[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress. The people, the events, the plugins, the blocks, the themes, and in this case, building trust and collaboration in the hosting industry with the Secure Hosting Alliance.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you, and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox, and use the form there.

So on the podcast today, we have David Snead. David has been involved in the hosting industry since 1999, starting out as legal counsel for one of the earliest shared hosting companies, and going on to work with over 50 others. He helped found the i2Coalition, serve as in-house counsel for cPanel and WebPros, and now leads the Secure Hosting Alliance.

If you’re listening to this podcast, I’m sure that many of you will have worked closely with hosting companies. Perhaps you run an agency, or business, that depends on the reliability, ethics, and security of hosting providers. David is here to talk about cross-industry collaboration in the hosting world, specifically around improving security, professionalism, and communication between hosts.

The conversation focused on why, and how, the Internet Infrastructure Forum, or IIF, is building a framework for real-time intelligence sharing and abuse reporting, aiming to help the entire ecosystem detect and prevent attacks faster than adversaries can adapt.

David talks about the challenges hosting companies face, especially smaller ones, in keeping up with security, and how this evolving project hopes to ease this by sharing actionable, non-proprietary abuse information across registrars, hosting providers, DNS services, and more.

He discusses the growth of both the Secure Hosting Alliance and the IIF, the business case for collaboration, and the nuances of legal and technical information sharing across borders.

If you’re in hosting, run a web agency, or just want to know how the backbone of the web is working to stay more secure and connected, this episode is for you.

If you’re interested in finding out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so, without further delay, I bring you David Snead.

I am joined on the podcast by David Snead. Hello David.

[00:03:20] David Snead: Hello.

[00:03:21] Nathan Wrigley: Very nice to have you with us. David’s got a really interesting background, and a really interesting, I’m going to use the word project. I don’t know if that’s the right word. It feels like it’s got more solidity and it’s got a lot more history than that. It’s something which is, I think going, but we’ll find out a little bit more about it. It’s all about the hosting industry and trying to get hosts to, I guess communicate with each other in ways going forwards.

[00:03:44] David Snead: That is a part of it. There are really two goals and one is to level up the ethics and professionalism in the hosting industry. And the second is to facilitate more comradery and interaction among hosts. Something that folks felt occurred in the early 2000s, and with all the consolidation that occurred went away. And so that’s something that we’re also trying to facilitate.

[00:04:16] Nathan Wrigley: Okay. So given that we’re going to be talking about hosting, I guess it’s a good idea to paint your credentials and find out a little bit more about you. So a short opportunity to just tell us a little about you and your background in WordPress and hosting specifically, I suppose.

[00:04:29] David Snead: Sure. So I have been working in the hosting industry since 1999. As I often say, I was working in the hosting industry when hosting was cool. It is not so cool anymore. In fact most people don’t really pay attention to it.

You know, and I started as a lawyer for a hosting company, and I was in-house counsel for a company that actually owned a hosting company and was one of the earliest hosting companies that specialised in shared hosting. And so I was their general counsel. And for some reason it stuck, and I’ve just kind of turned it into a career.

So after that I had a private practise as a lawyer and I worked with probably 50 different hosting companies, mostly writing policies that nobody ever reads, which makes me super fun at parties.

And then from there, my friend Christian Dawson and I formed the i2Coalition as a response to some legislation in the US that would’ve been kind of the death nail for internet providers. So we started the i2Coalition. I then went in-house for cPanel and worked at cPanel and WebPros for 10 years, and then started the Secure Hosting Alliance.

[00:05:52] Nathan Wrigley: Okay. So you’ve got all all the history. That’s pretty good. You know, if we’re going to talk about hosting.

[00:05:57] David Snead: All the hosting history in one person. That’s kind of a very scary idea, no?

[00:06:02] Nathan Wrigley: But that’s excellent. So do you still offer counsel? Is that still, so you haven’t sort of sidestepped and do half of the week on a sort of more technical basis? It’s still the legal side that you’re involved in.

[00:06:13] David Snead: I do. Right now I’m doing mostly M&A work for, it’s weird. So I don’t know if anybody has ever said this to you before, but web hosting is kind of like the Hotel California. It’s like, once you start in the web hosting industry, you never leave. And so I have all these clients from 15 years ago who are now running like little baby hosts, and they’re talking to bigger hosts and they want to get acquired. So I’m doing some of that now. I am not writing any of the policies that nobody ever reads because that was just, I did that for too long.

[00:06:51] Nathan Wrigley: There were too many moments parties.

[00:06:53] David Snead: Yes, exactly. Yeah.

[00:06:55] Nathan Wrigley: Okay, so I’m going to read into the record the title and the blurb that went with the presentation that you are doing or done.

[00:07:02] David Snead: I did it yesterday.

[00:07:03] Nathan Wrigley: Okay, we’ll get into that in a moment. So the title is coordinating the fight, cross industry collaboration, and the blurb goes as follows. WordPress hosting threats cross company lines. When one provider falls victim, the entire ecosystem suffers. This session explores how the Internet Infrastructure Forum, or IFF, enables hosting providers, registrars and registries to coordinate abuse response through real time intelligence sharing. Learn how operational collaboration helps responsible operators detect and stop attacks faster than adversaries can adapt. And why working together produces results no single provider could achieve alone.

When I read that, immediately was, yeah, that’s a really sensible idea. Why are we separately, as hosting companies, I say we, I mean the hosting companies. Why are they all trying to do the same work over and over again, separately? When presumably this aspect of the work, the security bit is something they all have in common.

[00:08:05] David Snead: Right? So that’s the fundamental question, right? So the IIF is a voluntary organisation that is made up of everyone in the infrastructure stack. So from registrars, registries, DNS providers, hosting providers, cloud providers, everyone in the stack. So it is facilitated by the Internet and Jurisdiction Foundation. They’re based in Paris, and they’re the actually the secretariat for it.

