WordPress blogging platform hits 3.0
The blogging and/or content management system (CMS) WordPress, used by millions of blogs, has reached 3.0 – marking a significant point in its evolution as a platform for all sorts of content online.
Or as the blogpost on the WordPress site puts it:
“Arm your vuvuzelas: WordPress 3.0, the thirteenth major release of WordPress and the culmination of half a year of work by 218 contributors, is now available for download (or upgrade within your dashboard). Major new features in this release include a sexy new default theme called Twenty Ten. Theme developers have new APIs that allow them to easily implement custom backgrounds, headers, shortlinks, menus (no more file editing), post types, and taxonomies. (Twenty Ten theme shows all of that off.) Developers and network admins will appreciate the long-awaited merge of MU and WordPress, creating the new multi-site functionality which makes it possible to run one blog or ten million from the same installation.”
There’s a huge list of changes and improvements.
The release is named “Thelonius”, after the jazz pianist Thelonius Monk; previous versions have been called Mingus, Strayhorn, Duke, Ella, Getz, Dexter, Brecker, Tyner, Coltrane, Baker and Carmen – so you can see that there’s a sort of jazz thing going on.
But what will matter for many WordPress users is the question of security. While WordPress does a terrific job in the main of providing good security, the fact that there are so many blogs out there using it means that vulnerabilities and exploits abound. As it’s open source software, you have to take that as you find it – and there are plenty of things that can be done to harden it.
The WPSecurityLock blog, one of a number which focusses on reports of security weaknesses or exploits against WordPress, has examined the claims made for 3.0- of which the most notable immediately is that you don’t have to have an admin called “admin” anymore; you can change the username to something else. On its own, that might be one of the biggest steps. From personal experience, I’d say that the other step which makes the biggest security difference is not to allow external user registration (not just turn it off, but also change the hooks in the code): that prevents all manner of cookie- and injection-based attacks.
There’s also BlogSecurity, which has already discovered a “thrashing” attack based on the ability to retrieve posts that have been trashed (only in version 2.9 upwards). BlogSecurity hasn’t yet got its teeth into 3.0, but if you’re a WordPress user it is well worth keeping an eye on both of those.
The other big problem will be what 3.0 does to the enormous number of plugins written for WordPress, which add functionality of one sort or another (my personal favourite for killing spam is still Spam Karma 2, but it’s unlikely this will be updated for version 3; however the code is now available for upgrade and improvement at a Google Code repository – though that does seem active.
There’s also Mullenweg‘s 74-minute speech at WordCamp in San Francisco which he says is “jam-packed with information on the growth of WordPress, 3.0, what we’re planning for the future, and the philosophy of WordPress.”