top | item 41631912

WP Engine sent “cease and desist” letter to Automattic

317 points| kevmarsden | 1 year ago |twitter.com

Direct link to letter: https://wpengine.com/wp-content/uploads/2024/09/Cease-and-De...

Related article on TechCrunch: https://techcrunch.com/2024/09/22/matt-mullenweg-calls-wp-en...

267 comments

order

tptacek|1 year ago

I'm not a lawyer, as you will soon realize. This is just water cooler talk, which is what HN is for.

I sort of directionally think that if WPE had a strong case here, their opening bid wouldn't be a C&D (I've noticed C&Ds frequently include a "preserve documents" section, presumably as punctuation, but for what it's worth that's an implicit threat they might sue).

The meat of this C&D seems to be a section towards the middle where they describe Mullenweg's keynote speech. It makes, according to WPE, these claims (numbers mine):

1. Claiming that WP Engine is a company that just wants to “feed off” of the WordPress ecosystem without giving anything back.

2. Suggesting that WP Engine employees may be fired for speaking up, supporting Mr. Mullenweg, or supporting WordPress, and offering to provide support in finding them new jobs if that were to occur.

3. Stating that every WP Engine customer should watch his speech and then not renew their contracts with WP Engine when those contracts are up for renewal.

4. Claiming that if current WP Engine customers switch to a different host they “might get faster performance.”

5. Alleging that WP Engine is “misus[ing] the trademark” including by using “WP” in its name.

6. Claiming that WP Engine’s investor doesn’t “give a dang” about Open Source ideals.

Under a US defamation analysis, claims (1), (3), and (6) appear to be statements of opinion. Statements of opinion, even when persuasively worded and authoritative, are generally not actionable as defamation. It might depend on the wording; in corner cases, an opinion can be actionable if it directly implies a conclusion made from facts known to the speaker and not disclosed to the audience --- but the facts involved have to be specific, you can't just imagine that I've implied I have secret facts (or my audience expects me to) because I'm Matt Mullenweg.

Claim (4) seems like it's probably just a fact? Is WPE assuredly the fastest possible provider at any given price point? The "might" also seems pretty important there.

That leaves (5) the allegation about the trademark dispute, which doesn't sound like an especially promising avenue for a lawsuit, but who knows? and (2) the bit about employee and former employee reprisals. The thing about (2) is if there's a single example of a disgruntled WPE employee who thinks they missed a promotion because they stuck up for the WordPress Foundation or whatever, WPE might have a hard time using that claim.

You'd think that before WordPress/Automattic started directly demanding funds from the board of WPE, they probably had some kind of counsel review this stuff and figure out what they could and couldn't safely say?

Maybe there's tortious interference stuff here that gives these claims more teeth than a typical defamation suit (I've come to roll my eyes at tortious interference, too; unless you're alleging really specific fact patterns I've come to assume these interference claims are also a sort of C&D "punctuation").

This is one of those times where I'm saying a lot of stuff in the hopes that someone much more knowledgeable will set me straight. :)

mintplant|1 year ago

People in this thread seem to be focused on the defamation angle, but is the more important allegation not the alleged demand for large amounts of money to not destroy WP Engine's business? Matt sounds like a wannabe mob boss in the screencapped texts, sending photos of the crowd before his keynote and talking about how he could still "very easily" make it just a Q&A session if WP Engine agrees to pay up.

bastawhiz|1 year ago

The most damning claim, I think, is that Automattic put a banner in every WordPress dashboard on the subject, including WordPress instances hosted by WPE. Automattic is a direct competitor to WPE (by way of WordPress.com). I'm no lawyer but I expect there's at least some argument to be made that there's some abuse of Automattic's position in doing so (though I don't know enough about the law to know whether they have a chance of winning such an argument). If Automattic was purely producing open source software with no vested interest in profit, that would be a different story perhaps.

DannyBee|1 year ago

The defamation angle is not interesting.

They are pretty clear they will go after them for torturous interference, unfair competition, etc.

California's UCL is much broader than you may think here - it is consistently interpreted very broadly by california courts, and has fairly low requirements (IE fraudulent business practices under the UCL do not have meet the same requirements as fraud)

bravetraveler|1 year ago

There is simply no need to preserve documents given how public this was. If pressed the grievance can be corroborated externally.