And what it’s designed to do is create a common way for everyone who’s in the infrastructure stack to share information about abuse and abuse issues. And it’s one of the fundamental problems that you referred to is everybody is operating in a silo, right? And that’s mostly because that’s the way the internet is architected, right?

So the internet is architected, so it’s distributed, right? Registrars and registries basically do their own thing with domain names. They might have a small hosting component or maybe a cloud component, but by and large, all they do is domain names.

Hosting providers probably resell domain names, but they’re not part of that industry. And so how do they all coordinate? And that’s what the IIF is trying to facilitate, is more information sharing among the participants.

[00:09:39] Nathan Wrigley: Well I imagine some of the hosting companies are probably fairly good. You know, they’ve got a giant customer base. Let’s imagine hosting company X over there, they’ve got millions of customers. They’ve got a huge budget that they can put over to, let’s say, security things. Well that’s all well and good, brilliant. But then there are other companies who are much scrappier. You know, they maybe have only a few thousand customers. And so their budget for the exact same work is going to be reduced.

How will this work? Is it going to be like a subscription service basically? Will you have a membership, which is in some way equal to the number of clients that you’ve got? Will there be some expectation that, okay, we’ll look at your revenue, your membership will be equivalent to a percentage of your revenue? How will that all work?

[00:10:20] David Snead: We don’t know. This is a very early stage project. Right now we are in a prototype phase where we have just figured out what information folks should submit to the secretariat.

So the way it works is, you submit the information that you collect for a particular abuse issue to the secretariat, who then enriches it with all the other information that’s been submitted and sends it to the right person.

So a great example is, let’s say a registrar reported a phishing domain. They turn off the phishing domain and they have maybe a timestamp, an IP address where it was submitted from. They submit that to the secretariat, who then finds the hosting company who is providing the services for the hosting and says, this came in about this particular site. Can you take action on that? So that’s the way it works.

Right now it’s very early stage. It’s in the first phase of a test, and we’re going to look at whether the way we’ve architected it, or the way the group has architected it, actually makes sense.

[00:11:39] Nathan Wrigley: Is this going to be then a sort of slow on ramp whereby you bring a few companies in at the beginning, hopefully. And then one or two more and iron out the wrinkles, and then some more and some more? Because I imagine, if you just threw the switch, everybody’s in, a lot could go wrong at that point. And I’m guessing there’s going to be more of a slow on ramp.

[00:12:00] David Snead: So you’ve pointed out my particular frustration with the IIF, and the reason that the secretariat is moving slowly, right? So fortunately, or unfortunately, based on my cultural background, I’m just sitting here going, this needs to move faster. We need to have everybody involved, we need to have all the hosts involved, we need to have all the registrars and registries. And other folks who are a little bit more skilled in this type of work say, no, we need to figure out what we’re doing and that requires a small number of people.

The phase that we’re in right now is looking for more folks who are interested in sitting at the table and being part of the discussion. Particularly in the hosting industry and in the web design and marketing industry. Those are folks who don’t generally participate in these kind of industry led collaboration exercises. And that’s the reason that I’m at WordCamp, is to talk to web designers, marketing agencies about why they should participate in something like this.

[00:13:13] Nathan Wrigley: So this really isn’t bound in any way to WordPress, is it? It just so happens that WordPress has a significant chunk of the internet, so this is a good place to start. But if you happen to be a, I don’t know, Drupal user, or you’re just into writing PHP code or whatever it may be, this is still applicable. There’s no real WordPress layer to this. This is just a good place for you to come because, well, there’s probably, what, 30 hosts, 100 yards away from us out there.

[00:13:37] David Snead: I know. And I haven’t seen all of them yet.

[00:13:39] Nathan Wrigley: Yeah, there’s work to do. But agnostic to any platform, basically.

[00:13:42] David Snead: It is completely platform agnostic, yeah.

[00:13:43] Nathan Wrigley: Okay. Okay, that’s interesting. But WordPress is a, is certainly a good place to start.

Now, I’m imagining, if I was a hosting company and I was the chief executive, I definitely have some questions for you in terms of, okay, we’re going to share our valuable intel with you, what are you going to do with that? How can we trust you? How do we know that the sharing is going to be done effectively and what have you?

So I guess really what I’m getting to is, what is the assurances or checks and balances that you, in the end, will hope to offer the host? That you can assure them that, look, if you hand us this body of work, you don’t need to think about it again. You can trust us to do it honourably, effectively, collaboratively. You get where going.

[00:14:26] David Snead: Yeah, yeah. And I suspect that you wanted to be a lawyer at some time, because that’s one of the issues that we’re facing. Information that can be shared freely, as an example, in the United States, might not be capable of being shared so freely in the European Union, or in Brazil, or in India or someplace like that.

So one of the things that’s being done, not by me, but by another group, another working group that’s part of this, is analysing the legal issues around information sharing.

The information that’s being shared, to answer the proprietary and confidentiality question, is not proprietary or confidential information. So it’s things like timestamps, domain names, IP addresses for the initial abuse submission. Things like that that really don’t indicate some sort of company confidential information. And it’s further abstracted into xarf, which is a language that’s used for abuse reporting, that we all can share. And so I think that the only thing that would be of concern is whether that information is personal information that’s subject to jurisdictional restrictions around the world.

[00:15:48] Nathan Wrigley: Would the idea be that this organisation would do the remedial work? So is there any notion that, let’s say for example, some sort of security problem was discovered by hosting company A over there, and they share that intel with you. Maybe the question is kind of asking, will you then appoint people to figure out what the patch is for that? Or is your idea just to, oh, red flag, we’ve got this problem, now you all know about it. Is it just information sharing as opposed to fixes?

[00:16:17] David Snead: Yeah, it’s the latter. So the thing that we’re solving for right now, so there’s just one issue that, one abuse issue, that we’re testing out and it’s issues related to fake shops. And so the fake shop issue is the test abuse issue for the project, and where folks are sharing information. It’s a particular problem right now with credentials harvesting. And so that’s what we’re trying to look at.

