Nobody Made Me Write This

Last week was my first week of doing the new Founder’s Memo video blog (on my existing YouTube channel). So far so good.

• The stats on my YouTube channel blew through the roof compared to what’s been normal.
• I re-worked the What’s New page on BMA to work in the new stuff.
• It now has its own dedicated website.

Having to learn the ropes in some ways. After all, I’m a WordPress guy and an old-school blogger. Not a YouTuber. 🤪

Anyway, in this issue…

• Why I decided to put an AI disclosure policy on my site even though I’m not required to do it
• A story of one of those urgent fires I had to put out last week for Concierge
• I re-tested whether I could officially switch over to FluentCart (from WooCommerce).

Let’s dive in…

Why I Just Published an AI Policy… And Nothing Made Me Do It

So, I was listening to a podcast the other day while I went for an afternoon walk. And the subject of that podcast was: AI Policies. And it got me thinking…

Most of us are used to publishing those boring, legal pages on our sites. You know…. “terms of service”, “privacy policy”, “cookie policy” and things like that. But, what about an AI disclosure policy?

I use AI constantly around here. Frankly, I’d be pretty stupid if I wasn’t. 😜 I use it in a bunch of my internal business processes – as well as client site work over in Concierge. Maybe I should say that out loud somewhere, instead of just… doing it quietly and hoping nobody asks? Frankly, I don’t mind when people ask. I don’t hide from it.

So I went looking for the actual legal requirement. Didn’t really find one.

There’s no US law that says you have to disclose AI use on a blog post, an email, or your website copy. The rule is really just “don’t be deceptive,” same as it’s always been (here’s a decent breakdown of where the actual line sits). The one spot it gets real teeth: testimonials and reviews. If you’re using AI to fake a customer endorsement, that’s already illegal, AI or not… nothing new there. And the state laws popping up are aimed at chatbots pretending to be human and synthetic video, not some guy writing blog posts with help from Claude.

If you’ve got readers or customers in the EU, different story… you already know why, since I told you about it a few issues back (#594). That transparency rule that made Anthropic start watermarking Claude’s output? That’s real, and it does reach content, not just chatbots. All content creators need to be aware of that.

So for most of you reading this… legally, you’re already fine. I was too. But, I published a policy anyway. I wrote a plain-English AI disclosure policy.

I’m not legally required to do it, but I figured it was the appropriate thing to do. Everybody already knows AI is everywhere in content right now. And yet, watch how people react when it gets made visible instead of assumed.

Remember that watermark thing? People didn’t just object to being tracked. Some genuinely got angry that Claude’s output could now be identified as AI-touched even after it got rewritten, reformatted, folded into something else. Techdirt called it an “AI scarlet letter.” And within days, watermark-remover tools showed up on GitHub. One of them already passes 14,000 stars. Searches for “AI watermark remover” jumped 60% in a week.

I find that rather humorous, honestly. Why are people so up in arms about anybody knowing they use AI?

I don’t get it, personally. It’d be like a carpenter insisting “I never use power drills,” while everybody standing there can see the drill sitting right on his belt. Or a teacher swearing “I only use transparencies,” in a room with a computer projector bolted to the ceiling. Nobody’s fooled. You’re just spending energy hiding something that was never actually shameful in the first place.

But, we all have our own ways of using AI. I don’t have AI “write” anything. Everything goes through me. I still write a ton of it manually, but I do use AI as a tool to help quickly structure ideas. In fact, if you wanna watch me actually producing last week’s issue of this very newsletter using Claude, click here to watch my full process. Founder’s Memo last week shows the whole thing.

My AI disclosure policy took me maybe an hour to write once I sat down. Now it just… exists. Answers the question before anyone has to wonder about it. If (or when) legal requirements change, I’ll just edit the page. But, for now, I figure I’ll just get out ahead of it and be transparent. It also covers how I use AI in my execution of services for Concierge.

