


<p>Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case, how WordPress gets updated.</p>



<p>If you&#8217;d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast, player of choice, or by going to wptavern.com/feed/podcast. And you can copy that URL into most podcast players.</p>



<p>If you have a topic that you&#8217;d like us to feature in the podcast while I&#8217;m keen to hear from you and hopefully get you, or your idea featured on the show. Head to wptavern.com/contact/jukebox .</p>



<p>And use the form there.</p>



<p>So on the podcast today, we have Aaron Jorbin. Aaron has led teams responsible for some of the largest and most prominent WordPress sites in the world, including Rolling Stone, Variety, WIRED, The New Yorker and The White House. He&#8217;s also a WordPress Core committer who focuses on improving developer happiness, and making the internet usable by everyone.</p>



<p>He&#8217;s been an integral part of the WordPress community since 2010, and today Aaron opens up about the crucial importance of major and minor WordPress releases, and the need for user trust, which forms the backbone for features like auto updates that enhanced WordPress security.</p>



<p>We get into the process behind WordPress releases, discussing how major and minor releases a planned and executed. Aaron explains the dynamics of the Core Committer community, a group of around a hundred dedicated individuals, about 50 of whom are currently active, whose decisions and hard work keep WordPress robust up to date and secure. The commitment to transparency, minimal egos, and the ability to handle criticism are mentioned as key elements for maintaining trust inside this community within a community.</p>



<p>We talk about how communication and decision-making take place mostly in public forums, ensuring openness and collaboration. The conversation also touches on the ebb and flow of volunteer and sponsored contributors. The challenges of coordinating across global time zones, and the need for asynchronous decision-making.</p>



<p>Aaron explains what it takes to move from a small contributor to a key player in the WordPress ecosystem, emphasizing the burden of responsibility that comes with making changes affecting millions of non-technical users. Whether you&#8217;re a developer tester or enthusiastic user, Aaron encourages contributions in various forms, from sharing ideas to testing and providing feedback.</p>



<p>If you&#8217;ve ever wondered how WordPress is maintained and updated, this episode is for you.</p>



<p>If you&#8217;re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you&#8217;ll find all the other episodes as well.</p>



<p>And so without further delay, I bring you Aaron Jorbin.</p>



<p>I am joined on the podcast today by Aaron Jorbin. Hello Aaron.</p>



<p>[00:03:42] <strong>Aaron Jorbin:</strong> Hello Nathan.</p>



<p>[00:03:43] <strong>Nathan Wrigley:</strong> This is going to be a really interesting episode, and I confess, dear listener, that this is an episode that I basically know almost nothing about. So everything that comes out of Aaron&#8217;s mouth is going to be schooling me in a process that I know nothing about.</p>



<p>But it is probably the most important process. Without the process that we&#8217;re going to discuss today, the entire enterprise of WordPress doesn&#8217;t exist, because we&#8217;re going to be talking about the way that WordPress is released, goes from one version to another.</p>



<p>Before we get into the meat of the podcast though, Aaron, can I just offer you the opportunity to tell us a little bit about yourself, who you are, where you come from, where you are at the moment, because that&#8217;s kind of interesting, and what your role in the WordPress community is, please.</p>



<p>[00:04:26] <strong>Aaron Jorbin:</strong> So I am Aaron Jorbin. I have been a Core contributor since 2010, and have been involved in WordPress since about a year or two before that. I went to a WordPress meetup and got sucked into the community, got lucky. And it was right before WordCamp Portland 2009, which was sold out in like three hours. And so I had not gotten a ticket, and there was a raffle for tickets. And so I was able to win the raffle and get a ticket, and get to go to a WordCamp, and start meeting the people that I had known from IRC in real life, and got brought in then.</p>



<p>And my role, I am one of the Core committers, so I&#8217;m one of the one hundred or so people that can make changes to WordPress Core itself. And for the last year, I&#8217;ve been specifically focusing on the minor releases of WordPress, so the maintenance and security releases.</p>



<p>And these are ones that are much smaller in scope, these aren&#8217;t bringing in new features, but in my opinion, some of the more important ones. They&#8217;re the ones that are auto updated by default.</p>



<p>And so the changes that we make in these releases go to every site. And it is a terrifying moment when you start rolling them out, and you just have to cross your fingers that everything is going to go smooth. And so we&#8217;ve put a lot of processes in place to help them go as smooth as they possibly can.</p>



<p>That has been my main focus, but I&#8217;ve also worked a lot on the build tools of WordPress, and on the more low down systems. I haven&#8217;t done a lot with many user facing features. I think the last user facing feature that I had a heavy hand in was the ability to log out of other, where you were logged in elsewhere. And we did user testing for that at the final WordCamp San Francisco, so I think that was 2014.</p>



<p>[00:06:29] <strong>Nathan Wrigley:</strong> Honestly, what a fascinating story. Can I just ask though, if we go back to 2010, I think that was the year that you said you began your WordPress journey. So it&#8217;s a long time, you&#8217;ve been doing this software now for 14 years. What was the path of escalation that took you from, I&#8217;m brand new to WordPress, to Core Committer?</p>



<p>Because it feels like, if you&#8217;re into the software of WordPress, Core Committer is, that&#8217;s like where the road ends. There&#8217;s not really too many places to go beyond there. You know, you&#8217;ve got the capacity to improve WordPress. You could destroy it if you so wish to. So how did that path happen? And I&#8217;m guessing it was a sort of slow, incremental community journey, but I&#8217;d love to hear that.</p>



<p>[00:07:07] <strong>Aaron Jorbin:</strong> Yeah, so my first code contribution was, so Jen Milo, who was at the time the UX lead of WordPress. She published a blog post about a few small UX changes she would like to see in WordPress Core. And I was like, well, I&#8217;ve got some extra time on my hands. I&#8217;m going to try to work on one of these.</p>



<p>And I sat down for a couple of days, and worked on the initial patch for it, and went back and forth with Andrew Nacin, who was a new committer at that time, and we came up with a solution. This was during the 3.0 cycle, and it was for the ability for you to see, if you attempted to change the admin email in WordPress, it sends an email that you need to confirm, but there was no notice whatsoever that there was a pending change. So it was just adding a notice that there was a pending change, so you could know that someone had tried to change it.</p>



<p>And so, worked on that, and that got accepted. I was very excited. I ran home to my then girlfriend, and told her, oh my God, oh my God, you&#8217;re not going to understand any of this, because she was not a techie. This is what I did. My code is now going to help power almost 20% of the internet. That also shows how old this was.</p>



<p>From there it was, well, now I&#8217;ve seen this process, now I&#8217;ve been involved in this process, what can I do to continue being involved in this process? And so I was working on a few small enhancements, or bug fixes, every release. And did that for, probably about three years before I got a job at Condé Nast, the magazine publisher. And part of my role there was to really help the company used WordPress better.</p>



<p>And so that gave me a lot of freedom and time, and I found one of the best uses of that time was to help make WordPress itself better. If it&#8217;s better for Condé Nast, it&#8217;s probably going to be better for everyone. And at the time, one of the challenges, it was right as the Git mirrors were added for WordPress. And I was like, okay well, now we have patches that are coming in through Git, coming in through SVN, coming in against the old Core repo, versus against the modern develop repo.</p>



<p>And so I worked on a tool called Grunt Patch WordPress, that made it easy for you to apply patches from anywhere. And you could just enter a ticket number, it would list all of the patches, and it would apply it automatically, no matter how it had been created. And working on that, I got involved more in the build tools, and was asked during the 4.1 cycle, if I would be willing to become a committer, and if I was willing to help maintain WordPress.</p>



<p>And it was a huge honour, and a huge burden that I would be willing to take on. My friend Daniel Bachhuber gave a talk a number of years ago, my condolences, you are now the maintainer of an open source software project. And in many ways, like you are taking on a great weight. Your changes are going to affect other people, and you are going to be responsible for making these changes.</p>



<p>It is still an honour that the community and other committers trust me enough to stay in this role, and that I have been able to make a number of changes, and hopefully make WordPress better in the process.</p>