The letter in entirety is a warning of potential legal action. That is the next action if the other party neither ceases or desists.

Maybe this is normal, but we're glorified animals trying to find justice out of a made up process. It's arbitrary, hence arbitration. Not a lawyer either. You probably know more terminology than I do; I just deal with them a lot :/

edit: I think it's a little strange to be placing judgements at this stage. We'll hear the facts if this goes to court. There's enough to know several are upset. Another consideration: by placing the numbers you're kind of trying to make their argument. Why? Let them.

akerl_|1 year ago

I assume the real goal here is to have the letter exist and be public, as a counterpoint in customer conversations.

crashbunny|1 year ago

I'm also not a lawyer, pleased to meet you.

> I sort of directionally think that if WPE had a strong case here, their opening bid wouldn't be a C&D

I believe, as a non lawyer, in some places to be able to sue for defamation you must first contact the defamer and demand they take it down.

I have no idea and no opinion if there is a case. If there is a case a C&D might be a necessary step.

DonHopkins|1 year ago

>6. Claiming that WP Engine’s investor doesn’t “give a dang” about Open Source ideals.

But dang is not theirs to give!

FireBeyond|1 year ago

> Maybe there's tortious interference stuff here that gives these claims more teeth than a typical defamation suit (I've come to roll my eyes at tortious interference, too; unless you're alleging really specific fact patterns I've come to assume these interference claims are also a sort of C&D "punctuation").

This is the big one to me, actually. If Matt used the announcement feature in the WP.org codebase to place an announcement in WPEngine customers consoles telling them they should not support WPEngine, but instead his for-profit competitor, WP.com, it's pretty hard to argue that that is anything but tortious interference.

aimazon|1 year ago

Matt is predictable. WPE wrote this letter for the community. They knew Matt would throw a fit and they would be able to take the high ground while also releasing an assassination of Matt’s character. The Wordpress community doesn’t care about Wordpress.com, Matt just blew what little credibility he had left. Worthless as a legal letter, brilliant as a response for the Wordpress community. Matt will inevitably step down within a few weeks, and a few years from now, this will be seen as a pivotal moment enabling WPE to dominate Wordpress.com. Matt could not have played this worse.

supermatt|1 year ago

WP Engine calls itself the worlds #1 wordpress hosting (with over 1.5m clients), but they aren't even in the top 10 material contributors to wordpress. Although they have pledged to support wordpress development, is is only to the tune of 40 hours a week. Their pledge is miniscule given their usage of wordpress and isn't even in the top 25 pledges made. It seems they were called out on this, and told to resolve it or it would get highlighted, and highlighted it was.

Sure, the license allows them to do whatever they want, but there's nothing wrong with publicizing that they don't give much in return. With over $400M ARR, thats something they could easily resolve.

imiric|1 year ago

Nice try, Matt.

In all seriousness, if this whole thing is about some false marketing claim from WPE, then call them out specifically on that in a tweet or something. Why does it deserve the "scorched earth nuclear approach", which equates to blackmailing them into giving you millions to prevent you from disparaging them in all media outlets? The claims Matt made go far beyond WPE not contributing to WP development as much as they say they do.

This corporate mudslinging paints WP.com in a much worse light than WPE. IANAL but I think there's a case here for a defamation lawsuit at the very least, if not for outright blackmailing.

FlamingMoe|1 year ago

100%. WP is GPL and they can use it how they like. And others are also allowed to call them out if they want to.

ChoHag|1 year ago

Is supporting wordpress development part of the license offered by wordpress that WP Engine agreed to?

No?

If you don't want people to use your stuff, don't give it away for free.

> there's nothing wrong with publicizing that they don't give much in return

That would be the case IF giving back was part of the deal which they are therefore reneging on. It was not. You are in the wrong.

Aloha|1 year ago

Disclaimer WP Engine Customer -

I read the comments from Matt M yesterday, and it felt like a hit piece.

I run a website for a couple scifi like conventions, we need cheap reliable hosting without me having to deal with the vagaries of running wordpress myself.

I would have bought a product like WP Engine directly from Automattic, but AFAIK they dont offer one, this feels like lashing out at a competitor because they failed to enter a market segment, and now feel their lunch is being ate.

