ActivityPub for WordPress

Tag: ActivityPub

  • 7.6.0 — Command, Sync & Go

    This release puts speed and control right at your fingertips. Whether you’re jumping between settings, syncing followers, or handling quotes in real time, version 7.6.0 makes managing your Fediverse presence faster and more intuitive than ever.

    Wapuu, the yellow WordPress mascot, pilots a small spaceship shaped like the WordPress ‘W’ through a glowing Fediverse nebula. Light trails and floating ActivityPub icons surround the ship, symbolizing fast, effortless navigation through connected worlds.

    Navigate in a Flash

    Say hello to the quickest way to move around your ActivityPub settings.

    In preparation for WordPress 6.9, which brings the Command Palette (Cmd/Ctrl + K) to the entire wp-admin, the plugin now adds its own commands, giving you instant, keyboard-driven access to your workflows anywhere in WordPress.

    Type “ActivityPub” and you’ll see context-aware commands that adapt to your site setup and user role. Whether you’re managing a blog actor or a user actor, you can open followers and following lists, check blocked actors, jump straight to your settings, or even search and edit extra fields — all without ever leaving the Command Palette.

    A screenshot of the Command Palette in action.

    Every command includes the ActivityPub icon for easy recognition. Just press Cmd + K or Ctrl + K, start typing, and go — it’s the smoothest way yet to pilot your Fediverse setup.

    Stay in Sync Across the Fediverse

    Your follower lists now stay accurate wherever you connect.
    With support for Follower Synchronization (FEP-8fcf), the plugin automatically keeps your followers collection in step with other servers — even when things drift out of sync.

    If differences appear, background tasks quietly reconcile them, keeping your lists clean and consistent. The result is a smoother, more reliable experience across the entire Fediverse — no manual fixes required.

    Speed When It Counts

    Quoted posts and follow confirmations now move at the speed of conversation.

    A new immediate Accept dispatch system sends responses as soon as they’re created, instead of waiting for the next scheduled queue.

    That means faster follow confirmations and quicker quote acknowledgments, making interactions feel more natural across the Fediverse. Behind the scenes, those Accept messages go straight to the right inboxes — including mentioned and replied-to users — while a scheduled backup ensures full compatibility with slower servers.

    It’s a smart balance between speed and reliability, helping your posts and follows appear almost instantly.

    Privacy, Your Way

    Want to keep your social graph private? You can now hide your followers and following lists from public view while keeping all relationships intact. Your followers still follow — they’re just hidden when you prefer a little more privacy.

    Full Changelog

    Added

    • Add bidirectional transforms between reply and embed blocks for improved user experience.
    • Add Command Palette integration for quick navigation to ActivityPub admin pages
    • Added a new ap_object post type and taxonomies for storing and managing incoming ActivityPub objects, with updated handlers
    • Added a privacy option to hide followers and following lists from profiles while keeping follow relationships intact.
    • Added a scheduled task and setting to automatically purge old inbox items, helping maintain site performance and storage control.
    • Added fallback to trigger create handling when updates fail for missing posts or comments, ensuring objects are properly created.
    • Added immediate dispatch for Accept activities to speed up quoted posts while keeping scheduled processing for compatibility with other instances.
    • Added new configuration options to better manage traffic spikes when federating posts, allowing finer control over retry limits, delays, and batch pauses.
    • Added support for FEP-8fcf follower synchronization, improving data consistency across servers with new sync headers, digest checks, and reconciliation tasks.
    • Add LiteSpeed Cache integration to prevent ActivityPub JSON responses from being cached incorrectly. Includes automatic .htaccess rules and Site Health check to ensure proper configuration.
    • Add quote visibility setting for Classic Editor users.
    • Add unified attachment processor for handling ActivityPub media imports from both remote URLs and local files, with automatic media block generation and Classic Editor support.
    • Integrate Federated Reply block with WP.com Reader’s post share functionality, allowing users to reply to ActivityPub posts directly from the Reader.