<p>[00:10:41] <strong>Nathan Wrigley:</strong> It is such an interesting tale that. And really, I think the word that&#8217;s coming out of it for me was one that you just said, and it was trust. It feels like this whole process, from 2010 until the moment you were offered the Core Commiter status, it feels like it&#8217;s a work of building up trust, of doing things in a way which is fully transparent. People can see what you&#8217;re doing. You&#8217;ve done something important. Things worked, I guess, as well. And over time, people just begin to say, oh okay, yeah, Aaron, oh yeah, his name&#8217;s come up a little bit. And then eventually, that moment where you get the ability to alter WordPress Core.</p>



<p>But also, I guess the journey between 2010, okay, it was 20% of the internet. It was still big. But it&#8217;s like going from 20 to 43, let&#8217;s say about there at the moment. That&#8217;s a big jump. To be approaching half of the internet is incredible. And you illustrated, or you alluded to the fact that you sometimes probably feel the burden of that a little bit. You commit something, and millions of people are going to feel the effect of that. And millions of them will be utterly non-technical. And so they will not know when something goes wrong. They will not understand where to go and seek resolution to that, potentially.</p>



<p>And so that must add to the burden even more because, you know, if something goes wrong at my local shop, I just take it back and get another one. If something goes wrong with a website and I&#8217;m non-technical, then, yeah, that&#8217;s really interesting. So trust is what I&#8217;m imagining is the sort of essence of what you&#8217;re doing.</p>



<p>[00:12:14] <strong>Aaron Jorbin:</strong> Yes. So ultimately, user trust matters. I think it was Andrew Nacin who first said to me that, what makes WordPress work as well as it does, is the trust the users place in the software. The fact that users trust WordPress to auto update. Without auto updates, WordPress would be less secure. Without the ability to have a bug fix, or a security bug fix go out nearly instantaneously, it would be weeks before many people logged into WordPress. Potentially, you know, some people will set up a site, and set it and forget it. And they would get hacked if it wasn&#8217;t for auto updates. And so having that user trust really is a requirement for WordPress to be as successful as it is.</p>



<p>[00:13:05] <strong>Nathan Wrigley:</strong> So there&#8217;s the trust from the community, but also presumably there must be a fairly high level of trust between you Core Commiters. And I think you said about the number 100, something like that. Have I got that right? Is it roughly around there?</p>



<p>[00:13:17] <strong>Aaron Jorbin:</strong> It is about a hundred people that have committed over the course of the 21 years that WordPress has been involved. I think there&#8217;s about 50 active at the moment in some way, shape, or form.</p>



<p>[00:13:28] <strong>Nathan Wrigley:</strong> But a hundred broadly speaking, over the course of WordPress, and maybe 50 at the moment. I guess the trust between all of you must be fairly high. And I presume you must have back channels. Well, of course you do. But I&#8217;m really just leading you down the garden path of, tell us what these are.</p>



<p>How do you communicate? How do you maintain that trust? Is the trust, dare I ask it, is the trust ever taken away, and somebody has to be removed from that role? So yeah, let&#8217;s just get into that. How do you communicate? How do you ensure that trust is kept going? What are the ways that you build all of that up?</p>



<p>[00:14:03] <strong>Aaron Jorbin:</strong> First off, there&#8217;s very little back channel. There&#8217;s very little that is not discussed in the open, related to WordPress Core. Security is about the only thing that does not get discussed openly. Otherwise, there might be some conversations, especially when things are just not known. When people have, what I would refer to as a very half-baked idea. You might back channel, and have a quick side discussion with one or two other people, to try to make that idea a little bit better, so that you don&#8217;t feel like you&#8217;re going to embarrass yourself by sharing the idea.</p>



<p>Other than that, it is all in public. It is in Slack, it is on Trac tickets , it is on GitHub issues, it is on pull requests. That discussion is happening in public, and is open for anyone to really contribute their thoughts and their ideas.</p>



<p>And where the trust amongst us comes in, is the fact that I think, generally, there is very little ego involved in the people that are committers. We don&#8217;t feel bad if another person tells us our idea was wrong, or our idea isn&#8217;t the right solution.</p>



<p>It is okay for someone to tell me that my code is, bad or that my code doesn&#8217;t solve the problem. That&#8217;s not an insult to me personally. I think that all of the committers, there&#8217;s that idea that we are all going to be okay. We&#8217;re not going to insult each other. It&#8217;s not an instance of, what idiot made that decision? That&#8217;s not the type of thing that would ever be said amongst committers. It&#8217;s, okay, what information was had that guided that decision? How can we improve that information?</p>



<p>[00:15:48] <strong>Nathan Wrigley:</strong> Does the Core Commiter community, you mentioned that it was, over time it&#8217;s been a hundred, and at the moment it&#8217;s 50. Does it ebb and flow a little bit? In other words, are there people who just take a step back, maybe come back in six months time or something? Or are many of those people in some way able to commit to Core on a more or less permanent basis because, I don&#8217;t know, maybe they&#8217;re sponsored, or seconded by their company or something like that?</p>



<p>[00:16:08] <strong>Aaron Jorbin:</strong> Yeah so, I mean, I would say most of the people that are active are given support in some way, shape, or form. So myself, I have GitHub sponsors that, right now, are covering a portion of my life expenses. But others are paid full-time, whether it be by a hosting company, by a product company. And so most of the people that are active are supported, but not all of them. There are a number of committers that are still doing this on a very volunteer basis.</p>



<p>And people&#8217;s activity does ebb and flow. And so, I think a good example of this is myself. So I was very active, especially during the 4.1 to about 4.9 timeframe. But then I took on a different role, and didn&#8217;t have as much time. And so I stepped back from necessarily doing as many active commits, and more was there to help be in meetings, and provide some historical context, or to work on a couple of small things here or there.</p>



<p>And then after I left my most recent job, I was like, I&#8217;m taking a break. I stopped looking at computer screens for nearly six months. It was incredible. But decided that, ultimately, I like WordPress. I like contributing to what I view as a very important mission to democratise publishing. I think that, even if I don&#8217;t necessarily agree with everything everyone has to say online, I think they have a right to share it and a right to say it.</p>



<p>I want to help people do that. I want to help, whether it be a small business that just wants to get word out about its hours, to a large media company that wants to do journalism, to politicians who I may or may not agree with, wanting to get elected. I think that everyone has a right to share their beliefs online, and WordPress helps unlock that, and I like working on that.</p>



<p>[00:18:07] <strong>Nathan Wrigley:</strong> Nice. I think, if we were to poll every single person that&#8217;s used WordPress ever, which should be a difficult thing to do, but let&#8217;s imagine that we could. I&#8217;m imagining that the vast majority of those people would not necessarily have technical expertise or any interest in the project. They&#8217;re just using it, it&#8217;s functional to them. They may not even know that it&#8217;s called WordPress. They log into their website, and they do their thing. They create their content, and they click publish, and what have you.</p>



<p>But yet It just magically updates itself from time to time, whether that&#8217;s at the click of a button, or something, a little bit more automated. It just sort of happens in the background. And also, I would imagine that the listeners to this podcast, even though it&#8217;s very likely that they&#8217;re really quite crazily into WordPress, there&#8217;ll be this curtain between what they experience, and what Core is doing. How all those decisions are made, and how those changes get pushed.</p>



<p>Now, they may have noticed, obviously, that there are minor releases. So we go from 6.5, to 6.5.1, to 6.5.2, and then there are more major releases, 6.5 to 6.6, or 7 at some point, you know. But the major releases kind of have dates in the calendar, stretching right out into the future. So we try to get those dates for the whole year, and you can look those up online, and may provide that in the show notes. But you can see, in theory, they&#8217;re provided for. We&#8217;ve got a north star. We know that on this date we should be shipping the next version of WordPress.</p>



<p>But in between those major ones, we get these little ones which come around, like today. Little ones just happen, might happen in a week, might be two weeks, there might be a few weeks that go between them. How are those decisions made, and could we break it into the two parts? Could we do the major first, and then the minor afterwards? Because I think the major is more, how to describe it, there&#8217;s more thought goes into it on a long term basis.</p>



<p>There&#8217;s more north star of that, and the minor ones feel like sometimes it&#8217;s reactive instead of proactive, because of security and so on. So let&#8217;s do the major releases. How is it decided what features go in, what we&#8217;re aiming for, what we want to ship?</p>