[00:16:43] Nathan Wrigley: And how has the conversations that you’ve had thus far, how have they gone? Has this been warmly received or are you facing a little bit of pushback?

[00:16:50] David Snead: So, look, I’ll be very direct with you. If something isn’t just an immediate threat to them, it’s very difficult to conceptualise why you should participate. And I am pretty used to answering that question simply based on the political work that I do with the i2Coalition. But once you talk about, so let’s use fake shops as an example. Fake shops, and you’re providing services to fake shops, actually has an impact on your bottom line.

So if you are providing, let’s say, payment processing to an entity that is running a fake shop, it very easily can make your credit card processing charges higher. It ends up eating bandwidth. It will tax your abuse resources.

One of the things that you referred to initially is, you know, larger hosts have a lot of money. I wouldn’t say they have a lot of money, but they have more bandwidth to handle a vast fire hose of abuse issues. Most smaller hosting companies might only get five or six abuse issues in a month. But if you have a fake shop, that’s going to generate a huge amount of abuse, and it’s taking away resources that you can use to actually grow your business. So that argument actually is relatively persuasive in getting folks to pay attention.

I find that the business argument around abuse is a much more compelling discussion than kind of moral persuasion. I don’t think moral persuasion works in the context of a community that is trying very hard just to keep their heads above water.

[00:18:42] Nathan Wrigley: It feels to me from what you’ve just said, and I could be reading too much between the lines, but it feels to me as if a good target audience would be smaller hosts to begin with, simply because they’re probably going to be more receptive because they have less bandwidth themselves. And so would welcome anything that can make the burden of sharing this information easier. So 10 of the small hosts combined is, well, it’s much bigger than each of them individually would be, whereas I suppose you’ll have to get a critical mass of them on board until maybe some of the bigger hosts start to look at you with favourable eyes, let’s say that.

[00:19:15] David Snead: Well, so we have some pretty large hosting companies who are participating. So as an example, both GoDaddy and Newfold are participating. But we also have smaller hosts. But I agree with you, the information that’s being provided, particularly since it is actionable, realistic information that can be adapted for bespoke systems, is invaluable, right?

So if you only get five or six abuse complaints and you get an abuse complaint, and you can go to the secretariat and say, we got a complaint about this domain, and the secretariat says, here’s what the registrar did. Here’s what Cloudflare did. Here’s the information they provided us. And you can use that to make a decision on how to address that problem. It saved you hours and hours and hours of research time.

[00:20:09] Nathan Wrigley: Technically speaking, what would the conduit of information both toward you and away from you look like? So if I’m hosting company X, how are you imagining that I will supply you with that information? But also, if I’m just looking for information from you on a daily, weekly basis, whatever it may be, how do I receive that? Is this like a, I don’t know, a website or an API or?

[00:20:33] David Snead: It’s an API. So it’s a file. It’s just a general file download.

[00:20:37] Nathan Wrigley: Right, okay. So it’s readily available 24/7?

[00:20:40] David Snead: Right. That’s the goal. Right now it’s not, but the goal is to kind of figure out a way to make something like that possible.

[00:20:47] Nathan Wrigley: Yeah, okay. I also suppose that the hosting companies, whilst this is good for their business if they can minimise costs and hand a lot of this work over to you, there’s a part of them which would also probably like to put some sort of badge on their website to say, this is what we’re doing. We’re part of this alliance, for want of a better word. Is that something that you are looking to develop as well, you know, some sort of credentialing system to demonstrate that you’re in this?

[00:21:12] David Snead: So that’s not something that the IIF is working on. It’s something that the Secure Hosting Alliance does. The Secure Hosting Alliance has a trust seal that we give to hosts who fulfil our Trust Seal Certification provisions. But that’s not something that the IIF does.

Talking about like why, other than business reasons, folks should participate in this, one of the things that is going on that I would suggest that most hosts know about, is there’s a little bit of a moral panic going on in the world about what contents you have. And regulation is actually a very real thing for the hosting industry, who has not ever been regulated. This is the time where you can say, hey, this is what we’re doing, right? We’re dealing with issues. This way a trust seal is the same thing, right? It’s something that you can say, we are actually taking steps to make the internet a better place.

[00:22:18] Nathan Wrigley: I think if you are a general agency owner or, I don’t know, just a freelancer, hosting is one of those things that you, once you’ve done it once, you’re in it for the long haul until something goes wrong. But you’re also browsing around for any tiny indication of why is this host slightly different? You know, what is it that they’re doing that, I don’t know, is faster? What is it that they’re doing that’s more secure? So it feels to me if you had a credentialing system and I began to hear about it and see it pop up again and again, it would be one of the metrics which I would weigh up when looking at hosting.

[00:22:51] David Snead: I would think so. One of the things that a trust seal does is it indicates that there’s been some vetting of the host. That someone has determined the things that are important to the hosting industry and are important to the web design industry. The agency industry are also important to the host.

Great example of that is one of the provisions of the Secure Hosting Alliances’ Trust Seal Certification is that a contract is presented to the customer before they sign up, which is super customer friendly.

One of the things as a lawyer that you hear about all the time when people are dissatisfied with their services is, yeah, well, I never saw that contract. Or it was just a hyperlink in an email that I got. That’s one of the differentiators for a Trust Seal certified host is that the contract is actually presented to them, to the customer beforehand.

[00:23:57] Nathan Wrigley: So in terms of the WordPress crowd, is this a thing that you are pitching only to hosts? Like when you step out of here, are you trying to have conversations only with hosts? Or is there some bit of the WordPress community, the freelance, the agency owners? Are you trying to communicate with them just to scope out what they need?

