ActivityPub for WordPress

Category: Changelog

  • 9.0.0 — Growing Up

    Major versions are the right moment to fix things properly instead of patching around them. In ActivityPub plugin 9.0.0, unpublishing a federated post sends a real Delete instead of a placeholder text, and federation can be tuned down so it doesn’t overwhelm smaller servers. The ActivityPub API moves closer to the W3C standard, and your blog can now be featured in Starter Kits, if you allow it.

    Starter Kits, With Your Consent

    Starter Kits are curated lists of accounts, bundled so that others can discover and follow them in one go. You may know the idea as Starter Packs from Bluesky, and Mastodon is rolling out its own version called Collections with version 4.6. The name varies, the idea is the same: someone who knows a topic well puts together a list of accounts worth following, and shares it.

    For blogs, discovery is the hard part of the Fediverse. A blog doesn’t post twenty times a day, so it rarely surfaces in busy timelines on its own. Being part of a Starter Kit changes that: when someone shares a “great photography blogs” kit, every person who opens it sees your blog, and following is one tap away.

    Screenshot of a Featured-Collection, showing two WordPress blogs, on Mastodon.

    One piece was missing, though: other people couldn’t add your WordPress blog to their lists, because your site never told their server who is allowed to do that. ActivityPub 9.0.0 fixes this with the new Default Starter Kit policy setting: Anyone, Followers only, or Just me. The default is “Just me”, so nothing changes unless you say so. If you want the reach, set it to “Anyone” under Settings → ActivityPub → Activities. Under the hood, this announces a canFeature policy on your profile, based on a new Fediverse Enhancement Proposal (FEP-7aa9) that is not published yet; we’ll link it here once it is.

    The Mastodon team explains the thinking behind Collections in their design post, and Fedi.Tips has a guide to Mastodon’s Lists feature, the private cousin of Collections. And since ActivityPub 8.1.0 you can import Starter Kits into WordPress under Tools → Import, so it works in both directions.

    Blurred Previews for Your Photos

    Photos are heavy. While they load, most Fediverse apps show an empty gray box.

    The plugin now generates a BlurHash for every image: a tiny, blurred color preview that other Fediverse apps can show while the real photo loads. Your followers see a soft impression of the picture instead of an empty rectangle. The BlurHash website has a nice interactive demo.

    The plugin uses the same blurhash property that Mastodon documents as part of its ActivityPub extensions, so your previews work wherever Mastodon’s do. Everything happens automatically in the background; there’s nothing to configure.

    From Placeholder to Delete

    Until now, when you moved a federated post back to draft or made it private, the plugin sent an Update with a placeholder text: “(This post is being modified)”. Your followers kept a copy that claimed the post was being edited, even if it never came back. That was a workaround, and a bad one: it misrepresented your content and left stale placeholders sitting in timelines across the Fediverse.

    ActivityPub 9.0.0 replaces the workaround with the behavior the Fediverse expects. When a federated post moves to draft, pending, private, trash, or gets a password, the plugin now sends a Delete to your followers, so their servers remove their copies. Your site keeps a Tombstone in place of the post, as described in FEP-4f05, so it can announce the post again if you re-publish it.

    Be aware: even unpublishing a post only temporarily might delete it forever on other servers. When you take a post down on purpose, that’s what you want. But if you plan to come back, know that whether the post comes back with you depends on the receiving server, and the boosts, favorites, and replies on the old copies are gone either way. Discourse and NodeBB restore posts like this; Mastodon currently does not, though there’s an open issue we hope to see land soon. For now, treat unpublishing as deleting, even if you plan to publish again.

    Screenshot of the Soft-Delete warning in the Block-Editor.

    That’s why the editor now warns you before you make a federated post a draft, private, or password-protected. The dialog tells you that followers’ copies will be removed, so you know what will happen before you save.

    Federation That Doesn’t Overwhelm Your Server

    Federation is real work. When you publish a post, the plugin sends it to every follower’s server, and each delivery is a signed HTTP request processed in the background. On a well-provisioned server, no problem. On shared hosting with a few thousand followers, that burst of background work can slow your whole site down, right at the moment your new post brings visitors in.

    The new Distribution Mode setting exists so the plugin stays a good guest on the server it runs on. It comes with three presets:

    • Default: the current behavior, as fast as possible (100 deliveries per batch, 15 seconds pause).
    • Balanced: a moderate pace (50 per batch, 30 seconds pause).
    • Eco Mode: gentle on server resources, made for shared hosting (20 per batch, 30 seconds pause).

    Nothing changes unless you need it to: Default behaves exactly like before. But if your site gets sluggish after publishing, switch to Balanced or Eco Mode under the Advanced tab of the ActivityPub settings. Your followers get the post a few minutes later, and your server keeps breathing. A Custom mode with your own batch size and pause is there for fine-tuning.

    The Advanced tab is hidden by default. To enable it, open the ActivityPub settings page, click Screen Options in the top right corner, check Advanced Settings, and save.

    Hosting providers can pin a preset across all their sites with the ACTIVITYPUB_DISTRIBUTION_MODE constant, so a whole fleet of sites stays well-behaved without anyone touching a setting.

    Speaking Standard ActivityPub

    The ActivityPub API (the plugin’s Client-to-Server implementation) keeps converging on what the W3C SWICG is standardizing. Clients can now request the canonical SWICG scope names like activitypub:read:all and activitypub:write:all, and the OAuth discovery metadata advertises them. Token responses include activitypub_actor_id, following the SWICG ActivityPub API Basic Profile, and rate-limit responses now carry a Retry-After header so clients know how long to wait.

    None of this changes anything for existing apps. It just means new apps can connect to your site by following the standard, not our documentation.

    Since this is a major version, there’s one heads-up for developers: we removed functions, methods, and the Follower class that were deprecated in versions 7.0 through 7.4. Everything removed has had a documented replacement for over a year, but if your plugin or theme builds on ActivityPub internals, check the changelog before updating.

    A Good Reason to Update Soon

    Beyond the features, 9.0.0 includes a series of security hardening fixes that keep private data private and tighten how the plugin verifies who is allowed to change what. None of them need anything from you beyond updating, which is exactly why you should update soon. The details are in the changelog below.

    Changelog

    Added

    • Add a Distribution Mode setting to control how quickly posts are delivered to followers.
    • Add an opt-in setting to consent to inclusion in Starter Kits (also called Starter Packs or Featured Collections). Off by default. Find it under Settings, ActivityPub, Activities.
    • C2S clients can now request canonical SWICG ActivityPub API scope names such as activitypub:read:all and activitypub:write:all, and the OAuth discovery metadata advertises them.
    • C2S token responses now include activitypub_actor_id so clients following the SWICG ActivityPub API Basic Profile can discover the authenticated actor.
    • Generate a blurred color preview (blurhash) for images so other fediverse apps can show a placeholder while your photos load.
    • Quote notification emails now include a link to the post that quoted you, so you can review and respond more quickly.
    • Warn in the editor before making a post that’s already shared on the Fediverse a draft, private, or password-protected, since followers’ copies will be removed.

    Changed

    • Add the blurhash term to the outbound JSON-LD @context so attachments that include a blurhash property are strictly correct JSON-LD, matching Mastodon’s own context shape.
    • Federated posts moved to draft, pending, private, trash, or password-protected now send a Delete to followers (previously sent a placeholder “editing” Update or were silent).
    • OAuth rate-limit responses now include a Retry-After header so clients know how long to wait before retrying.
    • Updated a build dependency to a clean release now that a fixed version is available.

    Removed

    • Removed functions, methods, and the Follower class that were deprecated in versions 7.0 through 7.4.

