This Month in Web: September 2026

September has already brought useful changes to WooCommerce, another step forward for AI-powered Google Search, new WordPress features and a reminder that website security goes much further than simply keeping a few plugins updated.

Rather than covering every minor release and announcement, we have pulled together the updates we think are actually worth knowing about if you own, manage or market a business website.

WooCommerce 11.1 brings some genuinely useful store improvements

WooCommerce 11.1 arrived at the beginning of September with several changes that should be noticeable to both store owners and developers.

One of the biggest additions is native support for multiple images against individual product variations.

Until now, if a product came in several colours or styles and you wanted each variation to have its own gallery, this would often require an additional extension or custom development.

WooCommerce is now bringing more of that functionality into the platform itself.

For example, a clothing retailer could show one complete gallery when a customer selects a black product variation, then automatically swap those images when they select blue.

It sounds like a relatively small feature, but better product imagery can make a real difference to the buying experience, particularly for products where colour, finish or specification matters.

WooCommerce API performance has also improved

There have been improvements behind the scenes too.

WooCommerce has made changes designed to speed up Store API and REST API requests by avoiding unnecessary processing where it is not needed.

Most business owners will never directly interact with the WooCommerce API, but it powers a growing number of integrations, custom features and modern storefront experiences.

Performance improvements at platform level are therefore welcome, particularly as WooCommerce websites become more complex.

If you run an online shop, this is another good reason to keep WooCommerce, plugins and your wider hosting environment properly maintained rather than allowing the site to fall several versions behind.

You can read more about how we approach WooCommerce and eCommerce website development.

WooCommerce is preparing to drop older versions of PHP

Another announcement worth paying attention to is WooCommerce’s proposed move to PHP 8.1 as its minimum supported version from WooCommerce 11.5, currently expected in early 2027.

This would mean new WooCommerce releases no longer supporting PHP 7.4 or PHP 8.0.

For a well-maintained website this should not cause much concern. Those versions of PHP are already old and have been unsupported by PHP itself for some time.

The potential problem is with websites that have been left untouched for years.

Older WordPress themes, abandoned plugins and bespoke functionality can sometimes prevent a site from moving cleanly onto a modern PHP version.

Should you update PHP now?

If your WooCommerce website is still running PHP 7.4 or 8.0, it is worth reviewing rather than waiting until a future WooCommerce update forces the issue.

That does not necessarily mean logging into your hosting account and changing the PHP version immediately.

A safer approach is to:

• check the current PHP version;
• confirm WordPress, WooCommerce, the active theme and plugins are up to date;
• test the newer PHP version on a staging website where possible;
• check checkout, payments, forms and integrations;
• then roll the change onto the live website.

This is one of those areas where routine website maintenance prevents relatively small technical jobs from becoming much bigger projects later.

Google Search continues moving towards AI

Google’s shift towards AI-powered search has continued this month with the introduction of Gemini 3.8 Flash and its use within AI Mode for some Google Search users.

The individual model name is probably not particularly important to most businesses.

The direction Google is moving in is.

Search is becoming increasingly capable of handling longer, more conversational and more complicated questions rather than simply matching a handful of keywords against a page.

Instead of somebody searching:

commercial coffee machines

they can increasingly ask something closer to:

What type of commercial coffee machine would suit an office making around 150 drinks per day?

Google can then use AI to interpret the question, gather information and help the user continue researching through follow-up queries.

Does AI Search change SEO?

Yes, but probably not in the way some of the more dramatic headlines suggest.

Businesses do not suddenly need to abandon traditional SEO and start again with an entirely separate form of optimisation.

The fundamentals still matter:

• clear and genuinely useful website content;
• strong service and product pages;
• good technical SEO;
• logical internal linking;
• authority around the subjects your business specialises in;
• content that properly answers real customer questions.

If anything, AI-powered search makes shallow content written purely around one keyword less useful.

A website that clearly explains its services, demonstrates expertise and answers related questions gives search engines considerably more context to work with.

We expect AI Search to become an increasingly important part of SEO, and it is something we will be covering more regularly as the search landscape develops.

WordPress 7.1 is now the current major WordPress release

WordPress 7.1 technically arrived in August, but with September being its first full month as the current major release, it is worth including here.

The update continues WordPress’s gradual push towards giving site owners and developers more control within the platform itself.

That includes improved responsive styling tools inside the block editor and changes to media editing, alongside the usual collection of performance, accessibility and developer improvements.

For most business owners, however, the key takeaway is not one individual WordPress feature.

It is that WordPress continues to evolve.

A WordPress website is software. The platform, PHP, themes, plugins and third-party integrations all change over time.

That is why we generally advise against treating a business website as something that can be built, launched and then ignored indefinitely.

A hosting security incident shows how wide website security really is

One of the more technical stories from the end of August has also been discussed heavily this month after Softaculous confirmed an unusual attack affecting part of its infrastructure.

The incident involved BGP hijacking, where internet traffic intended for legitimate infrastructure was redirected towards systems controlled by an attacker.

It affected part of the Virtualizor update process and resulted in a malicious update reaching a small number of systems.

It is not the sort of attack most website owners will ever need to understand in detail.

But it highlights an important point.

Website security is not just a WordPress security plugin

When people think about website security, the focus is often entirely on WordPress itself.

In reality, your website depends on a much larger stack of technology, which can include:

• WordPress;
• themes and plugins;
• PHP;
• the web server;
• hosting control panels;
• databases;
• DNS;
• SSL certificates;
• software update systems;
• third-party services;
• network infrastructure.

No hosting provider or website can guarantee protection against every possible security issue.

The aim is to reduce the risk.

Reliable website hosting, sensible server configuration, regular software updates, backups and ongoing monitoring all form part of that.

It is also why we prefer taking responsibility for the wider website environment rather than simply installing a security plugin and assuming the job is done.

So, what actually matters this month?

If you strip away the release numbers and technical terminology, there are a few fairly clear themes running through September’s updates.

eCommerce platforms are becoming more capable. WooCommerce continues adding functionality that previously required separate extensions while also improving performance behind the scenes.

Older technology is being left behind. The proposed PHP requirement is another reminder that websites cannot remain frozen on old software indefinitely.

Search is changing. Google is continuing to build AI deeper into the search experience, changing how people can research products, services and businesses.

Website infrastructure matters. Security and reliability depend on much more than the visible WordPress website.

None of these changes mean business owners need to spend every week reading WordPress development notes or keeping track of Google’s latest AI model.

But they do reinforce the importance of having somebody keeping an eye on the technology your website and marketing depend on.

We’ll keep an eye on it for you

This is the first of our This Month in Web round-ups, where we will pick out the industry changes we think are actually relevant to businesses and leave out the noise.

If you are unsure whether any of the updates above affect your website, hosting, WooCommerce store or SEO, get in touch with Mello and we can take a look.