For twenty years a WordPress developer’s value was the ability to write the code: the hooks, the queries, the block markup, the escaping you did from memory. AI collapsed the cost of writing that code to almost nothing. So here’s the uncomfortable question: what are you still good for?
The numbers give an uncomfortable answer too. Developers have never used AI more, and never trusted it less: adoption is up, trust is down, and the most experienced developers are the most sceptical of all. WordPress vulnerabilities rose 42% in a year, 91% of them in plugins, with vibe-coded code named as a driver. Agencies say their single biggest worry is no longer speed, but the quality of what the machine produces.
The scarce skill in 2026 isn’t prompting. It’s everything wrapped around the generation: the context you give the agent, the spec you hold it to, the harness that catches it, and the call only you can make.
This talk is about those four, for WordPress specifically, including what AI gets confidently wrong here every single time: missing nonces, absent capability checks, unescaped output, invented hooks, block markup that validates but renders wrong.
You’ll leave with a working discipline, not another tool to install.