    Fixed

    • Fix a fatal error when receiving a new follower while the Stream plugin is active.
    • Fix a follow request being marked as accepted when the confirmation came from a different account than the one being followed.
    • Fix the Fediverse settings appearing twice and visibility changes not saving in the block editor when the Classic Editor plugin is also active.
    • Fix the introduction video failing to load on the Getting Started help screen.
    • Follower synchronization with Mastodon no longer fails, signed requests with query strings now verify correctly.
    • Harden the Blurhash encoder: skip decompression-bomb images before decoding, flatten transparency onto white so transparent logos no longer produce near-black placeholders, and defer the cron encode until attachment metadata is saved.
    • Images and videos placed in a Media & Text block are now included when a post is shared to the Fediverse.
    • Requests from other platforms to feature your posts are now handled correctly instead of being ignored.
    • RSS and Atom feeds now show a simple @username mention in place of the reply block’s full embed card, which only renders properly when the plugin’s frontend CSS is loaded.
    • Stop a deprecation notice from appearing in the error log when the NodeInfo plugin is also active.

    Security

    • Enforce the signing-key host check on incoming federated activities regardless of how the key identifier is formatted.
    • Fix the real-time activity stream so it only returns the requesting user’s own activities.
    • Harden the Site Health connectivity check so it cannot be used to reach unsafe network addresses.
    • Only share comment replies in the Fediverse when the post they belong to is itself federated, so replies on private or non-federated posts stay private.
    • Prevent a remote server from discovering which of your followers belong to a third-party server it does not control.
    • Prevent logged-in users from viewing another user’s private outbox activities.
    • Prevent remote servers from modifying or deleting federated profiles, posts, and interactions they do not own.
    • Rate-limit the remote-follow lookup to prevent it from being abused to trigger outbound requests.
    • Stop the OAuth token introspection endpoint from revealing another user’s token details to logged-in users.
    • Stop the quote-authorization stamp from exposing a post’s other metadata.

    Get It

    Download from WordPress.org or grab it on GitHub.

    A huge thank you to everyone who contributed code, testing, bug reports, and ideas to this release. Special thanks to .

    Update, and let us know what you think: will you open your blog up for Starter Kits? And does the new delete behavior match what you expected your site to do all along?

  • ATmosphere 1.0.0 — Liftoff

    This post isn’t about the ActivityPub plugin. ATmosphere is a separate plugin from the same small team, for the other half of the open social web: the AT Protocol, the open network behind Bluesky. We’re posting about it here because the audience overlaps and the mission is the same. If there’s enough interest, we’ll spin up a dedicated blog for it. Until then, this is the closest venue.

    A banner that says: WordPress, part of the open social web.

    Today is the public 1.0.0 release on WordPress.org. After months of design notes, internal experiments, and a stretch of focused work alongside the ActivityPub plugin, ATmosphere has cleared the troposphere.

    What ATmosphere is

    When you publish a post, ATmosphere shares it on Bluesky and stores the full article on your AT Protocol account as a structured record. Bluesky replies, likes, and reposts come back as comments on your WordPress post. Approved comments from logged-in readers go the other way and appear as replies under your original Bluesky post. The same conversation lives in both places without you having to copy anything by hand.

    The bet underneath is bigger than cross-posting. ATmosphere publishes site.standard.* lexicon records, so your blog itself becomes AT Protocol data, not just a link shared on Bluesky. Any compatible app can read the full article from your AT Protocol account, the same way it reads a Bluesky post. WordPress becomes a first-class participant in the network, not a visitor.

    How this differs from a cross-poster

    The first question you may have is: how is this different from Jetpack Social’s Bluesky integration, or from any of the other plugins that share to Bluesky?

    The answer is that they’re solving a different problem. A cross-poster gets your content in front of Bluesky users, which is a real and useful thing. But it’s still a broadcast model. Your WordPress site talks at Bluesky, it doesn’t participate in the protocol.

    In practice that shakes out two ways. First, a cross-posted update creates a copy, not a connection. The post on Bluesky and the post on WordPress are separate records, and nothing in the protocol ties them together. Second, your blog itself has no identity in the network. The cross-poster authenticates as you, the person, and posts on your behalf. Your blog as an entity, with its archive and structure, is invisible to the protocol.

    ATmosphere is built around making your blog itself a participant. Every publish writes two records: an app.bsky.feed.post so the update shows up in Bluesky timelines, and a site.standard.document from the standard.site lexicons that stores the full canonical article on your AT Protocol account. A bskyPostRef link ties the two together. Your blog appears in the network as a publication that other apps and aggregators can discover and read in full, not as a stream of truncated link cards.

    If you want a poster, Jetpack Social is the right tool. If you want your WordPress site to be a place on the AT Protocol, that’s what ATmosphere is for.

    Why a third-party PDS, for now

    There’s a natural follow-up once the model clicks: if my WordPress site is acting as a Bluesky identity, why does Bluesky (or another provider) still need to be in the picture at all? Why not host the data on the site itself?

    We tried that route first. About 90% of a Personal Data Server (the AT Protocol service that holds your signed records and streams them to the network) maps cleanly to PHP and a WordPress database. The remaining 10% is the firehose: a WebSocket stream that pushes every change to the network’s relays in real time. PHP’s request-response model is fundamentally incompatible with persistent connections like that, and typical WordPress hosting environments aren’t designed for always-on background processes either.

    The cleaner mental model turned out to be email. Even when you self-host your mail, you don’t build the mail server as a WordPress plugin. The mail server is its own piece of infrastructure that runs alongside your site. AT Protocol is the same shape. The PDS is infrastructure, not application logic. ActivityPub was designed to be implementable by any HTTP server, which is why it works as a plain WordPress plugin. AT Protocol was designed around always-on data servers, so the natural fit is a hosted PDS running next to WordPress, not inside it.

    For 1.0.0, that means using whichever PDS the user already has. Most people connecting ATmosphere come in with a Bluesky account, so they already have a PDS and a DID, and borrowing that lets us focus on the parts that live on the WordPress side: the publishing pipeline, the long-form rendering, the comment round trip, the domain-as-handle handshake.

    We are still pulling on a thread, though. There’s a version of this where a PDS sits comfortably alongside WordPress, ready to host your records for you, so the AT Protocol side feels just as native to WordPress as the ActivityPub side already does. Nothing to announce yet. We’ll let you know when there’s something to show 😉

    Your domain, your handle

    One of the headline features: your WordPress domain becomes your Bluesky handle. Instead of @you.bsky.social, your handle reads @yourblog.com.

    A screenshot of the handle settings.

    ATmosphere handles the verification side. It serves the right file at /.well-known/atproto-did so Bluesky can confirm the domain really belongs to you. From the settings page, it’s one click. You then open Bluesky, pick Change Handle, choose I have my own domain, enter your site, and you’re done. Same identity model Bluesky uses for its own custom domains, but the technical bit takes care of itself.

    Long posts, done right

    The hardest problem in WordPress-to-Bluesky publishing is what to do with a long article on a 300-character network. ATmosphere gives you three options from the settings page:

    • A link card, the default. A clean preview pointing back to your full post.
    • A single post combining the body text and the permalink, for when the post fits.
    • A two-post teaser thread: a hook, a body chunk, and a “continue reading” reply with the link card. The teaser surfaces reliably on bsky.app profiles, and the terminal post always offers a clear path back to the full article on your site.

    When you edit a threaded post, ATmosphere updates the existing Bluesky posts in place when it can, so links and replies stay connected. If you change the publishing format, ATmosphere replaces the old posts with new ones. And the full article, every paragraph of it, lives on your AT Protocol account regardless of which format you pick, so other AT Protocol-aware apps and readers can render the long version too.

    Two-way conversations

    When someone replies, likes, or reposts your post on Bluesky, ATmosphere checks periodically and turns those reactions into WordPress comments on the matching post. Likes and reposts get their own comment types, so they show up as engagement counts rather than duplicating as text comments.

    Going the other way: when a logged-in reader leaves an approved comment on a cross-posted article, it’s published to Bluesky as a reply under your original post. Edits sync. Unapprove or delete, and the corresponding Bluesky reply comes down too. Anonymous comments, trackbacks, and pingbacks are skipped. Only logged-in readers participate in the round trip.

    A few more things worth knowing

    • Backfill. A built-in tool publishes older posts to AT Protocol on demand, batched to ten at a time so it doesn’t overwhelm your server.
    • Post types. Choose which post types publish to AT Protocol from the settings page. Plugins and themes can opt their own custom post types in with add_post_type_support( 'your_type', 'atmosphere' ).
    • Extensible. New atmosphere_publish_post_result and atmosphere_publish_comment_result actions let other code react to publish success or failure. An atmosphere_should_sync_reply filter lets you suppress specific incoming replies before they become comments.

