ActivityPub for WordPress

Category: Features

  • Bridging the gap

    The image shows the fediverse Wapuu is building a bridge from the Bluesky Space Station to the Fediverse Space Station.

    The Fediverse is intended to be an interoperable, decentralized social network where users can connect across platforms and tools. In practice, though, the reality is more fragmented.

    According to Wikipedia:

    The majority of Fediverse platforms are based on free and open-source software, and create connections between servers using the ActivityPub protocol.

    Still, networks like Bluesky, Nostr, and Diaspora take their own technical paths toward the same vision, which means the fediverse isn’t fully connected just yet.

    Bridgy Fed

    To help address this gap, Ryan Barrett (@snarfed.org) began developing Bridgy Fed, a tool designed to connect these otherwise separate networks:

    Bridgy Fed connects web sites, the fediverse, and Bluesky. You can use it to make your profile on one visible in another, follow people, see their posts, and reply and like and repost them. Interactions work in both directions as much as possible.

    With even more networks on the list.

    While it’s not a native solution, it does help connect people today—and I really appreciate the perspective of Anuj Ahooja (@quillmatiq), CEO of A New Social, the organization behind Bridgy Fed:

    The future of the open social web is people connecting with people no matter what technology they happen to choose. And if bridges and duct tape is what’s necessary, then we’ll continue building bridges, because it’s connections and community over everything.

    You can easily connect your blog to Bluesky using Bridgy by following a few simple steps.

    Bridge your Blog

    You can connect your blog to Bluesky using any self-hosted WordPress site or a paid WordPress.com plan.

    First, go to the ActivityPub settings and open the Screen Options at the top right. Enable the Advanced Settings checkbox and click Save.

    This will reveal the Advanced tab in the settings, where you’ll find the Following User Interface option. Enable that as well.

    Once this feature is active, you’ll be able to access the Following subpage.

    To follow the Bluesky account, enter bsky.brid.gy@bsky.brid.gy into the input box on the left and click Follow. The account should appear in your list shortly. After a few minutes, your follow request will be accepted, and the account will follow your blog back.

    You can verify the connection by checking your Followers list. From this point on, all your new blog posts will also be published on Bluesky. You’ll receive reactions to your posts and even follow requests from Bluesky users.

    That’s it! All your upcoming posts will also be published on Bluesky, you will receive all reactions to your posts and even follow requests.

    If you ever want to stop the bridge from publishing, simply unfollow the Bridgy account and remove it from your Followers list.

    Happy cross-posting bridging :)

    Be Aware

    Even though following other accounts is now possible, there is currently no way to view their incoming posts. Aside from the specific use case described above, following others doesn’t offer much benefit at this stage. Please be cautious if you think you need to follow more people, as it may increase traffic to your site without a clear purpose.

    We’ll let you know as soon as the full reader experience is implemented and will enable all necessary (currently hidden) features at that time.

    Follow us!

    As a proof of concept, you can now also follow our updates on Bluesky via @activitypub.blog.activitypub.blog.ap.brid.gy‬

  • HTTP Signature Upgrades Coming Soon

    Ever wonder how your site proves it’s really you talking to the rest of the Fediverse? It’s not magic—it’s HTTP signatures, the digital equivalent of a secret handshake. With our next release, we’re making that handshake a lot more universal (and a little less awkward).

    Why HTTP Signatures Matter

    When you interact with the Fediverse, you want to know that the messages you send and receive are genuine. HTTP signatures are the technology that makes this possible. Every time your site sends a message, it includes a digital signature—like sealing an envelope with your personal stamp. This signature proves that your content really came from your account and that no one has tampered with it along the way. As a result, you can trust that your interactions across the network are authentic.

    A Wapuu dressed as a detective holds a sealed envelope marked with an RFC 9421 checkmark, symbolizing secure and verified communication, with a key floating nearby against a starry background.

