Just when you thought things were settling down… boom 💥 — the ActivityPub plugin gets another big upgrade. Say hello to version 7.0.0, a release packed with new features, polish, and under-the-hood improvements to help your WordPress site federate smoother, smarter, and more securely than ever.
Let’s dive into what’s new.
Following the Fediverse
We’ve added the initial building blocks for Following support — both sending and managing follow requests for remote actors. It’s not in the UI just yet (we’re rolling it out carefully), but that’s not far away. A big step toward richer, two-way federation.
We’ll work with developers of third-party plugins — including those behind Friends and Event Bridge — to migrate their custom follow implementations to this new core feature. This collaboration helps ensure a consistent, reliable follow experience across the ecosystem.
This foundational support for following is also the first step toward a full-featured reader experience right inside WordPress — something we’re excited to keep building toward.
Refined Signature
This release brings support for RFC-9421-style HTTP signatures, both incoming and (optionally) outgoing. That’s a mouthful, but it basically means supporting the latest standard in how we verify and send activities — including a fallback to good old Draft Cavage when needed.
Check out the blog post to learn more: HTTP Signature Upgrades Coming Soon
Full Changelog
Added
- Added basic support for handling remote rejections of follow requests.
- Added basic support for RFC-9421 style signatures for incoming activities.
- Added initial Following support for Actors, hidden for now until plugins add support.
- Added missing “Advanced Settings” details to Site Health debug information.
- Added option to auto-approve reactions like likes and reposts.
- Added support for namespaced attributes and the dcterms:subject field (FEP-b2b8), as a first step toward phasing out summary-based content warnings.
- Added support for the WP Rest Cache plugin to help with caching REST API responses.
- Documented support for FEP-844e.
- Optional support for RFC-9421 style signatures for outgoing activities, including retry with Draft-Cavage-style signature.
- Reactions block now supports customizing colors, borders, box-shadows, and typography.
- Support for sending follow requests to remote actors is now in place, including outbox delivery and status updates—UI integration will follow later.
Changed
- Comment feeds now show only comments by default, with a new
typefilter (e.g.,like,all) to customize which reactions appear. - Consistent naming of Blog user in Block settings.
- hs2019 signatures for incoming REST API requests now have their algorithm determined based on their public key.
- Likes, comments, and reposts from the Fediverse now require either a name or
preferredUsernameto be set when the Discussion optionrequire_name_emailis set to true. It falls back to “Anonymous”, if not. - Management of public/private keys for Actors now lives in the Actors collection, in preparation for Signature improvements down the line.
- Notification emails for new reactions received from the Fediverse now link to the moderation page instead of the edit page, preventing errors and making comment management smoother.
- Plugins now have full control over which Settings tabs are shown in Settings > Activitypub.
- Reworked follower structure to simplify handling and enable reuse for following mechanism.
- Screen options in the Activitypub settings page are now filterable.
- Setting the blog identifier to empty will no longer trigger an error message about it being the same as an existing user name.
- Step completion tracking in the Welcome tab now even works when the number of steps gets reduced.
- The image attachment setting is no longer saved to the database if it matches the default value.
- The welcome page now links to the correct profile when Blog Only mode was selected in the profile mode step.
- Unified retrieval of comment avatars and re-used core filters to give access to third-part plugins.
Fixed
- Allow interaction redirect URLs that contain an ampersand.
- Comments received from the Fediverse no longer show an Edit link in the comment list, despite not being editable.
- Fixed an issue where links to remote likes and boosts could open raw JSON instead of a proper page.
- Fixed a potential error when getting an Activitypub ID based on a user ID.
- HTTP signatures using the hs2019 algorithm now get accepted without error.
- Improved compatibility with older follower data.
- Inbox requests that are missing an
algorithmparameter in their signature no longer create a PHP warning. - Interaction attempts that pass a webfinger ID instead of a URL will work again.
- Names containing HTML entities now get displayed correctly in the Reactions block’s list of users.
- Prevent storage of empty or default post meta values.
- The amount of avatars shown in the Reactions block no longer depends on the amount of likes, but is comment type agnostic.
- The command-line interface extension, accidentally removed in a recent cleanup, has been restored.
- The image attachment setting now correctly respects a value of 0, instead of falling back to the default.
- The Welcome screen now loads with proper styling when shown as a fallback.
- Using categories as hashtags has been removed to prevent conflicts with tags of the same name.
- When verifying signatures on incoming requests, the digest header now gets checked as expected.
Downloads
- WordPress.org: https://downloads.wordpress.org/plugin/activitypub.7.0.0.zip
- GitHub: https://github.com/Automattic/wordpress-activitypub/releases/tag/7.0.0
Thank you!
Huge thanks to everyone who contributed code, feedback, tests, or moral support. This community makes the fediverse feel a little more federated with every release. ❤️
Update now, test things out, and let us know how 7.0.0 works for you!
ActivityPub for WordPress 
Leave a comment