    Get It

    Download from WordPress.org or grab the source on GitHub.

    A dedicated blog?

    This blog has always been about the ActivityPub plugin, and ATmosphere is a different plugin for a different protocol, so this post is something of a guest appearance. If readers tell us they want ongoing release posts, deep dives, and roadmap notes about ATmosphere too, we’ll spin up a dedicated home for it. For now, follow along here and let us know.

    A huge thank-you to everyone who shaped 1.0.0, especially Brandon Kraft (@kraft) and Ryan Cowles, who carried huge pieces of the onboarding, settings, and publishing work over the last few months. Thanks also to the AT Protocol and Bluesky folks who’ve been generous with their time on the lexicon questions.

    Try it out, point your domain at Bluesky, publish a post, and tell us what you think. What should ATmosphere do next?

  • 8.1.0 — By the Numbers

    If 8.0.0 opened the Fediverse up as a two-way street, 8.1.0 helps you see and share what travels down it. A new Fediverse statistics feature leads the release, with a dashboard widget, email reports, and a shareable stats block. Alongside it: a new ActivityPub API that lets third-party Fediverse apps post to your blog, Starter Pack imports, and richer image metadata for photographers.

    Wapuu in a space suit floats in front of an oversized, glowing yearly Fediverse stats card. The card shows a big follower number, a rising line chart, and a small "Top Post" highlight. Around Wapuu, little numbered badges drift like stars through space: posts, likes, boosts, replies. Wapuu holds one of the badges up proudly, as if admiring it.

    Your Fediverse, By the Numbers

    The headline work this release is a brand-new Fediverse statistics feature, three connected pieces that finally let you see (and share) how your site is doing on the open social web.

    The Dashboard Widget

    When you log into your WordPress admin, there’s now a Fediverse Stats widget on the dashboard.

    A screenshot of the Fediverse Stats Dashboard Widget.

    It’s built around three things:

    • Stat highlights: followers, posts, and engagement counts, with a comparison to the previous period so you can tell if the line is going up or down.
    • A monthly engagement chart: an interactive SVG line chart of engagement over time.
    • Top supporter and top posts: the people most engaged with your blog, and the posts that travelled furthest.

    If you have both a user actor and a blog actor enabled, a selector lets you switch between them.

    Monthly and Annual Email Reports

    Not everyone logs into wp-admin every day, so the plugin can now also email you your stats.

    There are two report types:

    • Annual reports, a wrap-up of your year on the Fediverse. On by default.
    • Monthly reports, a smaller recap for the previous month. Opt-in, for the folks who like a regular pulse check.

    Both are delivered through the WordPress email system and available as notification preferences, so you can turn them on or off per actor.

    The Stats Block, With a Sharepic

    The same statistics also power a new Fediverse Stats block, a yearly snapshot you can drop into any post or page.

    Fediverse Stats 2025

    @activitypub.blog

    21 Posts Federated
    1,720 Total Engagements
    Follower Growth +0 637 → 637 followers
    Most Active Month July
    Top Supporter Tim Chambers 10 boosts

    Top Posts

    1. 7.0.0 – I will follow you! 203 engagements
    2. Bridging the gap 158 engagements
    3. Our 2025 Roadmap: Building the Future of WordPress Federation 134 engagements
    4. 6.0.0 – New Kids on the Block 109 engagements
    5. 7.3.0 – Ctrl+Fed+Delete 91 engagements
    ActivityPub for WordPress · Powered by the ActivityPub plugin

    On the page, it renders as a clean card styled to match your theme, with colors and fonts picked up automatically from the active block theme, so it feels at home without fiddling.

    Underneath, it also generates a shareable image version, a sharepic ready to post to the Fediverse itself. Think of it as your Fediverse year-in-review, without firing up a design tool.

    And to make the timing easier, there’s a new seasonal starter pattern that suggests sharing your stats when you create a new post in December or January, the moment when everyone on the timeline is already in reflection mode.

    Open for Apps: The ActivityPub API

    For a long time, the plugin has spoken the server-to-server half of ActivityPub fluently, which is how your posts reach Mastodon, Pixelfed, and the rest. With 8.1.0, the plugin now also exposes an ActivityPub API, an implementation of the Client-to-Server (C2S) half of the protocol.

    In plain language: third-party Fediverse apps can now create, edit, and delete posts on your blog directly, the same way they would on a Mastodon account. Alongside the basics, the ActivityPub API also supports Block, Add (pin a post), and Remove (unpin a post) activities. To make app discovery smoother, actor profiles now also expose OAuth server metadata and a registration endpoint, so clients can find their way in without manual setup.

    The ActivityPub API is experimental and hidden behind a feature flag. To try it, open the ActivityPub settings page, click Screen Options in the top right, enable Advanced Settings, and save. Under the new Advanced tab, flip on ActivityPub API and you’re off. Once enabled, connected apps can be managed from your profile page.

    This is foundational work. Most of what it enables will show up over time, as more apps start treating your WordPress site as something they can post from, not just to.

    Bring Your Friends: Starter Pack Imports

    Starter Packs are one of the easier ways to onboard onto a new Fediverse platform: follow a curated list of people and you land somewhere with a timeline already humming.

    8.1.0 adds support for importing Starter Packs in both the Pixelfed and Mastodon formats. If you’re moving to WordPress from another Fediverse platform, or setting up a new blog and want to bootstrap your Following list, point the importer at a Starter Pack and the plugin will take care of the rest.

    EXIF Metadata for Images

    Photographers, this one’s for you. Image attachments now carry EXIF metadata (camera body, lens, focal length, aperture, shutter speed, ISO) using the Vernissage namespace.

    The short version: the information that makes a photo worth reading about no longer gets stripped on the way out. Vernissage and other photo-focused Fediverse platforms can pick up the metadata and display it alongside the image, the way they would for a native post.

    Changelog

    Security

    • Add rate limiting to app registration to prevent abuse.
    • Fix blog actor outbox exposing private activities to unauthenticated visitors.
    • Restrict localhost URL allowance to local development environments only.
    • Verify that the signing key belongs to the same server as the activity actor.

    Added

    • Add a “Posts and Replies” tab bar for author archives that filters between posts and replies, similar to Mastodon’s profile view.
    • Add a liked collection to actor profiles, showing all posts the actor has liked.
    • Add a seasonal starter pattern that suggests sharing Fediverse stats when creating a new post in December and January.
    • Add a stats block that displays annual Fediverse statistics as a card on the site and as a shareable image on the Fediverse, with automatic color and font adoption from the site’s theme.
    • Add Fediverse statistics dashboard widget with engagement metrics, charts, and monthly/annual email reports.
    • Added activitypub_pre_get_by_id filter to allow plugins to register custom virtual actors resolved by ID.
    • Add EXIF metadata support for image attachments using Vernissage namespace.
    • Add new Fediverse Following Page and Profile Page block patterns.
    • Add OAuth server metadata and registration endpoint discovery to actor profiles.
    • Add real-time streaming for inbox and outbox updates via Server-Sent Events (SSE).
    • Add support for Block, Add (pin post), and Remove (unpin post) activities via Client-to-Server API.
    • Add support for check-in activities posted via compatible apps.
    • Add support for importing Starter Packs in both the Pixelfed and Mastodon formats.
    • Add tags.pub integration to supplement tag timelines with posts from across the Fediverse.
    • Support for ActivityPub Client-to-Server (C2S) protocol, allowing apps like federated clients to create, edit, and delete posts on your behalf.

    Changed

    • Block patterns for follow, following, and profile pages are now only suggested when editing pages.
    • Fix notification pagination when using Enable Mastodon Apps: use date-constrained queries instead of truncating the shared notification pool, and expose $limit, $before_date, and $after_date as additional filter arguments so third-party handlers can fetch the correct window.
    • Improve the pre-publish format suggestion panel with clearer messages and a confirmation after applying a format.
    • Podcast episodes now respect the configured object type setting instead of always being sent as “Note”.
    • Show reaction action buttons even when a post has no reactions yet.