<p>[00:20:05] <strong>Aaron Jorbin:</strong> So, I mean ultimately it&#8217;s decided what is going in by what is ready to go in, for a major release, and what people want to work on. Whether that is individuals that have a improvement that they really want to drive forward, whether it&#8217;s a company that decides that they want to donate, or devote, resources to working on maybe a larger feature that they think that will benefit their users, or hopefully benefit all users.</p>



<p>The decisions of what is ready to go in is basically a decision of the committers as a whole. And it&#8217;s often based on a consensus. And it&#8217;s not necessarily that everyone agrees, it&#8217;s that no one disagrees. So we will work in Slack, there will often be people that are guiding it. There are individuals that are wholly focused on just looking at the backlog of requests, and every idea that ever has been proposed. And saying like, okay well, this is a common theme, and this is a way to solve that problem. And we&#8217;ll be working towards that.</p>



<p>And so those major releases will often be set, generally by the project leadership, by Josepha and by Matt. And the dates might flux. Oftentimes we&#8217;re looking at trying to find a date that works for everyone in the world can be hard. There are holidays nearly everywhere, or nearly every day in some countries, and so trying to minimise the impact of those releases. And so not doing a release on a major Christian holiday, or a major Muslim holiday, is generally best possible solution.</p>



<p>For the minor releases, like you said, there&#8217;s kind of the reactive ones, in which case, those would generally be decided sometimes hours ahead of time. In the case of 6.4.1 two weeks ahead of time in other cases. So the recent 6.5.3 there was about one month of process.</p>



<p>And basically what it was was, it started with, some discussions in Slack of, okay, I think we&#8217;re going to want a maintenance release. Let&#8217;s try to put together a group of people that can lead it. And then, okay, amongst that group, let&#8217;s discuss possible dates. Let&#8217;s look at calendars. Let&#8217;s look at our personal calendars to make sure that we will be available. Let&#8217;s look at the holiday calendars to make sure that we&#8217;re not scheduling it during a bank holiday, or a religious holiday. And let&#8217;s try to do our best to make sure that people will be available for that release.</p>



<p>As far as what goes into the minor releases, it&#8217;s a lot of times like what bugs are known, what bugs are people reporting, what things can we fix in that timeframe? And so, a way that people can get involved is, there will generally be a post on Make Core about the release, and if you don&#8217;t see one, there&#8217;s always the weekly Dev Chat agendas, where you can comment on there. And commenting about a bug of, I think that this bug needs to be fixed in this.</p>



<p>We keep the scope rather tight, and that we try to focus the bug fixes solely on recently introduced bugs, rather than longer standing bugs, but anything can be discussed. If someone wants to try to make the case for it, they can try to make the case for it. The idea that, in the presence of new rationale, a good maintainer changes their mind often. And so even if the answer is initially no, that doesn&#8217;t mean the answer is no forever, and adding new information, adding data can really change minds a lot of times.</p>



<p>[00:23:53] <strong>Nathan Wrigley:</strong> You talked about a consensus there, and in fact, I think the implication of what you said was that, broadly speaking, the consensus is often there. There&#8217;s often broad consensus amongst you Core Committers about what needs to go in. In a way that kind of seems surprising, because you&#8217;d imagine that with 50 minds staring at a problem, there&#8217;s going to be 50 different solutions, and a lot of arguing and tussling.</p>



<p>But, again, I suppose that goes back to the trust thing that we talked about earlier, and maybe something different to trust, maybe it&#8217;s accommodation, or the ability to defer to somebody politely, as opposed to just wanting to railroad them.</p>



<p>And I feel maybe that in the corporate world, that whole governance model would break down reasonably quickly. Is that what you&#8217;re saying? That the 50 of you, or however many are in the, air quotes, room at the time, you really do have that? There is a consensus of almost everything that goes in. That&#8217;s remarkable.</p>



<p>[00:24:46] <strong>Aaron Jorbin:</strong> I would say we get to consensus. There is not always one to begin with. There is absolutely disagreements that happen, and disagreements that take place. And I would say that there are very few changes that aren&#8217;t without some sort of, often minor, disagreement. Of whether it be, I think this line needs more documentation, or I don&#8217;t like the variable name used here, ultimately nitpicky things.</p>



<p>All the way up to major, I don&#8217;t think that this is something that should be in Core disagreements. And you will have discussions, and sometimes that discussion will peter out, and not necessarily get to a quick resolution. Oftentimes though it will get to a resolution.</p>



<p>And another saying that I often use to guide me is, no is temporary, but yes is forever. Saying that code is not ready for WordPress isn&#8217;t saying that this code is never going in WordPress, or this feature is never going in WordPress.</p>



<p>There&#8217;s very few things I can think of that I would be like, this should never go into WordPress. But once it is in WordPress, it is the responsibility of all maintainers, all of the committers to maintain it, and to make it as best as it possibly can. Once it&#8217;s released from WordPress, because there will be features that are added that might get removed.</p>



<p>And so I think the font library is a good example of this. This was originally targeted for, I think, 6.3, and wasn&#8217;t quite ready. And then 6.4, it got very close, but then ultimately was pulled back. And then 6.5, after a lot of disagreement that people probably saw publicly amongst many committers, we did find solutions in a way to ship that, in a way that I think ultimately has been beneficial for the users of WordPress.</p>



<p>[00:26:39] <strong>Nathan Wrigley:</strong> Is the release lead for each release, so that, let&#8217;s say, for example, 6.5 or 6.6, has a release lead. Is the release lead ultimately responsible for the go, no go decision? In other words, if the 50 of you are, yeah, you can&#8217;t quite get that consensus that would be lovely, then it falls on the shoulders of an individual, and if you follow the project, you&#8217;ll know that that individual changes from time to time.</p>



<p>[00:27:05] <strong>Aaron Jorbin:</strong> Yeah. So, I mean ultimately it is Matt&#8217;s decision. And I for one, think that Matt has very good product sense, and WordPress is largely successful because of Matt. And I think that there are very few cases where I can think of where a problem has needed to be escalated to Matt to make a decision. Ultimately, you know, it&#8217;s often there will be a decision that gets made amongst the people that are most active, and working on it closely. And it&#8217;s not a highly conflicted situation. It&#8217;s very rare that the release lead needs to decide between two camps, if you will.</p>



<p>[00:27:50] <strong>Nathan Wrigley:</strong> I think sometimes the impression, out in the wider world, probably not in the community of WordPressers who follow the project really, really closely, but I do wonder sometimes if there is an impression that decisions, like any hierarchy, there must be somebody at the top making all these decisions and what have you. So that&#8217;s really nice to hear. That&#8217;s nice to hear that you think that&#8217;s a fair and equitable way of doing it.</p>



<p>However, I wonder how you feel about the, I can&#8217;t think of a better word, so I&#8217;m going to use the word chaos. The open source nature of the project can at times be fairly chaotic, because everybody gets a voice, everybody can put time into things, everybody can push their own agenda. I guess in a more corporate structure, it would be top down, whereas we&#8217;ve got a much flatter structure in WordPress. Everybody gets their go. Does it sometimes feel a little bit like that? And I&#8217;m not asking you to throw any names out, or throw anybody under a bus. But, does it occasionally feel, oh, can we just make the decision? Can we just do this, or this, which one?</p>



<p>[00:28:45] <strong>Aaron Jorbin:</strong> I think chaos actually is a great term for it because it often is, and especially when working around the clock. There are people contributing in nearly every time zone. And I think you would struggle to find a time of day where someone isn&#8217;t working on WordPress.</p>



<p>Luckily there&#8217;s very few decisions that need to get made at a snap of a hat. It is almost always a case where the decisions can be made asynchronously, where the discussion can continue possibly over the course of multiple days, or weeks. And the chaos works. And I know that a lot of people struggle with the chaos, and with understanding, well, how can I get involved? Who&#8217;s the person in charge that I need to talk to? Everyone is in charge, so you talk to everyone.</p>



<p>[00:29:38] <strong>Nathan Wrigley:</strong> Yeah, it&#8217;s not like if you&#8217;re in the corporate world where you just whip out the company Rolodex, for want of a better word, and you discover that, oh okay, they&#8217;re in charge of that department, that&#8217;s them. It&#8217;s a little bit more fine grain and nuanced, and things change all the time, and somebody&#8217;s gone on holiday. I love that then. So there is a kind of chaotic element to it, which I think you embrace, I guess. This is just the way it works, and it&#8217;s probably got massive upsides, as well as some interesting downsides as well.</p>



