This is a short extract of the in depth article “WP forks ACF to create SCF, a controversial plugin” which includes all the code analysis and FAQ.

WordPress.org, led by Matt Mullenweg, has forked the popular Advanced Custom Fields (ACF) plugin to create Secure Custom Fields (SCF). This move has raised controversy due to ongoing legal disputes between Automattic (WordPress) and WP Engine, which acquired ACF in 2020.

SCF, aimed at replacing ACF, removes the ACF Pro features and fixes security vulnerabilities. While it remains a free plugin, many developers have voiced concerns about the ethics behind the fork. WP Engine has responded by continuing ACF development independently.

The decision has left users questioning how this affects their sites. For now, SCF remains a plugin outside WordPress core, and ACF continues to exist, albeit removed from the WordPress repository.

What is Forking?

Forking, common in open-source projects, allows developers to copy code and evolve it independently under the same GPL license. WordPress itself originated as a fork from b2/cafelog. Forking typically promotes innovation but, in this case, seems rooted in Automattic’s attempt to gain control over a plugin vital to many WordPress developers.

SCF vs. ACF: What’s Changed?

While SCF retains the core functionality of ACF, Automattic has removed the option to upgrade to ACF Pro, eliminating its premium features like Repeater Fields and Flexible Content. However, the update is primarily focused on security improvements, which WP Engine has acknowledged in their updates.

What’s Next?

SCF may signal broader moves by Automattic to gain leverage against WP Engine, but it has sparked debate about the long-term impact on the WordPress ecosystem. Developers now face a choice: stick with ACF updates from WP Engine or adopt the new SCF plugin, knowing both have distinct paths ahead.

For most end users, this fork might have little effect on usability, but ethical and developer concerns linger in the background.