If you’re running anything online right now, you’re probably using AI somewhere, even if it’s just spellcheck on steroids. The way I see it, why let anybody be left wondering? You don’t need a lawyer for this one. You need about an hour, and the willingness to just say what you’re actually doing. I know perceptions about usage of AI are shifting… and frankly I expect social debate over this to heat up and shift over time. I just figure…. get out there and own it. In whatever way is true for you.

WordPress News & Updates

RankMath is quietly handing your site’s admin keys to WP Rocket’s parent company. This one’s ugly. As of the 1.0.277 update, if a site admin connected to a free RankMath account opens “Help & Support,” the plugin immediately creates a full-admin WordPress Application Password… and sends it straight to group.one’s servers (the company that also owns WP Rocket), no confirmation required. It shows up on your profile as “WAP – Rank Math Support Agent,” never expires, and there’s no toggle to turn it off. The researcher who found it (who, to his credit, discloses upfront that he runs a competing SEO plugin) says he’s not accusing anyone of using it maliciously… just pointing out that 4 million sites’ worth of admin passwords sitting on one company’s servers is a pretty attractive target for somebody else. If you run RankMath, go check Users → Profile → Application Passwords and revoke anything starting with “WAP.” Here’s the full breakdown.

Wordfence’s new AI vulnerability hunter is having quite a month. Their agent, nicknamed Argus, chained six separate flaws together into a critical unauthenticated RCE in the Avada theme… found and built a working exploit in about two hours, no human involved. Same tool then found a critical auth bypass in WPMU DEV Dashboard (350,000 installs) and an account-takeover bug in TranslatePress (400,000 installs, already patched). Equal parts impressive and unsettling… the good guys have an AI finding these bugs now, which is great, right up until someone points the same kind of tool the other direction. Full writeup here.

GiveWP patched a perfect 10.0 CVSS vulnerability. A broken “safe” unserialize function meant an attacker with zero credentials could run commands on the server of any default GiveWP install. Fixed in 4.16.7.2. If you’re running donation forms, update now, not later. Details here.

Pods shipped emergency patches across six major versions after a critical privilege-escalation bug surfaced. Unauthenticated attackers could escalate straight to admin, including resetting anyone’s password. The lead developer reportedly took the rest of the week off his day job to get patches out. That’s the kind of response you want to see. Full story.

There’s a new free tool called the Plugin Graveyard, and it’s exactly the kind of boring-but-useful thing I like. It tracks active WordPress plugins that haven’t been updated in 12+ months and cross-references them against known vulnerabilities… last count, 47 plugins like that affecting an estimated 4.2 million installs. Worth a bookmark. Check it out here.

Contact Form 7 is still the most-used form plugin on WordPress, but it’s bleeding share. Down from 39% of sites in 2022 to 29.74% now… about a quarter of its footprint gone in four years. Gravity Forms was the only major form plugin to actually gain ground over the past year. Full numbers here.

FluentPlayer 1.4 shipped a muted-preview autoplay mode that doesn’t count a view until someone actually clicks play with sound… which means your view counts finally mean something. Modal playback and inline chapters also landed for Pro users. What’s new.

FluentBooking 2.3.0 got a full admin rebuild… new dashboard, proper dark mode, cleaner scheduling views. Worth a mention for the tease at the end: MCP support for AI agents is landing next week. Full changelog.

If you’re pulling Tripadvisor reviews into WP Social Ninja, today’s the deadline. Legacy Tripadvisor API keys stop working August 31… that’s today. WP Social Ninja 4.4.0 supports the new Terra platform, but you’ll need to generate a fresh key on Tripadvisor’s end. Migration details here.

WP Rocket published its post-mortem on the WordPress 7.1 outage, and it’s a genuinely honest one… roughly 10% of their users actually got hit, and their VP of Engineering admitted their test suite grew “opportunistically” instead of being built around what people actually run alongside it (Elementor Pro, despite being one of the triggers, wasn’t even on the list). Meanwhile WordPress’s own X account took a public jab at them over it, which… didn’t land well with a lot of people. Read the post-mortem.

