๐—ช๐—ผ๐—ฟ๐—ฑ๐—ฃ๐—ฟ๐—ฒ๐˜€๐˜€ ๐—–๐—ต๐—ฎ๐—ป๐—ด๐—ฒ๐˜€ ๐—›๐—ผ๐˜„ ๐—œ๐˜ ๐—ง๐—ฟ๐˜‚๐˜€๐˜๐˜€ ๐—–๐—ผ๐—ฑ๐—ฒ

I pushed a plugin update. It did not go live for 24 hours. I thought I broke something. I did not. WordPress changed the rules.

Since June 5, 2026, new releases wait 24 hours. Auto-updates pause. Manual updates work.

Someone bought 31 plugins. They added backdoors. They had legal access. They sent malware to 400,000 sites.

The old rule: access equals trust. The rule failed. Now, WordPress checks every release. They call this Protect The Shire. Moderators and scanners review the code.

I agree. I found 35 bugs in my own code once. All code needs a check.

There is a cost. Security fixes also wait 24 hours. It is a trade.

I prefer a slow system over a broken one. Your sites stay safer.

Source: https://dev.to/rapls/wordpressorg-now-distrusts-my-commits-by-default-as-a-plugin-author-i-think-thats-right-gfc