clear to the audience yes no I just believe for marketing you need to be creative and open-minded and yeah take decisions together with other people not alone always you should not think okay I need to do it's always good to be together you know that was also my learning and also often I saw some people told me no that will not work and then it's good to test and to prove things yeah because even when I started to test I was very unexperienced in marketing so I was 19 years old I studied and I worked in marketing and I needed to take important decisions yeah and I had no one to ask and then I just asked the numbers a little bit and that helped me out very often so you're eager in asking questions and asking yourself okay is this right yes and not just assume we should go and accept the results yes it's so not for every small thing you are doing you should make a test I think it should be if you have very important things to do and very big numbers then you should test yeah and then you can see also if it's significant and you're still young in career yes and you are able to ask the right questions yes but not just me it was always also the team that's it's always the group together so it's good to be able to ask questions even if you're still young in your career and you can learn from people because of course you have not the experience not the background experience so you're not you don't have an opinion shaped by your own experience you ask the right questions yes and this is also a great opportunity I see because I see that many people who worked for a long time in marketing they say we do this and you ask but why yeah my god feeling says it I know this I'm working very long in this segment I'm an expert and that's for me in terms of marketing a critical statement because I saw you have often so many proofs that it's still not that it's this test will not work and then you do it and you see for your target group it works so also for people who are not that experienced in marketing just ask questions sometimes ask hey is this really right and then just try it just test it be brave try and don't listen too much to someone who says always it's good to have experience I don't want to say something bad about this but for me it's I saw out of my experience it's important to test and often it was also sometimes that I said I think this test will work and my whole team said never never and when we tested it they were you know it's always right or the opposite so it was great so everyone had the same results the same results and we were voting as a team everyone is equal the manager deciding for the team everyone had the same power for rating for this different ideas and that was great that's great now you work for inside I can imagine there are people curious about you should they contact inside or should they contact you directly do you run your own company as well or are you available as a marketer at parties or is there something inside you should discuss with inside no I work for inside and I think it's a great company but of course you can reach out to me also on Twitter and LinkedIn so if you have any questions or if you're not sure or something just reach out just contact me we can book you for talks consultancy it's all free I think yes it's all free no we should share this knowledge that's so important so also if you would like to see my talk I also shared the tool I worked with we had our own created workflow so everyone can have it because I really think we should empower each other it should be not we should work together so if you have any questions I help you out and because it's a great community so what you do here volunteering and everything I want to give also something back and just reach out to me always what is the place people can reach out to you on LinkedIn yes LinkedIn Viola Gruner that's it Twitter Gruner Viola I'm on Twitter but I'm not long on Twitter I'm so new in this WordPress community just eight months so my Twitter account is very very small Twitter is a lot of people use Twitter in this community I know thank you very much I just want to share that I'm so glad being here thank you so much to this great community and thank you so much to all volunteers it's amazing really the organization and everything lovely that was a very kind word it's so great what you're doing and everyone is putting their free time in it a big thank you to you thank you very much enjoy welcome thank you longer version of our talk so this is basically 45 minutes long slot where speaker has 30 minutes for his talk and 50 minutes for questions just so we have the standing mics over there so queue up when you see that speaker is about to close up queue if you have any questions if for some reason you can't reach these microphones there will be handheld mics like this one going to be held out for you to give the questions so our next speaker comes from Estonia and the fun fact I learned about his last name is that it means bridge in Estonian so Oliver he's the CEO and co-founder of patch stack come on big round of applause for Oliver hello everyone I think that's actually the biggest crowd of people that I've seen being interested about security so thanks my name is Oliver I'm the co-founder and CEO of patch stack a little bit about my background I've been working in WordPress since 2014 when I was running a web development company which was focused on WordPress actually about web application security in general but we very much so focused on WordPress from the early days already I'm also an active community builder so in Estonia where I live I've also co-founded a co-working space which has turned into a startup center in our town and I've also been organizing hacking events which capture the flag competitions where hackers are challenging each other and competing against each other so we've been doing it for NATO and different kind of organizations today I'll mostly use your time to give you a little bit of an overview of what we've seen over the past couple of years in the WordPress security space I will dive into a little bit into numbers but I'm also going to talk a little bit about what are the biggest challenges that we've seen that need to be hopefully solved or improved I will then share what are the expectations for this year something that we've already seen this year but what we should expect in this year and beyond and then dive into what we as a community could do to make WordPress ecosystem even more secure than it is today so let's start with the very good news I think WordPress ecosystem is more secure than it has ever been before if we look at the data from the past years in 2020 there was 541 