[00:24:15] David Snead: So for both the Secure Hosting Alliance and for the IIF, it is that. I really enjoy talking to agencies and developers about whether this is important to them, or why it might be important to them.

[00:24:31] Nathan Wrigley: In terms of how long this project’s been going, I’ve only heard of it because of your participation here, but I don’t know if you’ve been banging this gong for a decade or, I mean you’ve been in the industry for long enough to have been banging it for decades. Is this a new initiative or is this something which has a long and storied history?

[00:24:49] David Snead: So the Secure Hosting Alliance has only been active for a year, a little bit over a year. I’ve been talking about abuse for a long time, but the Secure Hosting Alliance has only been around for a year.

[00:25:01] Nathan Wrigley: And have you, in that year, got any intuitions that you’ll be here for another year? Is it basically going in the right direction?

[00:25:09] David Snead: It is going in the right direction. So we started out with two or three charter members. We now have 25 hosting members. We have three security vendors who are members as well. We have, I think, 17 Trust Seal Certified members, and we’re launching in 2027 a trust seal for security vendors who provide services to hosting companies.

[00:25:40] Nathan Wrigley: I know that several owners of hosting companies listen to this podcast. They may very well be the people that you’ve spoken to already, but if they are not, and they are people who would like to investigate this further, I suppose the thing that’s going to be in their head is, okay, Nathan and David, you’ve explained what I’ll get out of it, what do I need to put into it? So is this an annual financial commitment? How does it all work from that point of view?

[00:26:02] David Snead: Yeah, so you become a member of the i2Coalition. And so the Secure Hosting Alliance is a working group of the i2Coalition. So you would be a general member and you would participate in the Secure Hosting Alliances’ working groups. You also have the ability to participate in the i2Coalition as a whole, which is a much larger trade association that represents almost everyone in the internet infrastructure vertical. Mostly doing policy work, primarily in the US and the EU. Although there’s, we’re doing some work in India right now as well.

[00:26:40] Nathan Wrigley: And does membership allow you to steer the future of the project? I know that lots of chefs in the kitchen results in terrible food, but that, I fear, is something that could happen. You’ve got 87 members, 260 members. And then the 260 members all start to bicker and, you know, we want this, no. You see how it goes.

[00:26:59] David Snead: I do.

[00:26:59] Nathan Wrigley: What’s the position there? You know, is there sort of gated levels of membership? How are you organising all of that?

[00:27:04] David Snead: There are not. The membership is based on self-reported revenue. The membership is not horrifically expensive from my perspective. And I think that that, most of our members would say that it is, it’s actually relatively affordable, particularly for the small to medium sized hosts. And registrars or design agencies, anyone who’s participating.

The question about, who’s running the show, comes up quite a bit. We haven’t really faced that issue, particularly in the Secure Hosting Alliance. Folks seem to get along. But the organisation runs on the idea of rough consensus. And so decisions end up not being controlled by one member or not. Some of the i2Coalition has some very large companies who everybody knows about, who get along with startups, and folks against whom they compete directly. And policies still get made. The organisation still moves forward.

[00:28:11] Nathan Wrigley: Yeah, I guess you’re in a space where, obviously all of these hosting companies commercially are vying for everybody else’s business. But in this particular situation, that is not the case. Nobody’s vying for their websites to be less secure. They all want the same level of security. So at least in that sense, you would hope that consensus could be maintained even if, commercially, the two companies that are in the room, the 10 companies that are in the room might be commercially at loggerheads with each other. At least on this they could agree. That would be the hope, I suppose, anyway.

[00:28:47] David Snead: It seems to be, not only the hope, but the actual way that things work. You ask about how compromise is reached. What comes to mind is I have a much different concept of privacy than, particularly when I was at WebPros, than other folks in the i2Coalition had. And another company just called me up and we worked through our disagreements about how privacy should be handled within the i2Coalition and were able to move forward.

The industry I’ve found to be hugely collaborative, particularly the hosting industry. Everybody knows what their competitor is doing. But when it comes to addressing an issue like, how are we going to deal with abuse as a community? Folks come together. CEOs of hosting companies while they compete tend to be relatively good friends.

As I said at the very beginning, it really is like the Hotel California, right? You come in as a CEO of a hosting company, you grow it and you sell it to another company. All of a sudden you’re at the bottom again with a server in your grandma’s basement, you know, trying to start again.

[00:30:08] Nathan Wrigley: It’s a really curious effort. I suppose really at the bottom of this entire podcast is your endeavour to be heard and to reach out and get some conversations going. So with that in mind, where do people find the information about this? So maybe there’s a website that we could mention. But also, is there a specific place where you hang out? Is there a place where you would like to be contacted most?

[00:30:33] David Snead: Sure. So our website is hostingsecurity.net. I’m not too afraid of getting too much spam. So folks can email me at snead@i2coalition.com And the two is the numeral two. So it’s snead@i2coalition.com. And I’m happy to answer questions.

In terms of hanging out, I am at most industry conferences in the hosting industry. In the WordPress industry, I’ll be at WordCamp US. We also participate very heavily in ICANN. So there is an i2Coalition member at every single ICANN meeting.

[00:31:12] Nathan Wrigley: So if you go to wptavern.com and you search for the episode with David Snead, S-N-E-A-D, you’ll be able to find those details. I’ll put everything into the show notes. So anything that I missed? Was there a particular focus that we didn’t touch?

[00:31:26] David Snead: No, this is actually one of the most thorough podcasts I’ve been on recently.

[00:31:31] Nathan Wrigley: That’s love to hear it. Well, David Snead, thank you very much for joining me today.

[00:31:35] David Snead: Glad to be here. Thanks for having me.

[00:00:19] Nathan Wrigley: Welcome to the Jukebox Podcast from WP Tavern. My name is Nathan Wrigley.

Jukebox is a podcast which is dedicated to all things WordPress, the people, the events, the plugins, the blocks, the themes, and in this case how WordPress Credits bridges education and industry in the WordPress ecosystem.

