Matt Mullenweg’s extortion campaign against WP Engine has serious security implications. Especially over the possibility that access to the WordPress website might be blocked to certain groups, as has now happened, or it could shut entirely. What seems like it should be a simple to answer question is who owns the WordPress website and the related wordpress.org domain name. It turns out there is understandable confusion over that. The kind of confusion that Matt Mullenweg seems rather concerned about between WordPress WP Engine, but the kind of confusion it turns out he often engages in. It appears that Matt Mullenweg owns those, which we will get in to more detail, after looking at the confused information out there.

WordPress Foundation Owns It?

If you were to search Google to try to figure out the answer, the snippet for one of top results, which is from the Awesome Motive owned WP Beginner, says “To summarize, WordPress.org and the WordPress trademark are owned by the WordPress Foundation”:

That is easy to understand. The WordPress Foundation owns it the WordPress website, which would make sense if it was a normal open source foundation. Say, like, the Mozilla Foundation, but it isn’t.

The page itself now says “To summarize, the WordPress trademark are owned by the WordPress Foundation.” They removed the “WordPress.org and” portion of the sentence recently and forgot to change the word “are” to “is” when they did that.

The WordPress Foundation website would suggest that they own the website, as this is written on the homepage (emphasis in the original):

The point of the foundation is to ensure free access, in perpetuity, to the software projects we support. People and businesses may come and go, so it is important to ensure that the source code for these projects will survive beyond the current contributor base, that we may create a stable platform for web publishing for generations to come.

On the foundation’s Projects page, they have these bullet pointed items:

• WordPress, freely available GPL blogging software with about 346,509 lines of code representing about 91 person-years of development.
• WordPress is available in over 200 languages and the latest version has been downloaded over 77 million times.
• WordPress Plugins, a repository of over 54,000 freely available plugins representing about as many volunteers. These plugins have received over 859 million downloads that we know about.
• WordPress Themes, over 3,048 free GPL-licensed design and themes for WordPress that have received over 128 million downloads.

They link to the homepage of the WordPress website as well as the plugin and theme directories on the website. That would suggest that the WordPress website is part of the foundation. But if you carefully read the text above the bullet points, it simply says those are things that Matt Mullenweg has been involved in:

Matt Mullenweg, the director of the WordPress Foundation, has been directly involved in the creation of, or coordination of volunteers around, a number of WordPress projects that espouse the core philosophy:

If that isn’t confusing enough, on the footer of the WordPress website is a Donate link:

That links to a page on the foundation’s website, which at one point links to the misleading Project page and says this:

Money raised by the WordPress Foundation will be used to ensure free access to supported software projects

Questions of Ownership Posed on WordPress Website

Another result as to the owner comes from the support forum of the WordPress website, a person curious about the ownership wrote this:

I recently pondered the question of who owns WordPress.org, and in my quest for answers, I consulted two blogs. According to my findings, WordPress.org is not owned by any individual or entity; rather, it operates under the GPL2 license.

To gain more insight, I explored a related query in the WordPress.org support forum, which can be found here: [https://wordpress.org/support/topic/who-owns-wordpress-org/]. However, this left me with an additional question: Can we attribute the term “owner” to the entity or individuals responsible for running WordPress.org?

I would appreciate any clarification on the ownership structure or the distinction between those who run and own WordPress.org. Thank you for your assistance.

The only response to that is a doozy. It comes from an employee of Automattic, that is sponsored by Automattic “to contribute 40 hours per week to the Core team.” Here that is:

Understanding the ownership and management structure of WordPress.org requires distinguishing between the WordPress open-source project and the entities associated with it. Here’s a breakdown:

1. Ownership of WordPress.org: WordPress.org is not “owned” in the traditional sense, as it’s an open-source project. The software it provides is licensed under GPLv2, which means it’s free to use and modify. There’s no individual or company that “owns” the open-source software of WordPress.org.
2. WordPress Foundation: While no one owns WordPress.org for practical purposes, the WordPress Foundation holds the trademark for WordPress. The Foundation focuses on ensuring free access to the software and promoting the open-source project.
3. Management and Distribution: WordPress.org mainly distributes open-source code and hosts this code. It is not an entity that enters into agreements or has a typical ownership structure like a private company.
4. WordPress.com vs. WordPress.org: There’s often confusion between WordPress.org and WordPress.com. WordPress.com is a commercial entity owned by Automattic, offering WordPress hosting services. In contrast, WordPress.org is community-based, providing the open-source software.

