The Domain Behind the WordPress War: Who Owns WordPress.org?

On October 30, 2024, a declaration signed by Matt Mullenweg entered the docket of a federal court in California. Its second paragraph contained a sentence about a website that serves updates to millions of sites. "I own the domain name www.WordPress.org individually," Mullenweg wrote. Three paragraphs later came a firmer version: "I retain sole ownership of the domain name WordPress.org."

The press had already reported the ownership. The declaration put it under oath, in a case about access to the site. WP Engine, a hosting company built entirely on WordPress, had first lost that access five weeks earlier. Its chief executive, Heather Brunner, told the court of being "under the impression" until very recently that wordpress.org was associated with or owned by the nonprofit WordPress Foundation.

WP Engine sued Automattic, the company Mullenweg founded and runs, and Mullenweg personally. The case has not reached a verdict. Its papers give a detailed public account of how much a domain can control, and of where that control may stop.

One person registered the name in March 2003

WordPress began as a small software project. Mullenweg and co-founder Mike Little started development in January 2003 and released the first version that May. Between those dates, Mullenweg says, came the domain: "in March 2003, I registered the domain name WordPress.org."

The public registry record agrees on the date. The registration data for wordpress.org shows a creation date of March 28, 2003, the registrar MarkMonitor, and an expiry date in 2035. It does not name a registrant. The WHOIS output for the same name lists "REDACTED REGISTRANT." Anyone checking the public record for the owner of WordPress.org in November 2026 finds the company that sponsors the registration, not the person who holds it.

The suffix gives no answer either. Many readers treat .org as a nonprofit signal, but the registry that runs it says otherwise: "Yes, .ORG is an open and unrestricted domain." A charity, a company, and a private individual can all hold one.

The site grew over the years. According to Mullenweg, it first held only a download link. Directories of themes and plugins followed, then more than thirteen million cumulative accounts. The court recorded that more than 40% of websites run on WordPress, a figure taken from Mullenweg's declaration. The registration did not change as the site grew. A personal domain became infrastructure for a large part of the web.

Three layers carried the same name

The word "WordPress" covers three different things, and each sits under a different arrangement.

The software is open source. Under its license, anyone may use, copy, and modify it.

The trademarks moved in 2010. Mullenweg announced that Automattic had transferred the WordPress trademark to the WordPress Foundation. The declaration fills in the rest of the arrangement: Automattic retained a commercial license, and Mullenweg retained a license for use with the website.

The domain stayed where it began. The background section of the December 2024 court order lists Mullenweg as the individual owner of the domain name and the manager of the website, as well as a founding director of the Foundation.

WP Engine later turned that structure into an accusation. Its amended complaint alleged a long concealment of who controlled the site, describing a "dot-org" that Mullenweg "solely owns and directs with an iron fist" for commercial gain. Automattic called the complaint "another unfounded effort" by WP Engine's private equity owner. In court, the defendants framed the same facts differently. Mullenweg created the site to serve the community, they said in 2024, and Mullenweg and Automattic staff contribute over 3,500 hours weekly to maintain it. They put the running cost at an estimated $800,000 a year.

An 8% demand turned the domain into leverage

The conflict opened in September 2024 with a demand about trademarks. According to Brunner, Automattic's finance chief warned that Automattic would "go to war" unless WP Engine agreed to pay. Hours before Mullenweg's keynote at WordCamp US on September 20, a one-page trademark license arrived with a demand for an immediate response. It offered a royalty of 8% of gross revenue, 8% of revenue spent on staff working on WordPress under the direction of WordPress.org, or a mix of the two.

WP Engine did not sign. In the keynote, Mullenweg said WP Engine "feed[s] off the host without giving anything back." Mullenweg pointed to an imbalance in contributions and reported that WP Engine listed 40 hours a week for the project. WP Engine answers that it has invested hundreds of millions of dollars supporting WordPress in the market.

Five days after the keynote, the dispute moved from the trademark to the site. On September 25, Mullenweg posted a notice on WordPress.org itself, under the title "WP Engine is banned from WordPress.org." The post tied the ban to WP Engine's legal claims: "WP Engine no longer has free access to WordPress.org's resources." The sworn account says that Mullenweg blocked WP Engine's servers because of what Mullenweg called WP Engine's growing trademark misuse and "the threat it posed to the community." The block lifted temporarily on September 27 and returned on October 1.