    Fixed

    • ActivityPub endpoints that surface comment, reply, like, share, and remote-reply metadata now honor the parent post’s visibility setting.
    • Added validation for SSE access tokens passed via query parameter.
    • Fix account migration (Move) not working when moving back to an external account.
    • Fix a fatal error during activity delivery when the outbox item has been deleted.
    • Fix a fatal error when receiving activities with a non-string language property.
    • Fix a fatal array_keys(null) in Comment::get_comment_type_slugs() that could take down any request where a third-party plugin transitioned a custom comment type before add_comment_type() had been called.
    • Fix a missing script dependency notice on the admin page in WordPress 6.9.1 and later.
    • Fix BuddyPress @mention filter corrupting Fediverse Followers and Following blocks.
    • Fix cleanup jobs silently doing nothing on sites where purge retention options were not set.
    • Fix comments on remote posts being incorrectly held in moderation.
    • Fix double-encoded HTML entities in post titles on the Fediverse Stats dashboard.
    • Fixed an issue where quote authorization stamps could reference unrelated posts.
    • Fixed double-encoding of special characters in comment author names on updates.
    • Fixed emoji shortcode replacement to handle special characters in emoji names correctly.
    • Fix fatal error when other plugins hook into the user agent filter expecting two arguments.
    • Fix Fediverse Preview showing the standard web view instead of the ActivityPub preview for draft posts.
    • Fix OAuth authentication failing for local development clients using localhost subdomains.
    • Fix performance regression from reply-exclusion filter by skipping it for queries targeting non-ActivityPub post types.
    • Fix Reader feed failing to load with newer WordPress versions.
    • Fix remote actor avatars getting stuck on broken URLs when the original image becomes unavailable.
    • Fix Site Health check showing an empty error message when the WebFinger endpoint is not reachable.
    • Fix the Fediverse profile “Joined” date showing the oldest post date instead of when the site started federating.
    • Fix the Fediverse profile showing an inflated post count by excluding incoming comments from the total.
    • Fix Update handler using stale local actor data instead of the activity payload.
    • Improved HTTP Signature validation for requests with a missing Date header.
    • Only allow S256 as PKCE code challenge method for OAuth authorization.
    • Prevent third-party plugin UI elements and scripts from appearing in federated content.
    • Require signed peer requests for the followers synchronization endpoint per FEP-8fcf.
    • Show a styled error page instead of raw technical output when an OAuth application cannot be reached during authorization.
    • Strip private recipient fields from all outgoing activities to prevent leaking private audiences.
    • Sync ActivityPub blog actor settings via Jetpack.
    • Use ap_actor post ID for remote account IDs instead of remapping URI strings.
    • Use safe HTTP request for signature retry to prevent requests to private IP ranges.
    • Validate emoji updated timestamps before storing them.

    Get It

    Download from WordPress.org or grab it on GitHub.

    A huge thank you to everyone who contributed code, testing, bug reports, and ideas to this release.

    Update, drop a stats block into your next recap post, and let us know what you think. Which number surprised you most? Which Fediverse app are you most excited to try with your blog?

  • 8.0.0 — Smash That Like Button

    Wapuu in a space suit floats in space assembling a glowing profile layout made of blocks, placing a “Follow” button while reaction icons for Like and Boost hover nearby.

    Every major version is a milestone, and 8.0.0 is no exception. Your WordPress blog just became a two-way street in the Fediverse. Visitors can like and boost your posts directly on your site. Media from federated replies is handled more reliably, and new block patterns make it easy to drop ActivityPub features into your pages.

    Like and Boost, Right From Your Blog

    The Fediverse Reactions block now has optional Like and Boost action buttons, inline with each reaction group. When a visitor clicks one, a modal opens where they can enter their Fediverse handle or copy the post URL to interact from their home server.

    Like this post modal dialog on activitypub.blog showing two ways to interact: a copyable Post URL field and a "Your Profile" field where visitors can enter their Fediverse handle.

    The plugin remembers the visitor’s profile in their browser, so the second time around it’s even faster. And for folks who aren’t familiar with how the Fediverse works, each modal now includes a collapsible “Why do I need to enter my profile?” help section that explains the open social web in plain language.

    This dramatically lowers the friction for cross-platform engagement.

    Block Patterns and Templates

    Setting up a Fediverse-ready profile page used to mean manually assembling Follow Me, Extra Fields, and Followers blocks. Not anymore.

    WordPress Site Editor Patterns screen with the Fediverse category selected, showing four block patterns: Author Header with Follow, Author Profile with Follow, Fediverse Follow Page with a profile card and followers list, and Fediverse Sidebar with a Follow Me block and Followers block.

    We’ve added a “Fediverse” block pattern category with four pre-configured layouts:

    • Author Profile with Follow, a compact profile card.
    • Fediverse Follow Page, a full-page follow experience.
    • Author Header with Follow, great for author archive headers.
    • Fediverse Sidebar, drop it into any sidebar or widget area.

    If you’re running a block theme on WordPress 6.7+, there’s also a new Author Archive (Fediverse) block theme template ready to go.

    Publish Smarter With Post Format Suggestions

    A new pre-publish panel now analyzes your post content and suggests an appropriate post format when your object type is set to “Post Format.” Got a post that’s mostly images? It’ll nudge you toward the Image format. A video post? Video format.

    WordPress block editor pre-publish panel showing post format suggestions. The sidebar displays "Suggestion: Use a post format" and "Suggestion: Add Tag" options, with the Fediverse section expanded recommending to "Set format to Image" because the post contains an image, making it visible on platforms like Pixelfed. A checkbox for "Always show pre-publish checks" is enabled at the bottom.

    This matters because media-focused Fediverse platforms like Pixelfed and Vernissage display Notes differently than Articles, so choosing the right format means your content looks its best everywhere it lands.

    Community Snippets

    We’ve added a snippets/ folder to the GitHub repository, a home for lightweight, community-contributed extensions that don’t belong in the core plugin but are too useful to lose. The first batch includes:

    • FediBlog Tag, automatically adds #FediBlog to standard blog posts for better Fediverse discovery.
    • Locale from Tags, derives post locale from taxonomy tags.
    • Bot Account, marks your profile as automated and displays a “BOT” badge in the Fediverse.
    • Blockless ActivityPub, renders Fediverse reactions as pure server-side HTML, no JS required.
    • Photon CDN, serves cached remote media through Jetpack’s Photon CDN for faster delivery.

    Got a snippet of your own? Check out the snippets folder and send a PR.

    Smarter Media Caching

    Under the hood, we’ve rebuilt how the plugin handles remote media, avatars, emoji, images, audio, and video from across the Fediverse. Instead of importing everything into the WordPress Media Library at insert time, media is now wrapped in custom blocks and cached lazily at render time.

    What does that mean for you? Faster processing of incoming content, less disk usage, and better rendering of audio and video attachments. Original remote URLs are preserved in block attributes, so caches can be regenerated without data loss. If you’re using Jetpack’s Site Accelerator, that works too, the new system is built filter-first.

    For site admins, there are new CLI commands to keep things tidy:

    wp activitypub cache status
    wp activitypub cache clear

    Minimum PHP 7.4

    With WordPress 7.0 deprecating PHP 7.2 and 7.3, we’ve raised the minimum requirement to PHP 7.4. This lets us clean up compatibility polyfills and use more modern PHP features going forward. If you’re still on an older version, update your PHP before updating the plugin.

    Changelog

    Added

    • Add a help section to interaction dialogs explaining the Fediverse and why entering a profile is needed.
    • Add a notice on the Settings page to easily switch from legacy template mode to automatic mode.
    • Add a pre-publish suggestion that recommends a post format for better compatibility with media-focused Fediverse platforms.
    • Add a Site Health check that warns when plugins are causing too many federation updates.
    • Add backwards compatibility for the ACTIVITYPUB_DISABLE_SIDELOADING constant and activitypub_sideloading_enabled filter from version 7.9.1.
    • Add bot account snippet that marks ActivityPub profiles as automated accounts, displaying a “BOT” badge on Mastodon and other Fediverse platforms.
    • Add Cache namespace for remote media caching with CLI commands, improved MIME validation, and filter-based architecture.
    • Add federation of video poster images set in the WordPress video block.
    • Add Locale from Tags community snippet.
    • Add optional Like and Boost action buttons to the Fediverse Reactions block, allowing visitors to interact with posts from their own server.
    • Add pre-built Fediverse block patterns for easy profile, follow page, and sidebar setup.
    • Add snippet for blockless fediverse reactions.
    • Add wp activitypub fetch CLI command for fetching remote URLs with signed HTTP requests.