    Changed

    • Added support for FEP-3b86 Activity Intents, extending WebFinger and REST interactions with new Create and Follow intent links.
    • Added support for the latest NodeInfo (FEP-0151), with improved federation details, staff info, and software metadata for better ActivityPub compliance.
    • Extended inbox support for undoing Like, Create, and Announce activities, with refactored undo logic and improved activity persistence.
    • Improved Classic Editor integration by adding better media handling and full test coverage for attachments, permissions, and metadata.
    • Improved delivery of public and follower activities by expanding local recipient handling to include all ActivityPub-capable users and follower collections.
    • Improved inbox performance by batching and deduplicating activities, reducing redundant processing and improving handling during high activity periods.
    • Improved REST API responses with smarter context handling.
    • Improved REST collection pagination by using explicit total item counts for more accurate results.
    • Moved default visibility handling from the server to the editor UI, ensuring consistent and flexible ActivityPub visibility settings across both block and classic editors.
    • Prevented self-announcing by ignoring announces from the blog actor, while still processing announces from user and external actors.
    • Refactored activity handling to support multiple recipients per activity, allowing posts and interactions to be linked to several local users at once.
    • Refactored avatar handling into a new system that stores and manages avatars per remote actor, improving reliability and preparing for future caching support.
    • Refactored the inbox system to use a shared inbox, storing activities once with multiple recipients for improved efficiency and reduced duplication.
    • Reorganize integration loader and move Stream integration into dedicated folder structure.
    • Reply posts: do not display post title before @mentions in posts that are replies to somebody else
    • Simplified configuration by always enabling the shared inbox and removing its separate setting, UI field, and related logic.
    • Simplified inbox storage settings, allowing certain activities (like deletes) to be skipped to reduce unnecessary database use.
    • Simplify follow() API return types to int|WP_Error for better predictability.
    • Updated inbox handling to support multiple users receiving the same activity and improve overall data consistency.
    • Updated mailer hooks to send notifications only when activities are successfully handled, preventing emails for failed events.
    • Update plugin short description to be more user-friendly.

    Fixed

    • Reply block now properly validates ActivityPub URLs before setting inReplyTo field
    • Added a safeguard to ensure the plugin works correctly even when no post types are selected.
    • Added a safety check to prevent errors when resolving comment author hostnames without a valid IP address.
    • Fixed activity processing to handle QuoteRequest and other edge cases more reliably.
    • Fixed an issue with post content templates to ensure the correct fallback is always applied.
    • Fixed fatal error when transformer Factory receives WP_Error objects.
    • Fixed HTML entity encoding in extra field names when displayed on ActivityPub platforms
    • Fixed typo in example, improve quoting description.
    • Fix Following table error message to display user input instead of empty string when webfinger lookup fails.
    • Fix infinite recursion when storing remote actors with mentions in their bios
    • Fix local inbox delivery to use internal REST API instead of HTTP, enabling local follows and proper boost counting.
    • Fix logic errors in Move handler: remove redundant assignment and fix variable name collision.
    • Fix public key retrieval for GoToSocial profiles with path-based key URLs.
    • Improved actor resolution by prioritizing blog actor detection before remote actor checks and refining home page URL handling.
    • Improved handling of empty fields for better compatibility with Pixelfed and more consistent fallback behavior across actor names, URLs, and related data.
    • Improved hashtag encoding for consistent formatting.
    • Improved Jetpack integration by initializing it during the WordPress startup process.
    • Refactored Mastodon import handling to use consistent array-based data, improving reliability and compatibility across all import scenarios.

    Downloads

    Thanks, Crew!

    Big thanks to everyone who contributed code, feedback, and testing to make this release possible. You keep ActivityPub evolving with every version.

    Version 7.6.0 is now live — update today and enjoy lightning-fast navigation, smarter synchronization, and smoother federation! ❤️

  • 7.5.0 — Follow the Feed, Quote the Lead

    We’re back with a fresh release, and this one makes following and sharing smoother than ever—plus gives you more control over how your posts can be quoted.

    A New Way to Follow (For Now)

    Starting today, users on WordPress.com sites and self-hosted sites connected through Jetpack can see the posts of accounts they follow directly in their WordPress.com Reader timeline. The Following UI has been around for a little while, yet hidden, and with this release it will be enabled by default for these sites.

