Pantheon release notes

We are continuing to enhance the Top Traffic Patterns interface with clearer visibility into what traffic actually counts toward your bill.

You can now filter the Top Traffic Sources tables – Top Paths, Top IPs, and Top User Agents – to show only Pages Served, the subset of requests that count toward billing. This makes it easy to separate the noise of total traffic from the actual billable traffic driving your usage. A new Total Requests breakdown also shows the split between Pages Served and uncounted requests at a glance.

Note: This feature is currently available only for sites migrated to Pantheon's new Global CDN (GCDN). If you don't yet see the toggle on your dashboard, consider migrating to the new GCDN to unlock this and other upcoming traffic insight enhancements.

The latest security release for WordPress, 7.0.2, is available on Pantheon as of July 17, 2026.

Action required

Because this is a security update, we recommend upgrade to WordPress 7.0.2 as soon as possible from your Pantheon dashboard or Terminus to access the latest features, fixes, and security enhancements. See related documentation for how to apply core updates.

Highlights

This update resolves two security vulnerabilities that were reported via WordPress core's HackerOne reporting portal. Fixes in this release include:

• A facilitated SQL injection issue
• A REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

WordPress 6.9 is affected by both vulnerabilities. Version 6.9.5 has been released with fixes for both and is also available from our WordPress upstream.

WordPress 6.8 is only affected by the first vulnerability. Version 6.8.6 has been released with the fix and is available from our WordPress upstream.

For more information on this release, please visit the HelpHub site.

After a successful Beta phase, Pantheon's next-generation Global CDN (GCDN) is now generally available. Built on Cloudflare, the new GCDN delivers built-in bot protection, expanded site eligibility, and the same self-serve migration experience customers have been using in the Beta — now production-ready for the majority of sites on the platform.

What's included

• Built-in bot protection — Incoming traffic is automatically scored, with managed challenges issued to suspicious requests and verified bots (such as search engine crawlers) allowed through.
• Multizone Failover support — Sites with Multizone Failover enabled can migrate to GCDN and continue to benefit from automated regional failover.
• Custom Certificates support — Sites using customer-provided TLS certificates are now supported on GCDN. Migration for these sites is owned by our Professional Services team and coordinated through support — open a support ticket to get started.
• Platform vanity domain support — Organization-owned vanity hostnames (e.g., live-mysite.example-agency.com) are fully supported. Migration for these sites is owned by our Professional Services team and coordinated through support — open a support ticket to get started.

Action Required

Eligible sites will display a GCDN banner in the Pantheon dashboard. To migrate:

1. Locate the GCDN banner on an eligible site.
2. Click it and complete the guided process.
3. Point your DNS records to the new GCDN infrastructure.

Domain verification supports DNS-01 TXT record validation, requiring TXT records added at your DNS provider.

Eligibility

GCDN is available to all sites on the platform except those currently using Advanced Global CDN (AGCDN). AGCDN customers will be migrated in a future phase — no action is required from them at this time.

More information

For full details on GCDN, refer to the Global CDN guide on the Pantheon docs site.

A visual refresh of the Pantheon Dashboard is rolling out gradually over the next 2–4 weeks, reflecting an update to Pantheon's underlying design system. You may notice colors, typography, and some components looking slightly different day to day as the rollout progresses — this is expected.

Why we're doing this

This refresh modernizes the look of the Dashboard and brings it in line with Pantheon's updated design system. It also sets us up to build and ship new Dashboard features more quickly going forward.

What's staying the same

The layout, navigation, and workflows you're used to are not changing. This is a visual update only — nothing is moving, and no functionality is changing.

Rollout timeline

This update is being released gradually rather than all at once. Because of that, you may see some parts of the Dashboard update before others, and the look may continue to shift slightly as the rollout completes.

No action required

This change applies automatically. There's nothing you need to do to prepare for or opt into this update.

Sites can now compile frontend assets (themes, design systems, and other Node.js-based tooling) automatically as part of the build process.

When enabled, Pantheon installs your Node.js dependencies and runs your build script for each configured path on every code push, so compiled assets no longer need to be committed to your repository. Frontend builds work on any site, whether or not you use Integrated Composer.

Enable frontend builds

Add a frontend_build block to your pantheon.yml file:

Pantheon selects a package manager automatically based on the lock file present in each build path. Supported package managers include bun, pnpm, yarn, and npm.

For full configuration details and examples, see the frontend asset builds documentation.

Starting today, all new signups get a free 30-day trial of Pantheon. When the trial ends, site assets are stored and locked for 90 days, then unlocked as soon as the user upgrades.

Existing customers with active paid workspaces will not have changes to their current set up or experience. Existing sandbox users will receive an email in the coming months about moving to the new trial experience.

What's included in the trial?

• One professional workspace
• Up to 2 sandbox sites, including Dev, Test, and Live environments
• Additional tools like New Relic, Object Cache, and Pantheon Search

For more details, see this related documentation.

PHP versions 8.2.32, 8.3.32, 8.4.23, and 8.5.8 are now available on the platform. These updates include important security fixes, along with bug fixes and enhancements that improve performance and stability. Updates will be applied automatically over the next few days, so no manual action is required.

Elasticsearch is now available as an add-on for WordPress sites on Pantheon for all Performance sites and above. This new capability is powered by ElasticPress, the leading Elasticsearch solution for WordPress.

What's included?

ElasticPress improves the overall search experience and performance of your WordPress sites, as well as allowing for better WP_Query performance and reduced load on your application server. Capabilities include:

• Full-text search — Fuzzy matching, synonyms, and weighted fields for more relevant search results.
• Instant Search — Real-time search-as-you-type results without full page reloads.
• WP_Query integration — ElasticPress allows you to offload WP_Query requests to Elasticsearch, reducing database load and improving page load times.
• Faceted filtering — Narrow results by category, tag, custom taxonomy, and other attributes.
• WooCommerce support — Product search and filtering for WooCommerce storefronts.
• Related content — Surface related posts and pages automatically.
• Custom content indexing — Index posts, pages, custom post types, and custom fields.

Who has access?

Elasticsearch is available to WordPress sites on Performance Small plans and above.

How to enable it

Review the Setup and Configuration documentation for detailed instructions on setting up Elasticsearch and ElasticPress.

More information

For additional guidance and a walkthrough of these features, see the Elasticsearch on Pantheon documentation.