A new project called FAIR aims to decentralize WordPress infrastructure by enabling web hosts and organizations to run their own mirrors of WordPress’s core update, plugin, theme, and translation servers. This initiative stems from concerns over centralized control and supply chain security vulnerabilities, particularly after Automattic CEO Matt Mullenweg’s controversial actions regarding WP Engine.

FAIR proposes a solution where users are no longer solely reliant on WordPress.org for updates and extensions. Instead, they can utilize independent mirrors, offering greater control and potentially mitigating risks associated with a single point of failure. Over 100 prominent WordPress contributors from more than 10 organizations have been involved in building it in the past six months. The project has asked the Linux Foundation to provide neutral oversight, and a technical steering committee cochaired by long-time WordPress leaders Carrie Dils, Mika Epstein, and Ryan McCue to guide its development.

While Automattic maintains that users have always had the ability to modify their update sources, FAIR proponents argue that this new approach will enhance security, reduce costs, and create opportunities for innovation within the WordPress ecosystem. The FAIR repository is already live on GitHub and accepting contributions, and though Automattic’s participation in the project remains uncertain, the FAIR team plans to move forward regardless.

The Linux Foundation’s Mike Dolan notes that the community has had trust challenges in the past and is looking for stability and neutrality. If widely adopted, the network could allow developers to ship both free and premium versions of plugins in a single signed package, opening up innovation and potentially leading to a shift in how updates and extensions are distributed for the world’s most popular content management system.