    When you follow an account, ActivityPub checks for a discoverable RSS feed. If one exists, it’s automatically added to your Reader timeline so new posts appear alongside everything else you already follow. Unfollowing works the same way—the feed disappears when you remove the account. And if you’d like to view the feed for an account you’ve followed, just hover over it in the list table and click View Feed.

    WordPress.com Reader page displaying recent posts from subscriptions. Shows a post by Eugen Rochko from 2 hours ago featuring an image of Federation Street with a blue cartoon elephant. The left sidebar contains navigation options including Recent, Discover, Likes, Conversations, Lists, Tags, Automattic, A8C Conversations, and Manage Subscriptions.
    WordPress admin Followings page showing a list of 3 accepted follows: notiz.blog, pfefferle (Matthias Pfefferle), and obenland (Konstantin Obenland). The page includes a Follow form for adding new followers via username or profile link, bulk actions dropdown, and an explanation of the ActivityPub follow request protocol.

    Think of this as a bridge: a simple way to read the posts of accounts you follow today, while we continue building a full, first-class ActivityPub reading experience for tomorrow.

    There are a couple of details to keep in mind. Removing a subscription directly in the Reader won’t update your site’s Following list, and interactions are limited to what RSS allows, which means sharing and reposting rather than the full range of ActivityPub features.

    Running a self-hosted site without Jetpack? You can still enable the Following UI manually—it just won’t connect with the Reader.

    Quote Post Controls

    We’ve also added support for Mastodon’s quote post feature—and given you an easy way to control how others can quote your content.

    A screenshot of a blog post quoted on Mastodon.

    When writing in the Block Editor, you’ll now see a sidebar setting that lets you decide whether everyone can quote your post, only your followers can, or if quoting is reserved for you alone. Once published, Mastodon and other compatible platforms will honor your choice automatically. No extra setup needed—just write, choose, and publish with confidence.

    Full Changelog

    Added

    • Added a setting to control who can quote your posts.
    • Added support for QuoteRequest activities (FEP-044f), enabling proper handling, validation, and policy-based acceptance or rejection of quote requests.
    • Add upgrade routine to enable ActivityPub feeds in WordPress.com Reader
    • Add Yoast SEO integration for author archives site health check.
    • Improved interaction policies with clearer defaults and better Mastodon compatibility.
    • New site health check warns if active Captcha plugins may block ActivityPub comments.
    • Sync following meta to enable RSS feed subscriptions for ActivityPub actors in WordPress.com Reader
    • You can now follow people and see their updates right in the WordPress.com Reader when using Jetpack or WordPress.com.

    Changed

    • Added support for fetching actors by account identifiers and improved reliability of actor retrieval.
    • Clarify error messages in account modal to specify full profile URL format.
    • Improved checks to better identify public Activities.
    • Improved compatibility by making the ‘implements’ field always use multiple entries.
    • Improved recipient handling for clarity and improved visibility handling of activities.
    • Remote reply blocks now sync account info across all blocks on the same page
    • Standardized notification handling with new hooks for better extensibility and consistency.
    • Updated sync allowlist to add support for Jetpack notifications of likes and reposts.

    Fixed

    • Fixed an issue where post metadata in the block editor was missing or failed to update.
    • Fix Flag activity object list processing to preserve URL arrays
    • Fix PHP warning in bulk edit scenario when post_author is missing from $_REQUEST
    • Posts now only fall back to the blog user when blog mode is enabled and no valid author exists, ensuring content negotiation only runs if an Actor is available.

    Downloads

    Thank you!

    Thanks to everyone who contributed code, tested, offered feedback, or lent support along the way. Update to 7.5.0 today and follow, share, and quote to your heart’s content!

  • 7.4.0 – More Control, Less Waiting

    Fediverse life just got a little easier! This release is all about giving you more confidence in how you manage your users — and making your follower, following, and block lists feel lightning fast. Let’s dive in.

    Wapuu, the yellow WordPress mascot, floats in space wearing a gray astronaut suit. In front of Wapuu is a spaceship control panel with the WordPress logo and the Fediverse logo, each with checkboxes. Below them is a large glowing orange ‘CONFIRM’ button. Wapuu points toward the panel, symbolizing making a choice.

    Clean Breaks, Done Right

    Until now, removing someone’s ActivityPub capability in WordPress only affected their local account. Their presence in the Fediverse lingered on. With this release, you’re in charge of what happens next.