I ran websites for a long time without any version control, and would have no problem doing it again, the benefit of WordPress is the semi-WYSIWYG editor and the plugin ecosystem.

sceptic123|1 year ago

> cheap reliable hosting

I can't speak to the reliability, but it's definitely not cheap

philistine|1 year ago

Could you enlighten me as to what WP Engine does differently from Automattic that you can't buy from them? Looking at the WP Engine, it's the exact same thing, with the numbers filed off, as Automattic offers.

terrycody|1 year ago

Wp engine is not cheap at all, instead its expensive, my websites hosted on Namecheap for years, and never touched even 1 second, and everything is stable, the price? I would tell you, around $45 per year hosting price for 3 sites...

You definitely were ripped off.

firecall|1 year ago

> Automattic CEO and WordPress co-creator Matt Mullenweg unleashed a scathing attack on a rival firm this week, calling WP Engine a “cancer to WordPress.”

In my experience, WordPress itself could be called a Cancer to the Web.

The amount of new clients I've picked up who needed help rescuing broken and malware ridden WordPress sites is... well, it's more than I'd like as I really do not enjoy WordPress LOL

busterarm|1 year ago

That's on the customers. I used to work at a shop that used WP and it was a huge force multiplier. We were WP Engine customers and at some point we moved to Pantheon.io and then we moved to a static site with an internal-only WP frontend for content editors.

We had 2 developers, a PM, 20-30 content writers and $5B ARR. Websites were strictly for marketing/leadgen. Even when we switched to building a static site, we still had our content editors write markdown in WordPress because it was easier to do that and pull all of the content from the database on deploy than train them.

The absolute worst part of being a WP Engine customer was being on Linode and the yearly Christmas Eve DDOS.

anonzzzies|1 year ago

> as I really do not enjoy WordPress LOL

me neither but it pays; when we get called, bad things already happened, so it's always an emergency which means we can ask for 400-500$/hr to fix it. And there are so many bad wp sites that we can retire on that alone. But let me tell you about OpenCart, Drupal, etc which also are all lovely targets and more niche so higher hourlies!

As someone with a formal verification and static typing background, it is the most terrible crap there is, but it is very good business.

MathMonkeyMan|1 year ago

I wonder to what extent that can be attributed to its ubiquity versus its quality. I've never worked with WordPress.

For example, I notice that most of the automated "attacks" on my server are WordPress related. Is its defect rate significantly higher than other systems', or is it just that if you're going fishing you should bait for the most common fish? PHP and Apache come up a lot too.

sixtyj|1 year ago

And so nice it looked at the beginning…

Instead of WordPress, what solutions do you use?

Wix, Squarespace, Webflow, Webnode and other wysiwyg ones are even worse imho.

Are there any non-Nodejs or non-React open source CMS that don’t vendor lock you?

Because I feel that WP somehow sucks in details and maintenance, but I can’t find anything comparable without being sucked into development hell. :)

Thanks for suggestions.

arp242|1 year ago

WordPress isn't that bad. Okay, the code is kinda messy in some places, but which 25 year old project isn't? And yes, in the early days it was cowboy coding, but those days have been over for more than 15 years.

What "broken and malware ridden WordPress site" typically means is "customer installed a bunch of random plugins from random sites written by teenagers or bozos who don't know what they're doing". And yes, that can screw things up, but that's not really WordPress's fault IMHO.

Maybe it can do more to protect users from this; I don't know. But obviously the plugin ecosystem is a hugely important part of the WordPress platform and you can't just lock that down technically. Just make sure you only install plugins from authors who aren't teenagers or bozos.

I'll add that personally I don't especially like WordPress for various reasons. But at the same time I don't think this is really a fair criticism.

gjsman-1000|1 year ago

And yet, reality is that for many companies, an off-the-shelf CMS is all they need, and all they can afford, and all they can figure out without hiring IT.

Which means, if we want to kill WordPress, we need to offer a better solution. Not just for WordPress, but a coherent system that also reimplements the top hundred or so plugins.

If anyone wants to join me rewriting it in Laravel so we could add a WSL-like layer for WordPress cancer plugins… I don’t know. I wish someone would have the conversation. I don’t even care whether it’s Rust.

chris_wot|1 year ago

I personally don't like block themes.

theyknowitsxmas|1 year ago

Yeah I run wp2static on clients, cancel the hosting then push the files to vercel/cloudflare pages/github pages.