<p>In terms of the project, it feels like, since the dawn of the internet, so whenever that was, Tim Berners Lee, 35 years or whatever. Open source, at the beginning of the internet, was a real crucial underpinning for all sorts of things. The servers that we use, the CMSs that we use, and so open source projects just popped up everywhere. But then it feels, more recently, that competitive, market-based, commercial CMSs have come along, with probably a corporate governance structure. So not as transparent, but maybe more top down. So perhaps easier to manage in that way.</p>



<p>Do you have any feelings, or misgivings about open source in the near future, because of the competitive landscape that a CMS finds itself in now?</p>



<p>[00:30:50] <strong>Aaron Jorbin:</strong> I think that ultimately open source always wins. I think that you are better off betting on open source. I saw a tweet the other day about someone that has a shop on Shopify, and they woke up one morning and Shopify had turned them off. And they were like, well, our target was to make $25 million this year, but now it might be zero, because this decision by this company was to turn us off.</p>



<p>And thankfully with WordPress, you don&#8217;t have to deal with that. WordPress cannot turn a site off. WordPress cannot decide that a specific website is no longer going to be allowed to use WordPress. WordPress has the benefit of the GPL, GNU public license. And in that there are the four freedoms, and one of those is the freedom to run the software in any way you choose.</p>



<p>So that freedom, I think, ultimately is what gives open source its power, and its sustainability. WordPress itself is a fork of another project. I am never upset if someone says, well, I&#8217;m going to fork WordPress to do this, it&#8217;s like, okay. If your software is going to be better, that&#8217;s awesome. Open source wins.</p>



<p>I am not someone that&#8217;s ever been a big Drupal user, but I love Drupal. Drupal&#8217;s open source software. I don&#8217;t view Drupal as the enemy of WordPress. I think that, if a site wants to use Drupal because that&#8217;s the best open source software, or the best software it can find, awesome.</p>



<p>WordPress has been lucky to, you know, at various times, collaborate with people in the Drupal community. A number of years ago, I was running the WordPress meetup in Washington DC, and we organised what we refer to as the open source barbecue. And so it was the WordPress meetup, the PHP meetup, the Android meetup, and the jQuery meetup. And we just threw a barbecue for 200 people to come and celebrate open source, and eat barbecue.</p>



<p>[00:32:54] <strong>Nathan Wrigley:</strong> If we were just concentrating on the features, so not the ethics of owning the technology, who owns it, who gets to shut you down or not. Do you think that it&#8217;s easy for an open source project, of the breadth, and scale, and depth, and enormity of WordPress, to keep up with the features that the proprietary CMSs ship? Because they know their users, and because they don&#8217;t have to make decisions in committee.</p>



<p>Well, they probably do but, you know, the committees are probably much smaller, and managed from the top down. And they can ship features like this, and like that. They don&#8217;t need to necessarily worry. It&#8217;s a difficult question to encapsulate, but do you understand where I&#8217;m going with that? They can ship features perhaps more quickly than WordPress can.</p>



<p>[00:33:33] <strong>Aaron Jorbin:</strong> Absolutely. But I don&#8217;t think it is the ability to ship features quickly that leads to success. I think it&#8217;s the ability to ship the right features, and provide the right experience for users. And I think that experience includes the ability for them to decide to move. If you are not happy with your WordPress host, you can move hosts. If you are not happy with the agency that you are using, you can move agencies. If you are using a closed source CMS, your ability to move is a lot harder.</p>



<p>You get locked in, and ultimately that is harder for you. It might mean that you get features quicker. It might mean that you get up and running quicker, but at what cost? Everything has a benefit, everything has a cost. And I think that the benefits of open source just drastically outweigh the costs of using it. The fact that you are going to deal with volunteers running your software project in many cases.</p>



<p>There&#8217;s the old XKCD article, which has the tiny twig of holding up the software is one random guy in Omaha, Nebraska. And as much as possible, I think one of the benefits of WordPress is that there&#8217;s very few things where it&#8217;s one twig being held up by a single person. There are very few parts of the code base that multiple committers aren&#8217;t familiar with. And the beauty of how it&#8217;s been developed is we can look back in many cases, and understand why changes were made.</p>



<p>You&#8217;ll see in, if you ever look at a WordPress commit, there&#8217;s often be a long section. There will be a one sentence description, and then there might be a paragraph or two explaining what the change is. And then there&#8217;s also links to tickets, and often very important, the props of who worked on it along the way.</p>



<p>And so you can see, okay, well, these 15 people contributed to this. Oh, 12 of them aren&#8217;t active anymore, but there&#8217;s 3 of them that are. Maybe they remember, or I can look at the tickets that are referenced, and I can find the discussion that took place leading up to it. And that ticket, maybe that links to an IRC conversation from 15 years ago. We have the logs of that conversation, and can look back at what was discussed, and how did we get to this solution.</p>



<p>[00:36:03] <strong>Nathan Wrigley:</strong> I think history shows that people seem to like open source. You only have to look at the numbers, and the enormity of a lot of open source projects to realise that it definitely tends towards winning. I don&#8217;t know quite how to phrase that but, does that make sense? The graph tends towards open source on the whole.</p>



<p>Okay so, Aaron, given all of this, if somebody&#8217;s listening to this and they think, actually, I&#8217;d like to get into that, I&#8217;d be curious to see what this is like, dip my feet. Nobody&#8217;s suggesting that you have to show up and stay there for the rest of your life but, how do people begin this journey? Where are the best places to go?</p>



<p>[00:36:36] <strong>Aaron Jorbin:</strong> So if you want to contribute to WordPress Core, and I hope that everyone does at some point in their life, the best way to get started is to join the new contributor chats, which take place biweekly in WordPress Slack. And so if you go to make.wordpress.org/chat, you can join the WordPress Slack. If you go to make.wordpress.org/core, you can see the Core discussions, and you can see the meetings that are taking place.</p>



<p>Get involved. Find a issue that is bothering you, or that you think is going to make WordPress better, and add your thoughts. Think about like, if someone isn&#8217;t thinking about this, what is going to get them to think about this? Add context, add information. Even if you are not someone that can write code, maybe you can quickly sketch out an idea, take a picture of that and upload it.</p>



<p>Maybe you can share some data or share some stats from your company of, hey, this change took place and it&#8217;s actually caused a 10% drop for us in user signups. That is like, okay, well, that&#8217;s a data point that we can look at, and maybe use to come up to a better solution. This change would help speed up our website.</p>



<p>You can also test the changes that other people have proposed. There is the WordPress Playground now, that allows you to very easily test out a change. Just earlier today, there&#8217;s a change that was being proposed for 6.6 to remove the revisions panel from the sidebar. And a handful of us were like, I don&#8217;t think that&#8217;s quite right, here&#8217;s some alternate ideas. And then someone coded one up. A couple people looked at it and we&#8217;re like, that&#8217;s not the right way, how about this other way? And it was coded up, and I tested it and just was like, all right, here&#8217;s what I see. And it just took a couple of clicks of my mouse. It wasn&#8217;t a hard process to test and share a little bit of feedback for the project.</p>



<p>[00:38:41] <strong>Nathan Wrigley:</strong> So it&#8217;s not all about committing code. There are many more ways that you could help Core. So it may be that you identify problems, or test possible things that could go in, and just give your opinions. There&#8217;s loads of different ways that you can help in this initiative. And I will make sure that the, bits and pieces that Aaron has mentioned today all make it into the show notes. If you go to wptavern.com/podcast, and search for this episode, you&#8217;ll be able to find the show notes all attached there. It only remains for me, Aaron, to ask, if anybody is interested in just connecting with you personally, do you have a favorite place online where you send people?</p>



<p>[00:39:16] <strong>Aaron Jorbin:</strong> My WordPress site is my favorite place, which is at aaron.jorb.in. I&#8217;m also on a number of social media networks, generally with the username of Aaron Jorbin. A handful of them I think I use just Jorbin. Yeah, I would love to chat with people. If people see me at a WordCamp, please come up and talk to me. I can be a bit of an introvert at those, and so I might not approach people, but would love to chat with as many people as I can.</p>