    When you remove ActivityPub capabilities from users on your site, you’ll now see a confirmation step:

    A screenshot of the confirmation step that shows after removing the ActivityPub capability from users.

    With this change, you can decide whether you’re simply adjusting roles inside WordPress, or making a complete exit across the network.

    We’ve also expanded delete handling to cover more scenarios:

    • Comment removal: Permanently deleted federated comments now send a Delete activity across the Fediverse.
    • Virtual deletes & restores: You can now remove objects from the Fediverse without deleting them locally — and bring them back if needed.
    • WP-CLI command for Actors: A new command makes it easier to manage and clean up Actors directly from the command line.

    Together, these tools make sure your Fediverse presence stays consistent with the choices you make in WordPress.

    Lists That Load in a Snap

    Managing your Fediverse connections shouldn’t feel slow — and now it doesn’t. The follower, following, and block lists are noticeably faster and more reliable in this release.

    Behind the scenes, we cleaned up and centralized how account information is resolved. Instead of each list handling things in its own way, they now all share a single, streamlined method with built-in caching. That means less duplication, less waiting, and a smoother experience every time you browse your lists — even on larger sites.

    Full Changelog

    Added

    • Add activitypub_json REST field for ap_actor posts to access raw JSON data.
    • Add Delete activity support for permanently deleted federated comments.
    • Added a new WP-CLI command to manage Actors.
    • Added confirmation step for bulk removal of ActivityPub capability, asking whether to also delete users from the Fediverse.
    • Adds support for virtual deletes and restores, allowing objects to be removed from the fediverse without being deleted locally.
    • Add Yoast SEO integration for media pages site health check.
    • Optimized WebFinger lookups by centralizing and caching account resolution for faster, more consistent handling across lists.

    Changed

    • Clarified the ‘attachment’ post type description to explain it refers to media library uploads and recommend disabling federation in most cases.
    • Hide site-wide checkbox in block confirmations when accessed from ActivityPub settings page.
    • Improved ActivityPub compatibility by aligning with Mastodon’s Application Actor.
    • It’s now possible to reply to multiple posts using multiple reply blocks.
    • Refactored Reply block to use WordPress core embed functionality for better compatibility and performance.
    • Use wp_interactivity_config() for static values instead of wp_interactivity_state() to improve performance and code clarity.

    Deprecated

    • ActivityPub now defaults to automated object type selection, with the old manual option moved to Advanced settings for compatibility.

    Fixed

    • Fix content visibility override issue preventing authors from changing visibility on older posts.
    • Fix PHP warning when saving ActivityPub settings.
    • Fix query args preservation in collection pagination links.
    • Fix release script to catch more ‘unreleased’ deprecation patterns that were previously missed during version updates.
    • Fix reply block rendering inconsistency where blocks were always converted to @-mentions in ActivityPub content. Now only first reply blocks become @-mentions, others remain as regular links.
    • Stop sending follow notifications to the Application user, since system-level accounts cannot be followed.

    Downloads

    Thanks

    High-fives to everyone who helped chart the course, whether you coded, tested, spotted bugs, or just cheered from the sidelines. You keep this ship flying! 🚀

    Version 7.4.0 has just landed—jump in and tell us how it feels out there in the Fediverse.

  • Help Shape the Future of Moderation in the Fediverse

    Running a community in the Fediverse means balancing openness with safety. Every year, @iftas takes the pulse of administrators, moderators, and community managers with their Annual Needs Assessment. This survey helps identify what’s working, where support is needed, and which tools can make a difference for those keeping decentralized spaces safe.

    The 2025 survey is now open

    Take part in the IFTAS Needs Assessment (5–10 minutes).

    Take the survey now

    (If you haven’t seen them before, you can also take a look at last year’s report)

    Last year’s responses represented moderators of over 4.3 million accounts across ActivityPub platforms. With WordPress now the largest group of federating instances, it’s especially important for our community of hosts, site admins, and moderators to be heard.

    Moderation in WordPress: From Site-Wide to Personal Controls

    We recently introduced a major update to the ActivityPub plugin for WordPress: personalized and site-wide moderation tools.