    A Bit of Background: draft-cavage and RFC 9421

    If you’ve heard about HTTP signatures, you might have come across terms like “draft-cavage” and “RFC 9421.” These are just different versions of the rules for how those digital signatures are created and checked.

    For a long time, most of the Fediverse has used what’s called the draft-cavage-12 specification. Think of this as a set of instructions that people agreed to try out, but that hadn’t been officially finalized. It worked well enough to let sites talk to each other securely, but because it was just a draft, there were sometimes small differences in how different software used it.

    Recently, the community agreed on a final, official version of these rules, called RFC 9421. This is now the standard way to create and verify HTTP signatures. This makes it easier for sites and servers to understand each other and work together, since everyone is following the same process.

    Incoming Support for the New Standard, Out of the Box

    With this update, the plugin will support incoming HTTP signatures that use the new standard right away. There’s nothing extra you need to do. This means that when other servers use the new, official approach for signatures, your site will recognize and accept them. By making support for the new standard easy and automatic, the plugin helps move the Fediverse forward, encouraging more sites to adopt this approach and making connections across the network more reliable.

    Outgoing Requests and the Double Knock Approach

    There’s a new setting for outgoing requests, but for most people, there’s no need to touch it. This option is really for the folks who like to be on the cutting edge and want to start using the new standard for outgoing messages right away. If that sounds like you, here’s how to find it: head to the ActivityPub settings in your dashboard, open “Screen Options” at the top right, and enable “Advanced Settings.” Then, click on the Advanced Settings tab and turn on “Use modern signature format for Fediverse communications.”

    But don’t feel any pressure—leaving this setting off is perfectly fine. The plugin already handles incoming messages with the new standard out of the box, and we’ll automatically enable outgoing support for everyone once the wider Fediverse is ready. For now, this is just an option for early adopters.

    If you do turn it on, the plugin uses what we call the “double knock” approach. It’ll try the new standard first, and if the other server isn’t ready for it, it’ll automatically fall back to the older method. So, you can experiment without worrying about breaking communication with anyone.

    Improved Verification for Existing Signatures

    The plugin also brings improvements to how it handles signatures that use the older method, especially those using the hs2019 algorithm. Now, when a signed message arrives, the plugin fetches the sender’s public key and uses it to determine the correct way to verify the signature, following the specification more closely. This means more reliable verification and fewer errors, making your experience smoother and more predictable.

    Looking Forward

    With this update, the plugin helps move the Fediverse toward a shared standard for signing and verifying messages. By supporting both the new standard and the older method, you’re making it easier for everyone to communicate using the same agreed-upon approach. There’s no change in security, but you’re part of making the network more consistent and helping the community take the next step forward.

    We hope this explanation helps clarify these technical changes. If you have any questions about HTTP signatures or how our plugin interacts with the Fediverse, please don’t hesitate to reach out in the comments below.

  • New Look, Faster Blocks in ActivityPub 6.0.0

    In this version of ActivityPub for WordPress, most blocks received a pretty fundamental overhaul of their technical infrastructure, design, and functionality.

    The biggest change is almost invisible—all blocks now use WordPress’ Interactivity API under the hood, shedding a substantial amount of load-heavy scripts. On well-optimized sites, this should lead to noticeably quicker load times and improved web vitals.

    Let’s dive in and look at each block individually.

    Follow Me Block

    After updating, you might glance at your existing Follow Me blocks and think… “Did anything change?” That’s the goal! We’ve worked hard to keep things fully backwards compatible, so nothing should break—or even look too different—unless you want it to.

    ActivityPub for WordPress
    ActivityPub for WordPress
    @activitypub.blog@activitypub.blog

    News about the ActivityPub plugin for WordPress.

    21 posts
    487 followers

    The “Follow” button was updated to use WordPress’ built-in Button block, so all those customization options you already know and love are right there. We also turned “Button Only” into a proper Block Style. You’ll see it right next to the default, complete with a hover preview, making it easy to switch between.