security vulnerabilities disclosed in the entire WordPress ecosystem that includes plugins, themes, WordPress core, everything is included in 2021 this number jumped to 1,382 and last year, in 2022 this number skyrocketed into 4,528 security vulnerabilities what's important to mention here is the fact that these vulnerabilities are not like they just popped up this year on those years and like they've never been existing there before you can expect it like a backlog of security vulnerabilities that are getting fixed from all these previous years because they have actually existed there for many, many years so now we're finally cleaning up the backlog of security issues within the plugins and themes and in the WordPress ecosystem in general so that's a really good thing because the bad actors the hackers who would otherwise exploit these issues have much less issues to find because the plugin developers have already fixed them and themes as well out of those 4,500 security bugs that were disclosed in 2022 99.7% were actually found in plugins and themes like most of these issues as you can see are from the plugins and themes and only 26 of those in total were actually from the WordPress core and the good thing about this is that those issues that were fixed in the WordPress core itself, we never seen any of them actually be actively exploited what it means is that the WordPress as a platform itself is very mature it has a very mature release cycle, it has a very good attention on security and the issues that are found in the core are mostly so low severity that they're not really useful for anyone to even exploit that's not the true unfortunately with the plugins and themes if we look into 2022 in terms of the data that we saw in all the vulnerabilities that were reported within this year actually we saw a little bit of a shift into vulnerabilities that were disclosed and there is a reason for it which is actually on the next slide but before I get to it I will give you a little bit of insight into what those vulnerabilities look like the first thing that you can do is to click on the page that is on the top of the list is something that you actually trick the admin user into clicking your link that directs them into the page where they are like tricked into clicking an option or changing some option on your website then there is cross-site scripting vulnerabilities where a malicious code can be injected into the website so the visitor loads it into the site and then we have actually one that is very important to mention is the broken access control where the plugins don't necessarily maybe use the WordPress hooks in the correct way I think many of you have heard about the ease admin function which a lot of people are actually confusing in terms of what it does but one of the issues with the broken access control is that the plugins maybe having unauthenticated access to a function that should only be available for authenticated users and in that case attackers can either turn on registration, make the registered users admins by default and all that kind of crazy stuff the reason why the cross-site request forgery which is actually the lowest ranking fruit you can find in the WordPress ecosystem was on the top one position is actually the issue in the software supply chain or the security of the software supply chain and think about that is like all our websites use some level of plugins and you know if a plugin has a vulnerability that releases a patch for example you will go there and get it patched and you update the plugin now what if the plugins themselves also use plugins and you know then what it means is that the plugin or the framework or library that was used within the plugin is getting a security issue fixed then all the plugins that actually use this framework also need to go and update and then eventually if they do then the end user needs to go and update the plugin on the website and like with each additional layer we are actually adding delay for the end users to get protected and that's a really big challenge in the space right now and the last year the number actually spiked because there was two big frameworks that were actually used within thousands of plugins and they shared then eventually the common security vulnerabilities it's actually also very hard to secure to report security issues to plugins to give you a little bit of context behind this chart that you're seeing on the screen what we do at patch tech is running a program called patch tech alliance it's a community of ethical hackers who report security vulnerabilities in any of the plugins in the ecosystem and they are getting rewarded for that they're getting rewarded because they are using ethical processes to make sure that the plugin developers have all the necessary information to fix a security vulnerability before it's being found by someone else with much worse motivations let's say so 1160 security vulnerabilities unique security vulnerabilities were reported last year into the patch tech alliance program out of those 1160 there were 748 that were accepted by us which we validated we made sure that there are correct issues that there was enough information about that so that the plugin developer could fix it and then you know big portion of them got patched even though it takes a lot of effort to actually reach out to the plugin developers because very often you can't find any information on the website you can't find information on their forms even if they do have a form then very often you just get like an error message saying that whoops that form is not working so you have you basically have like a black hole where you're putting your security reports and you never get the reply on the other hand you have those security researchers and ethical hackers who are waiting for you know hearing back when are those vulnerabilities getting resolved so here who is actually helping us out a lot and I think we should give a big applause to the WordPress.org plugin review team because they are being done like amazing job in terms of how much they have actually dealt with those issues so really come on guys it's so the plugin review team is helping us when we need to escalate security issues to them to make sure that the end users will eventually get the information that they need to patch to update the plugins that are vulnerable and from those 748 issues 148 cases were actually escalated to the plugins team and what they've done is then they try to reach out to those plugins again as well and if they can't do so then they are going to close the plugin now what is a scary part here is that over 10% of those you know cases they actually