    • Site administrators can now set domain, keyword, and actor-level blocks that protect the entire site.
    • Individual users can fine-tune their own experience with personal blocks, managed directly from their profiles.
    • Content is checked against both global and personal rules—so moderation works at every level.

    These improvements directly address needs raised in previous IFTAS surveys, making moderation more discoverable, flexible, and effective for WordPress communities in the Fediverse.

    Your Input Matters

    IFTAS uses the Needs Assessment to guide tools, policies, and advocacy that reflect the real-world challenges of moderators—especially those in under-resourced communities. The more representative the responses, the stronger the outcomes for everyone.

    If you’re running a federating WordPress site, please consider:

    1. Filling out the survey yourself.
    2. Sharing it with other admins, moderators, and community organizers.
    3. Reminding folks that it’s anonymous, quick, and impactful.
    Take the 2025 Fediverse Needs Assessment

    Together, we can keep building a safer, healthier Fediverse—one that reflects the needs of its communities.

  • 7.3.0 – Ctrl+Fed+Delete

    A cute Wapuu astronaut inside a futuristic space station, sitting at a glowing control desk with holographic message icons floating in front of them. Some messages have a green checkmark for approval, others a red X or trash bin icon for deletion. The Wapuu looks focused, managing which messages can enter from the Fediverse and which should be removed. The background shows the curved windows of the space station with stars and a planet outside, blending sci-fi tech with Wapuu’s cartoon charm.

    Ready for a smoother ride on the Fediverse? ActivityPub for WordPress 7.3.0 is here to make your experience friendlier and more flexible than ever. Whether you’re keeping out unwanted guests, bringing stray conversations home, or just tidying up your digital footprint, this release puts powerful new tools right at your fingertips. Let’s take a look at what’s new!

    Personalized & Site-Wide Moderation

    With this release, Moderation tools are easier to discover and manage, thanks to a revamped two-tiered system that empowers both site admins and individual users with greater control over their Fediverse experience.

    WordPress admin screen showing the Blocked Actors page with a list of blocked ActivityPub accounts and a form to add new blocks.

    Now, site administrators can set up site-wide blocks—covering domains, keywords, and even specific actors—right from the Settings screen or the new Blocked Actors table. These tools work together to keep out unwanted content and spammy actors for everyone on your site.

    But we didn’t stop there! Every user can fine-tune their own experience. Head to your Profile to add personal domain and keyword blocks, or visit the new Blocked Actors submenu under Users to manage who can interact with you. Blocking someone is easier than ever—just paste their profile ID or webfinger, or use the handy new “Block” link right from your Followers list.

    • Followers table in WordPress with options to delete, block, or follow back ActivityPub followers.
      Followers List With Block Option
    • Confirmation screen in WordPress for blocking an ActivityPub account, including options for site-wide blocking.
      Block Account Confirmation
    • Followers page in WordPress showing an empty list and a notification that an account has been blocked.
      Followers After Blocking

    Whenever new ActivityPub content comes in, the plugin checks it against both global and personal blocks. Domains are matched not just to the sender, but also to the activity and object IDs. Keywords are scanned throughout the content, summaries, and even actor names. Site-wide rules always run first, followed by your personal settings—so you’re protected at every level. (For the blog actor, only site-wide blocks apply.)

    For backwards compatibility, the classic comment disallow list is still supported, ensuring your existing moderation rules continue to work seamlessly.

    Saying Goodbye, the Right Way

    Sometimes, a clean break is necessary. Whether you’re retiring a blog, removing a user, or handling old content, this release makes sure your presence in the Fediverse can be removed gracefully and consistently.

    We’ve added a self-destruct feature for sites that want to step away entirely. With a single CLI command (wp activitypub self_destruct), WordPress will send out Delete activities to all followers. Built-in progress tracking and admin notifications let you know when the process has finished, so you can be sure your Fediverse footprint is fully cleared.

    User deletion is now handled with the same care. When a user is removed from WordPress, a corresponding Delete activity is sent to their followers, ensuring that connections across the network are properly closed.

    Bring the Conversation to You

    Sometimes a reply you care about doesn’t make it all the way to your Inbox. Maybe it was posted on a remote server with finicky delivery, or slipped past the usual flow of ActivityPub. With this release, you don’t have to miss out.

