Senior web developer with a speciality in web application security. Decades of experience in building, managing and securing WordPress both in corporate environments and as an entrepreneur.
Session
Practical Application Security for Devs
Workshop
10:15 – 11:00
Complexity: Medium
Intended Audience: Developers
I would like to host a workshop where devs can actually get their hands dirty and benchmark their own site security. There’s a serious lack of even basic DNS and server-side knowledge in the dev community and with AI speeding up security scanning, and also increasing attacks thanks to AI, I think we’ll all have our hands full in the future.
Idea would be to look at tools that help us every step of the way including DNS level, server-side level and actual application security. Possibly create an actual environment that could be compromised and scanned and give devs a taste of what can be done to improve matters, more than just good old SQL injection advice.
Lauri Saarni is a Senior Developer at Valu Digital, where he works on product development, AI solutions, as a Findkit specialist and is involved in project work as well. He is a WordPress core contributor on the AI Team, contributing to the PHP AI Client and WordPress’s canonical AI plugins. His CMS career spans back to the early 2000s, covering WordPress, TYPO3, Neos CMS, and custom systems, with work in both Finland and Cambodia (fair trade software). His background also includes pastoral and missionary work, which grounds his human-centric vision for an AI-driven web.
Session
Under the Hood: How Agentic WordPress Works
Workshop
11:15 – 12:15
Complexity: Medium
Intended Audience: WordPress developers and technical leads interested in AI integration. Familiarity with PHP and WordPress core APIs is helpful; no prior experience with AI tooling or MCP is required.
WordPress core is getting its AI building blocks: the PHP AI Client, the Abilities API, and the MCP Adapter. Together they let you turn site functionality into tools that agents can call. Agents can run from inside wp-admin, on the frontend, or from external AI clients via MCP. This talk introduces each building block, shows a simple agentic loop in action, and compares the architectural options (shared keys vs. per-user costs, controlled vs. open connections) so you can choose the right AI solution for the task at hand.
Goal: Build one real ability and connect an agent with it.
Prerequisites: Local WordPress environment running and verified before arriving (wp-env / Studio / Local or similar that has WP CLI in use)
Plugin skeleton repo cloned. I will provide a git repo with git tags per checkpoint so anyone can jump ahead.
Optional, for following the demo half on their own later: an MCP-capable client (Claude Desktop, Codex, OSLT) and an AI provider API key(or Ollama running locally)
Milana Cap is a WordPress engineer at XWP, freelance WordPress engineer at Toptal, WordPress Documentation Team representative, plugin reviewer, and Documentation Focus lead for WordPress 5.8 – 6.2 release cycles.
She helped organise some of the largest WordPress conferences, WordCamp Europe 2018 and 2019, focusing on Contributor Days, and 2026 as a member of the Speakers team.
Being a single mum in Serbia, she developed the superpower of fighting the odds. Easily bribed with dark chocolate and a nice piece of bacon.
Session
WordPress gems for devs: Accessibility with HTML API
Workshop
13:10 – 14:25
Complexity: Medium
Intended Audience: Developers
In recent releases, WordPress has started introducing small portions of real gems that will have an immense impact on the way we develop websites and think about essential aspects of them that go beyond the code, such as performance, user experience, developer experience, and maybe the most important of all, accessibility.
Did you know that WordPress’ HTML API powers Interactivity API? Did you know it is delightful and fun to develop with? And did you know that it can be essential for improving accessibility in every step of your development workflow? Milana can show you how.
Tuomas is an Account Director and Conceptualizer who has spent over two decades navigating the digital realm. Having spent roughly equal amounts of time building digital services and trying to sell them, he has experienced web projects from every conceivable angle: as a creator, a buyer, and occasionally as the person explaining to both sides what they actually meant.
With an engineering background from Aalto University, Tuomas likes to bridge the gap between heavy technical execution and business goals. These days, he spends his time (even on weekends) weaponizing rapid prototyping and AI tools in the sales phase, mostly to prove that showing a working concept beats explaining it with 50 slides every single time, and to ensure everyone is arguing over a live prototype instead of a 40-page spec document nobody read anyway.
Session
Using working prototypes when selling WordPress projects
Workshop
15:10 – 16:25
Complexity: Medium
Intended Audience: Account directors, developers involved in sales, and anyone interested in selling WordPress projects to customers.
Why rely on 40-page spec documents and hand-waving when you can show a living concept from day one? Or maybe day two, or three at the latest? Bringing working prototypes into the first client conversations dramatically narrows down real client needs while quickly validating technical feasibility.
In this talk, we’ll explore how to build and leverage lightweight sales prototypes:
Keep the infra simple: Avoid heavy setups like vector databases or complex multi-model stacks (LLM, reranking, embeddings). The best sales prototype runs easily without a dedicated DevOps team.
Stick to public data: Skip painful NDA loops and security friction by using open data or smart pseudo-content—often better for testing than messy confidential files anyway.
Concrete business & engineering benefits:
– Smoother communication: Bridges the gap between developers, sales, and the client so everyone speaks the same language early on.
– Clearer infrastructure needs: Helps teams understand actual server, API, and architectural requirements before making major commitments.
– Measurable usage: Early client interaction with the prototype provides measurable usage data before production builds even start.
– New product opportunities: Prototyping often reveals unexpected WordPress application concepts that can be productized and sold to other clients.
– Hands-on skill building: Live testing with WordPress hooks, APIs, and LLM features boosts overall organizational capabilities—especially since early-stage freedom leaves room for genuine technical exploration.