<p>Something I used to do, that I&#8217;m going to try to get back into is, one lunch during the WordCamp, I&#8217;d sit down at a random table and just ask people, so how do you use WordPress? And you never know who you&#8217;re going to meet, and what they&#8217;re going to have to share if you do that.</p>



<p>[00:39:58] <strong>Nathan Wrigley:</strong> Yeah, that&#8217;s nice. And by the way, I&#8217;m incredibly jealous of your domain name. That&#8217;s just a stroke of luck that there&#8217;s a whole top level domain with your final two letters of your name in there. That&#8217;s lovely. I&#8217;ll add that into the show notes as well. But, Aaron Jorbin, thank you so much for chatting to me today. A real pleasure, thank you.</p>



<p>[00:40:14] <strong>Aaron Jorbin:</strong> Thank you so much for having me.</p>
</div>



<p>On the podcast today we have Aaron Jorbin.</p>



<p>Aaron has led teams responsible for some of the largest and most prominent WordPress sites in the world including Rolling Stone, Variety, WIRED, The New Yorker, and The White House. He is also a WordPress Core Committer who focuses on improving developer happiness and making the internet usable by everyone.</p>



<p>He’s been an integral part of the WordPress community since 2010, and today Aaron opens up about the crucial importance of major and minor WordPress releases, and the need for user trust, which forms the backbone for features like auto updates that enhance WordPress security.</p>



<p>We get into the process behind WordPress releases, discussing how major and minor updates are planned and executed. Aaron explains the dynamics of the Core Committer community, a group of around 100 dedicated individuals, about 50 of whom are currently active, whose decisions and hard work keep WordPress robust, up to date and secure. The commitment to transparency, minimal egos, and the ability to handle criticism are mentioned as key elements for maintaining trust inside this community within a community.</p>



<p>We talk about how communication and decision-making take place mostly in public forums, ensuring openness and collaboration. The conversation also touches on the ebb and flow of volunteer and sponsored contributors, the challenges of coordinating across global time zones, and the need for asynchronous decision making.</p>



<p>Aaron explains what it takes to move from a small contributor to a key player in the WordPress ecosystem, emphasising the burden of responsibility that comes with making changes affecting millions of non-technical users. Whether you&#8217;re a developer, tester, or enthusiastic user, Aaron encourages contributions in various forms, from sharing ideas to testing and providing feedback.</p>



<p>If you’ve ever wondered how WordPress is maintained and updated, this episode is for you.</p>



<h2 class="wp-block-heading">Useful links</h2>



<p><a href="https://www.condenast.com/">Condé Nast</a></p>



<p><a href="https://make.wordpress.org/core/2018/03/28/grunt-patch-wordpress-1-0-0/">Grunt Patch WordPress</a></p>



<p><a href="https://wordpress.org/download/releases/">Previous WordPress releases</a></p>



<p><a href="https://www.drupal.org/">Drupal</a></p>



<p><a href="https://www.meetup.com/wordpressdc/">WordPress DC meetup</a></p>



<p><a href="https://xkcd.com/2347/">Dependency cartoon from xkcd</a></p>



<p><a href="https://make.wordpress.org/chat/">WordPress Slack</a></p>



<p><a href="https://make.wordpress.org/core/">Make WordPress Core</a></p>



<p><a href="https://wordpress.org/playground/">WordPress Playground</a></p>



<p><a href="https://aaron.jorb.in/">Aaron&#8217;s website</a></p>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Wed, 03 Jul 2024 14:00:00 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:32:"http://purl.org/dc/elements/1.1/";a:1:{s:7:"creator";a:1:{i:0;a:5:{s:4:"data";s:14:"Nathan Wrigley";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}i:49;a:6:{s:4:"data";s:13:"
	
	
	
	
	
	
";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";s:5:"child";a:2:{s:0:"";a:5:{s:5:"title";a:1:{i:0;a:5:{s:4:"data";s:45:"Akismet: What is reCAPTCHA? How Does It Work?";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"guid";a:1:{i:0;a:5:{s:4:"data";s:28:"http://akismet.com/?p=284031";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:4:"link";a:1:{i:0;a:5:{s:4:"data";s:43:"https://akismet.com/blog/what-is-recaptcha/";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:11:"description";a:1:{i:0;a:5:{s:4:"data";s:28937:"<p>There are few things in this world as annoying, and pervasive, as spam. You probably get spam phone calls, spam texts, and spam emails. <em>You’ve won a prize. You’ve broken a copyright law. You’ve placed an order and need to verify your account details.</em> <em>You can make $3,956 a day working from home doing this one cool trick</em>. It sucks up our time and, if we fall for it, can be downright dangerous.&nbsp;</p>



<p>But there’s also spam on many websites. Comment sections filled with links to less-than-reputable pages designed to phish for sensitive info or initiate a malware download.&nbsp;</p>



<p>For site owners, spammy comment sections, fake user registrations, and false contact form submissions can add hours of work each week, make your site seem less legitimate, and put visitors and your entire reputation at risk.&nbsp;</p>



<p>That’s where reCAPTCHA comes in. Owned by Google, reCAPTCHA is a free service that distinguishes real human users from automated bots. But there are pros and cons to implementing reCAPTCHA on your site, so you’ll need to weigh your options carefully in order to find an effective solution.&nbsp;</p>


<p>In this post, we’ll take a closer look at reCAPTCHA and how it works. Then, we’ll explore the main drawbacks of reCAPTCHA, and consider a better alternative. Let’s jump right&nbsp;in!</p>


<span id="more-284031"></span>



<p>.</p>


<h2 id="what-is recaptcha" class="wp-block-heading">What is&nbsp;reCAPTCHA?</h2>


<p>reCAPTCHA is a free Google service that protects websites from spam. <a href="https://akismet.com/blog/what-is-captcha/">CAPTCHA tests</a> were first introduced in 1997 as an extra layer of security against hackers and bots.&nbsp;</p>



<p>These tests were deployed primarily on login pages and <a href="https://akismet.com/blog/how-to-add-wordpress-contact-form/">contact form pages</a>. They generated distorted text and users had to decipher the words to pass the test. Since then, CAPTCHAs have become more complex to keep up with evolving technologies and bots.&nbsp;</p>


<p>The advanced nature of CAPTCHA can cause problems for the user experience (UX) since it demands more input from site visitors. In fact, reCAPTCHA (introduced in 2007) presents more complicated challenges like puzzles and image identification, which typically require user&nbsp;interaction.</p>


<img width="434" height="627" src="https://akismet.com/wp-content/uploads/2024/06/image.png" alt="example of a CAPTCHA with images of cars" class="wp-image-284033" />



<p>In 2009, reCAPTCHA was acquired by Google. The original version is no longer available since it was found to be too easy for bots (using algorithms trained in pattern recognition) and too difficult for humans.&nbsp;</p>


<p>So now, there are different versions of reCAPTCHA, which we’ll explore later in the&nbsp;post.</p>

<h2 id="how-does-recaptcha work" class="wp-block-heading">How does reCAPTCHA&nbsp;work?</h2>


<p>reCAPTCHA uses artificial intelligence (AI) to differentiate between humans and bots. While the traditional CAPTCHA issued tests before allowing visitor access, algorithms trained in pattern recognition could quickly solve these challenges.&nbsp;</p>



<p>Therefore, reCAPTCHA was introduced. As we discussed, the original version is no longer in use, but there are still two versions available.&nbsp;</p>


<p>reCAPTCHA v2 requires users to select images or check the “I’m not a robot”&nbsp;box.</p>


<img width="371" height="480" src="https://akismet.com/wp-content/uploads/2024/06/image-1.png" alt="example form with ReCAPTCHA" class="wp-image-284034" />


<p>Meanwhile, reCAPTCHA v3 aims to minimize the disruption to the user experience. Instead of requiring user interaction, it calculates scores based on user behavior. The website administrator can then allow or block access, but they can also issue further v2 tests, if needed, for&nbsp;verification.</p>

<p>The latest version of reCAPTCHA (v3) uses a JavaScript API to determine a score between 0 and 1. While a score of 0 is judged to be a bot, a score of 1 is almost always a human user. It uses a concept called “actions” which lets you define steps in your typical user&nbsp;journey.</p>


<p>This way, the reCAPTCHA technology learns how real users interact with your site so that it’s able to detect bot traffic. In fact, some websites deploy reCAPTCHA across all pages so that the technology has more user activity to work with.&nbsp;</p>