    Now you can search for any remote URL directly. If the comment is already in your database, you’ll be taken straight to the matching comment thread on your blog post. If not, the plugin will fetch and import the remote reply to that post, so you can fold scattered conversations back into your site seamlessly.

    This means you’re no longer limited to what arrives automatically. If you’ve got a link to a discussion happening elsewhere in the Fediverse, you can pull it right into your own comment threads and keep the context intact.

    A Persistent Inbox for Better Debugging

    Fediverse interactions can get complex, and sometimes you need deeper insight into what’s really happening under the hood. That’s where the new persistent inbox comes in.

    When enabled in Advanced Settings, the plugin now logs all incoming Create or Update activities. Instead of vanishing once processed, these entries are collected in a dedicated Inbox Collection—giving you a complete trail to reference when debugging.

    Full Changelog

    Added

    • Add actor blocking functionality with list table interface for managing blocked users and site-wide blocks.
    • Add code coverage reporting to GitHub Actions PHPUnit workflow with dedicated coverage job using Xdebug.
    • Add comprehensive blocking and moderation system for ActivityPub with user-specific and site-wide controls for actors, domains, and keywords.
    • Add comprehensive unit tests for Followers and Following table classes with proper ActivityPub icon object handling.
    • Added link and explanation for the existing Starter Kit importer on the help tab of the Following pages.
    • Adds a self-destruct feature to remove a blog from the Fediverse by sending Delete activities to followers.
    • Adds a User Interface to select accounts during Starter Kit import.
    • Adds support for importing Starter Kits from a link (URL).
    • Adds support for searching (remote) URLs similar to Mastodon, redirecting to existing replies or importing them if missing.
    • Adds support for sending Delete activities when a user is removed.
    • Adds support for Starter Kit collections in the ActivityPub API.
    • A global Inbox handler and persistence layer to log incoming Create and Update requests for debugging and verifying Activity handling.
    • Follower lists now include the option to block individual accounts.
    • Improved handling of deleted content with a new unified system for better tracking and compatibility.
    • Moderation now checks blocked keywords across all language variants of the content, summary and name fields.
    • When activated or deactivated network-wide, the plugin now refreshes rewrite rules across all sites.

    Changed

    • Add default avatars for actors without icons in admin tables.
    • Added support for list of Actor IDs in Starter Kits.
    • Improve Following class documentation and optimize count methods for better performance.
    • Refactor actor blocking with unified API for better maintainability.

    Fixed

    • Blocks relying on user selectors no longer error due to a race condition when fetching users.
    • Fix duplicate HTML IDs and missing form labels in modal blocks.
    • Fix malformed ActivityPub handles for users with email-based logins (e.g., from Site Kit Google authentication).
    • Fix PHP 8.4 deprecation warnings by preventing null values from being passed to WordPress core functions.
    • Improves handling of author URLs by converting them to a proper format.
    • Improves REST responses by skipping invalid actors in Followers and Following controllers.
    • More reliable Actor checks during the follow process.
    • Prevents Application users from being followed.
    • Proper implementation of FEP 844e.
    • Switches ActivityPub summaries to plain text for better compatibility.

    Downloads

    Thank you!

    Big thanks to everyone who contributed code, shared feedback, tested, or encouraged us along the way! Together, we’re making the fediverse more connected—one release at a time. ❤️

    We’ve just rolled out version 7.3.0—try it out and let us know what you think!

  • Bridging the gap

    The image shows the fediverse Wapuu is building a bridge from the Bluesky Space Station to the Fediverse Space Station.

    The Fediverse is intended to be an interoperable, decentralized social network where users can connect across platforms and tools. In practice, though, the reality is more fragmented.

    According to Wikipedia:

    The majority of Fediverse platforms are based on free and open-source software, and create connections between servers using the ActivityPub protocol.

    Still, networks like Bluesky, Nostr, and Diaspora take their own technical paths toward the same vision, which means the fediverse isn’t fully connected just yet.

    Bridgy Fed

    To help address this gap, Ryan Barrett (@snarfed.org) began developing Bridgy Fed, a tool designed to connect these otherwise separate networks:

    Bridgy Fed connects web sites, the fediverse, and Bluesky. You can use it to make your profile on one visible in another, follow people, see their posts, and reply and like and repost them. Interactions work in both directions as much as possible.

