Posts to Podcast gives your audience another way to keep up with what you publish.
Starting today, WordPress.com bloggers can turn recent posts into AI-generated podcast episodes directly from their dashboard. Choose the posts you want to include, generate a two-host audio conversation, review the draft, and publish it when you’re ready.
You’ll find Posts to Podcast under Media -> Create AI Podcast in your WordPress.com dashboard. Choose a time range, such as the last week or month, or select specific posts yourself.

The episode below was generated from recent WordPress.com blog posts using the same feature we’re announcing today:
Posts to Podcast turns the posts you select into a two-host audio conversation. The finished episode is saved to your Media Library, and WordPress.com prepares a draft post with the audio and transcript already included.
From there, you stay in control: review the draft, make any edits you want, and publish it like any other post. Since the audio is saved to your Media Library, you can also reuse it elsewhere, upload it to another platform, or keep it as part of your site’s media archive.

Use Posts to Podcast to create weekly recaps, monthly digests, audio companions to newsletters, or listening-friendly versions of recent posts.
Posts to Podcast is available to all WordPress.com sites. Whether you publish daily updates, weekly essays, tutorials, newsletters, or personal reflections, you can turn recent posts into a listenable episode directly from your dashboard.
Your words do the work. Posts to Podcast gives them a microphone.
Open your dashboard, go to Media -> Create AI Podcast, and turn your recent writing into something your audience can listen to.
]]>If things have felt a little busier around WordPress.com these past two weeks, there’s a good reason: we shipped a lot, including a new home for your podcast, a weekly letter for close friends, and a new Mac app that uses your site context, so you can get more done without leaving your flow.
Here’s what’s new on WordPress.com to help you create, publish, and grow:
Launch a podcast that lives alongside your blog and newsletter — no separate hosting platform or tool needed. Find it in your site sidebar at Jetpack → Podcast.
Learn more about running your podcast on WordPress.com in our blog post.

For the corner of your life where you’d rather email a few close friends than post to the world.
Lately is a weekly letter for the people closest to you, compiled automatically from notes you send during the week, and delivered every Friday to the friends you choose.
It runs through Telegram: message the WordPress Agent as things happen, and it handles sending your curated newsletter each week. Available now as a beta for new sites.

If you blog, publish, or run a business on WordPress, your site has been accumulating useful context since day one: your voice, audience, archive, offers, media, guidelines, and the shape of your work.
Workspace is a new Mac app that puts all of that to work. At its center, the WordPress Agent helps you write, research, and ship without you having to start from scratch every time you want to get something done.

Use it to draft a post from your notes, update a page, generate an image, or get a quick answer about your site — all from a keyboard shortcut and without leaving what you’re working on.
Available now as a beta on every WordPress.com plan — learn more and try it today.
If you’re heading to WordCamp Europe in Kraków in just a few weeks, open Telegram and message @wordcamp_agent_bot.
It’s a free travel and conference assistant for attendees. It can help plan your trip, browse the schedule, remember which sessions you care about, and ping you before they start.
It’s your WordCamp assistant in your pocket — chat with it today.
Calling all developers, designers, and vibe coders: starting a new WordPress project locally just got a lot faster.
The new Blueprints Gallery in WordPress Studio (desktop version 1.9.0 and later) gives you a curated library of pre-configured WordPress setups — for blogging, ecommerce, plugin testing, design exploration, and more — that you can launch as a local site in a couple of clicks.
Use the Live Preview button to try a Blueprint before you commit to it, and then sync with a WordPress.com hosting plan when you’re ready to go live.

If you’ve been hand-configuring the same kind of WordPress site over and over, this is your shortcut.
Rewards for showing up, making progress, and getting things done.
WordPress.com users now have an Achievements page. Track your daily activity streak, earn badges for milestones, and check out other people’s achievements when they make their profiles public.

