WordPress.org has reduced the Protect The Shire cooldown period for plugin and theme updates from 24 hours to six hours. The change was mentioned on WordPress Slack rather than announced through a public post, meaning plugin developers only discovered the new delay when releasing updates they had planned around the original 24-hour cooldown period.
The six-hour window may not last for long. WordPress.org developers are already working on further reducing the delay, with the current plan being to skip the cooldown entirely when the Gandalf security review returns no findings.
The change raises questions about communication
Protect The Shire initiative was introduced to improve the security of plugins and themes hosted in the WordPress.org directory. As part of the initiative, new releases were initially subject to a cooldown of up to 24 hours before being distributed through auto-updates, giving Gandalf the AI scanner and human reviewers time to examine changes.
The cooldown period has now been reduced to six hours as highlighted by Konstantin Obenland on the #meta Slack channel, “I changed the cooldown period to 6h as a first iteration on Protect the Shire. Will dig into Gandalf next, to see where it can be reduced further.”
The change was not announced through a public WordPress.org post. Enrico Battocchi (Lead Developer and Plugin Release Lead at Yoast) asked how developers could learn about such updates, “How can we learn about such updates? Will there be a post? I cannot find one about the 6h reduction. It would be helpful since we need to plan the release schedule of our plugins…”
Francisco Torres (one of the Plugin Team Reps) responded that the delay would be shown on the plugin page when a new version was created, “The specific delay will appear on your plugin page once the new version has been created. This delay may change over time while the process is ongoing. For now, it is therefore better to check the dynamic notice on your plugin page than a static publication.”
Lopo said that discovering the change only when preparing a release could affect developers who had planned around the original 24-hour delay, “I understand, but it would really help to know about changes like this in advance, when we’re planning our release schedule. We currently plan around the 24-hour delay window. If I hadn’t come across a casual mention of the new value, we would have released Monday morning expecting the bulk of updates to roll out the next day, only to discover mid-release that we had to reshuffle our plans.”
Lopo added, “Even a brief announcement (if not a full post) would help. I doubt we’re the only ones who’d be caught off guard, discovering only after release that we now need to rearrange shifts to monitor rollout, publish premium add-ons, and provide timely support to users.”
The change was also highlighted by Ajay D’Souza (Founder at WebberZone) when he pushed an update to one of his plugins. Without a public announcement about the shortened cooldown, D’Souza discovered the change through the release process and posted: “It looks like the 24 hours is now 6!”
Future Roadmap and community suggestion
The six-hour cooldown may also be temporary. A draft pull request on GitHub proposes a further change to the WordPress.org Plugin Directory that would allow a release to be served immediately when Gandalf completes its scan with no findings. The pull request is currently under review and is not an implemented change.
The proposal explains that the current delay provides a window for both automated scanners and human reviewers, but that the two processes currently operate separately. Under the proposed change, “when a Gandalf scan completes with no findings, the version it scanned stops waiting and starts being served.” Releases would continue through the normal cooldown process if Gandalf finds issues or does not return a valid clean result.
The pull request describes the proposed change as “a policy change, not just a code change,” because ending the delay after a clean automated scan would remove the human-review portion of the waiting period for releases that Gandalf clears. The change was later put on hold until SecOps had an opportunity to review and tune the scanner.
Separately, developer Deepak Gupta has proposed introducing a new WP_SKIP_COOLDOWN_PERIOD constant that site administrators could define in wp-config.php to bypass the plugin and theme update cooldown. The proposal is aimed at developers, agencies, and advanced users who may need to deploy a critical fix immediately, while leaving the cooldown enabled by default for other sites.