<h2 id="distinction-between-captcha-and recaptcha" class="wp-block-heading">Distinction between CAPTCHA and&nbsp;reCAPTCHA</h2>

<p>You might still be wondering about the <a href="https://akismet.com/blog/akismet-vs-captcha-vs-recaptcha/">difference between CAPTCHA and reCAPTCHA</a>. First off, CAPTCHA is an umbrella term used to describe any website authentication test to separate humans from&nbsp;bots.</p>


<p>On the other hand, reCAPTCHA is a type of CAPTCHA test owned by Google. Note that there are several types of CAPTCHAs owned by different companies, and reCAPTCHA is just one of many.&nbsp;</p>


<p>As we discussed, the original reCAPTCHA test was much more simplistic, primarily relying on word tests disguised with twisted letters. But now, there are different types of reCAPTCHA including images, checkboxes, and tests that require no user input at&nbsp;all.</p>

<h2 id="the-different-types-of recaptcha" class="wp-block-heading">The different types of&nbsp;reCAPTCHA</h2>

<p>Now, let’s take a look at all <a href="https://akismet.com/blog/recaptcha-v2-vs-v3/">the different versions of&nbsp;reCAPTCHA</a>.</p>


<h3 id="recaptcha-v1" class="wp-block-heading">reCAPTCHA v1</h3>


<p>reCAPTCHA v1 isn’t widely used anymore and was discontinued by Google in 2018. But this version of reCAPTCHA came the closest to emulating the traditional CAPTCHA tests that relied on object&nbsp;recognition.</p>


<p>In this instance, a user would be presented with a pair of words, one of which functioned as a control word and could be understood by a bot. The other word could only be recognized by human users.&nbsp;</p>


<p>This CAPTCHA method was developed in the late 1990s and continued to be used throughout the 2010s. It also started using scanned words and photographs to make the tests more challenging, but it has since been replaced with more sophisticated reCAPTCHA&nbsp;tests.</p>


<h3 id="recaptcha-v2" class="wp-block-heading">reCAPTCHA v2</h3>



<p>After reCAPTCHA v1 was shut down, it was replaced with reCAPTCHA v2, which currently consists of three versions.&nbsp;</p>



<p>The first one is the reCAPTCHA v2 for Android, which is an API that can protect Android apps from bot traffic. The API integrates directly into Android apps, and in an attempt to preserve the UX, the API allows low-risk users to pass through easily. When needed, the API will present a challenge to the user to verify that they are human.&nbsp;</p>



<p>Then there’s the reCAPTCHA v2 that most users are familiar with. This is the “I’m not a robot” checkbox. In this case, all that users have to do is check the box, rather than solve a complex test or problem.&nbsp;</p>


<p>As such, it’s considered more user&#8209;friendly than previous methods. Though it sounds simple, Google analyzes various factors like mouse movement and browsing history to detect bot&nbsp;activity.</p>


<p>Even more sophisticated is the invisible reCAPTCHA badge which requires no user input at all. Similar to the previous method, Google evaluates activities like mouse movement and typing patterns. This version of reCAPTCHA is triggered via a JavaScript API call or when a user clicks on a button.&nbsp;</p>



<p>It’s still not a perfect solution since sophisticated bots that use AI technology can bypass the reCAPTCHA. And, it isn’t immune to CAPTCHA farms — which are businesses that employ human workers to solve reCAPTCHAs to aid cybercriminals and hackers.&nbsp;</p>



<h3 id="recaptcha-v3" class="wp-block-heading">reCAPTCHA v3</h3>


<p>In further attempts to improve the UX, Google introduced reCAPTCHA v3, which works similarly to the invisible reCAPTCHA badge. This version of reCAPTCHA works in the background, so it’s completely invisible to users and presents no&nbsp;tests.</p>

<p>The reCAPTCHA v3 method tracks all requests made by a user on a website, and every request is given a score between 0 and 1. As we discussed earlier, a score close to 0 is likely to be a bot whereas a score closer to 1 is judged as&nbsp;human.</p>


<p>The interactions monitored by the reCAPTCHA vary between websites. For instance, the administrator can provide examples of normal user interactions&nbsp;so that the reCAPTCHA can pick up on any deviation from the norm.&nbsp;</p>


<p>reCAPTCHA v3 is the best version of the technology in terms of efficacy and UX. That said, it’s more difficult to implement since the scores must be defined by the administrator, which can be time&#8209;consuming to set&nbsp;up.</p>


<p>With this in mind, you might automatically block users who return a score below 0.2. Then, scores between 0.2 and 0.6 may generate a CAPTCHA challenge to verify that the user is human.&nbsp;</p>



<p>Meanwhile, any score above 0.6 may instantly be granted access. The issue is that a strict scoring system holds the potential to block out legitimate users while a lenient system may allow bots to bypass the reCAPTCHA.&nbsp;</p>


<h2 id="challenges-and-downsides-of recaptcha" class="wp-block-heading">Challenges and downsides of&nbsp;reCAPTCHA</h2>


<p>Now that you know the different types of reCAPTCHA, let’s take a look at the main limitations.&nbsp;</p>


<h3 id="1-impact-on-users-with disabilities" class="wp-block-heading">1. Impact on users with&nbsp;disabilities</h3>


<p>It’s imperative to design web content in a way that’s accessible to people with disabilities. This way, your enterprise site can comply with the Americans with Disabilities Act (ADA) and the Web Content Accessibility Guidelines (WCAG).&nbsp;</p>


<p>The problem is that many reCAPTCHA tests are visual and require users to identify images or text. This has been shown to <a href="https://dl.acm.org/doi/fullHtml/10.1145/3524010.3539498">discriminate against users with visual impairments</a>. And since they’re designed to be unreadable by machines, screen readers are unable to interpret&nbsp;them.</p>


<p>Additionally, audio reCAPTCHA tests alienate users with hearing impairments. Meanwhile, the mathematical equation tests are believed to be more accessible to users with vision impairments, but these can exclude those with cognitive disorders like dyscalculia.&nbsp;</p>


<h3 id="2-annoyance-and frustration" class="wp-block-heading">2. Annoyance and&nbsp;frustration</h3>

<p>Many users may find reCAPTCHA annoying. When you expect instant access to a page, and instead you’re required to check a box or complete a task, it’s natural to become&nbsp;frustrated.</p>

<p>This can lead to early exits. High bounce rates can send signals to search engines that users don’t find your website valuable. Therefore, it can result in both traffic and revenue&nbsp;loss.</p>

<h3 id="3-data-collection-and-privacy concerns" class="wp-block-heading">3. Data collection and privacy&nbsp;concerns</h3>

<p>In order to differentiate between bots and humans, reCAPTCHA v3 and the invisible reCAPTCHA badge analyze data like mouse navigation and click patterns. Since this is classified as personal data, this method of reCAPTCHA requires privacy&nbsp;compliance.</p>


<p>There are plenty of laws and legislations that exist to protect user privacy on the internet. Most notable, perhaps, is the General Data Protection Regulation (GDPR) in the EU, but there’s also the Colorado Privacy Act, the Utah Consumer Privacy Act, the California Consumer Privacy Act, and many more.&nbsp;</p>


<p>Therefore, it’s important to gather consent from users if you plan to implement reCAPTCHA. <a href="https://developers.google.com/assistant/console/policies/privacy-policy-guide">Google recommends a privacy policy</a> that informs users of the data collected, the data shared, and a statement that tells users how the data will be&nbsp;used.</p>


<p>That said, this is considered the bare minimum in terms of privacy, so it’s useful to have a proper look into what should be included. This is very important since non-compliance can damage your reputation, erode customer trust, and lead to heavy financial penalties.&nbsp;</p>


<h3 id="4-recaptchaâs-decreasing effectiveness" class="wp-block-heading">4. reCAPTCHA’s decreasing&nbsp;effectiveness</h3>


<p>Another potential problem with reCAPTCHA is its effectiveness given the emergence of artificial intelligence. In fact, researchers from the University of Columbia <a href="https://ieeexplore.ieee.org/document/7467367">created reCAPTCHA attacks</a> that managed to solve 70 percent of all challenges.&nbsp;</p>