Try it on a logged-in WordPress.com page. Try it in WordPress Studio. Two different surprises, both worth finding.
Type ↑↑↓↓←→←→BA on your keyboard to unlock these easter eggs.
We’ve also shipped reliability and polish updates across WordPress.com, like:
For custom or community Blueprints, using them in Studio often meant bringing in a configuration from outside the app, whether through a URL, ZIP file, JSON configuration, or GitHub example. Now, with Blueprints Gallery, you can browse, preview, and launch ready-to-use WordPress setups directly inside Studio.
Studio is WordPress.com’s fast, free, open source desktop app for building, testing, and managing WordPress sites locally.
Paired with Studio’s no-server-setup local environment, Blueprints make repeat projects faster to start and easier to keep consistent.
Blueprints are reusable JSON configurations that automatically set up a WordPress environment with specific themes, plugins, content, and settings. Think of them as advanced site recipes: instead of manually setting up your ideal configuration from scratch, you can launch a fully configured site in just a few clicks.
Whether you are building a portfolio, testing a plugin, experimenting with WooCommerce, or spinning up a local development environment, Blueprints help you get started faster and with less repetitive setup work.
The Blueprints Gallery is a curated collection of ready-made WordPress site setups now available directly in Studio. It gives you quick access to Blueprints designed for different workflows, use cases, and experiments.
Instead of leaving Studio to find or import Blueprint configurations, you can browse a growing library of pre-configured environments tailored for things like blogging, ecommerce, development, design exploration, or plugin testing.
Each Blueprint is designed to help you skip repetitive setup steps so you can spend less time on setup and more time working in WordPress.
For developers, the Blueprints library is also available through Studio’s CLI. With the blueprint command, you can list available Blueprints and launch a fully configured local WordPress site directly from your terminal in just a few steps.
The Blueprints Gallery is available in Studio desktop version 1.9.0 and later. First, make sure to update Studio. Then, click on the “Add site” button in the sidebar:

Next, choose “Build a new site” and scroll down to the “Explore more Blueprints” section.