remain closed which means that the plugins are still to this state actually closed down if you go to the WordPress.org repo you can see that the plugin is closed for security reasons or you know in some level of that in that kind of message now if 10% of these vulnerabilities that are getting escalated how many plugins actually are there that are abandoned that the developer doesn't respond to and how many websites there are that are running those plugins that are not maintained by anyone anymore and you know are basically vulnerable but without having without the website owner having any information about that so this is a big issue actually so way too many security bugs are not getting patched actually last year 26% of critical security bugs were not receiving a timely patch at all that means that these critical security issues are usually the ones that are unauthenticated that attackers can you know run mass exploitation campaigns to take over a website, inject malware and do pretty much whatever they want right so 26% is a big number so even if you have like auto updates enabled you know you're not really you know protected in any way because you just don't get an update so even though those plugins get removed from WordPress.org they still stay on websites and even worse so close plugins have no indicator of active security issues on the WordPress admin panel that's a big issue because if you look at the WordPress.org repository you actually see that the plugin is closed for security issues but now who is actually you know who should know about this issue the most is the site owners the ones that are actually running the WordPress website where they see the list of plugins that they have installed but to this date WordPress core itself doesn't have an indicator within the admin panel that will tell you that hey you're running this you know plugin on your website but this isn't this is closed by the WordPress.org repository and it's not you know actively maintained anymore that brings me to something that just happened very recently I was speaking at CloudFest last year sorry earlier this year and I was talking about this issue as well so we actually found an eight year old ticket in the WordPress basically a feature request to add an alert into the WordPress admin panel to show the user that the plugin is removed from the WordPress repository for the security reasons so there's a keyword code link to that entry so if anyone wants to kind of share their ideas or kind of like add additional information to that please do so because I think this is a very big thing that we should look into and have maybe a bit more of a deeper conversation around to make the WordPress ecosystem much more secure so let's look into what else we could do as a whole community to make WordPress more secure I think we need to accept that it's okay for projects to come to an end I think it's okay when we build plugins and we build projects in general and we eventually come to a conclusion that maybe it's not maybe it wasn't used by anyone that much that you were expecting or maybe it didn't go as well as you expected as well but if you built a plugin then you need to kind of keep in mind that other people might still be using it so I think it's very important to communicate very transparently and let the users know whenever you are planning to maybe you know drop the project or like move on to additional things what you could also do for example is you know reach out to the community talk to people on post status for example ask maybe someone wants to take this plugin over maybe someone else wants to maintain it in the future and I think another thing that we might want to think about is maybe it's okay to send an end of life date until the users receive security patches let them know that hey I'm planning to move to other things so here's a date until I'm actually you know getting the security patches if there's anything you know needing to get patched but I'm not planning additional secure additional features to the plugin so I'm not you know then the users will get some level of kind of time when they can find alternatives and figure out how to move forward and please don't reject security reports because you're moved on on the top corner you are actually seeing an interaction by our security team with the plugin developer I think it happened last month where we reported the security issue to them was a serious issue which actually needed to patch and the only response we got from there is that sorry we no longer maintain this plugin this plugin currently has over 100,000 active installations so again this is a problem and we don't know how many of these situations actually are there even more in the ecosystem and I think we need as a whole community to talk about that a little bit more to make the entire ecosystem more secure another thing that what we and it kind of like applies to the previous talk where we the previous slide where we reach out to developer and saying hey there's a security issue you know we could help you fix it is then please don't avoid security research at all what we've seen over the past years is that in many cases where security report or security researchers report the vulnerability to a plugin they are kind of like you know reacted with negativity you know why you are like looking into our stuff and you know who asked you to check and you know that kind of stuff so one thing that we should I think look into is considering security researchers as equal contributors as our developers when a developer is submitting nice code into your plugin into your open source project you are actually happy right so why shouldn't you be super happy and thankful to security researchers who point out in your code base to a places where you can improve your customers so plugins actually thanks to the security researchers in this space plugins that haven't fixed vulnerabilities before bad actors can exploit those zero days so from the past years we see this increasing number of security vulnerabilities being fixed and reported these are all the vulnerabilities less for the bad guys right so it's good so it's good for everyone it's good for the community it's good for the open source project maintainers and really think of researchers on your side I think if anyone gives you an option do you want the hackers to be on your side or do you want the hackers to be on the other side which one would you pick I think it's a pretty simple option to choose and I think we need to think about that in the sense of incentivizing the security researcher and the good hackers to be on our side and not on the other side so I've talked a