WordPress v WP Engine: what two years of fighting means for your site

Written in October 2026, looking back at a dispute that started in September 2024 and is still in court. We have no side in it. We are interested in what it showed about how WordPress sites get their updates.

What happened

WordPress is free software, but almost every WordPress site gets its updates, plugins and themes from one place: WordPress.org. WordPress.org is run by Matt Mullenweg, who co-founded WordPress and runs Automattic, the company behind WordPress.com.

In September 2024, Mullenweg publicly attacked WP Engine, one of the largest WordPress hosts. He argued that it profited from WordPress without giving enough back, and that it was confusing customers about its link to WordPress. Days later, on 25 September, WordPress.org cut WP Engine's servers off from its plugin and theme directory.

For WP Engine's customers, that meant their sites could no longer update plugins and themes the normal way. Security updates were caught in it too. None of them had done anything wrong.

Where it went from there

2 Oct 2024	WP Engine sued Automattic and Mullenweg.
12 Oct 2024	WordPress.org took over Advanced Custom Fields, a plugin WP Engine makes and millions of sites use. It replaced it in the directory with its own copy, renamed Secure Custom Fields.
10 Dec 2024	A US federal judge ordered WP Engine's access restored, finding it likely to win its claim that its business had been interfered with. That order stands until the trial.
24 Sep 2026	The same judge let WP Engine's competition claims go forward, and dismissed its claim of computer extortion. She also found that Automattic and Mullenweg don't own the WordPress trademarks they had asserted in their own name. Both sides' other claims continue.
19 Oct 2027	A ten-day jury trial is scheduled, as reported by The Repository.

What it means for your site

You don't need to have been a WP Engine customer for this to matter. The lesson is about where updates come from.

• One place, one person. Nearly every WordPress site depends on WordPress.org for its updates, and in 2024 it was shown that access can be withdrawn from a whole host's customers at once.
• A plugin can change hands. Sites that updated Advanced Custom Fields in October 2024 could end up running a different team's copy without having chosen to.
• Security doesn't pause for a dispute. A site that can't update can't be patched. This month's php2shell and July's wp2shell show how little time there is when it matters.

None of this is a reason to panic, and most sites carried on as normal. It is a reason to know who you depend on.

The bigger question

A WordPress site needs a steady supply of updates for as long as it runs. A site saved as plain files doesn't. Its pages are already made, and there is nothing in it to update.

Offramp moves a WordPress site to plain files and a simple editor, looking exactly as it does today. We are a supplier too, and you should ask us the same questions. The difference is that your site ends up as files in a repository you own, which any web host can serve. If we disappeared, your site would carry on without us.