If you’d like to subscribe to the podcast, you can do that by searching for WP Tavern in your podcast player of choice, or by going to wptavern.com/feed/podcast, and you can copy that URL into most podcast players.

If you have a topic that you’d like us to feature on the podcast, I’m keen to hear from you and hopefully get you, or your idea, featured on the show. Head to wptavern.com/contact/jukebox and use the form there.

So on the podcast today we have Ivana Ćirković. Ivana is a digital marketer with 18 years of experience working both in and out of the tech industry, and currently leads marketing at WPBakery. She’s an active participant in WordPress events, having attended, and spoken at, numerous local and international word camps over the years.

In this episode, our focus is on the WordPress Credits initiative. We learn how this program, launched by the WordPress Foundation, connects students with real world opportunities to contribute to the WordPress ecosystem, earn certifications, and increase their competitiveness in the job market.

Ivana discusses her own experience as a WP Credits mentor, working with students as they learn about digital marketing, remote work, and other open source contributions. We explore, how universities can modernise their curriculums, and real world value for students by participating in the initiative, and how businesses can get involved, not just to support the community, but to help shape and discover future talent.

The program’s evolving structure also gets attention, and we learn how students are guided through hands-on activities such as translation or documentation, and how their progress is tracked publicly via profiles on wordpress.org. Ivana shares the opportunities and challenges for both educators and businesses with thoughts on accountability, mentorship, and the need to bring new faces into the WordPress community.

If you’re interested in the future of WordPress, education, or bridging the gap between academia and industry, this episode is for you.

If you’d like to find out more, you can find all of the links in the show notes by heading to wptavern.com/podcast, where you’ll find all the other episodes as well.

And so without further delay, I bring you Ivana Ćirković.

I am joined on the podcast by Ivana Ćirković. Did I get that right?

[00:03:14] Ivana Ćirković: Yes. Excellent.

[00:03:16] Nathan Wrigley: Thank you. This is my first interview at WordCamp Europe 2026. I’m guessing because we’re on the first day of the event and it’s quite early in the morning, it’s 10 in the morning, I’m guessing you cannot have done your presentation yet?

[00:03:30] Ivana Ćirković: Not yet. Tomorrow.

[00:03:32] Nathan Wrigley: Do you get nervous with these kind of things?

[00:03:34] Ivana Ćirković: I get nervous all the time. I’ve been doing this for 12 years, it never gets easier. It is what it is.

[00:03:39] Nathan Wrigley: Well, the presentation that you are doing is going to be the focus of what we’re talking about today. So do you just want to tell us a little bit about the topic that you’re talking about, but also just give us a bit of a general bio about who you are and what you do. So just tell us about you and about your presentation basically.

[00:03:56] Ivana Ćirković: Okay. First thing first, I would like to introduce my presentation, or the talk, that is build up around WordPress Credits initiative, which is something that WordPress has rolled out late last year in December. And I applied to be a mentor to support students into their entering into WordPress. Got accepted, did my courses, passed them and started working with students on their, first entering the WordPress society, how everything works, contributing.

And out of all of this, I came up with the idea of sharing the story about WordPress Credits. What it is, why it is important, not just for the WordPress community, but also for universities all around the world for businesses to support, because there is an angle and huge opportunity for them too. And hopefully inspire people to join and become part of it more.

As far as I’m concerned, my name is  Ivana Ćirković and I am a digital marketer for 18 years. I’ve been working inside tech organisations, tech industry, but also outside of it. So I’m the multiverse. And lately, for past couple of years, I’ve been working in WPBakery, in marketing their product, and talking to people, sharing knowledge of what we do, how we do it, and so on. In the meantime I am attending many, many WordCamps, local and international ones, giving lectures, giving talks about digital marketing and all things related.

[00:05:39] Nathan Wrigley: So are you here at this event, not just to give your presentation, are you also here on behalf of WPBakery to represent them and the products that they have as well?

[00:05:47] Ivana Ćirković: Yes, we are sponsors. I am speaker, I was table lead for marketing on Contributors Day. So we are wide into the ecosystem.

[00:05:56] Nathan Wrigley: I have to say, having only been in this event space for about an hour, I’m actually deeply impressed by this particular event. It really is a gigantic venue. It’s so pleasurable as well to see the WordPress community in such large numbers here. And so we’re looking forward to a really good event.

Okay, let’s kick off with the topic at hand then. So it occurs to me that many people listening, whilst they’re using WordPress and they’re kind of, I don’t know, they’re building websites for people, and they’ve got products and plugins and they’re just general users. It may be that the community piece, and the educational piece, is nothing that they’ve heard of before. So would you just tell us a little bit about what WP Credits is as far as you’re concerned, just to give us that broad background of what it is?

[00:06:40] Ivana Ćirković: Okay. So WP Credits program is initially made to bring new young people into the WordPress, to broaden the ecosystem with the new fresh blood, new contributors. And to do so, WordPress Foundation initiated this program to connect with universities all across the world. To connect students to some programs, to learn about WordPress through contribution. For that, they will get graded and get certification, which in the end will help them be more marketable, and have more modern knowledge of what is needed in today’s job market, and to be more competitive and more appealing to potential employers.

So by doing so, WordPress Credits aims to broaden the ecosystem, to strengthen the WordPress community, and WordPress itself. But also to put new generations in more marketable place, and to help them get more profitable jobs.

[00:07:45] Nathan Wrigley: Thank you. That was a really nice summary. In terms of your personal commitment to it and what have you, how did you fall into it as a thing that you were doing? And is this something that you get sponsored for from WPBakery, or is it personal and simply a sort of philanthropic thing that you are doing on the side?

[00:08:01] Ivana Ćirković: Yeah, so basically, I’ve been doing education my whole professional life. So it’s something that comes natural to me. In my local country, in Serbia, I do informal education for high schoolers and primary school’s children about digital marketing, digital literacy. This is like very natural to me. I’m being sponsored by WPBakery to do so.