A PHP version is vulnerable. If you upgrade it, some plugin breaks. If you manually upgrade the offending plugin, the pesky developer now wants a subscription. Just a nono. I build on Hugo.

econcon|1 year ago

We had that problem in barebones WP with no plugins at all.

Once we installed a few security plugins, it worked out just fine!

breck|1 year ago

I'd love to get your feedback on https://hub.scroll.pub/. Create new sites in 0.1 seconds. No signup required.

It's a new stack, but it's pretty revolutionary foundation, and as we get some good templates and imrpove the UX, I think it should bring a lot of joy to people who currently suffer with wordpress. It's all open source/public domain. Having started my programming career in Wordpress ~17 years ago, I have been able to take my favorite parts from it and get rid of all the annoying parts (like requiring a database, php/javascript hybrid, etc).

keane|1 year ago

Just as an observation this reminds me of the dynamic that other open-source software distributors are tasked with defending.

Let's say you were distributing a browser, let's call it Firefox. You might have a corporation and a nonprofit and call them the Mozilla Corporation and the Mozilla Foundation.

Maybe in this scenario you would allow certain commercial uses of your registered trademarks so that the software could be distributed by others. Parameters in this policy might only allow the commercial use of the trademarks in certain ways, enabling others to advertise their product like "Grammarly for Firefox" or even their service "Download Firefox from CNET" without infringement. But these parameters would go on to disallow one from using the terms in a way that implied a direct connection to the Mozilla Foundation or caused confusion with regards to the root product such as advertising your site, CNET, as "The Firefox Store".

Then let's say someone renamed their CNET site FFXSource. And then advertised themselves as "The Most Trusted Firefox Tech Company" and that their download was "The most trusted Firefox build". They might be told this violated the terms that don't allow implying official connection to the wider project. (And then let's say the download they were offering had the browser History pane feature stripped out.)

In this scenario, it seems it would be the duty of the trademark owner, the Foundation, to seek that FFXSource either come into compliance or, to continue use that exceeded the blanket guidelines, to acquire a dedicated, more-expansive commercial license. (Of course none of my thoughts on this are legal advice.)

ptx|1 year ago

> Then let's say someone renamed their CNET site FFXSource.

This is addressed on page 5, where they quote the trademark policy[0], which until a few days ago said: "The abbreviation 'WP' is not covered by the WordPress trademarks and you are free to use it in any way you see fit".

The current policy[1] has since been modified to specifically mention WP Engine and make seemingly irrelevant accusations towards them, but it still retains the part about "WP" not being covered by their trademarks.

> And then advertised themselves as "The Most Trusted Firefox Tech Company" and that their download was "The most trusted Firefox build".

Using that sort of phrasing would clearly be misleading and looks like it would have been disallowed by the trademark policy, but is that what WP Engine actually did?

[0] https://web.archive.org/web/20240912061820/https://wordpress...

[1] https://wordpressfoundation.org/trademark-policy/

echoangle|1 year ago

First, I'm not sure your example comes close to infringing the trademark, but even if it does: Wouldn't the correct step be to inform the infringing party that you see it as infringement and give them a date by shich they have to rebrand, and give it to your lawyer after that? Why would you make threats about destroying their reputation by doing a keynote about them if you are legally in the right? That's just childish.

ipaddr|1 year ago

I don't think any of those issues you raised passes the bar. ffxsource.. no. The most trusted build. no many people build their own and it could be trusted more because someone is testing the official build and making changes and ensuring it works. The most trust Firefox Tech company is accurate. It implies many firefox tech companies exist and they are the best one.

muglug|1 year ago

Sad to see Matt M behaving in such a childish manner. The initial wordpress.org blogpost looked pretty bad, but the quoted text messages are so much worse.

keane|1 year ago

It's not uncommon for a license being required to use a registered trademark. WPE denies they need one. Matt apparently disagrees.

Spivak|1 year ago

This is a pretty bad look for Matt, it comes off as yet another CEO who's mad that there's no first-party advantage to hosting OSS. Thanks to the GPL and no CLA he can't take it proprietary like others before him. When you're mad at someone for using their freedom-to-run and freedom-to-modify it doesn't come off as pro-OSS as you think.

