"WordPress Is Eating Itself Alive" — Coding With Lewis Is Right, And The Reality Is Worse

Every so often somebody outside the WordPress bubble looks in, does the reading, and produces something better than anything the bubble managed for itself. That happened on 1 September 2026, when Lewis Menelaws — Coding With Lewis, 755,000 subscribers — published a 35-minute investigation called "WordPress Is Eating Itself Alive". At time of writing it has done nearly 200,000 views.

Full credit, up front and unqualified: this is the best single telling of this story that exists. Not the angriest. The best. He went back to the 2003 b2/cafelog fork, he pulled the actual download numbers, he found the 2005 Hot Nacho SEO-spam scandal that most WordPress lifers have conveniently forgotten, he read the cease-and-desist letters, and he interviewed the story through the one lens the WordPress press mostly avoided: the people who have to bet a business on the update button still working next Friday.

“How does software that powers 40% of the internet lose so much of its trust in just a few months?”

That is his opening line and it is the correct question. Watch the video — it's embedded at the bottom of this piece. Then come back, because I have been inside this ecosystem the entire journey, I maintained sixty-eight WordPress sites for paying clients, and there are three places where Lewis is being too kind.

What he gets absolutely, unarguably right

First, the origin story. He nails the thing that WordPress mythology sands off: WordPress did not win on merit. It won because a competitor rug-pulled its users. In 2004 Six Apart shipped Movable Type 3.0 and forced free personal-blog users into licence tiers of roughly $70 to $200 — call it $120 to $350 in today's money to keep a hobby blog online. WordPress downloads went from about 8,000 that month to nearly 20,000 the next.

“WordPress wasn't the superior product yet, not by a long shot, but it had the best foot in the door.”

That is the single most important sentence in the video, and it is the sentence that explains everything that came twenty years later. WordPress inherited an audience of refugees from a licensing demand. Its entire moral capital was built on we will never do that to you. Which means the day the man in charge started sending licensing demands, he wasn't breaking a business rule. He was breaking the founding promise, in front of the people who had staked careers on it.

Second, his structural breakdown is the clearest I have seen anywhere. He separates the four things people sloppily call "WordPress": the GPL software, wordpress.org (the pipes — downloads, plugin directory, update path), the WordPress Foundation (which holds the trademark), and Automattic (the for-profit). Then he lands the punchline about the 2010 trademark transfer that the community applauded as saintly self-sacrifice:

“The contract was smarter than a gift.”

Correct. The Foundation received the name; Automattic received an exclusive commercial licence back, effectively in perpetuity, with Automattic deciding who else got a commercial seat at the table. Sixteen years of "he gave away the trademark, what a mensch" coverage, and Lewis dismantles it in one clause. The non-commercial rights went in one pocket. The money stayed in the other.

Third — and this is where the video earns its 35 minutes — he refuses to make this about ideology. He goes and finds the agency owner. He quotes the WP Tavern comment from people who logged into client sites and found Secure Custom Fields, a plugin they had never installed, silently substituted for Advanced Custom Fields on two-million-plus sites.

“Nobody at that agency had an opinion about trademark law. They were just there because it was Monday.”

And he finds Naoko Takano — Japanese locale manager for sixteen years, translated WordPress into Japanese for free before anyone paid her, organised WordCamps for a decade — who took the alignment offer and walked. 159 people, 8.4% of Automattic, took that exit. Her resignation note was one short, undramatic paragraph: not aligned with the recent strategic decision. Lewis correctly identifies that as the real damage. Not the lawsuit. The translator.

The line that should end the "it's just a business dispute" defence forever

Two moments in the video, placed eighteen months apart, do more work than any legal filing.

March 2023, on stage at WP Engine's own developer conference, DECODE:

“When you support companies like WP Engine — who don't just provide a commercial service, but are also part of a wider open-source community… everyone's a shareholder in WordPress.”

September 2024, from the wordpress.org blog:

“WP Engine is a cancer to WordPress. And it's important to remember that unchecked cancer will spread.”

Same company. Same founder. Same ownership structure — Silver Lake had been on that board since 2018. Nothing about WP Engine changed in the interval. What changed was that a commercial negotiation didn't land. Put those two clips side by side, as Lewis does, and the "principled defence of open source" reading dies on the spot.

He is also right that the GoDaddy episode in June 2022 was the dress rehearsal. "Parasitic company", "existential threat", tweets later deleted, drama forgotten. But the method survived: name a host, count their Five for the Future hours, apply a noun. Two years later the same script ran with better production values and a keynote slot.

Where he is too generous, part one: the 45 hours

Lewis reports it accurately and moves on, and I understand why — it's a 35-minute video and the injunction is coming. But sit with the number for a second.

The keynote's central exhibit was a contribution-hours league table: Automattic 3,786 hours per week, WP Engine 47. Extraction, quantified. Weeks later, after a federal judge ordered the wordpress.org access restored, the login checkbox dropped and ACF handed back within 72 hours, Automattic published "Aligning Automattic Sponsored Contributions to WordPress" and cut its own core contribution to 45 hours a week.

Forty-five. Two fewer than the number he had put on a screen in front of a convention hall as evidence of parasitism. And the stated reason was not a resourcing constraint:

“Our number one goal is for WP Engine to drop their expensive lawsuits.”

So the contribution hours were never a measure of moral standing. They were a hostage. The moment they were useful as leverage rather than as evidence, they were spent. Every agency that had spent a decade being lectured about giving back to the commons watched the largest contributor withdraw 98% of its labour as a negotiating tactic — and then watched the project ship anyway, which raises an uncomfortable question about what those 3,786 hours were actually buying.