And the program works like, initiative needs people, needs more mentors to get involved. More than it needs like product and businesses to support with their products. So if there are businesses who are maybe interested in support through their product, know that you need to put your people first to actually get involved and contribute, and then you can offer products as the side piece, so to say.

[00:08:52] Nathan Wrigley: So yeah, it seems that you’ve got a lifelong interest in education as well. Okay, that gives me some sort of hook there.

Okay, if I was to say WP Credits to the people outside, the people who already knew about it, I think would probably peg it as entirely educational in nature, just an education initiative. But curiously, your presentation, the notes that went with that and the blurb that went on the WordCamp Europe website, you kind of make the point that it’s much bigger than that, and you get into businesses and the students themselves and universities.

So the students in universities bit, well, that’s the education piece. But the business bit, what’s going on there? Because I definitely hadn’t drawn that intuition. I thought education from top to bottom. But business, okay, where does that fit in?

[00:09:37] Ivana Ćirković: I will get the hot insights from the talk. So basically, there is more than what meets the eye, so to speak. Businesses have unique opportunity to shape people they want to employ by getting involved as mentors. They also get the chance to see firsthand how those young minds work in real environments, in real contribution. And they get the chance to pick and choose who they want to employ by seeing them work on some real things. Whether it’s documentation, whether it’s translation or programming, developing something, AI.

We need more people who know what they do, although they are young. By having students in this program, they are working on not fictional things, but actual things that really contribute to community and businesses as a whole. By supporting this initiative, businesses then in relations to that can get more insights into who they want to employ. So on top of that, they are building the better market for themselves as well.

[00:10:42] Nathan Wrigley: I guess the student university piece is fairly obvious. You know, WP Credits and the people working on that project communicate with universities, they’re probably easy to find. You know, if you go to a phone directory for example, they’ll all be there. And it’s an easy thing to do. You phone up the university and see if there’s interest. And I know that some universities have taken up the WP Credits program. And it seems to be, as far as I can work out, it seems to be working very successfully.

How are you going to make the connection with businesses? Because that seems like a much more scattered, I don’t know if you’re going to be working with big businesses, you know, huge companies or if it’s going to be kind of more the businesses on the street, the smaller businesses, that kind of thing. So, I’ll just sort of hand it over at that point.

[00:11:23] Ivana Ćirković: So basically, web agencies, businesses around WordPress, we know they have an issue with new employees onboarding last, let’s say three to six months. That cost time and money and other people who are teaching them what needs to be done and how.

Then we have WordPress Credit students who are already doing that junior type of work within contribution. They’re already onboarded through using Slack, knowing how to do remote work, what needs to be done. So businesses supporting WordPress Credits initiative can choose those students and spend less time and money and energy in onboarding them because they already went through that by doing WordPress Credits program.

[00:12:10] Nathan Wrigley: Yeah, I guess if you are a small web agency, it’s highly likely that you won’t necessarily have an induction program finely tuned, so that the young people that are coming through have this sort of specialised system where they can get some accreditation. It’s probably more, okay, I’m going to assign you to John this week and then next week you’re going to go over to Susan and follow what they’re doing.

So is there a sort of structured program that, let’s say a web agency based in London could drop into and receive documentation about? Where are we at with that whole process for the busineses?

[00:12:44] Ivana Ćirković: Yeah, so since this initiative is still fairly new and we already have just one generation of students that are passed the program, this is something in development. So at the moment, we still don’t have like a specific structure that is based just for agencies and businesses in general, but it is something that we are considering and working towards too. So definitely.

On the other hand, the upper management organisational team might not be aware to the fullest what am I about to talk. So it might come as a surprise to them, but also it is something in the works as well. So give us some time and we will come up with something.

[00:13:26] Nathan Wrigley: Yeah, it feels like that would be something really credible. Because if you’re a small business owner, the last thing you want to be doing is kind of wasting time. And onboarding somebody might be something that you’d have to divert weeks into, you know, syphoning employees off, writing documentation, SOPs, those kind of things. And if you could just pick something up off the shelf that was tried and tested over many years, that would actually be really handy. So good luck. I hope that that initiative comes off.

In terms of students, if you were a student, let’s say you are at a university, or you are looking for work, what would you say would be some of the top line items that you would mention as to why WP Credits is worth looking at? Because, you know, if I’m at a university, there’s probably a thousand different things that I could be doing. WP Credits would be in competition with all of those. Why do you think it’s something that young people should be taking care of to look at?

[00:14:17] Ivana Ćirković: Yeah, I would think differently, in that sense. Universities curriculums are outdated comparing to the industry that we are living and working in. So WordPress Credits gives something that is in trend. That is happening now that people are using and working now. So students who choose to go to this program are gaining the most efficient and not outdated curriculum, and things that are being worked on in this moment.

And this is bigger than WordPress. It is initially for WordPress, but the knowledge students get, nobody can take that away. They learn to be outspoken. They learn to use all the necessary remote work tools that is applicable in all the industry.

So we are really encouraging them to be very marketable employees and people who have portfolios, whether they choose that category that brings them portfolio. That is very transparent throughout whatever they do. Because on wordpress.org, every contribution is noted. So they’re building their own business brand by doing WordPress Credits. And in that way they are more marketable and can get more business opportunities.

[00:15:42] Nathan Wrigley: I didn’t realise that the wordpress.org profile, is it the profile that you mean?

[00:15:47] Ivana Ćirković: Yes.

[00:15:47] Nathan Wrigley: Each time you participate in one of these credit programs, that will be a badge, for want of a better word, that you can display and it will be freely available for the public. And presumably that will be difficult to acquire. That’s the wrong word. What I mean is, it won’t be simple to acquire. You will genuinely have had to.