Weaponizing the trademark that's more strongly associated with the software itself than the company Wordpress is a pretty low blow. WP Engine is hosting Wordpress, full-stop. There's maybe a discussion to have about when modifications constitute a fork that warrants a different name but we're about as far away from that as you can be.

I honestly don't know why Matt cares. His competitor is owned by PE, just wait for them to eat the business and offer a one-click migration. Play the long game.

mrwyz|1 year ago

I'm hopeful Automattic will win this one; WP Engine repackages WordPress and delivers it as a service. Fine. Software license allows for that. That does not give them the right to describe their service as "[the] Most Trusted WordPress Hosting and Beyond". They clearly say so in their policy: https://wordpressfoundation.org/trademark-policy/

echoangle|1 year ago

You can't prevent someone from using your Trademark as a description with your trademark policy. Everyone can use your Trademark to identify the thing, they don't need your permission. I could call myself the best Linux admin ever and the Linux Mark Institute can do nothing.

sureIy|1 year ago

You’re making no sense. Those words are just marketing, they’re not shitting on Automattic like Automattic is doing.

jmull|1 year ago

The policy says,

...a business related to WordPress themes can describe itself as “XYZ Themes, the world’s best WordPress themes,” but cannot call itself “The WordPress Theme Portal.”

It sounds like "[the] Most Trusted WordPress Hosting and Beyond" would be allowed.

sfmike|1 year ago

could someone articulate that wordpress.com is more trusted then wpengine?

anomaly_|1 year ago

Eh, sounds like mere puffery to me.

seydor|1 year ago

This reads more like a blog post than a cease and desist. Why do they take so long to get to the point of their demands. Matt is entitled to have opinions , and they should stick to the opinions they find unlawful instead of rambling on about everything he said

oldstrangers|1 year ago

This is funny considering WP Engine has been the only thing that kept me developing wordpress sites for years.

aussieguy1234|1 year ago

As a former WordPress engineer that built one of the worlds largest commercial WordPress deployments, I have a secret to tell you.

WordPress, out of the box, if you throw even a portion of traffic that you would expect form a large media site at it, will fall over.

We modified WordPress, took advantage of all the hooks, basically rewrote the post authoring and search system and introduced caching and databases on top of the default MySQL, such as ElasticSearch for content storage and searching content. We also had a network level CDN in front of it at all times.

By the end of it all, what we had was not fully WordPress anymore.

You'll find that alot of organisations doing WordPress are doing similar things.

CPLX|1 year ago

Without additional context the letter does read as persuasive.

Is there significant additional context? Having looked at Matt's comments in the speech I'm not seeing any actual substance of what's wrong with WP Engine.

gjsman-1000|1 year ago

It’s kind of perverse of Matt considering:

A. He accuses “WP Engine” for being confusing branding. He literally owns WordPress.com; which confuses tens of thousands of people on a daily basis. (“Are you on the WordPress login page?” “I swear that I am!”)

B. He complains about the post revisions not being limitless. But until recently, WordPress.com had a limit of 25.

C. If post revisions matter, surely plugins matter, right? WordPress.com requires going up two tiers to use any unapproved plugins.

D. Matt was an investor in WP Engine, and even appeared on their podcast last year, even though this revisions system limitation has been in place for a decade?

E. This is the same Matt who wrote the WordPress Bill of Rights, complete with specifically saying “The freedom to run the program, for any purpose” and “The freedom to study how the program works, and change it to make it do what you wish.”

F. The same Matt who wrote in the WordPress trademark policy that “WP” is not a WordPress trademark and anyone may use it however they wish?

G. The same Matt who forked B2, and if B2 was still around, would be quite vulnerable to B2 potentially complaining about Matt’s lack of contribution to them?

It goes on. I hate to say it, but every sign points to Matt being a hypocrite. Even an extortionist.

mrkramer|1 year ago

Automattic invested in WP Engine in the early days, why didn't they acquire it, or WP Engine didn't want to sell. But why did Matt choose the open source license that he chose, it seems like that at the end of the day he only cares for money and not the WordPress community.

markx2|1 year ago

The fact that he wants money for Automattic suggests that Automattic are now hurting financially in some way.

partiallypro|1 year ago

I know it's not considered "contribution" in the sense that Matt was talking about, but WPEngine owns and maintains some of the most popular and powerful Wordpress plugins on the planet. I'm not sure why he chose to pick a fight with them. My best guess is that he wants Wordpress.com (hosting) to be what WPEngine became.

