WordPress Protect the Shire: What Gandalf AI Review Means for Your Site in 2026

On June 5, 2026, WordPress announced something I have not seen in the platform's history: an AI-powered security review for every plugin and theme update before it reaches your site. The program is called Protect the Shire. The AI reviewer is named Gandalf. The security problem it was built to address is very real — a researcher earlier this year traced a 13-year backdoor campaign across 44 WordPress.org plugins back to a single operator who had been quietly inserting malicious code into legitimate plugins for over a decade.

Key takeaways

• WordPress launched Protect the Shire on June 5, 2026, adding a 24-hour AI-powered review window before all auto-updates
• An AI agent called Gandalf now reviews every release across 78,000-plus WordPress.org plugins and themes
• One-click updates from the WordPress dashboard are held during the review window, not just background auto-updates
• Plugin developers and agencies managing large site portfolios have publicly pushed back on the policy
• The 24-hour window is expected to shrink to minutes as the Gandalf AI system matures and improves

What triggered this?

The immediate context matters. Earlier in 2026, a developer published research tracing a 13-year backdoor campaign across 44 WordPress.org plugins back to a single operator. This was not a smash-and-grab. It was a patient, coordinated supply chain attack on the most widely deployed CMS on the internet — inserted slowly enough that it avoided detection for over a decade.

WordPress powers approximately 43% of all websites. Every plugin update pushed through auto-updates reaches millions of sites simultaneously. One compromised plugin, delivered silently through the auto-update mechanism, can affect more websites than nearly any other attack vector in consumer web infrastructure.

Protect the Shire is a direct response to that reality. Matt Mullenweg announced it on the WordPress.org News blog with a clear framing: the goal is to make all code in WordPress's directories and repositories as secure as possible, and the 24-hour cooldown is the first tool deployed toward that goal.

How does Gandalf actually work?

Gandalf is described by WordPress as a Wapuu — the platform's official mascot character — and is the first named AI agent operating at the WordPress.org infrastructure level. Wapuu Studio was used to create the character, which is now symbolically and functionally the face of the review layer across all of WordPress.org.

The mechanics are straightforward: every new release across 78,000-plus plugins and themes passes through Gandalf before it is distributed via auto-updates. During the review window, Gandalf compares the incoming code against the previous release, flags unexpected additions, checks against known malicious patterns, and escalates anything suspicious to human reviewers.

Developers who push an update see it go live immediately on the WordPress.org listing page — anyone who manually downloads from there gets the new version right away. The hold applies to WordPress.org's automatic distribution system — but that is where the majority of updates actually reach end sites, because most WordPress operators rely on auto-updates and have never changed that default setting.

WordPress is explicit that 24 hours is a starting point. As the system learns and the review process matures, the window is expected to drop to minutes. The caution is intentional: they are erring on the side of review time while the AI is still being calibrated to the full diversity of 78,000 plugins.

Who is pushing back, and why?

The loudest criticism comes from exactly the people you would expect: developers managing large WordPress portfolios and plugin authors who publish time-sensitive security releases.

One site maintainer quoted in community forums manages 325 WordPress websites. His frustration is specific: when a security patch lands, he can read the changelog, understand the fix, and know he needs to update now. But during the Protect the Shire review window, the standard WordPress dashboard update button will not install the latest version until the 24-hour review completes. He can see the fix. He just cannot push it through his normal workflow.

Sites hosted on platforms that maintain their own update mechanisms — WP Engine is the prominent example, along with those using the FAIR plugin — are not subject to the same delay because they do not rely on WordPress.org's distribution system. This creates what he described as an uneven playing field: sites on managed WordPress hosting with proprietary update infrastructure receive security patches faster than sites on commodity hosting that depend on WordPress.org's pipeline.

Plugin developers have a parallel concern. A security patch that fixes a live vulnerability is time-sensitive in a very specific way. Every hour between public disclosure and deployment is an hour that someone reading the changelog can infer what was fixed and attempt to exploit sites that have not yet received the update. A 24-hour hold introduces exposure on exactly the updates that need to move fastest.

What does this mean for your site in practice?

For site owners running a handful of WordPress sites on managed hosting, Protect the Shire will not change anything visible in your workflow. Auto-updates will arrive slightly later than before, and in exchange, the update that arrives has passed an AI-assisted security review. For most site operators, that is a reasonable trade.

For agencies and developers managing large portfolios, the practical implication is worth understanding clearly. The 24-hour hold does not prevent manual updates. You can navigate to the Plugins page in your WordPress dashboard and install any published update immediately, regardless of where it sits in the Protect the Shire review queue. The hold applies to automatic delivery — the mechanism that pushes updates to sites without anyone clicking anything.

This means your approach to security-critical updates should not fundamentally change: monitor changelogs, identify security fixes, and manually push them immediately if the vulnerability is serious. The Protect the Shire window does not take that control away from you — it just means you can no longer rely on auto-updates to reach all your sites within minutes of a release landing.

For large portfolios where manual updating is not practical, the question worth asking now is whether your hosting environment uses its own update mechanism independent of WordPress.org's distribution system, and what the security implications of that choice are in the current environment.

Is this the right call?

I think it is, with a specific caveat I would flag directly.

The 13-year backdoor campaign is the argument for this policy. An AI-powered review layer that can compare new code against previous releases and flag unexpected insertions is the right infrastructure response to a supply chain attack of that scale. Friction is not always bad when the thing being slowed down is code that will run on millions of websites.

The caveat is the security patch problem. WordPress should build an expedited review track for updates that include a formal security advisory, where Gandalf runs an accelerated check and the hold drops to one or two hours for confirmed vulnerability patches. That would address the legitimate concern from agencies and site managers without eliminating the protection the standard 24-hour window provides for routine feature releases.

The broader observation is that WordPress is doing something genuinely notable here. Building a named AI agent into the core update infrastructure of the world's most widely deployed CMS is not a small decision. Whether Gandalf becomes a permanent part of web security infrastructure or a footnote depends on one thing: how fast that 24-hour window actually shrinks as the system matures.

Frequently asked questions

Does Protect the Shire affect all WordPress updates?

The 24-hour review window applies to plugin and theme updates distributed through WordPress.org's auto-update system, including one-click updates initiated from the WordPress dashboard during the review window. Sites using hosting platforms with proprietary update mechanisms — such as WP Engine — may not be subject to the same delay because they use their own distribution pipeline.

Can I still update plugins manually during the 24-hour hold?

Yes. If you navigate directly to a plugin on WordPress.org and download the release, or use a hosting panel with its own update mechanism, you can install the latest version regardless of the Protect the Shire review status. The hold affects automatic delivery, not your ability to manually install what is already published.

Who is Gandalf and what exactly does the AI review?

Gandalf is the name WordPress assigned to the AI agent reviewing plugin and theme releases as part of Protect the Shire. It compares each new release against the previous version, flags unexpected code additions, checks against known malicious patterns, and escalates issues to human reviewers. It is the first named AI agent at the WordPress.org infrastructure level, created using Wapuu Studio, and is expected to operate faster as the system learns from the full plugin ecosystem.