In summary, while the WordPress Foundation holds the trademark, WordPress.org operates as a community-driven platform distributing open-source software, with no traditional ownership or corporate structure to manage it.

While they say there is “no traditional ownership or corporate structure to manage it,” some entity must own the website.

That question linked to another question, which had the always problematic support forum moderator Jan Dembowski responding this way:

Who “owns” WordPress.org?

No one for your purposes.

Does anyone know if there is a company that “owns” the open source software provided by wordpress.org?

There is no such company though the WordPress Foundation is the trademark holder.

Another responded, mentioning confusion between wordpress.org and wordpress.com, and said that wordpress.org is community-based:

The representative from Shopify may be mixing up WordPress.ORG, which is indeed open source, and WordPress.COM, which is owned by the company, Automattic. They have very similar names, but one is community-based and the other is run by the company Automattic.

Staying on the WordPress website, there is a large About section, but as best we can tell, it doesn’t address the ownership. There is a Domains page, but it doesn’t address who owns wordpress.org.

Matt Mullenweg Mixing Up His Roles?

Last Week Matt Mullenweg announced that WP Engine was banned from WordPress.org. He didn’t explain under what authority he could do that. He went on to claim that:

WP Engine needs a trademark license, they don’t have one.

WordPress doesn’t offer trademark licenses, so that doesn’t make sense. They don’t even own trademarks. Presumably, this is reference to a trademark license with Automattic. He then stated (emphasis in original):

What I will tell you is that, pending their legal claims and litigation against WordPress.org, WP Engine no longer has free access to WordPress.org’s resources.

WP Engine hadn’t made legal claims or engaged in litigation against WordPress.org. They did send a cease and desist letter to Automattic. That states a “duty of preservation applies to Automattic, WordPress.com, as well as WordPress Foundation which employs Automattic staff.” Notably, WordPress.org isn’t mentioned. Maybe, Matt Mullenweg is forgetting which role he is in writing that. He also said:

Why should WordPress.org provide these services to WP Engine for free, given their attacks on us?

Is he WordPress.org?

In a follow up post, he is again not making sense. He is writing as if he is WordPress, but then he mentions that WP Engine could “enter into a commercial licensing agreement:”

WP Engine was well aware that we could remove access when they chose to ignore our efforts to resolve our differences and enter into a commercial licensing agreement. Heather Brunner, Lee Wittlinger, and their Board chose to take this risk.

WordPress doesn’t offer commercial licensing agreements. Again, this seems to relate to Automattic.

We have lifted the blocks of their servers from accessing ours, until October 1, UTC 00:00. Hopefully this helps them spin up their mirrors of all of WordPress.org’s resources that they were using for free while not paying, and making legal threats against us.

It’s unclear who “we” is, as he wrote that and no one else is mentioned.

Open Source Projects Don’t Have Their Own Websites?

Brian Coords who is an influential voice in the WordPress space, wrote a post last week had this striking paragraph:

Everything else, including the directories on WordPress.org that host all those plugins and themes and provide your one-click install and updates? That’s not really part of the “open source” deal. Those are things Matt has freely provided to grow the ecosystem, but he that giveth can take away. And this isn’t just a WordPress issue. We can assume the same single point of failure for any repository or package manager of open source code, from NPM and Composer to Microsoft’s GitHub or even Homebrew. All of these cost money to run, and our industry has grown reliant on them.

The website of open source projects is, in fact, usually part of the open source deal. As we mentioned earlier, WordPress doesn’t disclose if Matt Mullenweg personally owns the website or if someone else does. Hiding the ownership of the website definitionally is not open.

There is an often repeated line that goes something like, “If you are not paying for it, you’re not the customer; you’re the product being sold.” The hidden owner of the WordPress is getting value from owing it. Why else would they own it and not transfer it to the WordPress Foundation? They possibly are making a profit on it now (through payments through recommended host and possibly selling data). Or they have value from having the asset. Say so they could extort a business competitor.

Matt Mullenweg Apparently Personally Owns the Website

The author of the post quoted in the previous section seems to treat it as a given the Matt Mullenweg owns the WordPress website. The closest we have found to confirmation of that is screenshots apparently from a WordPress Slack were he apparently wrote this:

W.org belongs to me, it’s not part of the foundation or any trust, I run it in an open way that allows lots of folks to participate but they don’t own it.

And this:

I have direct and root access to the account (and everything on w.org) because I started it.

The post those quotes are from is worth a read.

Matt Mullenweg could clear this up and clearly state on the WordPress website what the ownership situation is. Or better yet, move control to the WordPress Foundation alongside an independent board.