    Changed

    • Improved active user counting for NodeInfo to include all federated content types and comments.
    • Improve language map resolution to strictly follow the ActivityStreams spec.
    • Superseded outbox activities are now removed instead of kept, reducing clutter in the outbox.
    • The minimum required PHP version is now 7.4.

    Fixed

    • Accept incoming activities from servers that use standalone key objects for HTTP Signatures.
    • Fix a crash on servers where WordPress uses FTP instead of direct file access for media caching.
    • Fix a crash when receiving posts from certain federated platforms that send multilingual content.
    • Fix automatic cleanup of old activities failing silently on sites with large numbers of outbox, inbox, or remote post items.
    • Fix comment count to properly exclude likes, shares, and notes.
    • Fix follow button redirect from Mastodon not being recognized.
    • Fix modal overlay not covering the full screen on block themes.
    • Fix outbox invalidation canceling pending Accept/Reject responses to QuoteRequests for the same post.
    • Fix QuoteRequest handler to derive responding actor from post author instead of inbox recipient.
    • Fix reactions block buttons inheriting theme background color on classic themes.
    • Fix reactions block layout on small screens and remove unwanted button highlight when clicking action buttons.
    • Fix signature verification rejecting valid requests that use lowercase algorithm names in the Digest header.
    • Fix soft-deleted posts being served instead of a tombstone when the post is re-saved.
    • Improve compatibility with federated services that use a URL reference for the actor’s public key.
    • Improve handling of all public audience identifiers when sending activities to followers and relays.
    • Prevent private recipient lists from being shared when sending activities to other servers.

    Get It

    Download from WordPress.org or grab it on GitHub. Remember to check your PHP version first — 7.4 or higher is now required.

    A huge thank you to everyone who contributed code, testing, bug reports, and ideas to this release. Special thanks to @kraft, @jeremy, and @futtta for their snippet contributions.

    Update, try out those Like and Boost buttons, and let us know what you think — what’s the feature you’ve been waiting for? What would you like to see next?

  • 7.9.0 — Spring Cleaning 🪣🧹

    Every now and then, it’s time to tidy things up.

    An image of a Wapuu in a space-suite, cleaning the milky way.

    Version 7.9.0 is a spring-cleaning release: fewer rough edges, better defaults, and a lot of small improvements that make the plugin feel smoother and more predictable in daily use. No big rewrites — just many thoughtful fixes and refinements.

    And yes, there’s one change you’ll notice immediately.

    Emoji, But Make Them Emoji 🎺

    Custom emoji from the Fediverse now finally show up as… emoji.

    Instead of seeing placeholders like :sad_trombone:, federated posts now render the actual custom emoji they were meant to display. It’s a small detail, but one that makes conversations feel more human, and a lot less like reading raw markup.

    A screenshot of a comments section of a WordPress blog, showing comments with custom emojis.

    Sometimes polish really is about the little things.

    A Healthier, More Predictable Setup 🩺

    A quiet but important part of this release focuses on making things fail less often — and recover better when they do.

    Version 7.9.0 adds new Site Health checks to detect common issues that can silently break federation, including missing scheduled events and security plugins blocking REST API access. When possible, the plugin now attempts to repair these problems automatically.

    We also tightened up activity scheduling and outbox processing to reduce edge cases where federation could stall or behave inconsistently. These changes don’t add new buttons or screens, but they make ActivityPub for WordPress more resilient in real-world setups.

    Following, Reading, and the Social Graph 👥

    This release also includes a few improvements that move us one step closer to full Reader support — while keeping things deliberately cautious.

    With the new Fediverse Following block and Extra Fields improvements, it’s now much easier to build a proper profile page in WordPress, similar to what many other Fediverse platforms offer. You can surface who you follow and how you present yourself, using blocks instead of custom code.

    A screenshot of the Following-Block in the Editor.

    The Reader itself remains behind a feature flag and is still considered experimental. This release focuses on preparing the surrounding pieces — navigation, feedback, and presentation — rather than enabling it by default.

    If you’re curious about where this is heading, you can enable the feature and try it out today. As with earlier previews, feedback is very welcome and helps shape what full Reader support will eventually look like. (See the initial Reader announcement for upgrade notes and details.)

    Changelog 🪵

    Added

    • Add Fediverse Following block to display accounts the user follows.
    • Add global default quote policy setting that can be overridden per-post.
    • Add health check to verify scheduled events are registered and auto-repair if missing.
    • Add location support for posts using WordPress Geodata post meta fields.
    • Add Podlove Podcast Publisher integration for podcast episode federation.
    • Add site health check to detect when security plugins block REST API access.
    • Add Social Web item to the admin bar for quick access to the reader.
    • Add soft delete support with Tombstone objects when post visibility changes to local/private.
    • Custom emoji from the fediverse now show up instead of looking like :sad_trombone:.
    • Make actor table columns filterable.
    • Send Add/Remove activities when changing a post’s sticky status to improve interoperability with the featured collection.
    • Show warning instead of reply link when logged-in user cannot federate replies to fediverse comments.

    Changed

    • Defer outbox processing to async execution to improve publishing performance.
    • Move Jest mocks to tests/js directory for better project organization.
    • Remove redundant __nextHasNoMarginBottom props now that @wordpress/components 32.0.0 defaults to true.
    • Revert to synchronous outbox processing with improved timeout handling and WebFinger error caching.

    Fixed

    • Don’t filter the comment query when type__not_in has been set.
    • Filter comments on ActivityPub posts from REST API responses.
    • Fix duplicate media attachments when featured image is also in post content.
    • Fixed Federated Reply block embed appearing squished at 200×200 pixels for same-site embeds by passing explicit width to wp_oembed_get().
    • Fixed pagination metadata leaking when “Hide Social Graph” privacy setting is enabled.
    • Fix migration activities not being scheduled for federation due to hook registration timing.
    • Fix older comments with empty type not being federated.
    • Fix quote requests from Mastodon not being received.
    • Fix users not being accessible after re-enabling ActivityPub capability.
    • Hide admin REST API endpoints from discovery index.
    • Show informational notice when trying to follow an already-followed account.
    • Skip fetching public audience identifiers which are not actual recipients.

    Downloads

    Thank You 💛✨

    A huge thank you to everyone who tested early builds 🧪, filed bug reports 🐞, shared feedback 💬, reviewed pull requests 🔍, or helped improve docs 📚. Your input directly shaped many of the fixes and cleanups in this release.

    And thanks to everyone running ActivityPub for WordPress out in the wild 🌍 — that’s where spring cleaning really shows what needs sweeping 🧹.

    You make this project better, one emoji (and one fix) at a time 🥰

  • 7.8.0 – Happy Holidays

    7.8.0 – Happy Holidays

    As the year winds down, we’ve wrapped up a release that brings better moderation tools, a new way to display reactions, and a small surprise, just in time for the holidays.

    Stronger Tools for Moderation

    Moderation can be hard work, especially on the Fediverse, where conversations flow in from all directions. This release introduces new tools that help you stay in control with less manual effort.

    You can now subscribe to shared blocklists and let the plugin keep them up to date automatically. Subscribed lists are synced on a weekly cadence, so changes made upstream are reflected on your site without you having to lift a finger.

    A screenshot of the block list subscription feature.

    On top of that, we’ve added a bulk domain blocklist importer. You can upload a CSV or plain text file, including Mastodon-style exports, and quickly add large numbers of domains at once. To make it even easier to get started, the importer includes a one-click option for the popular community-maintained IFTAS DNI list (@about.iftas.org).

    A screenshot of the block list importer feature.