    With even more networks on the list.

    While it’s not a native solution, it does help connect people today—and I really appreciate the perspective of Anuj Ahooja (@quillmatiq), CEO of A New Social, the organization behind Bridgy Fed:

    The future of the open social web is people connecting with people no matter what technology they happen to choose. And if bridges and duct tape is what’s necessary, then we’ll continue building bridges, because it’s connections and community over everything.

    You can easily connect your blog to Bluesky using Bridgy by following a few simple steps.

    Bridge your Blog

    You can connect your blog to Bluesky using any self-hosted WordPress site or a paid WordPress.com plan.

    First, go to the ActivityPub settings and open the Screen Options at the top right. Enable the Advanced Settings checkbox and click Save.

    This will reveal the Advanced tab in the settings, where you’ll find the Following User Interface option. Enable that as well.

    Once this feature is active, you’ll be able to access the Following subpage.

    To follow the Bluesky account, enter bsky.brid.gy@bsky.brid.gy into the input box on the left and click Follow. The account should appear in your list shortly. After a few minutes, your follow request will be accepted, and the account will follow your blog back.

    You can verify the connection by checking your Followers list. From this point on, all your new blog posts will also be published on Bluesky. You’ll receive reactions to your posts and even follow requests from Bluesky users.

    That’s it! All your upcoming posts will also be published on Bluesky, you will receive all reactions to your posts and even follow requests.

    If you ever want to stop the bridge from publishing, simply unfollow the Bridgy account and remove it from your Followers list.

    Happy cross-posting bridging :)

    Be Aware

    Even though following other accounts is now possible, there is currently no way to view their incoming posts. Aside from the specific use case described above, following others doesn’t offer much benefit at this stage. Please be cautious if you think you need to follow more people, as it may increase traffic to your site without a clear purpose.

    We’ll let you know as soon as the full reader experience is implemented and will enable all necessary (currently hidden) features at that time.

    Follow us!

    As a proof of concept, you can now also follow our updates on Bluesky via @activitypub.blog.activitypub.blog.ap.brid.gy‬

  • 7.2.0 – Follow ups

    A Wapuu in a spacesuit, equipped with a tool, repairing a spaceship engine.

    We’ve rolled out an update that makes sharing content to the fediverse via ActivityPub even better—especially when it comes to images in comments. Now, when you include an HTML <img> tag that points to a file in your WordPress media library, that image is bundled as a proper attachment in the ActivityStreams payload. This means your followers on other platforms will see both your comment and its image, making conversations more vivid and engaging.

    To protect your privacy and security, only images hosted in your own WordPress media library are supported. Images from external sources are intentionally skipped.

    Smoother Following, Better Interactions

    If you’ve turned on the “Following User Interface” feature in the advanced settings, you’ll see a few nice improvements. The followers list now shows whether you’re already following someone—and if not, you can follow them back with just one click.

    Followers list screenshot showing the "Follow Back" button.

    We’ve also made it easier to follow people from other sites. When you click “Follow” on someone else’s blog, you’ll now be taken to your own site to complete it. It keeps things simple and familiar, even when you start following someone from another site.

    Better Support for Multibyte Text

    Finally, we’ve improved how multibyte characters (like those in Greek and other non-Latin scripts) are handled when generating post summaries for the fediverse. We’ve replaced byte-based string functions with multibyte-safe alternatives and reordered text processing steps to avoid errors.

    Full Changelog

    Added

    • Add image attachment support to federated comments – HTML images in comment content now include proper ActivityStreams attachment fields.
    • Link to the following internal dialog for remote interactions, if the feature is enabled.
    • The followers list now shows follow status and allows quick follow-back actions.
    • Trigger Actor updates on (un)setting a post as sticky.
    • You can now use OrderedCollections as starter packs — just drop in the output from a Follower or Following endpoint.

    Changed

    • Ensure that tests run in production-like conditions, avoiding interference from local development tools.
    • Moved HTTP request signing to a filter instead of calling it directly.