That’s it! Choose a Blueprint that fits your workflow and spin up a local WordPress site in seconds.
You can also use the Live Preview button to explore Blueprints before creating your site. Previews are powered by WordPress Playground, making it easy to quickly test layouts, themes, plugins, and overall site experience.
Looking for something specific? Use the search box to quickly find Blueprints that match your needs.
Want to build your own Blueprints? This guide will teach you the basics of creating a custom Blueprint.
The Blueprints Gallery is now available in Studio 1.9.0 and later.
It’s now easier to discover, preview, and launch reusable WordPress setups directly inside Studio. As the gallery continues to grow, you will see more Blueprints added for different workflows, learning experiences, and creative use cases.
Explore the Blueprints Gallery, and find your next starting point for building locally with Studio.
]]>The Essential Plugin supply chain attack is one example of what that looks like in practice. When malicious code was found across a portfolio of plugins, WordPress.com security teams identified affected hosted sites, updated detection systems, deployed a DNS-level block against the attacker-controlled domain, and removed malicious code from impacted environments.
This post explains what happened, how WordPress.com responded, and why proactive, managed security matters for those who need WordPress flexibility without having to manage every security risk alone.
In early 2026, the WordPress community experienced a large supply chain attack on plugins by the “Essential Plugin” developer.
A buyer had quietly acquired the entire Essential Plugin portfolio (formerly WP Online Support) — a collection of 30+ plugins built up over eight years of legitimate development. Roughly six months after the acquisition, malicious code — wpos-analytics — was added to the plugins’ source.
For months, the malicious code sat dormant. Then, in early April 2026, the backdoor was activated. The compromised plugins began phoning home to analytics.essentialplugin.com, where the attacker could ship arbitrary payloads to every site running an affected version.
On April 7, 2026, WordPress.org patched and permanently closed all 31 plugins in the portfolio. The patch stopped active exploitation by preventing the backdoor from executing, but WordPress.com’s security team chose to go further on the sites we host by removing the attacker’s code from affected plugin files.
What made this incident different was that the compromised code arrived through plugins that had previously been trusted. Site owners had not ignored updates or installed obviously suspicious software; the issue came through a familiar plugin supply chain.
A patch can stop malicious code from executing, but cleanup can go further. In this case, WordPress.com removed the attacker’s code from affected sites we host, rather than relying only on a disarm.
That distinction matters because WordPress.com’s security model is not limited to waiting for site owners to notice a problem or manually apply a fix. Our teams can detect, mitigate, and clean up issues across hosted sites at the platform level.
Waiting for sites to be flagged through normal scanning would mean some sites could be carrying dormant attacker code for months or longer. This is why WordPress.com took a proactive approach to protect sites and mitigate this attack.
Within hours of the disclosure, WordPress.com security specialists obtained a full list of every WordPress.com hosted site running one or more of the affected plugin slugs — over 2,200 sites. We then:
wpos-analytics module, the injected code block in each plugin’s main file, and flag suspicious activity unique to the malware.analytics.essentialplugin.com, preventing affected sites from reaching the attacker-controlled domain entirely.wpos-analytics directory and removing specific malicious code from the plugin files.The result: WordPress.com removed the attacker’s code from affected hosted sites and blocked the attacker-controlled domain at the platform level.
WordPress.com’s security model is built on proactive protection. That includes automated scanning, infrastructure hardening, proactive mitigation, and human-led incident response working continuously behind the scenes.
Every WordPress.com site is scanned daily by Jetpack Scan against a constantly updated library of malware and vulnerability signatures. Suspicious behavior and compromised files are surfaced quickly so security specialists can investigate and respond before issues spread further.
When new threats emerge, detection systems can be updated rapidly across the platform, helping identify affected sites at scale.
WordPress.com runs on a managed infrastructure designed to reduce common attack paths before they reach customer sites. Servers are patched and isolated, login abuse is rate-limited, and suspicious bot traffic is filtered automatically.
Core, plugin, and theme updates can also be applied automatically where appropriate. A managed Web Application Firewall helps block known exploit patterns at the edge before they ever reach your site.
WordPress.com also uses virtual patches: platform-level mitigations that can block known critical vulnerabilities even when an affected plugin has not yet been updated, or no developer fix is available.
During the Essential Plugin incident, WordPress.com also deployed a DNS-level block across WP Cloud for the attacker-controlled domain tied to the attack infrastructure.
Automation matters, but large-scale incidents still require human investigation and judgment.
WordPress.com security specialists handle malware analysis, vulnerability research, incident response, and site cleanup across the platform. When widespread threats emerge, the team coordinates detection updates, investigates affected environments, and works with plugin and theme authors on responsible disclosure.
In the Essential Plugin incident, WordPress.com identified affected hosted sites en masse and removed malicious code directly from impacted environments rather than relying solely on patches that disabled execution.
Security also means being able to recover quickly when something goes wrong.
Automated off-site backups through Jetpack VaultPress Backup allow affected sites to be restored to a known-good state, often within minutes.
Here’s a closer look at the protections and the steps you can take to keep your site safe and secure on WordPress.com.
The flexibility of WordPress is one of its greatest strengths. Plugins, themes, and integrations give site owners the freedom to build what they need, but that freedom works best when it is supported by a strong security infrastructure behind the scenes.
That is where WordPress.com’s managed approach matters. Platform-level monitoring, virtual patches, malware scanning, backups, and human security specialists help reduce the operational burden on site owners without taking away the flexibility that makes WordPress powerful.
Security work is often invisible when it is working well. You may never see the scans, mitigations, cleanup, and response happening in the background, but they are part of what helps keep your site running securely so you can focus on building, publishing, selling, and growing on WordPress.com.
]]>The first post you publish. The first comment that turns into a conversation. The day you realize you’ve shown up all week—not because you had to, but because you wanted to.
Now WordPress.com has a place to celebrate those moments: Achievements.
Achievements are about making the small acts of building, publishing, reading, and connecting on WordPress.com visible.
You can find your Achievements page in your Reader profile, or go straight there:

Your Achievements page is a record that celebrates your efforts on WordPress.com, from publishing posts to joining conversations, helping you feel recognized for your ongoing activity.
You’ll see:
Some achievements are simple milestones. Others are a little more unexpected. We won’t spoil all the surprises, but if you enjoy small quests, secret badges, and oddly specific internet accomplishments, you may want to poke around.

Your activity streak grows when you do things that help make WordPress.com feel alive: publish a post, leave a comment, like a post or a comment, or follow a site.
Keep it going day after day, and your streak grows with you. After seven consecutive days, you’ll earn a streak freeze. If you miss a day, your freeze will automatically protect your streak.
Tiny bit of magic. Tiny bit of mercy.

Your Achievements page is private by default. If you want to share it, you can make it visible to other logged-in WordPress.com users from the settings menu on the page.
You can turn off achievement notifications if you prefer to unlock things quietly; you’ll still earn achievements and maintain your activity streak, just without the alerts.

