DEV: Pumpkin Spice and Everything Nice

Welcome to DEV, your fortnightly dose of WordPress news.
Here’s your round-up of new tools and treats, smart dev tricks, bug battles, fresh features and community creations. Brought to you by WPMU DEV.

Stick around to the end to see a weatherman’s Halloween costume that had his co-anchor in a fit of giggles.

In today’s edition:

• Defender Pro’s ability to ward off malicious bots has been supercharged with a very powerful new weapon.
• A handful of dev-candy in the form of useful tools and cool projects from the community.
• The magic of Blueprints comes to WordPress Studio 1.6.0.

Hot Off The Presses: What’s New?

Forget Freddy Krueger. The real nightmare is trying to log into anything on a new device.

“Use a different password for everything! It’s safer!” they say. Sure, but now I’m haunted by 47 variations of the same password and zero memory of which one works, while my mind is possessed with nothing but random trivia and K-Pop Demon Hunters song lyrics.

Honestly? I’ll take the “or else.”

Fortunately, no password is needed to get updated on what’s new in WordPress. Just keep scrolling.

Spooky Season Side Projects from Scary-Smart Folks

There’s so many brilliant humans in the WordPress world out there brewing tools that are terrifyingly GOOD, and will make your dev lives a little easier.

Here’s a round-up of the WordPress wizardry that caught our eye recently:

• Per Sønderlandcreated WordPress Readme, a VS Code Extension that delivers live previews of readme.txt right inside your editor. No more formatting gremlins sneaking through unnoticed. 👉 Give it a spin.
• Reyes Martínez introduced Update Copilot, a Modular DS feature that analyzes plugin updates and assigns safety scores based on 15+ risk factors that could quickly turn your site into a haunted house of terror. 👉 Make updates less spooky.
• Lesley Sim unleashed EventKoi Lite, the free version of the EventKoi plugin, perfect for your Rocky Horror Picture Show movie night or David S. Pumpkins-themed party. 👉 Start planning events.
• This adaptive reading time calculator is a little gem of a tool, calculating reading time dynamically based on content length and reading level, perfect for helping to avoid visitors ghosting your site. 👉 Grab it for your blog.

Consider this your treat bag of tools, no tricks. 🎃

Summon Sites in Seconds: WordPress Studio 1.6.0 Unlocks Blueprints

WordPress Studio just got magic powers in version 1.6.0 thanks to built-in Blueprint support. Now you can spin up new sites from your own recipes. No more staring into the yawning abyss of an empty WordPress install, wondering where your life went wrong.

What’s a Blueprint, Anyway?

If you’re new to Blueprints, think of them as a recipe (in JSON form) for a WordPress site. They define PHP & WP versions, which themes/plugins to install, what settings to enable, and even demo content. WordPress Studio then reads the blueprint and conjures your site into existence.

Here’s How It Works

1. Hit Add Site → Start from Blueprint.
2. Choose one of the new presets (Quick Start, Development, or Commerce).
3. Name your site, tweak advanced settings if needed, and hit “Add” and abracadabra, a pre-configured dev site.

Studio Blueprints are a lightweight and portable way for teams to stay consistent without dragging around full site archives. It’s basically bottled lightning for your dev workflow. The current version of Studio ships with three starter Blueprints:

• Quick Start: mirrors the WordPress.com Business setup
• Development: debug settings, dev tools, plugin/theme setup
• Commerce: WooCommerce + companion plugins ready to go

Why This is Kind of a Big Deal (Especially for Agencies & Dev Teams)

• Standardization FTW: Add a blueprint.json to your repo, and every teammate gets the same local environment.
• Faster Client Onboarding: Create a WooCommerce or custom theme Blueprint once and spin it up again and again, like a magician pulling sites out of a hat.
• Reliable Testing: Need to reproduce that one weird bug on staging? Launch an exact clone of your setup.

