WordPress Takes Control of the ACF Plugin — What Developers Need to Know
The ACF Plugin Takeover: Background
In October 2023, the WordPress open-source project took a dramatic step that sent shockwaves through the developer community: WordPress.org seized direct control of the Advanced Custom Fields (ACF) plugin — one of the most widely installed WordPress plugins with over 2 million active installations — from its owner, WP Engine.
The move was unprecedented. WordPress.org forked ACF under the new name Secure Custom Fields (SCF), transferred the plugin's official WordPress.org listing, and redirected auto-updates from ACF to SCF for all existing ACF users.
Why Did WordPress Take Over ACF?
The takeover did not happen in isolation. It was the flashpoint of a months-long public dispute between Matt Mullenweg (WordPress co-founder and CEO of Automattic) and WP Engine, one of the largest managed WordPress hosting providers.
Mullenweg's stated reasons for the fork included:
- WP Engine's use of the WordPress and WooCommerce trademarks without what Automattic considered an appropriate licence agreement
- Concerns that ACF Pro's commercial features were being delivered in a way that harmed the open-source ecosystem
- A claimed security vulnerability in ACF that WP Engine had allegedly not addressed promptly
WP Engine disputed all of these claims and filed a lawsuit against Automattic in November 2023, alleging abuse of WordPress.org infrastructure, extortion, and unfair competition.
What Exactly Changed for ACF Users?
For the millions of WordPress sites running ACF Free, the plugin's auto-update mechanism began pointing to Secure Custom Fields instead. Practically speaking, this meant:
- Sites with auto-updates enabled silently switched from ACF to SCF without user consent
- The SCF plugin removed certain commercial upsell features that were present in the WP Engine version of ACF
- WP Engine continued maintaining ACF independently at
advancedcustomfields.comoutside WordPress.org
Users who wanted to stay on WP Engine's ACF had to manually switch their update source away from WordPress.org.
The Developer Community's Reaction
Reaction from the developer community was sharp and divided. Critics — including prominent WordPress contributors — raised serious governance concerns:
Using WordPress.org's plugin infrastructure to fork a competitor's product sets a precedent that undermines trust in the entire plugin repository, regardless of the underlying commercial dispute.
Others argued that Mullenweg's intervention was a legitimate assertion of open-source stewardship — that a plugin distributed via WordPress.org must remain genuinely open and free from commercial coercion.
The Drupal, Joomla, and broader CMS communities watched closely, with several open-source advocates describing the move as a cautionary tale about platform governance and the risks of building commercial products on top of community infrastructure.
ACF vs SCF: What Are the Differences?
As of 2025–2026, here is how the two forks compare for developers:
| Feature | ACF (WP Engine) | SCF (WordPress.org) |
|---|---|---|
| Field types | Full set including Relationship, Flexible Content | Full set (same core fields) |
| ACF Pro / paid features | Available via ACF Pro licence | Not included |
| WordPress.org listing | No — distributed independently | Yes — official repository |
| Auto-update via WP dashboard | Only with direct download or licence key | Yes |
| Long-term outlook | Backed by WP Engine, active development | Maintained by WordPress.org contributors |
What Should ACF Users Do?
If you are a developer or site owner currently running ACF, here is a practical checklist:
- Identify which version you are running. Check your plugin admin page — if it says "Secure Custom Fields" you are on the WordPress.org fork. If it says "Advanced Custom Fields" with WP Engine branding, you are on the original.
- Do not panic about existing functionality. For most sites using ACF Free field types, both forks work identically for day-to-day development.
- If you use ACF Pro features (Flexible Content, Options Pages, Gallery field with extended functionality) you need to maintain an active ACF Pro licence through WP Engine's channel.
- Review auto-update settings. If you are on SCF and want to pin a version or switch back to ACF, do so deliberately rather than letting auto-updates run unchecked.
- Consider alternatives for new projects. Plugins like Meta Box, Carbon Fields (free, open-source), and Pods offer similar custom field functionality without the governance uncertainty.
The Broader Lesson for WordPress Developers
The ACF episode is a reminder that the WordPress ecosystem, despite its scale, is governed by a small number of decision-makers with significant unilateral power. For developers building production sites or commercial products on WordPress, the incident raises several strategic questions:
- How much of your stack depends on third-party plugins distributed via WordPress.org?
- Do you have a plan if a critical plugin is abandoned, forked, or commercialised against your interests?
- Is the custom field architecture baked so deep into your theme that switching would be costly?
From a Laravel developer's perspective — where you own the full data model and are not dependent on a centralised plugin repository — events like the ACF takeover reinforce why custom-built CMS architectures and Laravel's native Eloquent models often make more sense for complex business applications than WordPress's plugin ecosystem.
Summary
WordPress's takeover of ACF in October 2023 was a watershed moment for the WordPress plugin ecosystem. Whether you view it as necessary open-source stewardship or a damaging precedent, it has material consequences for any developer or agency that has built heavily with ACF. Review your plugin stack, understand which version you are running, and plan migrations or alternatives accordingly.