The Great WordPress Landlord War: Why a Billionaire Feud and a 33-Hour Boardroom Coup Matter to Your Business

If you own a dental practice, a law firm, a commercial contracting company, or an e-commerce shop, you probably don’t spend your Tuesday mornings thinking about open-source software licensing, trademark litigation, or California corporate governance.

You pay an agency or an independent developer a few thousand dollars, your website goes live, and you assume it is like any other physical business asset you own: dependable, quiet, and doing its job.

Over 43.5% of the entire internet—including millions of small and mid-sized commercial enterprises—runs on WordPress. For nearly twenty years, it was celebrated as the ultimate benevolent community project: free software built by volunteers, powering everything from local mom-and-pop bakeries to multinational corporations.

Until the autumn of 2024, when a bitter, nuclear feud erupted between the co-founder of WordPress and one of the largest commercial web hosting companies in the world. What started as angry conference speeches escalated into federal lawsuits, locked servers, seized software plugins, hundreds of employee resignations, and culminated in September 2026 with a stunning 33-hour boardroom coup and $8.15 million in executive golden parachutes.

If you rely on a website to generate client inquiries, book appointments, or accept customer payments, you need to understand what happened.

Because behind the technical jargon lies a fundamental business reality that every company owner must confront: you might think you own your digital real estate, but you might actually be renting a unit in a high-rise where the landlord and property manager just started throwing grenades at each other.

Here is the entire story, explained completely without technical jargon, using the language every business owner understands: commercial real estate.

1. The Real Estate Metaphor: Who Actually Holds the Keys?

To understand how the WordPress ecosystem fractured, you have to separate five different entities that sound almost identical to anyone who isn't a software engineer.

Imagine you are opening a physical storefront in a commercial plaza:

For fifteen years, this arrangement functioned smoothly because everyone pretended it was a peaceful public utility:

• You (The Business Owner) paid a web designer to construct a storefront using the free blueprints.
• You paid WP Engine $30 to $300 a month to maintain the building on their high-speed commercial property lots.
• Your site automatically connected to the Municipal Supply Warehouse (WordPress.org) every week to download free replacement parts, plumbing updates, and new security locks.

2. The Spark: WordCamp US and the 8% "Protection Tax"

In mid-September 2024, thousands of web designers, developers, and agency executives gathered in Portland, Oregon for WordCamp US—the flagship annual gathering of the WordPress community.

Convention keynotes are traditionally polite, celebratory recaps of software roadmaps. But when Matt Mullenweg took the stage for the closing address, he dropped a public relations bombshell.

He publicly denounced WP Engine as a "cancer to WordPress" and urged attendees to vote with their wallets by boycotting the company.

What Was the Actual Dispute About?

Strip away the emotional rhetoric, and this was an old-fashioned corporate turf battle over money, control, and intellectual property:

1. The Private Equity Target: WP Engine is backed by Silver Lake, a multi-billion-dollar private equity firm. Mullenweg argued that WP Engine was generating roughly $400 million a year in revenue from websites built on the free community blueprint, while contributing only a fraction back in free volunteer labor to maintain the municipal blueprints.
2. The "Confusion" Claim: Mullenweg claimed that WP Engine's name misled ordinary small business owners into believing WP Engine was the official WordPress company.
3. The Financial Ultimatum: In private text messages and legal correspondence that were subsequently leaked, Automattic demanded that WP Engine pay 8% of its gross revenues (an estimated $32 million per year) or dedicate 8% of its total workforce solely to developing Automattic's open-source projects as a trademark licensing fee.

When WP Engine refused to pay what their attorneys characterized as an extortionate shakedown, the landlord decided to press the nuclear button.

3. The Nuclear Escalation: Shutting Off the Municipal Water Pipe

On September 25, 2024, Mullenweg took an action that stunned the global technology industry: he unilaterally banned WP Engine’s servers from connecting to WordPress.org.

To put this in real estate terms: the master developer turned off the municipal water and electrical mains to every single commercial building managed by his rival.

What Happened to Everyday Business Sites?

Instantly, tens of thousands of business websites hosted on WP Engine couldn't update their security plugins, download software fixes, or install new features. Agency developers woke up to broken administrative dashboards, failing update queues, and flashing security warnings.

Small business owners had done nothing wrong. They had paid their hosting bills, paid their agency retainers, and complied with every contract. Yet their digital storefronts were suddenly collateral damage in a billionaire ego battle.