[00:16:07] Ivana Ćirković: Yes, you need to do the work. Let’s say students are interested in translation. So they go to Polyglots team and they get assigned to a mentor who is on weekly basis working with them on onboarding, helping them how to navigate through wordpress.org website, translation, what needs to be done. And basically, for that student, they need to translate to have approved translation, 150 strings approved.

So that doesn’t mean, okay, I will translate 150 words. No, no. You might need to translate 500 words out of which 150 is approved. And this is the bare minimum you need to do in order to get that badge that you contributed. Because that contribution, each contribution needs to be something very specific and tailored to help other people. That is very open and helpful.

[00:17:00] Nathan Wrigley: So you mentioned translations there, which obviously is just one of multiple things that you could do, and we could list them all out, but we won’t. How is that curriculum, I’m doing air quotes, how is that curriculum decided upon? In other words, how do you decide, okay, I’m going to do a bit of translation, I’m going to do a bit of work on Core, I’m going to work for the Plugin Review Team? How is that decided? And, how is it decided by the institution, I guess that that’s going to equal something which our university will stamp as part of your degree, let’s say?

[00:17:33] Ivana Ćirković: Yeah. So basically, that is all arranged between the foundation and universities. You won’t get IT students doing marketing if that’s not their preferable choice. So students opt in. They’re given the whole like curriculum, categories of things they can contribute to. And the one they choose, this is the one they stick to throughout all the programs.

So you cannot switch in between like translation and documentation, or plugins, or WP-CLI whatever. The whole program stick to one chosen category. And that is all aligned with the, let’s say, topic of university. So IT is preferable for IT related contributions. Communications are also more favourable towards translation community, marketing. So it’s aligned that way.

[00:18:23] Nathan Wrigley: So flipping that round, so we’ve been talking about it from the point of view of the students. Now let’s just flip it around to the point of view of the university. I guess the same thing applies. They would have to communicate with the Foundation and say, okay, these are the kind of things that we wish our students to do. These particular strands, we will, you know, if they do 500 translation strings, that will count as something. I guess there’s got to be some interface between the Foundation and each university to establish what a credit equals.

[00:18:50] Ivana Ćirković: Yeah, common ground as to how WordPress Credits adds to the official curriculum of the university. And the thing that university get out of it, they are in position to offer modern, in trend, teachings, and that makes them more appealing to next generation of students. Because the more their existing students who are in the WordPress Credits program are succeeding, the more desirable the university gets to newer generations because they don’t teach outdated curriculums. They’re aligning to what is now efficient and needed in the job market.

[00:19:30] Nathan Wrigley: I suppose also as well, when I was at university, there was a choice of about, I don’t know, four things to do each year. Something like that. You could do this or this or this. And you had to pick one of them and that was your pathway. This feels much more wide open because knowing the WordPress ecosystem, I know that there’s dozens, maybe multiple dozens of different things that you could be involved in.

So that’s quite appealing as well, isn’t it? You know, you can just take a little nibble of this one thing, and another nibble of this. And so there’s potentially multiple dozens of different pathways that you could pick. And whilst you say that, once you’ve decided you’ve got to stick to that, well, that’s fair enough, but the fact that you’ve got so many different ways that you could choose. That to me as a university student would’ve been really appealing. The fact that there’s so many different things that you could do.

[00:20:15] Ivana Ćirković: Yeah. And once they got in, the overall input that we get from students that, first they don’t know that something like this exists. And once they go deep and start work, it’s like, wow. The whole mind just shifts, and they are amazed by all the possibilities that they can do within WordPress that isn’t talked about.

[00:20:36] Nathan Wrigley: Yeah. And I presume they get to do it in the way that the WordPress community works, which is remotely distributed and when you wish to do it. So long as I, you make the end of the university period of whatever a semester is or something, so long as you make the deadline, you can do it at night or in the early morning or.

[00:20:57] Ivana Ćirković: Exactly. So they are training to be like workers as we all are today, that are not restrained with some deadlines or by official university rules. They’re accountable for the final output. How will they come to that output? It’s entirely up to them because, yes, they are young but they’re not so young that they cannot be held accountable for their actions. So they need to do the work. We got weekly mentorships and assessments. So it’s a fun ride.

[00:21:31] Nathan Wrigley: So just touching on that, the sort of ongoing support that every student needs, because with the best rule in the world, there’s a proportion of students who will leave everything to the last minute. I’m looking at myself in the mirror when I say that. So that ongoing support, it’s a weekly sort of huddle. And is that like a one-to-one thing or is it a one to many thing?

[00:21:50] Ivana Ćirković: Yeah, so depending on the number of students, if a mentor has a one or two students, it can be one-to-one. If there are more like five or six, it’s better to have a group meeting on a weekly basis, and then Slack chats in between if anything is more needed than that.

So basically we go through what they did last week, are there any setbacks or they need additional help, or do they need information from other parts of the team? Are they interested in something else? So we are really trying to get them involved in a way that matters to them.

One of the things that each student needs to do, no matter section they chose, is to create a blog and to have weekly blog posts. So we discuss about that. What interests them. Whether they want to be something personal like, or professional like. So it’s very interesting to see how they think and how they express themself and how they build their online persona.

[00:22:55] Nathan Wrigley: Do those huddles take place on a, let’s say university by university basis? So for example, when you join and you mentor students, are they from the entire WP Campus project, or are you doing it from the university of this town and the university of that town?

[00:23:13] Ivana Ćirković: No, it’s mixed and matched.

[00:23:14] Nathan Wrigley: So, okay, well that’s a real strength as well it feels, because presumably then you’re on a call with people potentially from all over the world. Certainly people that you may not have encountered before. And those sort of serendipitous chance encounters can sometimes be some of the more meaningful ones. You know, work comes out of those things, and meetups come out of those things, and unexpected things come out of those things. So that must be really nice as well, watching those kind of things happen.