WP Engine's case is that this ban reached running software, because of a detail in the code. WP Engine's chief technology officer told the court that WordPress "hard codes" the wordpress.org update site into every installation. The current source contains such an address: the plugin update check calls a fixed address on api.wordpress.org. A hostname inside a personally held domain sits inside the release that site owners install.

The two sides disagree about what followed. WP Engine said customers could not install or update plugins from the admin panel, including updates that address bugs and security vulnerabilities. It built a partial mirror and called that workaround impractical. The defendants called panel access a convenience, not a necessity. Mullenweg added that the plugin directory stayed freely accessible and that hundreds of thousands of accounts had been blocked over the years. The judge later found none of those arguments persuasive at the preliminary stage. Mullenweg also stated the point that matters most for a domain story: "I have no contracts, agreements, or obligations" to give WP Engine access.

The site's owner changed what its users saw

Control of a domain carries control of the pages behind it, and the next steps showed how far that reached.

On or about October 8, the login page gained a checkbox. Users had to confirm they were not "affiliated with WP Engine in any way, financially or otherwise." A user who left the box empty could not log in. Mullenweg's declaration, which dates the checkbox to October 9, says the box was meant to safeguard the community.

Four days later came the plugin. Advanced Custom Fields, a WP Engine product with more than two million active installations, had a listing on wordpress.org. According to WP Engine, Mullenweg changed the name to Secure Custom Fields, changed the listed author to WordPress.org, and moved users to the new version through an update prompt. WP Engine said Mullenweg co-opted its listing page, and that a fork normally gets a new website or URL. Mullenweg's account is different. WP Engine never responded to a security disclosure, it says, and the WordPress security team found the patch incomplete and forked the plugin to finish it. WP Engine kept control of its plugin through its own channels, Mullenweg says, and the public was told about the fork.

A preliminary injunction restored access but decided no final question

On December 10, 2024, Judge Araceli Martínez-Olguín granted WP Engine's motion. The order required the defendants to restore access as it existed on September 20, remove the checkbox, and return the plugin listing.

The order is narrow. A preliminary injunction is a temporary measure. The judge found WP Engine likely to succeed on one claim, interference with its customer contracts, and did not reach the others. The judge also rejected the claimed right to make the changes for public safety, saying WP Engine's declarations "belied" that statement. The relief lasts until judgment after trial. Nothing in the order takes the domain from Mullenweg, and the order keeps the site's ability to ensure its security and operability under the policies of September 2024.

The order also shows how the defendants viewed the site. They asked for a $1.6 million bond, partly to compensate Mullenweg for services the court might order. The court declined, finding that a return to business as usual was unlikely to cause harm.

Automattic said it looked forward to prevailing at trial. Ten days after the order, Mullenweg paused several free services on WordPress.org in a post called Holiday Break, and described the stakes in personal terms. The attacks, the post said, were against Automattic, "but also me individually as the owner of WordPress.org." The pause showed again which services the owner of the site could switch off, though the post said none of it applied to WP Engine.

The court then drew a narrower line around access

Two later rulings made the picture more complicated, and they pull in different directions.

In September 2025, the judge dismissed WP Engine's antitrust claims with leave to amend. The judge also dismissed two extortion claims, one of them with leave to amend. On extortion, the court wrote that WP Engine could not plausibly allege "a preexisting right to access and use Wordpress.org or related trademarks in perpetuity for free." For a domain owner, that sentence is close to the defendants' position. The same order let a narrower claim continue, resting on two published statements, including free hosting for plugin developers. A site's published promises, in other words, can support a claim at the pleading stage even when no contract exists.

On September 24, 2026, the same judge reversed course on the antitrust claims. A Ninth Circuit decision in another case had held that a test the court used earlier does not bind a plaintiff who adequately pleads power in the broader market, and the order states that the court now finds those claims viable. At this stage the court takes the complaint's allegations as true, so the ruling proves nothing about the facts. It does accept as plausible that the defendants charged competitors for WordPress access that used to be free, and that the login checkbox could work as an illegal tie. The same order threw out a remaining extortion claim without leave to amend.

The order also separated the layers again. Most of the trademark counterclaims survived, but Mullenweg and Automattic cannot press them in their own right, because they are neither owners nor registrants of the marks. Those claims now proceed through the Foundation and WooCommerce. The holder of the domain and the holder of the marks are, for this purpose, different parties.

As of November 3, 2026, the docket shows an active case with no final judgment. No settlement had been announced when The Repository took stock in October. Summary judgment motions are due November 20, and a 10-day jury trial remains set for October 19, 2027. A motion by WP Engine for sanctions, over messages it says were lost, was argued on October 7, and the docket lists no written order yet. In a pre-filing letter, the defendants call WP Engine's "chokepoint" theory a recast refusal-to-deal claim, and argue that they have no duty to give access and that WP Engine should have known access could end. WP Engine says it will oppose that motion on all counts. The judge or a jury may yet accept either side's arguments.

The record separates a registration from a mandate

What the case has already established is smaller than either side's rhetoric, and more useful to anyone who depends on a shared name.

A domain registration answers one question: who controls this name. It does not answer who speaks for a project, who holds its marks, or what its users may expect. In WordPress, those answers point to different places, and the domain was the hardest to see. Public registration data does not name the holder today. The suffix proves nothing. Litigation produced the sworn statement.

The practical power came from the combination. A license let anyone copy the code. A hostname in that code sent every copy to one place for updates by default. That is this writer's reading of the record, not a finding of the court, but the sequence is documented. An open license and a single point of distribution can coexist for years, until a dispute shows which one carries the weight.

Some contributors tried to change that structure. FAIR, a Linux Foundation-backed project launched in June 2025, set out to build a decentralized alternative to WordPress.org's plugin infrastructure. Its leaders stepped away in February 2026 after failing to win funding from hosts. "If the ecosystem won't fund neutrality, neutrality won't materialize," they wrote.

The name still carries its registration date of March 28, 2003. A jury may decide what its holder owed the people who built on it. The public registry record shows a registrar, a date, and no registrant.

Sources and further reading

Court record

• U.S. District Court, N.D. Cal. — WPEngine, Inc. v. Automattic Inc., No. 4:24-cv-06917-AMO, docket. Entries through November 3, 2026. Checked 2026-11-03.
• Order re Motion for Preliminary Injunction, Dkt. 64, December 10, 2024. Background at pp. 1–15; merits at pp. 28–31; bond at pp. 39–40; relief at pp. 41–42. Checked 2026-11-03.
• Declaration of Matthew Charles Mullenweg, Dkt. 39, October 30, 2024. Ownership at ¶¶ 2 and 5; trademarks at ¶¶ 36–37; checkbox at ¶ 40. Checked 2026-11-03.
• Order re Motion to Dismiss, Dkt. 169, September 12, 2025. Extortion at p. 13; promissory estoppel at p. 24. Checked 2026-11-03.
• Order re Motions to Dismiss, Dkt. 410, September 24, 2026. Antitrust at pp. 2–7, with the Ninth Circuit decision at pp. 3–4; extortion at pp. 8–10; standing at p. 16. Checked 2026-11-03.
• Defendants' pre-filing letter on summary judgment, Dkt. 441, October 27, 2026, pp. 1–2. WP Engine's response is Dkt. 447. Checked 2026-11-03.

Registration data and code

• Public Interest Registry — RDAP record for wordpress.org. Registration, expiry, and registrar fields. Checked 2026-11-03.
• Public Interest Registry — .ORG FAQ. Checked 2026-11-03.
• WordPress source mirror — wp-includes/update.php, line 464. Checked 2026-11-03.

Statements by the parties

• Matt Mullenweg, WordPress.org News — WP Engine is banned from WordPress.org, September 25, 2024. Checked 2026-11-03.
• Matt Mullenweg, WordPress.org News — Holiday Break, December 20, 2024. Checked 2026-11-03.
• Matt Mullenweg — A New Home for the WordPress Trademark, September 9, 2010. Checked 2026-11-03.

Reporting

• The Repository — WP Engine v. Automattic, Two Years On, October 2, 2026. The publication discloses that WP Engine and Automattic-owned Pressable are sponsors. Checked 2026-11-03.
• The Repository — Automattic's New Lawyers Lose Bid for More Time, October 16, 2026. Checked 2026-11-03.
• The Repository — WP Engine Accuses Automattic and Matt Mullenweg of Concealing Control of WordPress.org, October 7, 2025. Checked 2026-11-03.
• WP Tavern — Automattic and Matt Mullenweg Push for Dismissal of Key Claims, November 1, 2024. Checked 2026-11-03.
• TechCrunch — WP Engine files an injunction to get its WordPress.org access back, October 18, 2024. Checked 2026-11-03.
• Engadget — WP Engine wins preliminary injunction in WordPress legal battle, December 11, 2024. Checked 2026-11-03.