Why pay for free software? Who decides the open source stack under WordPress?

Every WordPress site operates on an open source stack that comprises an operating system, a web server, a database, PHP, WordPress itself, and the browser on your end. Each layer of the stack has its own set of rules governing who approves changes. When you choose a host, you are essentially selecting this open source stack. For instance, during a client project, you compare various hosts based on the friendliness of their support chat and, inadvertently, also pick the underlying stack.

It's a common oversight to focus on this aspect. Disclosure: I currently work at Pantheon, a WordPress and Drupal hosting provider. According to WordPress, the recommended stack includes PHP 8.3 or higher, MariaDB 10.11 or MySQL 8.0 or higher, and either Apache or NGINX, along with HTTPS support. However, these are merely recommendations and not strict minimum requirements.

Despite being recommendations, WordPress names four separate projects before even loading a single plugin. This stack was once part of my job at GoDaddy, where I was frequently asked which foundational projects to fund. My answer typically centered on the obvious choices, but the most common query from budget approvers was, "Why pay for software that anyone can download for free?"

This post aims to provide a comprehensive answer to that question. In essence, while it may be free to download, maintaining the open source stack entails costs, and each layer of the stack has individuals deciding its operation. The open source stack under a WordPress page reveals that every page load traverses six stacked layers, each with distinct responsibilities and approval processes.

The first layer, Linux, manages the server your site resides on. Change approvals are handled by subsystem maintainers who accept patches and merge them into the main kernel repository under the leadership of a single top maintainer. The web server layer, whether Apache or NGINX, takes incoming requests, hands them off to PHP, and returns the resulting page.

The approval process for changes varies: Apache's Project Management Committee requires at least three binding +1 votes for consensus decisions, while NGINX employs the Contributor License Agreement and technical committee reviews. The database layer, either MySQL or MariaDB, stores your site's content. Oracle governs MySQL, with the project lead being appointed by Oracle, while MariaDB's Foundation board does not make technical decisions.

Instead, a 2025 agreement reveals that MariaDB plc employs the majority of developers contributing to MariaDB Server. The PHP layer runs all of WordPress's PHP code. As a language, PHP's changes are approved by the PHP community's governance process, which includes a variety of stakeholders and committees. In summary, the open source stack under WordPress isn't just free to download—it involves numerous decision-makers at each layer who determine how the stack functions and evolves.