lot about plugins ecosystem and teams ecosystem and the projects in general but I imagine in this room there's also people who just maybe build websites or have their own website built so what should you do in the light of all this information I think it's more and more important to choose your stack wisely and keep plugins to minimum it's a very common security recommendation but it's very important and I think it's still not praised enough I think it's very much easier to choose a stack or you know a selection of tools that you like to use like select your favorite page builder select your favorite you know forms plugin select your favorite you know tools that you in general built the websites with and if you're a developer building websites to a lot of different customers try to stick to that stack because when a security vulnerability is being found then you actually have much smaller attack surface like if you use like hundreds or 200 different plugins across all your websites you would probably need to deal with security vulnerabilities every single day that's a fact so another thing to look into is the word for specific firewall something that is actually being able to detect whether there are vulnerabilities on your website and to actually provide you a very targeted protection for those vulnerabilities something that is called nowadays as a virtual patching which means that the vulnerability is being found on your website and it receives a security rule exactly for that vulnerability I think it's very important because what you what you receive then is to actually keep in mind that I mentioned just 26% of the security or like the critical issues from 2022 were not patched so what virtual patching actually gives you is the time to stay protected until the developer releases a patch or it gives you a little bit more time to go there and update your website so it's definitely an essential thing looking into the light of how much of those security vulnerabilities are out there and how big is the chance that you might end up with one as well and really choose a good hosting service that lets you know about vulnerabilities as well because there's a lot of hosting companies who actually do that so we have managed hosting providers who have like a panel where you see all plugins that you have installed and everything a lot of the hosting providers nowadays actually also include the information whether any of those plugins include security vulnerability so ask this from your hosting company or choose a hosting company that already does security out of the box and helps you to at least be aware of those security issues so what to expect from 2023 so a lot more ethical hackers will get interested in WordPress that's for a fact because WordPress has a huge impact and there's so many different plugins and themes and so many different projects to look for security issues so nowadays we have also bug bounty programs and different programs which incentivize ethical hackers to report security vulnerabilities more ethically and obviously if we have more ethical hackers get interested in WordPress we will see a lot more vulnerabilities to be reported and patched as well not only because if we have more ethical hackers on board and we get more vulnerabilities reported and patched but also plugin developers themselves and team developers and project owners they actually put much more effort into security as well last year we saw an optic actually of projects getting security audits setting up security programs for their plugins and so forth I won't even start mentioning AI here because everyone is doing that so but you know you can kind of also think about that line of things because we do have a lot of tools available that would help ethical hackers to also find vulnerabilities more easily in the plugins and all that taking into consideration what we need to again keep in mind is that if 10% from the last year there was 10% of the plugins that remain closed after security reports being reported to them we're probably going to see that number increase as well as a final note here I actually want to also mention something that is upcoming over the upcoming years is that governments start to regulate open source security and supply chain security as well so if public sector and enterprises need to stay compliant they need to understand what kind of open source you know tools they rely on you know what kind of open source projects they actually even use what kind of you know plugins they are running on their you know infrastructure what is the security status of those then developers and agencies who provide services to them need also to kind of you know provide that kind of overview insight and security services so this is something that you know developers and agencies in the space already need to think about is that a lot of those you know larger enterprises and public sector customers will start asking hey why did you you why did you choose tat stack when you know starting to build our application and what does that you know what kind of risk might come with that if we rely on that kind of open source software and this also brings higher security expectations toward plugin developers because if if developers and agencies need to start choosing the stack more wisely and making sure that they have like a good overview of like how well it's maintained what are the previous security issues how well they are how fast are they actually fixing security issues if they're reported how well is it communicated and so forth then what we are going to see is that you know plugin developers will have higher expectations as well and to be honest I think plugin developers have the most to win from here I think what they can do is set up more security programs maybe even incentivize the ethical hackers to report vulnerabilities to them to make sure that they are more actively looking for vulnerabilities in their software set up a bounty program I think this is all in benefit for the plugin developers right now because the developers who will use your product they will trust you more so I think the key takeaways here really is that right now the WordPress ecosystem is more secure than ever I'm looking forward to say the exact same thing next year and then year again and then year again I think plugin developers have a lot to win here and as a community I think plugin developers have also the most to do in terms of making the WordPress space more secure and yeah if you want to see the data from which I actually used on the talk from the last year and a little bit even more data than the QR code actually sends you there and thank you all for