820jf98ajow|1 year ago

"I'm literally waiting for them to finish the raffle so my talk can start, I can make it just a Q&A about WP very easily"

If I were attending a conference I'd hope that the keynote speaker would put more thought into his talk than this. Not only is it childish, it's disrespectful to his audience.

malthaus|1 year ago

some of the comments here are exceptionally biased towards the party that does the "open source washing".

just look at the childish way automattic acted. that's not a way to lead an organization or deal with your competition. you compete by building a better product, take legal action in an adult way if you think they are warranted and in general take the high road - not display your immaturity.

the conflict of interest around the governance of wordpress is icky on top. so he just puts on his "open source" hat to gain favour for his for-profit company?

namedia|1 year ago

As a software developer, I can understand the point Matt is making but it's sad to see him calling another competitor a "cancer" to the web. I like Wordpress and was inspired by it a lot but with many years hosting Wordpress sites for our customers, I find its plugin and theme architecture very vulnerable and often be the backdoors for hackers/scammers to launch attacks on servers hosting Wordpress sites. Whoever hosting Wordpress sites must do a good jobs securing their servers to prevent exploits through the Wordpress plugins and theming system. I dont know much about WP Engine but they should be credited for securing their massive Wordpress installations. In my opinion, Matt should focus more on fixing the weaknesses of Wordpress architecture than bashing his competitor, Wordpress is really a pain point to those providing hosting for it. We used to provide Wordpress hosting and did customize it as a website builder but due to its fragile architecture, we have decided to develop our own CMS system, with 3rd party plugin and theming system inspired by Wordpress but have built-in protection mechanism to prevent backdoors potentially exist in 3rd party code.

jeanlucas|1 year ago

semi-off-topic: Does anyone have alternative links to twitter? I'm in Brazil and don't wanna go around and risk a fine just for a tweet...

torginus|1 year ago

I'm just confused about the whole thing. Aren't WP hosts a dime a dozen? And if you don't like how they conduct their business, just set up one yourself. I set up one for a friend on AWS, and while it requires some tech savvy, it's not exactly hard for someone with basic tech literacy and ability to follow instructions.

etchalon|1 year ago

It sounds like Automattic was desperate for money and played a desperate hand badly.

The receipts in the C&D don't leave one with a positive impression of Matt.

I'll wait for Matt's response, but I can't imagine it's anything more than "well, we deserve the money I was demanding!"

pluc|1 year ago

Well, there's that context we were all asking for.

mk89|1 year ago

When I read the title I was wondering "strange, wasn't Automattic the company behind wordpress? Who knows maybe they split and now they sued them for XYZ". Crazy.

Instead of going through all this, can't Automattic do like what most companies are doing now? Dual License (e.g., Redis, etc).

bdzr|1 year ago

Does anyone know why WP engine doesn't actually support multiple post revisions by default? I worked with WordPress significantly quite a while ago and found it to be an absolute dumpster fire of a codebase. It wouldn't surprise me in the slightest if running a scalable WP host required tamping down on some things.

etchalon|1 year ago

Revisions significantly bloat the size of the primary table (wp_posts) and secondary meta tables. Because WordPress's database architecture is hilariously simple and under-engineered, that bloat ends up slowing down every query.

So, to keep WordPress performant, you either need to regular prune wp_posts, or you need a continually beefier database instance to handle the installation.

Sane DevOps teams just limit revisions to something like "last 5" to keep things under control.

riffic|1 year ago

in the court of public opinion I think I know who I'm going to side with.

manuelmoreale|1 year ago

I'm going to side with chaos: let both fail, let new products come up.

mdotk|1 year ago

I'm no fan of WP Engine and their outrageous prices for very average performance, but this is a terrible look for Matt M if true. reply

nikolay|1 year ago

I love it! WP Engine showed its true colors. I also agree with Automattic, and I know customers who got tricked into using WP Engine and were later sorry for doing so! Sending C&D over this stuff is something that bans them for life in my book!