<p>This shows that reCAPTCHA is no longer as effective as it once was, whether that’s down to AI, CAPTCHA farms, or internal logic. What’s more, reCAPTCHA v3 requires the analysis of user&nbsp;behavior.</p>

<p>reCAPTCHA needs a large volume of data to determine normal human interactions and tell them apart from bots. But this technology relies on a client&#8209;side fingerprinting approach, which advanced bots can bypass&nbsp;easily.</p>

<h3 id="5-potential-for-false positives" class="wp-block-heading">5. Potential for false&nbsp;positives</h3>


<p>The final drawback to reCAPTCHA is that there is still the potential for false positives, which can block legitimate users from your site. For instance, enterprises that prioritize security may adopt a strict scoring system for reCAPTCHA v3. This makes it harder for users to score 1.&nbsp;</p>



<p>To give you an example, many administrators grant low scores to users who submit forms very quickly. That said, some human users are naturally quick typers, but going by this system, they may be flagged and denied access to your website.&nbsp;</p>



<p>Additionally, researchers from the University of Toronto found that <a href="http://arxiv.org/pdf/1903.01003">reCAPTCHA gives lower scores</a> to users who don’t have a Google account. Therefore, privacy-conscious visitors who use private browsers or VPNs are more likely to be mistaken for bots.&nbsp;&nbsp;</p>


<h2 id="akismet-the-better-alternative-to recaptcha" class="wp-block-heading">Akismet: The better alternative to&nbsp;reCAPTCHA</h2>

<p>Considering the challenges and drawbacks of reCAPTCHA, you may be cautious about deploying it on your website. Instead, you might prefer an <a href="https://akismet.com/blog/captcha-alternatives/">alternative anti&#8209;spam solution</a> that is more inclusive and doesn’t disrupt the&nbsp;UX.</p>

<p><a href="https://akismet.com/">Akismet</a> was developed by Automattic (the same team behind WordPress.com) and it’s one of the <a href="https://akismet.com/features/">leading anti&#8209;spam plugins</a>. It protects you against form, comment, and text&nbsp;spam.</p>


<img width="1600" height="732" src="https://akismet.com/wp-content/uploads/2024/06/image-2.png" alt="Akismet homepage with the text " />


<p>Since 2005, Akismet has removed over 500 billion pieces of spam across 100 million sites. The plugin is powered by machine learning, which explains how Akismet detects spam with a 99.99 percent accuracy&nbsp;rating.</p>

<p>Unlike reCAPTCHA, Akismet doesn’t require too much from your visitors. Instead, it operates behind the scenes, so it doesn’t add friction to your UX. This means that users may be more likely to stay on your website, helping you <a href="https://akismet.com/blog/form-conversion-rate/">get more conversions</a> and&nbsp;sales.</p>

<h2 id="how-akismet works" class="wp-block-heading">How Akismet&nbsp;works</h2>

<p>Akismet analyzes every piece of user&#8209;submitted content to prevent a range of online attacks. This analysis takes place in real time, so you can block suspicious activity before it even reaches your&nbsp;site.</p>

<p>It’s best to think of Akismet as a filter, where legitimate submissions are allowed to pass through, but spam submissions are denied. This saves you from manually reviewing every&nbsp;submission.</p>

<p>As mentioned earlier, Akismet is powered by machine learning algorithms. This enables the plugin to compare the content of submissions against a database of known spam. Plus, it integrates with popular form plugins, so you’re not limited to <a href="https://akismet.com/blog/comment-spam/">blog comment&nbsp;spam</a>.</p>


<p>You’ll also get access to monthly and annual spam charts. This way, you can check your spam accuracy rating, false positives, and more.&nbsp;</p>


<p>The Akismet plugin is simple to install on WordPress, but you will need an API key to connect to the Akismet&nbsp;database.</p>

<h2 id="benefits-of-akismet-over recaptcha" class="wp-block-heading">Benefits of Akismet over&nbsp;reCAPTCHA</h2>


<p>Now that you know more about Akismet, let’s look at the benefits of using this plugin over reCAPTCHA.&nbsp;</p>


<h3 id="1-improved accessibility" class="wp-block-heading">1. Improved&nbsp;accessibility</h3>

<p>As we discussed earlier, one of the limitations of reCAPTCHA is that some versions require users to decipher visual or auditory information. Other versions contain mathematical equations or ask users to complete&nbsp;checkboxes.</p>


<p>This can exclude those with cognitive, hearing, or visual impairments. Therefore, if you want to keep an accessible website, you’re better off <a href="https://akismet.com/blog/captcha-alternatives/">using a CAPTCHA alternative</a> like Akismet.&nbsp;</p>



<p>Akismet doesn’t require any user interaction. It works silently behind the scenes, so users can submit content without running into any obstacles.&nbsp;</p>


<h3 id="2-enhanced-user experience" class="wp-block-heading">2. Enhanced user&nbsp;experience</h3>


<p>All kinds of reCAPTCHA (except v3) add friction to the user experience, as they require individuals to check a box or complete a test. This delays access to a page or resource, which can lead to frustration on the user’s part.&nbsp;</p>


<p>Akismet doesn’t interfere with the UX. It operates in the background, so most users aren’t even aware of it. Additionally, the spam data is stored in the cloud, so the plugin doesn’t impact site&nbsp;speed.</p>

<h3 id="3-privacy protection" class="wp-block-heading">3. Privacy&nbsp;protection</h3>


<p>While reCAPTCHA can reduce spam submissions, it does so by gathering personal data, which means you have to obtain explicit consent from users. Plus, privacy-conscious users may be perturbed by data collection.&nbsp;</p>



<p>Akismet also collects personal data, but only that which is needed to carry out spam protection. According to the GDPR, this is classified as a “legitimate interest” use of that data.&nbsp;</p>



<p>In the plugin settings, you can easily enable a privacy notice that informs users about this. The company never sells personal data gathered through the plugin. You can check out the <a href="https://automattic.com/privacy/">full privacy policy here</a>.&nbsp;</p>


<h3 id="4-better-spam detection" class="wp-block-heading">4. Better spam&nbsp;detection</h3>

<p>reCAPTCHA is primarily an anti&#8209;spam measure, but the <a href="https://akismet.com/blog/do-captcha-and-recaptcha-protect-wordpress-sites-from-bots/">effectiveness of reCAPTCHA</a> has been challenged by advances in AI technology and the growth of CAPTCHA&nbsp;farms.</p>

<p>Akismet has a long reputation for detecting spam with very high accuracy. Currently, the plugin boasts an overall accuracy score of 99.99 percent, but you can view the exact spam accuracy score within your Akismet&nbsp;dashboard.</p>

<h3 id="5-reduced-false positives" class="wp-block-heading">5. Reduced false&nbsp;positives</h3>

<p>Earlier, we mentioned the fact that some versions of reCAPTCHA frequently result in false positives which block legitimate users from websites. This is especially true in the case of reCAPTCHA v3 (where administrators have to define their own rules) and for users who opt for private browsers and VPNs. Not only is this frustrating for users, but it can also result in revenue loss for&nbsp;organizations.</p>


<p>With Akismet, submissions are analyzed in real time and with incredible accuracy. Additionally, there are systems in place that make it easy for websites to <a href="https://akismet.com/support/general/akismet-unblocking-a-spam/">report false positives</a>.&nbsp;</p>



<p>When it comes to forms, you can simply remove submissions from the spam list. For comments, all you have to do is check the relevant boxes and use the <strong>Bulk actions </strong>dropdown menu to select <strong>Not spam.&nbsp;</strong></p>


<h2 id="frequently-asked questions" class="wp-block-heading">Frequently asked&nbsp;questions</h2>

<p>This guide has answered questions like “what is reCAPTCHA” and “how does reCAPTCHA work”, but you may still be looking for clarification on this technology. We’ll answer some other common questions in the next&nbsp;section.</p>

<h3 id="what-is-the-primary-purpose-of recaptcha" class="wp-block-heading">What is the primary purpose of&nbsp;reCAPTCHA?</h3>


<p>The primary purpose of reCAPTCHA is to differentiate human users from bots in order to block spam and other forms of online abuse. It is a type of technology that deploys adaptive challenges like image identification and checkboxes that detect suspicious behavior.&nbsp;</p>