WordPress.com has always been about showing up: writing, reading, commenting, following, liking, sharing, and building a little corner of the web that feels like yours.
Achievements are a fun way to recognize that effort. They’re not homework. They’re not a leaderboard. They’re just a friendly nudge, a little confetti, and a reminder that the small things you do here add up.
It’s another way WordPress.com helps turn publishing and participation into a habit you can build in your own corner of the web.
So go take a look. You may have already unlocked more than you think.
]]>You can start a podcast for free. We’ll help you set up your show, get your podcast onto major podcast apps like Apple Podcasts, Spotify, and Pocket Casts, and pair it with your newsletter to grow your audience. Upgrade to a Premium plan for audio hosting on WordPress.com, podcast stats, a podcast episode block, and an episode dashboard.
When you publish an episode on WordPress.com, it shows up everywhere your audience already is.

Substack pushes your listeners into their app, and Spotify pushes them into theirs. With Jetpack Podcast, your website and podcast live on your domain, your subscriber list is yours to export anytime, and your show reaches every podcast app that reads RSS.

If you ever decide to leave WordPress.com, your listeners come with you, since their podcast app subscribes to your feed, not ours.
The podcast stats dashboard lets you see how your show is doing with breakdowns by episode, app, and country. Dig into specific time periods and episodes to see how your audience has changed over time.

We are continuing the generous free offering on WordPress.com by letting you publish a podcast for free. We’ll help you get set up and get distributed to all the major podcast apps.
Upgrade to a WordPress.com Premium plan to get your podcast hosted on WordPress.com, podcast stats, an episode dashboard, and an episode player block for your posts. Not to mention the amazing amount of other things you get with the Premium plan.

Open your WordPress.com dashboard, click Jetpack in the sidebar, then click Podcast. Choose your plan, and enable podcasting to get started.
For more details on getting started, check out our support article.
If you’ve been meaning to start a podcast, this is the easiest way to get the first episode out. If you’ve already got a show running somewhere else, give WordPress.com a try so you can have your podcast hosted the same place as your blog and newsletter. Let us hear your feedback so we know what to work on next.
]]>We’ve been listening closely to our community, and one thing has become clear: while WordPress offers incredibly powerful tools for those who want deep control over every pixel of their site, not everyone wants, or needs, all of that advanced functionality. Many of you just want to get your site looking great and get on with sharing your ideas, growing your business, or telling your story.
Enter the Easy Site Editor.
The Easy Site Editor reimagines website building around something everyone already knows how to do: have a conversation.

The interface is refreshingly simple. On the left, you’ll find a chat panel where you can describe what you want in plain language. On the right, you’ll see a live preview of your actual website — exactly as your visitors will see it. Want to change your homepage headline? Just ask. Need to swap out a hero image, adjust your colors, or rewrite your About page? Type it in, and watch it happen.
Because the preview shows your real, live site, you can also click around and navigate between pages just like a regular visitor would. No more wondering “where am I?” or “how do I get back to that other section?”
For those moments when you want to tweak something directly yourself, the Easy Site Editor lets you make simple text and image edits. Just select the Edit option, click on what you want to change, and update it on the spot.
The Easy Site Editor doesn’t replace the full WordPress Site Editor, it complements it. The standard WordPress Site Editor remains the powerful, advanced tool that experienced users and designers love, with its granular control over blocks, templates, and theme settings. It’s an incredible piece of software for anyone who wants to dive deep.
But if you’re someone who’d rather just describe your vision and see it come to life, the Easy Site Editor will become your starting point. And whenever you’re ready to dig into the more advanced tools, they’re just a click away.
The Easy Site Editor is in beta and rolling out gradually to WordPress.com paid plans. If you have access, you’ll find it in your dashboard — look for the Easy Site Editor link in the menu. We’ll be expanding access as the beta progresses, so check back soon.
]]>Today we’re introducing Lately, a weekly letter sent to close friends every Friday. It’s available in beta for new sites.
We’d love to hear what you think and please do send us your feedback.
Lately lets you blog by messaging the WordPress Agent on Telegram. You send notes to it throughout the week and it captures those into a draft. Every Friday you choose what to keep, what to edit, and what to discard. Once you’re ready, Lately sends everything by email to your close friends (and only your close friends). Plus, any friends with a WordPress.com account can read your letter on the web or in the WordPress.com Reader. It’s a simpler and quieter way to blog.
There’s no software to learn with Lately. It’s as simple as sending a new message in Telegram. Just share whatever you notice to the WordPress Agent and it takes care of the rest. You get the power and freedom of WordPress with the simplicity of messaging.

