Automattic acquires security plugin BruteProtect, will build its functionality into Jetpack, retire standalone product
Automattic Acquires BruteProtect — I'm excited to announce that Automattic has acquired BruteProtect, a plugin and service that protects your sites from malicious logins …
Context & Ripple Effects
BruteProtect is the third small-team acquisition Automattic has folded into its orbit in under two years, after Simperium brought Simplenote in-house in January 2013 and Longreads joined in April 2014 — and it lands two months after the company closed a $160 million round at a $1.16 billion post-money valuation, its first billion-dollar mark. The pickup itself was picked up widely: VentureBeat, TechCrunch, The Next Web and others all ran the news on the day, and Matt Mullenweg amplified it on his own site.
What makes this one different from the earlier deals is where the technology goes. Rather than operating BruteProtect as a property, Automattic is retiring the standalone plugin entirely and rebuilding its malicious-login protection inside Jetpack, turning an independent developer's product into a default feature of Automattic's own distribution channel.
First-order effects
- Existing BruteProtect users lose a standalone product: their site protection migrates to Jetpack, which now bundles brute-force login defense alongside its other modules.
- Jetpack's installed base gains a security capability at no extra acquisition cost to users, strengthening the bundle's pitch over plugins that charge separately for login hardening.
Second-order effects
- Independent WordPress security plugin makers now compete against a free, Automattic-distributed equivalent inside Jetpack, pressuring their pricing and feature differentiation.
- Other plugin developers face a sharpened build-or-be-bought calculus: Automattic has demonstrated it will absorb point solutions and sunset the brand rather than run them independently.
Third-order effects
- If the pattern holds, Jetpack consolidates into the default utility layer of self-hosted WordPress — the place security, sync and performance features arrive by acquisition — narrowing the market for standalone single-purpose plugins.
- For the broader WordPress ecosystem, distribution through Automattic becomes the exit path of least resistance for successful plugin authors, concentrating platform power in one company even as the CMS itself stays open source.
The trend: Automattic is using acquisitions as its product roadmap for Jetpack, absorbing independent WordPress plugins and retiring them as standalone brands.