    Together, these features make moderation more scalable and less stressful, so you can spend more time engaging and less time firefighting.

    Reactions, Your Way

    Reactions are a big part of how conversations feel alive on the Fediverse, and now you have more control over how they appear on your site.

    The Fediverse Reactions block gained a new Summary display style. Instead of showing a facepile of avatars, this option presents reactions as clean, inline counters for comments, likes, boosts, and replies. It’s a great fit for minimal layouts, feeds, or sites where avatars are disabled.

    A screenshot of the compact reactions.

    You can switch between the classic facepile and the new summary style directly in the block settings. And if avatars are turned off in discussion settings, the block automatically falls back to the summary view.

    A Sneak Peek at the Reader (Experimental)

    One more thing, for the curious among you, there’s now an early preview of the ActivityPub Reader, hidden behind a feature flag in the Advanced settings tab. If you don’t see it yet, open Screen Options at the top right of the ActivityPub settings page, check “Advanced Settings,” and save. That reveals the Advanced tab where you can enable the Reader.

    A screenshot of the reader implementation.

    When enabled, this adds a new “Social Web” submenu to your Dashboard menu item. An place where you can read posts and shares from accounts you follow, turning your WordPress admin into a lightweight Fediverse reader.

    Because this is still very much a work in progress, the Reader is disabled by default and clearly marked as experimental. The UI, behavior, and feature set will change significantly in future releases as we explore what a great native Fediverse reading experience inside WordPress could look like.

    If you enjoy testing new ideas, we’d love to hear your feedback, whether it’s bug reports, rough edges you’ve noticed, or ideas about what this Reader should become. Early input helps shape where this goes next, so feel free to share your thoughts in whatever form works best for you.

    Changelog

    Added

    • Add blocklist subscriptions for automatic weekly synchronization of remote blocklists.
    • Add compact display style to Reactions block that hides avatars.
    • Add domain blocklist importer for bulk importing blocked domains.
    • Add image optimization for imported attachments (resize to 1200px max, convert to WebP).
    • Add local caching for remote actor avatars.
    • Add relay mode to forward public activities to all followers.
    • Add scheduled cleanup for remote posts, preserving posts with local user interactions.
    • Add site health check to warn when DISABLE_WP_CRON may impact ActivityPub functionality.
    • Add Social Web Reader for browsing ActivityPub content directly in WordPress admin.
    • Delete remote posts on plugin uninstall.
    • Mastodon importer now imports self-replies as comments, preserving thread structure.

    Changed

    • Cache expensive operations in Post transformer to improve performance.
    • Improve performance and reliability of @-mention detection.
    • Reduce federated content size by removing unnecessary HTML attributes.
    • Skip downloading video and audio attachments, embedding remote URLs directly to avoid storage limits.
    • Use stable term_id-based IDs for Term transformer to ensure federation consistency.
    • Wrap blocked domains and keywords tables in collapsible details element.

    Fixed

    • Respect WordPress “show avatars” setting for remote actor avatars.
    • Ensure NodeInfo accurately represents site administrators to the Fediverse.
    • Fediverse Followers block now works correctly when the “Hide Social Graph” privacy option is enabled.
    • Fix NodeInfo documents to comply with schema specification.
    • Follow Me block button-only style now respects width settings from the inner Button block.
    • Preserve whitespace inside preformatted elements when federating content.

    Downloads

    Holiday Thanks

    A special thank-you to everyone who joined us during the recent office hours — for the questions, the thoughtful feedback, and the great conversations about where ActivityPub for WordPress should go next. Talking directly with you helps shape these releases more than any roadmap ever could.

    See you in 2026 — and happy holidays!

  • 7.7.0 — Extra Quotable

    7.7.0 — Extra Quotable

    Right on the heels of WordPress 6.9 we released a new version of the ActivityPub plugin, making quote comments visible in the Reactions block and bringing you new ways of customizing your author pages.

    Quotes Join the Reactions Party

    When someone quotes your post on Mastodon or other Fediverse platforms, you’ll now see it right alongside your likes and reposts. Quotes get their own row in the Fediverse Reactions display, making it easy to see at a glance who’s building on your ideas and adding their own commentary.

    Fediverse Reactions section showing three rows: 25 reposts displayed as a row of user avatars, 27 likes with their own row of avatars, and 1 quote with a single avatar—demonstrating how quotes now appear as a separate reaction type alongside likes and reposts.

    Behind the scenes, we improved how we’re detecting quotes. Different platforms have their own ways of handling quote posts, and not all of them speak the same language. The plugin now understands these variations better, so whether someone quotes you from Mastodon, Misskey, or elsewhere, it just works.

    This means your engagement stats tell a fuller story. A quote isn’t just a repost—it’s someone adding their voice to yours, and now WordPress can recognize and display that distinction.

    Show Off Your Fediverse Identity

    If you’ve set up extra fields on your Fediverse profile—things like your website, pronouns, location, or links to other accounts—you can now display them directly on your WordPress site with the new Extra Fields block.

    • Fediverse Extra Fields block using the cards style, showing two profile fields displayed as separate bordered cards: 'Powered by' with value 'WordPress' and 'Blog' with a clickable URL, stacked vertically below the author profile header.
    • Fediverse Extra Fields block using the default list style, showing profile fields in a compact table layout with labels on the left and values on the right: 'Powered by: WordPress' and 'Blog:' with a clickable URL.
    • Fediverse Extra Fields block using the stacked style, showing profile fields with labels above their values: 'Powered by' above 'WordPress' and 'Blog' above a clickable URL, arranged vertically below the author profile header.

    Drop it onto any page, post, or your author archive template, pick a style that fits your theme, and your profile details appear right where your visitors can see them. Choose from a clean table layout, a stacked list, or styled cards. You can also control how many fields to show and customize colors to match your site.

    Changelog

    Added

    • Add documentation guide for using ActivityPub blocks in classic themes with Block Template Parts
    • Added a new Fediverse Extra Fields block to display ActivityPub extra fields, featuring compact, stacked, and card layouts with flexible user selection options.
    • Added support for quote comments, improving detection and handling of quoted replies and links in post interactions.
    • Add notifications for boosts, likes, and new followers in Mastodon apps via the Enable Mastodon Apps plugin
    • Adds support for turning tags, categories, and custom taxonomies into federated collections in the Reader view so you can browse and follow topics more seamlessly.
    • Prevent email notifications for comments on ActivityPub custom post types.
    • Send a Reject activity when a quote comment is deleted, revoking previous quote permissions and ensuring consistent inbox handling.
    • Store and retrieve webfinger acct for remote actors to improve identification and reduce lookups

    Changed

    • Improve gallery and image block markup for ap_posts with better alt text and optimized layouts.
    • Improve support for media attachments by handling Audio, Document, and Video object types in addition to Images.
    • Maintain consistent return values in Create handler.
    • Remove trailing hashtags from incoming posts to prevent duplication with taxonomy tags.
    • Store comments and reactions from followed actors on reader posts, and keep them separate from your site’s comments in wp-admin.
    • Update compatibility testing for PHP 8.5 and WordPress 6.9
    • Use tag name instead of slug for hashtag display.

    Fixed

    • Always includes id, first, and last links in collection responses, ensuring followers and following lists display correctly in Mastodon.
    • Automatically approves reactions on ActivityPub posts in the Reader view for a smoother, more seamless interaction experience.
    • Deliver public activities to followers only.
    • Disable REST API endpoints for internal post types.
    • False mention email notifications for users in CC field without actual mention tags.
    • Fix “Filename too long” errors when downloading attachments from URLs with query parameters (e.g., Instagram CDN URLs).
    • Fix make_clickable corrupting existing anchor tags in ActivityPub content
    • Fix PHP 8.5 deprecation warnings for ReflectionProperty::setAccessible() and ReflectionMethod::setAccessible()
    • Improved handling of unusual activity data to avoid errors when activities contain unexpected formats.
    • Preserve original ActivityPub activity timestamps when creating posts and comments instead of using current time.
    • Prevented duplicate email notifications when ActivityPub instances re-send Follow activities for already-following actors.
    • Prevents unwanted comment types—like pingbacks, trackbacks, notes and custom system comments, from being federated, ensuring only real user comments are shared with the fediverse.
    • Removed a redundant instruction from the custom post content settings to simplify the UI.
    • Reply block now shows fallback link when oEmbed fails instead of empty div.
    • Simplified reply links by removing special handling for federated comments, making replies work the same for all comments where replying is allowed.
    • Undefined array key warning in Scheduler::async_batch when called without arguments.