Friends are at the core of Lately and your letters are only shared with them. You can send any friend a link to your site and they’ll see an option to Subscribe. Once your friends hit “Subscribe” they’re listed in your Lately where you can approve them. Only friends you approve will receive each weekly letter you publish.

For anyone reading on the web, Lately ships with 3 style packs, from the understated Modern to the loud Pop. You can swap these out with the palette picker in the header. Emails all use the Modern style, but we plan to bring Pop and Zine to those email templates soon.



If you’ve been quietly meaning to share more with your friends, give the Lately beta a try today.
]]>Workspace is a desktop app that gives you quick access to WordPress Agent from anywhere on your Mac. Ask questions about your site, dictate ideas, capture screenshots, upload images, and transform selected text — all without leaving your workflow or rebuilding your context.
Your WordPress site already holds more than published pages and posts. It contains your archive, your media, your audience, your offers, your style, and the shape of your work. WordPress Workspace turns that existing context into a starting point.

WordPress Workspace includes capabilities you might otherwise pay for separately:
If you manage more than one site, each site can be its own workspace. Switch sites, and you switch context.
WordPress Workspace is included with every WordPress.com plan during the beta.
There is no separate account to create, and no additional subscription to pay. Just sign in with the WordPress.com account you already use, choose the site you want to work with, and start from there.
Workspace is designed around WordPress.com accounts, sites, and permissions, so your access follows the same model your team already uses.
Workspace will become even more useful when paired with guidelines — a feature expected to land in WordPress Core that lets you define how content should sound, read, and behave on your site.
When available, guidelines will shape how WordPress Agent responds, how dictated text is formatted, and how generated images align with your site’s voice. This means cleaner first drafts, more consistent tone, and less manual editing.

Guidelines will introduce:
Your WordPress site becomes more than the place where work is published. It becomes the place where context lives.
Workspace is one part of a broader shift toward WordPress becoming a richer environment for publishing, collaboration, and AI-assisted workflows.
WordPress Workspace is in beta and included with all WordPress.com plans. During beta, features and functionality may evolve as we gather feedback and refine the experience.
System requirements: macOS 11 (Big Sur) or later. Compatible with both Intel and Apple Silicon Macs.
]]>Welcome back to the WordPress.com changelog! It’s been a big two weeks at WordPress.com HQ: we opened opt-in access to the WordPress AI Assistant on all current paid plans, Studio Code launched in beta as a coding agent built specifically for WordPress, and we shipped a new theme focused on short-form social-style blogging.
Until this week, the WordPress AI Assistant was opt-in only on Business and Commerce plans. Starting now, it’s available as an opt-in on all current paid plans — Personal, Premium, Business, and Commerce. Free and legacy Blogger plans will need to upgrade.
The assistant works alongside you as you write, design, and update your site on WordPress.com, offering guidance, edits, and improvements. It’s not a separate app or a one-time setup tool; it’s ongoing help that understands your specific site, built into the editor and the Media Library.

Use it to:
Here’s how to opt in, plus some tips for getting the most out of the assistant.
Calling all developers, builders, and vibe coders: Studio Code is your WordPress expert in the terminal.
Describe what you want (in natural language, with a reference URL, or with a folder of images), and the AI agent builds the blocks, theme, plugins, and full WordPress site, locally.

A few things it does that a generic coding agent can’t:
/annotate, click any element on the page, and ask for the change you want.Install the Studio CLI, run studio code, and start describing. Studio Code is free with unlimited credits during the beta.
We introduced a new short-form blogging theme that lets you create your own small, personal “micro Twitter” with a group of friends, family, or any community you choose.
It’s built for quick posts, replies, and reposts, with a simple Compose flow, profile-style pages, and automatic attribution for shared posts.

The big idea is that social-style posting no longer has to live on someone else’s platform: every update is still a real WordPress.com post on a site you control, replies are saved as comments, and the whole experience stays portable, exportable, RSS-friendly, and independent of algorithmic feeds.
Take it for a spin at wordpress.com/social.
We’ve shipped reliability and polish updates across WordPress.com to keep your site (and the platform it runs on) running smoothly, including: