--- title: WordPress Forks ACF Plugin to Secure Custom Fields Amid... description: WordPress.org has forked the popular Advanced Custom Fields (ACF) plugin into Secure Custom Fields (SCF) amid a legal dispute involving WP Engine and... canonical: https://daily.dev/posts/wordpress-forks-acf-plugin-to-secure-custom-fields-amid-controversy-kffdcybzy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: WordPress Forks ACF Plugin to Secure Custom Fields Amid Controversy | daily.dev og:description: WordPress.org has forked the popular Advanced Custom Fields (ACF) plugin into Secure Custom Fields (SCF) amid a legal dispute involving WP Engine and... og:url: https://daily.dev/posts/wordpress-forks-acf-plugin-to-secure-custom-fields-amid-controversy-kffdcybzy og:image: https://api.daily.dev/og/posts/KFfdcYBZy.png og:image:alt: WordPress Forks ACF Plugin to Secure Custom Fields Amid Controversy og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # WordPress Forks ACF Plugin to Secure Custom Fields Amid Controversy **[Collections](https://daily.dev/sources/collections)** · 3 min read · 4 upvotes · 2 comments ## Summary WordPress.org has forked the popular Advanced Custom Fields (ACF) plugin into Secure Custom Fields (SCF) amid a legal dispute involving WP Engine and Automattic. This unprecedented move, announced by Matt Mullenweg to address security issues and remove commercial upsells, has sparked significant controversy and ethical debates within the WordPress community. WP Engine criticized the decision, highlighting its potential to undermine open-source principles and trust. Users are advised to follow official guidelines to manage the changes effectively. ## Content # WordPress Forks ACF Plugin Amid Controversy with WP Engine WordPress.org has recently taken control of the popular Advanced Custom Fields (ACF) plugin, replacing it with a forked version called Secure Custom Fields (SCF). This move came without prior explanation, following a legal dispute involving WP Engine and Automattic, the company behind WordPress. The decision has led to significant controversy and sparked debates within the WordPress community regarding the governance of open-source projects. ## Background and Reasons for the Fork The forking of ACF into Secure Custom Fields was announced by Matt Mullenweg, co-founder of WordPress. According to Mullenweg, the main reasons behind this intervention were to address a security issue and remove commercial upsells from the plugin. WordPress.org cited public safety guidelines as the basis for this decision. However, this proactive measure raised eyebrows because it is unusual for WordPress to take over a plugin without the creator's consent. ## Impact on Users and WP Engine WP Engine, which currently manages ACF, has criticized the move, arguing that it undermines the open-source principles that WordPress advocates. They noted that actions of this nature have never been taken before in the history of the WordPress plugin directory. WP Engine also reassured their users that the fork does not impact their other services or ACF PRO customers. For users of the free version of ACF, the company advises downloading version 6.3.8 directly from the official website to ensure they receive genuine updates. ## Industry Reactions and Ethical Concerns The move has raised ethical debates within the WordPress community. Critics argue that such unilateral actions could undermine the trust developers and users place in the WordPress plugin repository. Some have expressed concerns about the potential security risks posed by using SCF, which lacks the backing of the original ACF development team. WP Engine pointed out that the takeover of ACF sets a troubling precedent, potentially causing distrust among users towards plugins available on WordPress.org. Meanwhile, the WordPress.org team maintains that their actions are justified under their public safety and plugin directory guidelines. ## Guidance for ACF Users Users affected by the removal of ACF from the WordPress.org repository are advised to follow the official instructions provided by the ACF team for reverting the updates and securing their websites. Ensuring awareness and vigilance remains crucial for WordPress users and developers navigating these changes. While the forked SCF plugin aims to address security issues and commercial upsells, the broader community continues to wrestle with the implications of such an unprecedented intervention in the open-source ecosystem. ## Community discussion Top comments from developers on daily.dev. **@buttered\_toast** · 1 upvotes > Let's not forget they still use the same slug and all the meta data from ACF. > >  **@luckvcharms** · 0 upvotes > A large group that holds a vested interest in slapping their brand on everything that makes them look good, regardless of whether or not it's theirs, taking advantage of a loud and raucous issue to "fork" a widely used tool and showcase it as their own? > > Sounds like par for the course. ## Similar posts on daily.dev - [Governing Security in the Age of Infinite Signal](https://daily.dev/posts/governing-security-in-the-age-of-infinite-signal-qhihbir44) · Snyk · 0 upvotes · 0 comments - [No one has a good plan for how AI companies should work with the government](https://daily.dev/posts/no-one-has-a-good-plan-for-how-ai-companies-should-work-with-the-government-nkajqoze1) · TechCrunch · 0 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#webdev](https://daily.dev/tags/webdev), [#open-source](https://daily.dev/tags/open-source), [#wordpress](https://daily.dev/tags/wordpress) [View this post on daily.dev](https://daily.dev/posts/wordpress-forks-acf-plugin-to-secure-custom-fields-amid-controversy-kffdcybzy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"WordPress Forks ACF Plugin to Secure Custom Fields Amid Controversy","url":"https://daily.dev/posts/wordpress-forks-acf-plugin-to-secure-custom-fields-amid-controversy-kffdcybzy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/wordpress-forks-acf-plugin-to-secure-custom-fields-amid-controversy-kffdcybzy"},"datePublished":"2024-10-13T18:00:57.736Z","dateModified":"2024-10-14T10:21:38.035Z","description":"WordPress.org has forked the popular Advanced Custom Fields (ACF) plugin into Secure Custom Fields (SCF) amid a legal dispute involving WP Engine and...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/22b9d344315f144aaf54467192d080de?_a=AQAEuiZ","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/22b9d344315f144aaf54467192d080de?_a=AQAEuiZ","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":2,"discussionUrl":"https://daily.dev/posts/wordpress-forks-acf-plugin-to-secure-custom-fields-amid-controversy-kffdcybzy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":4},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":2}],"keywords":"security,webdev,open-source,wordpress","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"WordPress Forks ACF Plugin to Secure Custom Fields Amid Controversy"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/wordpress-forks-acf-plugin-to-secure-custom-fields-amid-controversy-kffdcybzy","comment":[{"@type":"Comment","text":"Let’s not forget they still use the same slug and all the meta data from ACF.","datePublished":"2024-10-14T08:01:46.587Z","dateModified":"2024-10-14T08:02:22.574Z","url":"https://daily.dev/posts/KFfdcYBZy#c-NQVbuAiJE","author":{"@type":"Person","name":"buttered_toast","url":"https://daily.dev/buttered_toast","image":"https://media.daily.dev/image/upload/s--cy7P3Lij--/f_auto/v1728887283/avatars/avatar_bm2YlqIhE29cS7Ujr1VQH"},"interactionStatistic":{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1}},{"@type":"Comment","text":"A large group that holds a vested interest in slapping their brand on everything that makes them look good, regardless of whether or not it’s theirs, taking advantage of a loud and raucous issue to “fork” a widely used tool and showcase it as their own?\nSounds like par for the course.","datePublished":"2024-11-12T14:48:00.624Z","url":"https://daily.dev/posts/KFfdcYBZy#c-heLWdsvSP","author":{"@type":"Person","name":"Vincent Knisley","url":"https://daily.dev/luckvcharms","image":"https://avatars0.githubusercontent.com/u/30909301?v=4"}}]} ```