    Downloads

    Thank You!

    As always, a huge thanks to everyone who contributed code, reported bugs, tested early builds, and shared ideas. Every bit of feedback helps make ActivityPub for WordPress better for the whole community.

    Version 7.7.0 is available now—update and let us know what you think!

  • 7.6.0 — Command, Sync & Go

    This release puts speed and control right at your fingertips. Whether you’re jumping between settings, syncing followers, or handling quotes in real time, version 7.6.0 makes managing your Fediverse presence faster and more intuitive than ever.

    Wapuu, the yellow WordPress mascot, pilots a small spaceship shaped like the WordPress ‘W’ through a glowing Fediverse nebula. Light trails and floating ActivityPub icons surround the ship, symbolizing fast, effortless navigation through connected worlds.

    Navigate in a Flash

    Say hello to the quickest way to move around your ActivityPub settings.

    In preparation for WordPress 6.9, which brings the Command Palette (Cmd/Ctrl + K) to the entire wp-admin, the plugin now adds its own commands, giving you instant, keyboard-driven access to your workflows anywhere in WordPress.

    Type “ActivityPub” and you’ll see context-aware commands that adapt to your site setup and user role. Whether you’re managing a blog actor or a user actor, you can open followers and following lists, check blocked actors, jump straight to your settings, or even search and edit extra fields — all without ever leaving the Command Palette.

    A screenshot of the Command Palette in action.

    Every command includes the ActivityPub icon for easy recognition. Just press Cmd + K or Ctrl + K, start typing, and go — it’s the smoothest way yet to pilot your Fediverse setup.

    Stay in Sync Across the Fediverse

    Your follower lists now stay accurate wherever you connect.
    With support for Follower Synchronization (FEP-8fcf), the plugin automatically keeps your followers collection in step with other servers — even when things drift out of sync.

    If differences appear, background tasks quietly reconcile them, keeping your lists clean and consistent. The result is a smoother, more reliable experience across the entire Fediverse — no manual fixes required.

    Speed When It Counts

    Quoted posts and follow confirmations now move at the speed of conversation.

    A new immediate Accept dispatch system sends responses as soon as they’re created, instead of waiting for the next scheduled queue.

    That means faster follow confirmations and quicker quote acknowledgments, making interactions feel more natural across the Fediverse. Behind the scenes, those Accept messages go straight to the right inboxes — including mentioned and replied-to users — while a scheduled backup ensures full compatibility with slower servers.

    It’s a smart balance between speed and reliability, helping your posts and follows appear almost instantly.

    Privacy, Your Way

    Want to keep your social graph private? You can now hide your followers and following lists from public view while keeping all relationships intact. Your followers still follow — they’re just hidden when you prefer a little more privacy.

    Full Changelog

    Added

    • Add bidirectional transforms between reply and embed blocks for improved user experience.
    • Add Command Palette integration for quick navigation to ActivityPub admin pages
    • Added a new ap_object post type and taxonomies for storing and managing incoming ActivityPub objects, with updated handlers
    • Added a privacy option to hide followers and following lists from profiles while keeping follow relationships intact.
    • Added a scheduled task and setting to automatically purge old inbox items, helping maintain site performance and storage control.
    • Added fallback to trigger create handling when updates fail for missing posts or comments, ensuring objects are properly created.
    • Added immediate dispatch for Accept activities to speed up quoted posts while keeping scheduled processing for compatibility with other instances.
    • Added new configuration options to better manage traffic spikes when federating posts, allowing finer control over retry limits, delays, and batch pauses.
    • Added support for FEP-8fcf follower synchronization, improving data consistency across servers with new sync headers, digest checks, and reconciliation tasks.
    • Add LiteSpeed Cache integration to prevent ActivityPub JSON responses from being cached incorrectly. Includes automatic .htaccess rules and Site Health check to ensure proper configuration.
    • Add quote visibility setting for Classic Editor users.
    • Add unified attachment processor for handling ActivityPub media imports from both remote URLs and local files, with automatic media block generation and Classic Editor support.
    • Integrate Federated Reply block with WP.com Reader’s post share functionality, allowing users to reply to ActivityPub posts directly from the Reader.

    Changed

    • Added support for FEP-3b86 Activity Intents, extending WebFinger and REST interactions with new Create and Follow intent links.
    • Added support for the latest NodeInfo (FEP-0151), with improved federation details, staff info, and software metadata for better ActivityPub compliance.
    • Extended inbox support for undoing Like, Create, and Announce activities, with refactored undo logic and improved activity persistence.
    • Improved Classic Editor integration by adding better media handling and full test coverage for attachments, permissions, and metadata.
    • Improved delivery of public and follower activities by expanding local recipient handling to include all ActivityPub-capable users and follower collections.
    • Improved inbox performance by batching and deduplicating activities, reducing redundant processing and improving handling during high activity periods.
    • Improved REST API responses with smarter context handling.
    • Improved REST collection pagination by using explicit total item counts for more accurate results.
    • Moved default visibility handling from the server to the editor UI, ensuring consistent and flexible ActivityPub visibility settings across both block and classic editors.
    • Prevented self-announcing by ignoring announces from the blog actor, while still processing announces from user and external actors.
    • Refactored activity handling to support multiple recipients per activity, allowing posts and interactions to be linked to several local users at once.
    • Refactored avatar handling into a new system that stores and manages avatars per remote actor, improving reliability and preparing for future caching support.
    • Refactored the inbox system to use a shared inbox, storing activities once with multiple recipients for improved efficiency and reduced duplication.
    • Reorganize integration loader and move Stream integration into dedicated folder structure.
    • Reply posts: do not display post title before @mentions in posts that are replies to somebody else
    • Simplified configuration by always enabling the shared inbox and removing its separate setting, UI field, and related logic.
    • Simplified inbox storage settings, allowing certain activities (like deletes) to be skipped to reduce unnecessary database use.
    • Simplify follow() API return types to int|WP_Error for better predictability.
    • Updated inbox handling to support multiple users receiving the same activity and improve overall data consistency.
    • Updated mailer hooks to send notifications only when activities are successfully handled, preventing emails for failed events.
    • Update plugin short description to be more user-friendly.

    Fixed

    • Reply block now properly validates ActivityPub URLs before setting inReplyTo field
    • Added a safeguard to ensure the plugin works correctly even when no post types are selected.
    • Added a safety check to prevent errors when resolving comment author hostnames without a valid IP address.
    • Fixed activity processing to handle QuoteRequest and other edge cases more reliably.
    • Fixed an issue with post content templates to ensure the correct fallback is always applied.
    • Fixed fatal error when transformer Factory receives WP_Error objects.
    • Fixed HTML entity encoding in extra field names when displayed on ActivityPub platforms
    • Fixed typo in example, improve quoting description.
    • Fix Following table error message to display user input instead of empty string when webfinger lookup fails.
    • Fix infinite recursion when storing remote actors with mentions in their bios
    • Fix local inbox delivery to use internal REST API instead of HTTP, enabling local follows and proper boost counting.
    • Fix logic errors in Move handler: remove redundant assignment and fix variable name collision.
    • Fix public key retrieval for GoToSocial profiles with path-based key URLs.
    • Improved actor resolution by prioritizing blog actor detection before remote actor checks and refining home page URL handling.
    • Improved handling of empty fields for better compatibility with Pixelfed and more consistent fallback behavior across actor names, URLs, and related data.
    • Improved hashtag encoding for consistent formatting.
    • Improved Jetpack integration by initializing it during the WordPress startup process.
    • Refactored Mastodon import handling to use consistent array-based data, improving reliability and compatibility across all import scenarios.

    Downloads

    Thanks, Crew!

    Big thanks to everyone who contributed code, feedback, and testing to make this release possible. You keep ActivityPub evolving with every version.