WP Engine scrambled, writing emergency code to redirect their servers to a hastily built private supply mirror within 72 hours. But the precedent was established: your storefront's security pipeline was subject to the personal discretion of a rival corporate executive.

4. The Hijacking of Advanced Custom Fields (ACF)

If shutting off the supply depot was the first shock, what happened next sent chills down the spine of every commercial software vendor in the world.

One of the most essential building tools in the entire WordPress ecosystem is a plugin called Advanced Custom Fields (ACF), owned by WP Engine. ACF is installed on over 2 million active websites. It is the digital equivalent of custom structural cabinetry—allowing web developers to build specialized quote calculators, property listings, and product tables.

On October 12, 2024, Automattic did the unthinkable: they seized the official ACF listing on the WordPress.org repository, stripped WP Engine's names from the credits, and renamed the plugin to "Secure Custom Fields" (SCF).

In the physical world, imagine you lease space to a custom locksmith in your town center. One night, the town mayor changes the locks on the locksmith's door, paints over their business sign with his own brand name, and begins distributing his own keys to all the locksmith's customers.

Developers around the world were horrified. If the central repository operator could confiscate a 2-million-user product overnight, no software business on the platform was safe.

5. The Loyalty Oath & The Great Employee Exodus

As pushback escalated online, the governance of WordPress descended into authoritarian drama.

The Compulsory Checkbox

WordPress.org implemented a mandatory login checkbox that every developer had to click before accessing the repository or submitting code:

"I am not affiliated with WP Engine in any way, financially or otherwise."

Because the phrasing was so ambiguous, it threw legal departments across the globe into chaos. If an agency built a website for a local dentist whose site was hosted on WP Engine, were they "affiliated"? Hundreds of veteran open-source contributors and volunteer translators who refused to sign the statement were summarily locked out of their accounts.

159 Employees Walk Out

Inside Automattic, internal dissent boiled over. Mullenweg offered employees an ultimatum: if you disagree with the company's war against WP Engine, you can take a nine-month severance package and leave today.

159 employees (8.4% of the entire company) immediately took the money and walked out the door. A few weeks later, a second buyout offer resulted in another wave of departures, gutting key teams responsible for core WordPress development, security, and developer relations.

6. The Climax: The 33-Hour Boardroom Coup of September 2026

The drama reached its surreal climax in September 2026—an event popularized in tech culture by the popular developer channel Fireship as "The Most Expensive 33 Hours in WordPress History."

Behind closed doors at Automattic, the company's Board of Directors—tired of endless litigation, plummeting brand trust, and mounting legal expenses—decided to intervene.

The Complete Timeline of the Landlord War

The brief coup demonstrated that the cracks inside WordPress leadership were not just philosophical—they were existential corporate fractures.

For the business owner on Main Street, it answered an urgent question: Is the leadership of the platform running my online storefront focused on delivering fast, secure software for my business, or are they engulfed in billionaire power struggles and boardroom wars?

7. The Hidden Costs to Your Business: Why You Should Care

You might say: "I run an accounting firm in Calgary. Why do I care if tech executives in San Francisco and Austin are suing each other?"

You care because this war directly impacts your monthly balance sheet, your website's security, and your business continuity.

1. The Fragility of the "Plugin Tower of Babel"

A typical commercial WordPress site doesn't run on pure WordPress. It runs on a fragile stack of 25 to 55 third-party plugins:

• A form plugin (Gravity Forms / WPForms)
• A search engine plugin (Yoast / RankMath)
• A visual builder (Elementor / Divi / Beaver Builder)
• An e-commerce system (WooCommerce)
• A database manager (Advanced Custom Fields)
• A security firewall (Wordfence / Sucuri)
• A payment gateway (Stripe / PayPal)

Every one of these plugins is an independent software company that relies on the WordPress.org pipeline to push daily security patches. When the central pipeline is weaponized or politicized, your digital storefront's defense against malware and ransomware is compromised.

2. The Maintenance Fee Creep

Notice how your web agency's monthly maintenance retainer has steadily increased from $99/mo to $250/mo, $500/mo, or more?
Agencies aren't necessarily price-gouging; they are spending dozens of unbillable hours every month babysitting broken plugin updates, database bloat, compatibility breaks, and security warnings caused by ecosystem instability.