[00:23:42] Ivana Ćirković: Yeah, it’s like nothing I experienced before. And just to have the privilege to talk and work with those people, you never know what can come up out of them, and out of our connections. And I get inspired every time we have chats and they make me want to be a better educator.

[00:24:03] Nathan Wrigley: Oh, that’s interesting.

[00:24:04] Ivana Ćirković: So, yeah, that’s my take out of all this.

[00:24:06] Nathan Wrigley: Yeah. Okay, so there’s actually some psychological benefit for you as well. You get a real nice feeling of it. Okay, that’s really good.

So with the best will in the world, a university, every year there’s a cohort of children, young adults, whatever it may be, whichever institution it is, and a proportion of them will work diligently and hard and they will succeed. And some others maybe not so much.

How does that work? How do you ensure that everybody gets through it? And I don’t know if there’s enough data to answer this question. Again, I’m doing air quotes, how is the pass rate? Do most people that embark on this get through the necessary things? Or is there a fair bit of, I don’t know, discipline, for want of a better word, that needs to be applied and cajoling people to get through it?

[00:24:46] Ivana Ćirković: Yeah, so I touched base on the accountability. So we have not strict rules, but recommendations. Weekly mentor chats, async communication through Slack. They all have weekly tasks that needed to be done. So if a student don’t answer the message or come to weekly mentor call three times, they are no longer WordPress Credit students. And that is the accountability.

You need to show yourself that you are willing to do the work. So if you don’t care, we won’t force you to do that if you don’t want to. We will set reminders, we will call back, we will reach out. But if you are no show, no tell anything for three times, then evidently you are not for that. You don’t wish to be there, and we won’t force you to be there.

[00:25:40] Nathan Wrigley: And then in some way, are you required then to report that back to the institution and sort of say, okay, we’ve reached the end of the road here, and then it’s for them to figure out how that impacts. And presumably the students can.

[00:25:53] Ivana Ćirković: Their grades, yeah.

[00:25:53] Nathan Wrigley: Yeah, their grades what have you, okay. Touching back on the sort of business side, because we’ve dwelled a lot with students and universities and we’re going to stay with students, because that’s really the underpinning of the whole thing. How has the business side of things, is it taking off? You were describing that it’s kind of like a new thing. Have you got any sort of success stories or anecdotal evidence that people do in fact want this?

[00:26:15] Ivana Ćirković: Yeah, so it’s still fairly new, so we don’t have those anecdotes yet. One of the reasons why I’m here at the WordCamp Europe is to find out and to get new perspective from businesses to like reach out to them to see what they think about the program. Would they want to be evolved. And how to give tips, maybe how we can improve. So stay tuned for more.

[00:26:38] Nathan Wrigley: Yeah. And it is interesting, when you walk around an event like this, I don’t have the exact numbers, but the demographic is definitely skewing older. There’s not so many 18 year olds. And if this community wishes to carry on, at some point the age demographic will get to retirement age.

[00:26:57] Ivana Ćirković: Yeah. Just last night we were talking. I’ve been in the community for 11 years. And for 11 years all the same faces are here. And we really need new faces. But to get new faces, WordPress Credits is one part of the solution. But then again, we need to meet young people where they are. And they are not on the conferences, they are not on websites, they don’t use websites, they don’t care about websites. They are on very specific social media channels. And if we want to get fresh, new, young blood, we need to go there and to present what we do in a way that matters to those kids.

[00:27:35] Nathan Wrigley: In terms of success, if you were to, I don’t know, let’s imagine that we could cast our minds forwards five years, let’s go for that. What would you like to have happened with WP Credits? Would you like, for example, to see a bunch of 20 somethings wandering around in an event like this? Does it matter that they’re involved in the community and doing WordPress events and contributing to Core and those kind of things? Or is success just more broadly, people are using WordPress? You know, it’s still a project. What’s your take on, what does success look like in five years?

[00:28:08] Ivana Ćirković: For me, I would like to see more young people involved. Yes, we will always have users because in its core, WordPress is a very useful tool. And I’m happy to stumble upon that tool many, many years ago to use it both personally and professionally. But I really want to see young people involved in a way that we were involved 10, 15 years ago, and to see what can happen with WordPress.

I strongly believe it’ll be transformed, not with AI or all other flashy trends. WordPress has always been about people. And we need new people, we need young people to get it where it needs to be.

We are getting older and don’t have strengths or stamina to do so for how many long years. By having new kids, fresh perspectives, I’m really excited to see what they can come up with next.

[00:29:08] Nathan Wrigley: Yeah, it’s kind of handing over the baton in a way, isn’t it? Seeing what the future holds. Yeah, I definitely have concerns that the age demographic is skewing. And no matter what has happened in the past, I don’t see it being backfilled with younger people moment.

But I think that’s largely because we just assumed that that age demographic would fill itself, because we were excited about it, so the younger generation will be excited about it. Well it turns out the world moved on. And TikTok came along, and YouTube became a massive thing and mobile phones and all the different platforms became a thing. And so the attention was put elsewhere by many young people.

And so I suppose we needed to come up with a system where we are, in a sense, just putting it in front of their face and saying, look, it’s here. You know, you’re a university student, you are somebody looking for work in a small business. Here’s a credible way of getting involved in something which potentially could change your life. That seems like the most credible way of doing it at the moment. And I guess we’ll just have to see what the next five years brings.

In which case, is there anything that you felt you wanted to touch on that you wanted to get out of this chat before we finished?

[00:30:15] Ivana Ćirković: No, I think you did it masterfully. And we touched base on everything that needed to be said.

[00:30:20] Nathan Wrigley: Perfect. In that case, I will say Ivana, thank you for chatting to me today. Fingers crossed that your presentation goes well tomorrow, and that you pack the place out, and that by this time next week, you are extremely busy with the WP Credits program. Thanks for chatting to me.

[00:30:34] Ivana Ćirković: Thank you. Thank you for inviting me.