making the WordPress space so much secure and thank you and thank you Oliver for sharing while we so just you know we have the standing mics there if you have questions we have time for questions while we're waiting people to queue there I have a question for like what we as the plugin developers you know can actually do to make those we're talking about the security like how to make but what can we actually do to make those plugins while developing it more secure yes definitely one of the things that can be done well is to kind of follow the code of conduct for example or like you know the documentation of how to use the maybe hooks in a correct way definitely sanitize the inputs you know wherever you can to do so and I think one of the things that can be done well that will improve not only the security of the plugin but also how the features of your plugin will see kind of your professionalities to have like some third party security audits done once in a while maybe once a year or so or maybe after like every like a larger release there is service providers in the space different ones that are actually providing code review code review services so this is something that you know should probably be done more often especially if you have a lot of active installations and the other thing is like if you don't have you know a lot of security services and you don't have a lot of operating revenue then obviously you know you can't have like a large sum of money to pay for those security research services then what you can still do is set up a security program like a managed vulnerability disclosure program where you just tell the ethical hackers that hey if you have security issues to report them here and make sure you know that these issues are then going back to that so I think in general if we kind of like put them into context then it's all about communication right so communicate well to your users how the security of your plugin is covered what you are doing as a plugin developer to make that code much more secure and also like if something is found in something is patched how well you are communicating is much more important than the fact that there was something found in the first place. Hi Oliver, great talk. Thank you. So has there been any discussion with the plugin review team about maybe not immediately closing plugins when they have a significant active installed base but maybe taking it on and patching it and treating it more like a core security issue and perhaps force pushing an update and then closing it. Yeah I think it always happens based on a situation so it's not always the way how it's not always that they are closing it down right away I think what they are also doing is trying to reach out to the plugin developer receiving some level of answer whether and when they are going to do that so it's not the case that they are just like close it down immediately in most of the cases but obviously like if there's no reaction whatsoever then closing the plugin probably will get the reaction which will eventually get to fixing the plugin or fixing the issue that is affecting users but I think there's still a lot of work to do right because we are still you know this growth that we are seeing in terms of the vulnerabilities being fixed from the past two or three years I mean we are still in a very much of a baby shoes like we are still I think there's so much more security issues to still iron out and I think as we are moving forward in this process and if the volume grows I think we also need to have even more worked out processes in terms of dealing with those security issues so yeah there's definitely work on there. Nice and then the second question. Hi I recently started experimenting with WordPress blocks and downloaded a lot of blocks plugins and they tend to lean into the JavaScript ecosystem a lot more and what I noticed is that some of these plugins have like a node modules directory with 30 to 50 dependencies aren't we opening up ourselves to even more dependencies by adopting these JavaScript types of working? Absolutely the answer is correct yeah I mean it is happening because and that's why I mentioned the supply chain thing right it's going to piggyback on top of the other things so and the rabbit hole goes deeper with you know each level of each layer so like even if we see already plugins using also a lot of JavaScript libraries like even WordPress core itself used like jQuery right and there was an issue in jQuery so like these things actually go deeper and deeper and I think JavaScript as we introduce more and more JavaScript into the WordPress core I think the problem also you know is going to get deeper and I mean there's just more work to be done We'll take the question from that side Hi yeah you talked about the way the metrics are climbing so we went from 541 in 2020 1382 year before last 4528 99% of those are from plugins but there's 60,000 or more plugins in the plugin repository like that still seems like there's a very small number compared to the amount of code out there and then there's obviously plugins beyond the plugin repository am I right to still be alarmed that there's a lot of surface area in the plugins to still be examined or are you seeing a slowdown in historical vulnerabilities and now it's newly introduced vulnerabilities can you reassure me or should I remain alert? I think you should definitely stay alert because what we don't see any slowdown we're definitely seeing increase even right now in this year and I think there's absolutely right there's 60,000 plugins in the ecosystem and right now the vulnerabilities that are getting reported to us and to the other vendors in the ecosystem these are done by ethical hackers who actually look for these issues but they select in most cases plugins with higher installation numbers or they are looking for easier security vulnerabilities that you can scan the entire REPL for for example cross-site request forgery and stuff like that so I think there's a lot more of those serious security issues still hidden in those lower installed count plugins and I think that's why I was also saying that we're still in a baby shoes like all these numbers are still like the tip of the iceberg in a way and another thing to mention here is that we have almost no visibility into the premium plugins the ones that are not hosted in the WordPress.org and these are most often much less in general so this is another kind of thing that we need to look into in the future as well Thank you Your question please Okay, greetings from the other side of Gulf of Finland Go Estonia Are you aware of a solution or even an initiative to set up a kind of