3. The Performance Tax (Losing Google Rankings)

WordPress was built on PHP and MySQL in 2003—before the modern smartphone era. Every time a customer visits your website:

1. The server has to query a MySQL database dozens of times.
2. It processes thousands of lines of PHP code across 35 plugins.
3. It glues together messy HTML with tons of redundant CSS and JavaScript.

This dynamic processing takes 1.5 to 4.5 seconds. In 2026, Google’s search algorithms heavily penalize slow page loads (Core Web Vitals). When your mobile site takes 3 seconds to render, over 53% of mobile visitors bounce before seeing your phone number.

8. The Sovereign Alternative: What True Digital Ownership Looks Like

If leasing space in a contested digital shopping plaza is dangerous, what is the alternative?

In modern software engineering, the alternative is called Digital Sovereignty.

The 4 Pillars of a Sovereign Business Website:

1. Pre-Compiled Static Code (Zero-Database Architecture):
   Instead of forcing a database server to re-assemble your website every time a visitor clicks a link, modern web engineering compiles your website into static HTML, modern CSS, and lightweight TypeScript ahead of time. When a customer visits, the page loads in under 0.2 seconds (sub-200 milliseconds)—faster than the blink of a human eye.
2. Indestructible Security:
   Over 90% of all website hacks target vulnerabilities in WordPress PHP plugins and MySQL injection vectors. A sovereign static website has no database to hack, no administrative login portal (/wp-admin) to brute-force, and no PHP scripts to exploit.
3. Decoupled Business Logic:
   Need a customer booking calendar, a contact form, or an e-commerce checkout? Instead of installing heavy plugins that slow down your entire site, modern sites connect to lightweight, dedicated microservices (like Resend for emails, Helcim for payments, and CalDAV for calendars). If one service ever experiences an outage, your storefront never goes down.
4. Permanent Property Ownership:
   Your website code lives in a standardized Git repository that you control. You can host it for free on Cloudflare Pages, Firebase Hosting, AWS S3, or Vercel. If any hosting provider ever changes their terms, you can migrate your entire business to a new host in under 3 minutes with zero downtime.

9. The Business Owner's Action Plan: 5 Steps to Protect Your Company

You don’t need to panic and tear down your website tomorrow morning. But as a prudent business owner, you should immediately take five defensive steps:

Step 1: Conduct a "Deed & Keys" Audit

Ask your web developer or agency the following four questions:

• Do we directly own and control our domain name registrar account (GoDaddy, Namecheap, Cloudflare)?
• Do we have independent administrator access to our hosting server?
• If our web agency closed its doors tomorrow, do we have an off-site archive of our website code and customer data?
• Is our site hosted on WP Engine, WordPress.com, or an independent host?

Step 2: Demand Off-Site Backups

Never store your website backups on the same server that hosts your website. Ensure your team maintains automated weekly backups stored on an independent cloud drive (like Amazon S3, Google Cloud Storage, or a local office NAS drive) that is completely decoupled from your hosting company.

Step 3: Run a Plugin Purge

Log into your website dashboard and review your active plugin list. If you see plugins that haven’t been updated in over six months, plugins you no longer use, or duplicate tools (like having three different analytics or SEO plugins active), instruct your agency to delete them immediately. Every plugin is a potential security vulnerability and a point of failure.

Step 4: Test Your Mobile Speed (Core Web Vitals)

Open PageSpeed Insights and test your company's homepage. If your mobile performance score is in the red (below 50) or your Largest Contentful Paint (LCP) exceeds 3.5 seconds, you are actively hemorrhaging ad spend and organic search customers to competitors with faster sites.

Step 5: Evaluate Decoupled & Sovereign Rebuilding

When the time comes for your next website redesign, refuse to accept another slow, fragile WordPress template that requires $300/month in maintenance contracts.

Ask your agency to quote a modern, sovereign decoupled architecture (built on React, Vite, Next.js, or pure HTML/Tailwind). You will gain an asset that loads instantly, never gets hacked, costs almost nothing to host, and gives you 100% permanent ownership of your digital property.

The Bottom Line

The drama between Matt Mullenweg, Automattic, WP Engine, and the board of directors is entertaining theater for Silicon Valley bloggers. But for the business owner trying to make payroll and grow an enterprise, it is a stark wake-up call.

Your website is the front door of your company. It is where customers form their first impression, where sales are closed, and where your reputation lives.

Don't let your business remain a tenant in someone else's war zone. Own your code, own your data, and hold the deed to your digital real estate.