    Version 7.6.0 is now live — update today and enjoy lightning-fast navigation, smarter synchronization, and smoother federation! ❤️

  • 7.5.0 — Follow the Feed, Quote the Lead

    We’re back with a fresh release, and this one makes following and sharing smoother than ever—plus gives you more control over how your posts can be quoted.

    A New Way to Follow (For Now)

    Starting today, users on WordPress.com sites and self-hosted sites connected through Jetpack can see the posts of accounts they follow directly in their WordPress.com Reader timeline. The Following UI has been around for a little while, yet hidden, and with this release it will be enabled by default for these sites.

    When you follow an account, ActivityPub checks for a discoverable RSS feed. If one exists, it’s automatically added to your Reader timeline so new posts appear alongside everything else you already follow. Unfollowing works the same way—the feed disappears when you remove the account. And if you’d like to view the feed for an account you’ve followed, just hover over it in the list table and click View Feed.

    WordPress.com Reader page displaying recent posts from subscriptions. Shows a post by Eugen Rochko from 2 hours ago featuring an image of Federation Street with a blue cartoon elephant. The left sidebar contains navigation options including Recent, Discover, Likes, Conversations, Lists, Tags, Automattic, A8C Conversations, and Manage Subscriptions.
    WordPress admin Followings page showing a list of 3 accepted follows: notiz.blog, pfefferle (Matthias Pfefferle), and obenland (Konstantin Obenland). The page includes a Follow form for adding new followers via username or profile link, bulk actions dropdown, and an explanation of the ActivityPub follow request protocol.

    Think of this as a bridge: a simple way to read the posts of accounts you follow today, while we continue building a full, first-class ActivityPub reading experience for tomorrow.

    There are a couple of details to keep in mind. Removing a subscription directly in the Reader won’t update your site’s Following list, and interactions are limited to what RSS allows, which means sharing and reposting rather than the full range of ActivityPub features.

    Running a self-hosted site without Jetpack? You can still enable the Following UI manually—it just won’t connect with the Reader.

    Quote Post Controls

    We’ve also added support for Mastodon’s quote post feature—and given you an easy way to control how others can quote your content.

    A screenshot of a blog post quoted on Mastodon.

    When writing in the Block Editor, you’ll now see a sidebar setting that lets you decide whether everyone can quote your post, only your followers can, or if quoting is reserved for you alone. Once published, Mastodon and other compatible platforms will honor your choice automatically. No extra setup needed—just write, choose, and publish with confidence.

    Full Changelog

    Added

    • Added a setting to control who can quote your posts.
    • Added support for QuoteRequest activities (FEP-044f), enabling proper handling, validation, and policy-based acceptance or rejection of quote requests.
    • Add upgrade routine to enable ActivityPub feeds in WordPress.com Reader
    • Add Yoast SEO integration for author archives site health check.
    • Improved interaction policies with clearer defaults and better Mastodon compatibility.
    • New site health check warns if active Captcha plugins may block ActivityPub comments.
    • Sync following meta to enable RSS feed subscriptions for ActivityPub actors in WordPress.com Reader
    • You can now follow people and see their updates right in the WordPress.com Reader when using Jetpack or WordPress.com.

    Changed

    • Added support for fetching actors by account identifiers and improved reliability of actor retrieval.
    • Clarify error messages in account modal to specify full profile URL format.
    • Improved checks to better identify public Activities.
    • Improved compatibility by making the ‘implements’ field always use multiple entries.
    • Improved recipient handling for clarity and improved visibility handling of activities.
    • Remote reply blocks now sync account info across all blocks on the same page
    • Standardized notification handling with new hooks for better extensibility and consistency.
    • Updated sync allowlist to add support for Jetpack notifications of likes and reposts.

    Fixed

    • Fixed an issue where post metadata in the block editor was missing or failed to update.
    • Fix Flag activity object list processing to preserve URL arrays
    • Fix PHP warning in bulk edit scenario when post_author is missing from $_REQUEST
    • Posts now only fall back to the blog user when blog mode is enabled and no valid author exists, ensuring content negotiation only runs if an Actor is available.

    Downloads

    Thank you!

    Thanks to everyone who contributed code, tested, offered feedback, or lent support along the way. Update to 7.5.0 today and follow, share, and quote to your heart’s content!

  • 7.4.0 – More Control, Less Waiting

    Fediverse life just got a little easier! This release is all about giving you more confidence in how you manage your users — and making your follower, following, and block lists feel lightning fast. Let’s dive in.

    Wapuu, the yellow WordPress mascot, floats in space wearing a gray astronaut suit. In front of Wapuu is a spaceship control panel with the WordPress logo and the Fediverse logo, each with checkboxes. Below them is a large glowing orange ‘CONFIRM’ button. Wapuu points toward the panel, symbolizing making a choice.

    Clean Breaks, Done Right

    Until now, removing someone’s ActivityPub capability in WordPress only affected their local account. Their presence in the Fediverse lingered on. With this release, you’re in charge of what happens next.

    When you remove ActivityPub capabilities from users on your site, you’ll now see a confirmation step:

    A screenshot of the confirmation step that shows after removing the ActivityPub capability from users.

    With this change, you can decide whether you’re simply adjusting roles inside WordPress, or making a complete exit across the network.

    We’ve also expanded delete handling to cover more scenarios:

    • Comment removal: Permanently deleted federated comments now send a Delete activity across the Fediverse.
    • Virtual deletes & restores: You can now remove objects from the Fediverse without deleting them locally — and bring them back if needed.
    • WP-CLI command for Actors: A new command makes it easier to manage and clean up Actors directly from the command line.

    Together, these tools make sure your Fediverse presence stays consistent with the choices you make in WordPress.

    Lists That Load in a Snap

    Managing your Fediverse connections shouldn’t feel slow — and now it doesn’t. The follower, following, and block lists are noticeably faster and more reliable in this release.

    Behind the scenes, we cleaned up and centralized how account information is resolved. Instead of each list handling things in its own way, they now all share a single, streamlined method with built-in caching. That means less duplication, less waiting, and a smoother experience every time you browse your lists — even on larger sites.

    Full Changelog

    Added

    • Add activitypub_json REST field for ap_actor posts to access raw JSON data.
    • Add Delete activity support for permanently deleted federated comments.
    • Added a new WP-CLI command to manage Actors.
    • Added confirmation step for bulk removal of ActivityPub capability, asking whether to also delete users from the Fediverse.
    • Adds support for virtual deletes and restores, allowing objects to be removed from the fediverse without being deleted locally.
    • Add Yoast SEO integration for media pages site health check.
    • Optimized WebFinger lookups by centralizing and caching account resolution for faster, more consistent handling across lists.

    Changed

    • Clarified the ‘attachment’ post type description to explain it refers to media library uploads and recommend disabling federation in most cases.
    • Hide site-wide checkbox in block confirmations when accessed from ActivityPub settings page.
    • Improved ActivityPub compatibility by aligning with Mastodon’s Application Actor.
    • It’s now possible to reply to multiple posts using multiple reply blocks.
    • Refactored Reply block to use WordPress core embed functionality for better compatibility and performance.
    • Use wp_interactivity_config() for static values instead of wp_interactivity_state() to improve performance and code clarity.

    Deprecated

    • ActivityPub now defaults to automated object type selection, with the old manual option moved to Advanced settings for compatibility.

    Fixed

    • Fix content visibility override issue preventing authors from changing visibility on older posts.
    • Fix PHP warning when saving ActivityPub settings.
    • Fix query args preservation in collection pagination links.
    • Fix release script to catch more ‘unreleased’ deprecation patterns that were previously missed during version updates.
    • Fix reply block rendering inconsistency where blocks were always converted to @-mentions in ActivityPub content. Now only first reply blocks become @-mentions, others remain as regular links.
    • Stop sending follow notifications to the Application user, since system-level accounts cannot be followed.

    Downloads

    Thanks

    High-fives to everyone who helped chart the course, whether you coded, tested, spotted bugs, or just cheered from the sidelines. You keep this ship flying! 🚀

    Version 7.4.0 has just landed—jump in and tell us how it feels out there in the Fediverse.