<h3 id="how-does-recaptcha-differentiate-between-a-human-and-a bot" class="wp-block-heading">How does reCAPTCHA differentiate between a human and a&nbsp;bot?</h3>


<p>Depending on the version of reCAPTCHA, different factors are considered to distinguish between bots and humans. For example, some reCAPTCHA tests track cursor movement, typing patterns, and browser history.&nbsp;</p>



<p>reCAPTCHA v3 evaluates these factors to generate scores. Scores closer to 0 are judged to be bots while those closer to 1 are considered human.&nbsp;</p>


<h3 id="what-are-the-key-differences-between-recaptcha-v2-and v3" class="wp-block-heading">What are the key differences between reCAPTCHA v2 and&nbsp;v3?</h3>


<p>There are some key differences between reCAPTCHA v2 and v3. reCAPTCHA v2 includes three different methods including the Android API, the “I’m not a robot” checkbox, and the invisible reCAPTCHA badge. All of these, except the badge, require user interaction.&nbsp;</p>



<p>reCAPTCHA v3 doesn’t require user input. Instead, it monitors certain factors like mouse movement and typing patterns to return a score between 0 and 1, which helps systems detect bot traffic.&nbsp;</p>


<h3 id="is-recaptcha-completely-effective-against-bots-and-automated attacks" class="wp-block-heading">Is reCAPTCHA completely effective against bots and automated&nbsp;attacks?</h3>

<p>reCAPTCHA is an <a href="https://akismet.com/blog/best-anti-spam-wordpress-plugins-compared/">anti&#8209;spam service</a> that attempts to block bots and prevent automated attacks like distributed denial of service (DDoS) attacks. The problem is that several researchers have questioned the effectiveness of reCAPTCHA. For instance, researchers from the University of Columbia launched low&#8209;risk bot attacks that solved over 70 percent of all&nbsp;challenges.</p>

<h3 id="how-does-recaptcha-impact-the-overall-user-experience-on websites" class="wp-block-heading">How does reCAPTCHA impact the overall user experience on&nbsp;websites?</h3>

<p>Most versions of reCAPTCHA require users to solve mathematical problems, decipher images and text, or simply check a box. While this may not sound too problematic, it adds friction to the user&nbsp;experience.</p>


<p>It delays users from accessing the desired page or resource, which can be frustrating. In turn, this can lead to early exits — which affect bounce rates, traffic volume, revenue, and more.&nbsp;</p>


<h3 id="can-recaptcha-be-bypassed-or-tricked-by-sophisticated bots" class="wp-block-heading">Can reCAPTCHA be bypassed or tricked by sophisticated&nbsp;bots?</h3>


<p>There are ways for cybercriminals and bots to bypass reCAPTCHA tests. To do this, all they have to do is raise the trust score by mimicking normal human behavior on a web browser.&nbsp;</p>



<p>They can achieve this effect by using a resistant TLS fingerprint. Plus, hackers can execute JavaScript using browser automation tools, and rotate JavaScript fingerprint details.&nbsp;</p>


<h3 id="what-are-the-implications-of-recaptcha-for-user privacy" class="wp-block-heading">What are the implications of reCAPTCHA for user&nbsp;privacy?</h3>


<p>Since reCAPTCHA gathers personal data about the user’s browser and device, certain states and countries require companies to get user consent. In particular, the GDPR ensures that visitors know how websites use, process, and store their information.&nbsp;</p>



<p>Therefore, you’ll need to obtain explicit consent. It’s also important to display a privacy policy on your site. Otherwise, you may encounter hefty financial penalties.&nbsp;</p>


<h3 id="are-there-any-alternatives-to-recaptcha-that-offer-similar-or-better functionalities" class="wp-block-heading">Are there any alternatives to reCAPTCHA that offer similar or better&nbsp;functionalities?</h3>

<p>Although reCAPTCHA is capable of blocking some spam, it can interfere with the UX and discriminate against those with disabilities. Therefore, you might prefer a more user&#8209;friendly alternative, like&nbsp;Akismet.</p>


<p>Akismet works in the background of your site, so it requires no user interaction. It also filters spam with an impressive accuracy rating of 99.99 percent, which means it rarely produces false positives.&nbsp;</p>


<h3 id="how-accurate-is-akismet-at-stopping spam" class="wp-block-heading">How accurate is Akismet at stopping&nbsp;spam?</h3>

<p>Akismet filters comment, form, and text spam with a 99.99 percent accuracy rate. Plus, it analyzes submissions in real time to maximize threat protection. And there are systems in place to report false positives, which makes Akismet much more effective than&nbsp;reCAPTCHA.</p>

<h3 id="how-many-sites-use akismet" class="wp-block-heading">How many sites use&nbsp;Akismet?</h3>

<p>Akismet is installed on over 100 million websites, and the plugin has blocked over 500 billion spam submissions. Better yet, it’s trusted by plenty of enterprise brands like Microsoft, ConvertKit, Bluehost, and&nbsp;WordPress.com.</p>

<h3 id="are-there-any-case-studies-of-companies-that-use akismet" class="wp-block-heading">Are there any case studies of companies that use&nbsp;Akismet?</h3>


<p>If you want to know how Akismet has helped real brands, you can check out some case studies.&nbsp;</p>



<p>For instance, <a href="https://akismet.com/blog/convertkit-customerstory/">ConvertKit</a> implemented Akismet to filter out spam and automate spam prevention. <a href="https://akismet.com/blog/saying-no-to-spam-on-smitten-kitchens-popular-food-site/">Smitten Kitchen</a> automated spam detection in the comments section of recipes, which has helped prevent the presence of affiliate links and irrelevant promotions.&nbsp;</p>


<h3 id="where-can-i-learn-more-about akismet" class="wp-block-heading">Where can I learn more about&nbsp;Akismet?</h3>


<p>If you want to learn more about the service, you can find a lot of <a href="https://akismet.com/resources/">free resources</a>. Akismet also has a <a href="https://akismet.com/support/">dedicated support page</a> to help you set up and use the plugin. And the <a href="https://akismet.com/blog/">Akismet blog</a> is frequently updated with useful articles.&nbsp;</p>


<h2 id="akismet-the-best-spam-solution-for-your website" class="wp-block-heading">Akismet: The best spam solution for your&nbsp;website</h2>

<p>Spam is a concern for any site administrator, since it can make your site appear less trustworthy and lead to cyberattacks. While reCAPTCHA is one solution for preventing spam, it may not be the best option in terms of user&nbsp;experience.</p>

<p>reCAPTCHA v3 runs in the background of your site, but it can still be frustrating for visitors. Additionally, it can exclude those with disabilities and incorrectly block legitimate visitors. Therefore, you might prefer a better alternative, like&nbsp;Akismet.</p>

<p>With a 99.99 percent accuracy rating, Akismet is excellent at blocking comment, form, and text spam. It also analyzes submissions in real time, and it doesn’t interfere with the UX. <a href="https://akismet.com/pricing/">Get started with the Akismet&nbsp;today</a>.</p>";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}s:7:"pubDate";a:1:{i:0;a:5:{s:4:"data";s:31:"Wed, 03 Jul 2024 13:00:00 +0000";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}s:32:"http://purl.org/dc/elements/1.1/";a:1:{s:7:"creator";a:1:{i:0;a:5:{s:4:"data";s:11:"Jen Swisher";s:7:"attribs";a:0:{}s:8:"xml_base";s:0:"";s:17:"xml_base_explicit";b:0;s:8:"xml_lang";s:0:"";}}}}}}}}}}}}}}}}s:4:"type";i:128;s:7:"headers";O:48:"WpOrg\Requests\Utility\CaseInsensitiveDictionary":1:{s:7:"*data";a:9:{s:6:"server";s:5:"nginx";s:4:"date";s:29:"Mon, 12 Aug 2024 17:36:58 GMT";s:12:"content-type";s:8:"text/xml";s:13:"last-modified";s:29:"Mon, 12 Aug 2024 17:30:45 GMT";s:4:"vary";s:15:"Accept-Encoding";s:15:"x-frame-options";s:10:"SAMEORIGIN";s:16:"content-encoding";s:4:"gzip";s:7:"alt-svc";s:19:"h3=":443"; ma=86400";s:4:"x-nc";s:9:"HIT ord 1";}}s:5:"build";s:14:"20240809162249";}