WordPress officially signed onto NVIDIA’s Open Weights and American AI Leadership letter, joining 270+ companies including Automattic and GoDaddy, arguing against early restrictions on open-weight AI models. Given everything else in this issue, feels like the whole industry is having the same conversation I opened with today… just at a different altitude. WordPress’s announcement here.

I Tried To Kill Off WooCommerce (For FluentCart). Not Yet.

I’ve been waiting on one specific thing from FluentCart for a long time: a real migration path off WooCommerce that actually handles subscriptions. In my world, that was the one thing that I needed to finally make the move.

Well, it finally happened. FluentCart 1.6.2 shipped with full support for migration away from WooCommerce Subscriptions. This is a really big deal.

So I did what any reasonable person does with a new toy… spun up a staging copy of my main site and tried to see if I could finally kick WooCommerce to the curb.

Short answer: not yet. But it’s closer than it’s ever been, and closer than I expected.

The migrator itself genuinely impressed me. Products, orders, subscriptions, history… it pulled all of it over cleanly. Order numbers stayed the same. Stripe and PayPal transaction IDs carried over. Subscriptions landed on FluentCart’s own billing without a gap in anyone’s renewal. That’s not a small thing to get right, and they got it right.

But once I was in there poking around, running my actual workflows against it instead of just admiring the migration, I ran into enough friction points that I’m not ready to pull the trigger. My site’s pretty deeply baked into WooCommerce at this point, so there’s real inertia to overcome. But I’d still make the jump if the gap were smaller.

Here’s some things I noticed:

• You can’t edit what’s actually on a subscription. In Woo, a subscription is its own thing, separate from the order, and you can add or remove line items on it directly. I use that constantly… upgrading someone to a different plan, tacking on an add-on, adjusting what they’re subscribed to without them lifting a finger. In FluentCart, you can change the price of the whole subscription, but you can’t touch the individual items on it. For anyone running tiered plans or add-ons, that’s a real gap.
• Product filtering needs work. The useful filters are buried under “More Views” or an advanced toggle, but “Physical” sits right out in the open… even if you only sell digital products. No category filter up front either. Small thing, but it adds up to a lot of extra clicking.
• Very little ability to control the “My Account” screen. With WooCommerce, I can edit almost anything. With FluentCart, you either accept what it is or… well, there’s no other option.
• No real upsell paths. They’ve got upgrade/downgrade covered, but true one-click upsell and downsell funnels would be huge… the kind of thing that makes a separate tool like CartFlows unnecessary. To be clear, WooCommerce doesn’t do this either. But, tools like Cartflows provide it. If I switch to FluentCart, I no longer can use such tools.
• Integrations are more tedious than they need to be. With WooCommerce (especially paired with WPFusion), I can set tags for every subscription status… activation, payment, cancellation… on one screen per product. FluentCart wants a separate integration for each event. For one product, that’s several integrations instead of one screen.

One more thing worth flagging if you’re considering this move yourself: your integrations don’t migrate over. The product data comes across perfectly, but if you’re using something like WPFusion, you’ll be rebuilding every single integration by hand afterward.

None of this is a knock on FluentCart, for the record. I posted this same basic list in their community as feedback for the dev team, because this migration path was a genuinely big step. We’re just down to the more granular stuff now, the kind of gaps that show up once a product’s core is solid and people start actually leaning on it. That’s usually a good sign, not a bad one.

Truth is, while WooCommerce has its issues and is certainly a little bloated, it is a full ecosystem which has been around a long time… infinitely customizable, tons of add-ons, years of momentum behind it. FluentCart is new and… not an ecosystem. One company builds it… and if they don’t build in a feature you want, you don’t have much choice but to wait for them to get around to it. It just doesn’t have all of the hooks and customization potential of WooCommerce.

For now, I’m staying on WooCommerce, watching to see how many of these gaps get closed. Once I can manage subscriptions the way I do now and get more control over the front-end, I’ll make the move without a second thought. WooCommerce, with all its many add-ons, will go buh bye from my site eventually. Just a matter of when.