Where he is too generous, part two: "probably not"

On market share, Lewis is scrupulously careful. Six consecutive quarters of decline, 43% down to 41.5% as of his July 2026 recording. Then:

“Can we attribute this to the WordPress fiasco? Well, probably not, to be honest. I wouldn't be surprised if 95% of WordPress users never even heard about it.”

He is right about the 95%. He is right that no CMS is growing — this is not a migration from WordPress to Wix, it is the whole category deflating while AI-native builders eat the greenfield. And he is being an honest analyst by not claiming a causal link he cannot prove.

But he is measuring the wrong population. W3Techs counts installed sites. Installed sites are the slowest-moving number in this entire industry, because they include every abandoned parish newsletter and every 2017 brochure site nobody has logged into since. Trust doesn't show up there for years.

It shows up in the population that was already fleeing: professionals choosing a stack for the next project. And that number is not on a chart, it's in the phone calls. Sixty-eight sites is a big enough sample to know what a client asks after the third "an update broke it" email in a year, and the drama gave every one of those conversations a spine it never had before. You no longer have to argue that WordPress is technically risky. You just have to say: the person in charge switched off updates for a competitor's customers to win an argument, and a judge had to switch them back on.

One more correction, offered warmly: his own headline stat was stale before he uploaded. By early August 2026 W3Techs had WordPress at 40.7% of all websites and 58.9% of the known-CMS market. He said 41.5% in July. The floor is moving faster than the edit.

Where he is too generous, part three: the ending

The final act of the video is genuinely thoughtful and I disagree with almost all of it. Lewis widens the lens: Redis relicensed in March 2024 and was forked into Valkey by Amazon, Google and Oracle within eight days, then quietly returned to open source having lost both the fight and the argument. Terraform, same script. Elasticsearch, same script.

“The same loop, but a different logo.”

Then he offers Mullenweg the tragic reading: two true things at once — he wanted a large profitable business and he wanted to democratise publishing — and every route out ends in either mission failure or community hatred, so:

“Why not just be the bad guy for once and see where that takes you?”

It's an elegant thought and it doesn't survive contact with the facts, for one reason: none of the other companies in that loop owned the update pipe.

Redis changed a licence. That is a forward-looking decision about future code, and it is a decision anyone can route around by forking — which is precisely what happened, in eight days, in public, with no customer's live site touched. HashiCorp changed a licence. Elastic changed a licence. Every one of those fights happened at the level of terms and conditions.

wordpress.org did something categorically different. It reached into running production systems belonging to third parties who were not party to the dispute, cut them off from security updates, and later replaced an installed plugin with a fork under a new name so that the next automatic update silently swapped the maintainer on two million sites. That is not a licensing manoeuvre. There is no Redis equivalent. Redis never pushed anything to your server.

And then the checkbox. To log in to wordpress.org you had to tick: "I am not affiliated with WP Engine in any way, financially or otherwise." A loyalty oath on the front door of the commons. Lewis calls it a required oath and moves on. It deserves a monument. It is the moment the project stopped pretending the pipes were neutral infrastructure, in writing, to every contributor on earth.

The thing he was too polite to say

So here it is, since somebody should.

The lasting damage is not reputational, and it is not the market share chart. It is that a generation of professionals now knows the update button has a landlord, and that the landlord will use it. That knowledge does not un-know itself when the litigation settles. Every risk assessment written for a WordPress build after September 2024 has to include a line item that did not exist before: single-point-of-failure governance, discretionary, uninsurable.

The market's answer is already built. In June 2025 a group of WordPress veterans — including Ryan McCue, who led the REST API — launched FAIR, Federated And Independent Repositories, under the Linux Foundation, to replace the dependency on wordpress.org for updates. FAIR shipped 1.4.0 this year. Lewis correctly notes the company it now keeps at the Linux Foundation: OpenTofu, Valkey, OpenSearch. That is not a list of successful projects. That is a hospice ward for ecosystems that stopped trusting their steward.

Meanwhile, since he recorded in July, the court file has got uglier than the video suggests. WP Engine has moved for sanctions over alleged spoliation of evidence, claiming sworn declarations and deposition testimony contradict months of assurances that Mullenweg's WhatsApp, Signal and Telegram messages had been preserved. WP Engine's counsel has separately sought the dissolution of the WordPress Foundation itself. Read that again. The nonprofit created in 2010 to guarantee that the name would outlive any one company is now the subject of a dissolution motion, brought because of what one company did with it.

And yet: the software works

The most honest thirty seconds in the video are the ones that undercut its own title. WordPress 7.0 shipped. Within seven days 46% of installs had auto-updated — tens of millions of sites, everything from a Raspberry Pi to government infrastructure. Nothing broke. No supply-chain incident. The engineering held.

“The fall, if you want to call it that, wasn't one site going dark. It was quieter than that.”

That is the correct diagnosis and it is why this story matters beyond WordPress. The code was never the problem. The code is excellent. What decayed was the assumption — unexamined for twenty years — that the steward and the commons were the same thing. Once that assumption is gone, the software can be flawless and the platform is still a liability, because you are no longer choosing a technology. You are choosing a person's future mood.

Some people said it with a lawsuit. Some with a plugin fork. Some, like Naoko Takano, with a short blog post and a badge left on the table — still believing in the licences, just not marching along.

And some of us said it by quietly rebuilding sixty-eight sites somewhere the update button has no landlord at all. Watch the video. Lewis did the work. He was just kinder about it than the record deserves.