User-Friendly Blueprint Builders

There are also a few really neat community projects that offer a user interface for creating Blueprints, giving you a more visual way to build:

• WordPress Playground Step Library: A drag-and-drop library of ready-to-go steps for your site recipes.
• Pootle Playground: Jamie Marsland’s experimental WordPress Blueprint Builder, where you can build a fully configured WordPress site right in your browser.
• Block Based Visual Blueprint Builder: Drag, drop and configure visually like it’s Lego for WordPress.

At the end of the day, Blueprints allow for more time spent doing the fun, creative work of building stuff (the fun kind of witchcraft), rather than the tedious setup. When you get them right, they open the door for WordPress development to be faster and more collaborative.

👉 Check out the official post
👉 Learn how to create your own custom WordPress Blueprints

Defender Pro’s Supernaturally Powerful New Feature

You don’t need to draw salt circles around your server to keep the demons out. Just update Defender Pro.

The latest version introduces the new Malicious Bot Detector, a scarily-powerful set of features that offer you two layers of supernatural defence from harmful bots before they can drain your site’s performance (or your sanity). Think of it like an exorcism for bad traffic.

The two combined layers of protection are:

• Catch fake bots impersonating legitimate crawlers. This means any mysterious bots claiming to be Googlebot or Bingbot will be fully examined, using IP and DNS validation to block any impostors.
• Trap bots that ignore robots.txt. This feature adds an invisible booby trap link to your site’s footer. It’s safe for real crawlers, but it’ll instantly activate and block any suspicious visitor who breaks the rules.

Together, these features strengthen your firewall, reduce fake traffic and keep your site safe, stable and blissfully unpossessed. No garlic, silver bullets, or arcane rituals required.

If your bandwidth has been vanishing like a ghost in the night, this one’s for you.

👉 Meet your new digital demon slayer.
👉 Learn more about the Malicious Bot Detector

Mind Bloggling Facts & Stats

• WordPress Campus Connect has convened 6 times already this year, with 5 more events planned or currently underway in classrooms across Spain, India, Uganda and Bangladesh. (Source)
• With 2,297 attendees from 64 countries, 28 speakers and 24 unique talks, WordPress Accessibility Day was a dazzling success and proved inclusion is serious business. (Source)
• Wordfence detected 1,857 new WordPress plugin vulnerabilities in Q3 2025 – which is 32% less than the previous quarter. They also paid out over $25k to all the valiant hunters in their bug bounty program. (Source)

Blogs & Resources You Shouldn’t Miss

Stop scrambling for ideas. The WP Girls created one kit that’ll give you a full year of content inspiration.

Find out how Joni Halabi is making the web more inclusive, one translated transcript at a time.

Are you spreading the peanut butter too thin? Why focus really matters in the WordPress space.

Your plugin only has 10 installs? Hey, we all gotta start somewhere! Here’s how to get more.

Remkus Devries walks through his scarily-efficient 15 minute process for diagnosing an ill-performing WordPress site.

Pssst… did you hear? Ollie’s menu designer might be added to WordPress core… 👀

Nightmarish thoughts that keep you up at night: How much revenue could downtime cost you on Black Friday?

Coffee Break Distractions

A Halloween costume you probably already have.

Alex, founder of ProgrammerHat, wants to turn WordPress into the fastest CMS in the world by rewriting it in C (or Rust). Yeah, it’s a wild idea, but the result could be a 20x speed boost. 😳

AI talks the talk, but is that confidence dangerous? Here’s why grumpy designer Eric Karkovack is wary.

Same Energy is a visual search engine that’s all vibes, no words necessary.

Build your own sticker cat-a-log of all the cute kitties you see IRL with this adorably clever app.

“To write a blog post, you must first redesign your blog.” (Umm… does anyone else feel called out?)

“Why didn’t you get any work done today?” “I was hypnotized by the galloping CSS horse.”

And finally…

Only on Halloween, get your weather updates from Ferdinand, the Mystical Meteorologist.

Love this mix of nerdery and nonsense? Forward it to your favorite WordPress weirdo. 💗