    ActivityPub for WordPress
    ActivityPub for WordPress
    @activitypub.blog@activitypub.blog

    News about the ActivityPub plugin for WordPress.

    21 posts
    487 followers

    And speaking of style: there’s a new Profile style! This transforms the block into something that looks like an author card, complete with a description, header image, and post/follower stats. More social, more visual, still fully customizable. Not into the rounded corners and shadows? No problem—you can tweak those in the Styles tab.

    ActivityPub for WordPress
    ActivityPub for WordPress
    @activitypub.blog@activitypub.blog

    News about the ActivityPub plugin for WordPress.

    21 posts
    487 followers

    But that’s not all! The Modal containing the follow information also received a slight makeover, making it more theme-agnostic in its appearance.

    Followers Block

    For this block we didn’t hold back on updating the design—subtler styling and better theme integration, so it looks at home wherever you drop it. Like we did with the Reactions block in version 5.9.0, we’ve updated the title to use WordPress’ native Heading block. That gives you more control over appearance, while keeping things compatible with existing content.

    This block now benefits from the same Interactivity API improvements and renders server-side on first load, making it feel noticeably faster and more responsive right from the start.

    We also introduced a new Card style here (you might’ve spotted it in the 6.0.0 announcement). It pairs nicely with the Follow Me block’s Profile style—rounded corners and a coordinated look that helps everything feel part of the same family.

    They’ll be more changes to come soon, as we unlock font and background customizations to bring the block up to par with the rest of them.

    Reactions Block

    The Reactions block is a bit of a behind-the-scenes hero. Thanks to block hooks, it can automatically appear at the end of posts—no editor work required. But if you want to place it manually (like we’re doing here), you totally can.

    Beyond receiving the same technical upgrades as the other blocks, this one now displays the actual reactions in the Editor, matching what you see on the frontend—no more stand-in data unless there are no reactions yet. It also includes a few subtle improvements, like rendering an HTML comment when there’s nothing to show (so you’re not left guessing), and displaying more avatars when the block is set to “wide” or “full”-width, making better use of the space.

    Remote Reply

    This one’s a bit niche, but clever: Remote Reply lets logged-out users respond to Fediverse comments directly from your site. It’s not a block you can add in the editor, but it now uses the same lightweight tech as the Follow Me button—so it loads faster and feels smoother.

    If you’ve never seen it in action, you’re not alone—it only appears when certain conditions are met (logged out, looking at a Fediverse-sourced comment, etc.). Here’s a quick demo:

    While most of what ActivityPub does happens quietly behind the scenes, this update puts a little more shine on the parts your visitors can see. The blocks are lighter, more flexible, and a bit more fun to work with.

    As always, we’d love to hear what you think! Every improvement in this release was shaped by feedback from users like you—so keep it coming!

  • Your Site, Your Rules: Filtering Fediverse Activity

    When running a WordPress site with the ActivityPub plugin, you’re not just managing a website—you’re also operating a node in the Fediverse. This means you need effective tools to block unwanted activities, users, servers, and content from other instances across the network.

    How Blocking Works in ActivityPub for WordPress

    The ActivityPub plugin takes a pragmatic approach to blocking unwanted content by building on WordPress’s existing “Disallowed Comment Keys” feature. While this leverages familiar comment filtering tools, it may be less immediately obvious than the dedicated blocking interfaces found in some other Fediverse applications.

    The Disallowed Comment Keys System

    At its core, WordPress has long had a built-in system to filter comments based on specific keywords or domains. The ActivityPub plugin builds on this system to also block incoming Fediverse activities.

    When an activity arrives at your WordPress site’s inbox, the plugin runs it through the same filtering mechanism used for regular WordPress comments. This means that if you’ve configured WordPress to block certain domains or keywords in comments, those same rules will apply to incoming ActivityPub activities like follows, likes, or replies.