a harness perhaps like a DevSecOps harness for plugin developers that would contain like basic sanity things like vulnerability scanning static analysis things that are pretty standard on most of the other runtimes or if not standards at least there's a toolkit that you can just take into use for supply chain management NPM audit and things like that so are you aware of something that would help plugin developers and if not should there be something like that Thanks for your asking Our own product does kind of something like that This was a paid advertisement Thanks for the question I mean yes we actually do something like that as well so we do vulnerability management and virtual patching so we identify those vulnerabilities in your application and provide you an understanding when should you patch something, what needs to be patched first before something else what are the criticality levels how fast should you react kind of like a protection before you go there and maybe update or maybe there's no update available so it covers your back until you can do so I'm sure there's other services as well but I'm obviously not going to mention them Okay actually just kidding Thank you Thank you for your presentation and for the ethical hacking you all are doing I find that example of the plugin developer who has 100,000 installs from this from your team quite distressing because I also suspect they have other plugins out there in the environment so I wonder what other things can we be doing to put more pressure on that kind of plugin developer including naming and shaming putting pressure on their other plugins like what are the ethical things that you can do in your role but that we as a community can do as well I think instead of naming and shaming we should just kind of focus on those who are doing better so if we are talking about for example we have something called a VDP directory so we have a directory of all the plugins in the WordPress ecosystem who have kind of opened up a security program where they kind of very well say like hey here's how you should report security vulnerabilities to us here so fast we are dealing with those issues it's all about communication and in terms of this specific example as well I think what is needed is to have an understanding of how this issue should be communicated I never kind of believe in naming and shaming because I feel that this is making people eventually hide from a lot of facts not to get named and shamed and I think naming and shaming is also kind of like the problem here why they are even like in many cases reacting negatively if they are receiving a security report because they don't want that attention on their project that oh my god security vulnerability I think what we can do is kind of just collectively talk about security issues more in a positive matter we should talk more about that's great we got another security issue fixed in the ecosystem there's again like hundreds of thousands more websites more secured thanks to that and we should praise the plugin developers for fixing issues transparently and openly I think that's kind of the only way to go one more question this side hello thank you great talk so I have a question lately I've seen this a lot in some especially premium plugins that under the pressure of the marketing teams these they just hide or even bury these vulnerabilities that are reported in the change logs they have so it's pretty difficult to find what actually happened and to learn from this so how do you find these practices and also is this only like a WordPress thing or you find this also in another ecosystems I find it more prevalent in the WordPress ecosystem not that much in the other ones where maybe the development practices are a little bit more mature and you know where a little bit more enterprise customers are using the frameworks but the good point that actually you brought out is that a lot of developers in or like not many but in still like we see a lot of cases where yeah the information is like hidden from change log or it's like hidden under like something like minor fix or something super vague right there's no point of doing that to be honest because what hackers do and what other security companies also do is that they monitor the SVN we also monitor the SVN on a daily basis so we see actually the code change diffs we see if you have escaped something we see if you sanitize something new on the plugin we see if you added nonces we actually see this information and so do hackers so even if you find even if you hide it from the users actually the only ones who are going to benefit are the bad hackers so there's really no point of doing that that's why I'm like I said like the communication is the key and instead of kind of like trying to hide it from it or like try to kind of like you know stay away from the maybe bad publicity of you know there was a security phone issue found I would say that security issues in my mind are much more secure than those that haven't fixed any at all because I have no idea if someone has even checked you know these plugins at all so yeah hiding information in the changelog should not be done really and I think yeah the only people you are going to eventually hide information from are those who need it the most thank you nice nice just stating the obvious this side is killing it guys to be the question just say no they're killing it so if you have more questions there's a mic there your question hi great talk so basically I was just wondering although it's like against the community or something like that but still there can be a possibility that someone like WordPress can have a place where like before uploading a plugin they can actually access like there's a certain level of security being maintained over there like that can be a good option that will actually check like it should not be that kind of plugin which is easily hacked or something like that so can it be a good thing like if a community come together or either WordPress itself come together and develop something like that actually WordPress does that they do it on the first submission of the plugin if you upload a new plugin to the system or to the repo then they're actually checking the plugin for those security issues they use I'm not actually 100% sure now but they use one of those like static code analyzing tools to actually check for unknown issues so they check if there's like maybe potential SQL injection, vulnerabilities and stuff like that but the thing is that after that like after plugins start to like release updates these checks are not done anymore so you know a lot of plugins that are actually applied into the repository are not at all anything similar to what they are today right so I think there is I think we need more tools that help plugin developers in general and I think we need different kinds of ones we need the ones that are for helping out with the communication but we also need to have access tools that they can run their plugin code through before they push a next update for example so you're completely right yeah we definitely need that kind of tools more thank you nice and this side is working up so we have the question there I had the slide with the main vulnerabilities like CSRF, XSS SQL injections and like most of it is handled with sanitizing, escaping and using nonsense is there like any other category of vulnerability that we should look out for I feel like it's too easy or is there anything more to hacking because I don't know how those sites are attacked I think a lot of like more complex ones that need more attention are definitely the ones with involved broken authentication or like misuse of like WordPress existing hooks obviously we have a solution that you could just read the codex and use the hooks in the right way but unfortunately not everyone does so another thing to look out for is when code is actually reused because what we've also seen is that some developers in WordPress we build plugins in PHP and you can find a lot of PHP in stack overflow but that doesn't necessarily mean that the code on stack overflow is also secure so we can see a lot of vulnerabilities being introduced in these kind of ways as well into the plugins but I think the more complex ones that I think need more attention are the logic issues are surrounding authentication and like how the kind of like WordPress core and APIs are being kind of interacted with I think these are the ones to kind of like look more closely Wow and this concludes probably the longest session that I ever attended just so many questions that's good do we have any more questions I have one just to make the prepared so you mentioned cloudfest or work in Europe which audience do you prefer and big round of applause Oliver thank you so much before you leave the stage we have a gift for you thank you so I haven't heard that so Mr. Rich thank you so much so our next session actually is at four so it's going to be second round of the lightning talks about Gutenberg static websites and future generations you heard about that speaker and the opening remarks so also you have the DLP connect at four with Hari Kourtney Afshana and Emmanuel happening just so yeah see you in 18 minutes here thank you welcome everybody this is Rick Hell and I was about to say Phoenix we're work in Europe I'm from Phoenix and today on day one of work camp Europe we have with us Martin Bellman Martin welcome how are you doing? I'm good enjoying work camp so far yay how many work camp Europe have you attended this is my third one I did a portal last year and then before COVID hit Berlin as well oh nice so okay yes making this the third exactly exactly how has it been great coming back to work camps since the lockdown yes I mean when I went to the first one which was Berlin I didn't expect that it would be so nice that there was this feeling of community and you know you would just meet people but you've never spoken to in real life and you come here and you hit it off right away and you talk about you know work press or life and it felt really good and so I think this is going to be a yearly thing now where I return to work camp because yeah it feels good it feels it feels really good and I was bummed that you know everybody was bummed that COVID hit and then there was no work camp or at least not in real life so was that your first work camp ever yes yes wow I love that never did a smaller work camp in Belgium or the Netherlands no it was like the first the first one and it was a big one yeah yeah it's been really good it's good experience so I can recommend it to everybody if you can make it to try and make it to one of the work camps near your area so we have been to a local camp or not yet no no like the first work camp I ever did was the big work camp Europe I have never been to a local one yeah yeah I should I should really but and you're located in Belgium yes that's correct has there been any local camps there I think there used to be a couple of years ago one in Antwerp but not anymore but we live very close by to the Netherlands which has a camp so a lot of us Belgians we would travel to the Netherlands to go there so well word on the street is word camp Netherlands is happening it's September okay maybe you can attend that one yeah I mean if I'm in the country I like to travel a lot so I don't know if I'll be there but yeah I'm a traveler so if I'm in the country I would definitely make it to the Netherlands yeah so I heard a rumor that you actually traveled here like was it a road trip yes how long ago did that start so we started on the 19th of May which is a good three weeks ago and we took the car over we crossed five four countries and then we took the ferry from Italy to here and just taking it slow me and my partner just traveling we went to a few Greek islands it's a working holiday thing where we have our laptops with us and we can do the work and we did this last year too when we went to Porto just stopping in Spain taking it slow making a road trip a lot of word camp Europe and maybe this will become a yearly thing depending on the location that it will be at but I really enjoy it it's just a nice way to see some of the of Europe some of the countries around us where did you go what countries did you head up so we start in Belgium then we pass France then we pass Switzerland then we are in Italy we have to drive through all of Italy then we take a ferry then we are in Greece we have the option to do some islands or you travel inland and now we are here at the other side of Greece that's so amazing it's quite a few countries now do you still drive this is a very American question but I'm assuming you drive a stick shift really? because the idea was because electric cars are coming and they're all automatic so when we bought the car three years ago I really wanted a manual a stick shift but then the thing was we're all going to be driving automatic soon anyway so let's already buy an automatic and then we can practice so it is an automatic but it's against it feels a bit weird I like a manual gearbox do you feel like you're a lazy driver now a little bit a little bit there's nothing to do anymore you have to pay attention obviously but yeah it takes some getting used to but I think now going back to manual might be harder it's a luxury so I actually had