    Where to Find and Configure Blocking Settings

    The blocking settings aren’t located within the ActivityPub plugin’s own settings page. Instead, they’re accessed through WordPress’s standard Discussion Settings:

    1. Navigate to Settings → Discussion in your WordPress admin panel.
    2. Scroll down to the Disallowed Comment Keys section.
    3. Add domains, keywords, or IP addresses you want to block, one per line.

    For example, to block a problematic Fediverse server, you would add its domain (like bad-instance.com) to the disallowed comment keys list.

    The ActivityPub settings page also links to this under Settings → ActivityPub → Settings tab, where the “Blocklist” section points you to the same Disallowed Comment Keys setting.

    Tracking Blocked Activities

    When the plugin blocks an incoming activity, it logs relevant details to your PHP error logs. This typically includes information about the actor (user) who sent the activity, helping you monitor and refine your blocking strategy over time.

    Best Practices for Blocking

    When managing your WordPress site as a Fediverse node:

    1. Be specific: Block particular profiles or domains instead of using broad keyword filters. Precision helps avoid false positives.
    2. Review your logs: Periodically check your PHP error logs to understand what’s being blocked.
    3. Adjust as needed: Refine your blocking strategy based on the patterns you observe.

    Unlike centralized social networks, the Fediverse gives you direct control over what appears on your site. Your blocklist is a reflection of your site’s values and the kind of interactions you want to support.

    Fediverse Reactions

  • From Toot to Post: Mastodon Migration Made Easy

    If you’ve been posting on Mastodon and want to bring those posts into your WordPress site, the new importer makes that possible. It’s a beta feature, but it already handles the basics well—and helps you keep more of your content in one place.

    Keep What You Create

    Social platforms can come and go—or just change in ways you didn’t expect. Maybe your Mastodon server shuts down, or the people running it move on. When that happens, it’s easy to lose your old posts and the history you’ve built up.

    The Mastodon importer helps you take control by bringing your posts into your WordPress site, where you own the content and can decide how it’s stored, shared, and presented. You’re not just copying things over—you’re giving your content a more permanent home.

    Getting Started

    The import process is user-friendly and follows a clear workflow:

    1. Log into your Mastodon account and go to Preferences > Import and Export.
    2. Request your archive and download the ZIP file when it’s ready.
    3. Open the WordPress Mastodon Importer and upload your file.
    4. Choose an author for your imported posts and decide whether to include media files or just the text.

    Once uploaded, you can assign imported posts to a specific author and choose whether to include image attachments with your posts or just import the text content.

    The importer processes your posts from the Mastodon outbox.json file, filtering to include only public posts while skipping boosts. Each post maintains its original publication date, content, and media. If your posts include images, video, or audio, the importer brings those in too and adds them to the post automatically.

    Screenshot of a Mastodon post showcasing redesigned WordPress email notifications, including examples of new follower and mention emails.
    Screenshot of a WordPress blog post about ActivityPub integration showing redesigned email notification templates on a green background.

    Your Posts, Rebuilt

    The importer transforms your Mastodon content into a rich block editor experience. Your posts convert into proper paragraph blocks while maintaining their original formatting. Images are organized into gallery blocks with captions intact, while videos and audio files transform into their respective media blocks for optimal playback.

    Hashtags from your Mastodon posts are converted to WordPress tags, preserving your content’s organizational structure and discoverability.

    When a post is part of a conversation, the importer adds a reply block at the beginning of your post that embeds the original post you were responding to. This keeps the conversation flow clear and provides context for your response.

    All these blocks remain fully editable after import, so you can tweak layouts or adjust media presentation as needed.

    For classic editor users, the importer keeps things simple with standard shortcodes for media. It’s not as fancy as the block version, but it should work reliably with your existing setup.

    It’s a Beta—Your Feedback Counts

    The Mastodon importer is still in beta, and there’s more work ahead—especially when it comes to large archives and better handling of replies. We’ve followed WordPress importer best practices, but real-world use is where things really get tested.

    Tried the importer? Let us know how it went—what worked, what didn’t, and what you’d love to see next. Your feedback helps shape where we take it from here.