a Jetta that was a manual stick shift in the early 2000s and went away for years and just recently bought an Audi that's a stick shift in America it took me three months to find it and it took a little maybe just a little bit riding a bike again if you haven't rode in 10 years so you'd be fine would you go back to an automatic I mean eventually with an electric car oh my god electric car yes but there are times when I have to go back to driving an automatic and I'm like oh my gosh I have so much time and so much like I could just chill yeah that's exactly it so there must be lovely on a road trip yeah it is very comfortable yeah what kind of car is it it's a Volkswagen T-Roc a bright blue one oh my goodness I'm very partial to V-Dubs and Audis sorry I'm probably acting like the biggest American right now but tell me about your plugin you're a product owner right several WooCommerce plugins yeah I started with this around 2017 all the stories that I tell usually involve traveling and the story of my WordPress career let's say also involves traveling I quit my cozy IT job in Belgium and traveled to Australia with my partner for a year we bought a four-wheel drive vehicle and we just slept in it and traveled through the whole country and yeah that was also my impression after it this is amazing and the question is how can I do this again and that's by becoming a freelancer or a product owner and so I started looking into WordPress looking into WooCommerce and I saw a few gaps in the market where I might launch a plugin that is beneficial to the WooCommerce community and that's basically how it all started around 2017 wow have you been loving it yeah yeah it's absolutely amazing it's definitely the right choice for me because it combines freedom I can have a bit my own agenda there's no customer deadlines I mean I love customers it's not that but I'm not as good with deadlines as I should be so like owning products is a good fit for me and yeah I mean there's a lot to learn in this journey because there's a lot more to owning products than just developing the products you have to market the products you have to the website has to be there it has to work, you have to service a lot of customers there's a whole support area that I've never had to deal with so it's a lot of work but it's definitely very rewarding and I'm very happy that I made that step so it all led to this point and it's been good for me do you have a team? are you still solo? I have a team but we are just three people so it's me, my partner is doing everything content wise and then I have a support agent who is helping me handle the support load so we're a very small team it still feels very indie I love it but that's how it starts right it's so easy I'm sure it's so difficult at times like anything if you start something new it's not always easy or not as easy as it looks but the end result is very rewarding so I'm very happy with this journey but it's not always easy there's a lot that goes with it marketing, talking to people customer experience, customer support I'm a very typical developer so these are things that I had to learn it sounds so simple but how do you talk to a customer so that they don't run away they understand what you're trying to say because I might want to approach everything very technical the average WordPress user is not technical at all so you have to learn how to deal with those customers how to talk to them on a level that everybody understands there's learning curves everywhere but so far it's working I love that how about in Australia tell us any sort of what was the craziest story or animal or creature you encountered or anything there are a few so everything in Australia tries to kill you it's a bit of an exaggeration but there are a lot of animals that can kill you but the upside is that in the last 40-50 years no animal has killed a human so it's it's fine but the most dangerous spider in Australia is very small and I remember we came across it once and we were at a campground and it was in the communal kitchen and it was just sitting there very open and if children were playing there the spider might have bitten any of the children so I went to the staff of the place and I said there's a deadly spider there can you take it away and there were very Australian about it I said yeah, no worries, we'll handle it no problem, after an hour the spider was still there so I decided to capture it myself so we took boxes like that we had with us and I was very scared and trying to capture that spider in the box and just make sure to put it somewhere so that was like I mean it puts things in perspective because I'm very tall and the spider is very small but it can hurt me any second and I try to get it away so that the area was safer for children to play at so there are a few stories like that but I mean it's not as bad as you make it because these are the stories that you tell it's a nice place it's a very nice place if I get a chance I will go back because it's very nice and we have scorpions everyone's like oh my god you have a scorpion what do you do? and I'm like dude scorpions are annoying and they hurt they're just creepy looking but the deadly spider will kill you though if not treated and depending on your weight and your height it can kill you but those are fun things to say at parties but the chances of it killing you is still low there are no worries but you do have to take it out of sight so that people don't accidentally trip on it and it gets angry that would not be a good plan it's too funny so when did you get into Athens? we got in here a couple of days ago actually so we already had some time to explore just wander around the city yeah awesome and are you going to be heading up parties right? yes there is a party organized by Freemius for several product people so people that create teams or plugins so they're kind of my peers and colleagues so that's a very nice thing to do of Freemius to organize that party because there will be a lot of people with the same interests in the same place so I'll definitely be going to that earlier you said you're a bit on the introverted side so you stick to one party tonight? two but the problem is word camp is too short it's only two days and so a lot of parties are at the same time so you have to make it work to go from one place to the other so it's kind of depend on how one party goes if I can go to another one but maybe I have my eye on a few I don't want to rush it just for the sake of going everywhere and just see how it goes I've done that before in word camp US 2019 I went to eight you went to eight parties on two days one night I did eight and was that still fun?