    Fixed

    • Allow non-administrator users to use Follow Me and Followers blocks.
    • Correct linking from followers to the following list.
    • Fix avatar rendering for followers with missing icon property.
    • Fix multibyte character corruption in post summaries, preventing Greek and other non-ASCII text from being garbled during text processing.
    • Informational Fediverse blocks are no longer rendered when posts get added to the Outbox.

    Downloads

    Thank you!

    Huge thanks to everyone who shared code, gave feedback, tested, or simply cheered us on! Together, we’re building a more connected fediverse, one release at a time. ❤️

    We’ve just released version 7.2.0, give it a spin and let us know what you think!

  • 7.1.0 — Polishing Tables

    This release is mostly made up of behind-the-scenes improvements, but one update you’ll notice right away is the refreshed Followers table. It now looks and feels much more like the standard WordPress admin tables: you can customize it with screen options to hide columns or change how many followers are shown per page, and you can now delete individual followers using inline action links. We also polished the layout by increasing information density and improving the readability of date columns.

    We’ve made migrations easier to kick off by automatically resolving account aliases and saving their ID form. That means you can now paste in WebFinger IDs, profile URLs, etc. and the plugin handles the rest, as long as it resolves to an ActivityPub profile.

    This release also fixes a long-time annoyance: unfederated posts (like those published before the plugin was activated or imported later) will no longer be sent out to followers just because they were updated. For now, we use a simple cutoff for posts older than a month, which should cover the majority of those cases.

    Coming Soon: Following Others!

    Most of the work that went into this release is still invisible, hiding behind a feature flag in Advanced Settings (you can find it by opening Screen Options in the ActivityPub settings screen).

    There’s really no functionality around it yet, beyond following accounts from other instances, as we have yet to start processing incoming posts and adding the ability to interact with them. But if you just can’t wait to show your appreciation for other accounts by following them, go wild!

    Behind the same feature flag, we’ve also added initial beta support for Fediverse Starter Kits. This lets new users follow a set of recommended accounts from a predefined list, following the format proposed by @dansup for Pixelfed. For now, only Actor objects are supporteded, but we’re hoping to expand that over time.

    Full Changelog

    Added

    • Added a first version of the Follow form, allowing users to follow other Actors by username or profile link.
    • Added initial support for Fediverse Starter Kits, allowing users to follow recommended accounts from a predefined list.
    • Ensure that all schedulers are registered during every plugin update.
    • Followers and Following list tables now support Columns and Pagination screen options.
    • The featured tags endpoint is now available again for all profiles, showing the most frequently used tags by each user.
    • The following endpoint now returns the actual list of users being followed.

    Changed

    • Follower tables now look closer to what other tables in WordPress look like.
    • Improved Account-Aliases handling by internally normalizing input formats.
    • Minor performance improvement when querying posts of various types, by avoiding double queries.
    • Set older unfederated posts to local visibility by default.
    • Step counts for the Welcome checklist now only take into account steps that are added in the Welcome class.
    • Table actions are now faster by using the Custom Post Type ID instead of the remote user URI, thanks to the unified Actor Model.
    • The following tables now more closely match the appearance of other WordPress tables and can be filtered by status.

    Fixed

    • Ensure correct visibility handling for Undo and Follow requests
    • Ensure that the Actor-ID is always a URL.
    • Fixed a bug in how follow requests were accepted to ensure they work correctly.
    • Fixed an issue where the number of followers shown didn’t always match the actual follower list.
    • Fixed a PHP error that prevented the Follower overview from loading.
    • Fixed missing avatar class so that CSS styles are correctly applied to ActivityPub avatars on the Dashboard.
    • Fixed potential errors when unrelated requests get caught in double-knocking callback.
    • Improved WebFinger fallback to better guess usernames from profile links.
    • Prevent WordPress from loading all admin notices twice on ActivityPub settings pages.
    • Removed follower dates to avoid confusion, as they may not have accurately reflected the actual follow time.
    • Stop purging Follow activities from the Outbox to allow proper Unfollow (Undo) handling.

    Downloads

    Thank you!

    Big thanks to everyone who contributed code, feedback, testing, or encouragement—this community helps make the fediverse more connected with every release. ❤️

    Update to 7.1.0, try it out, and tell us what you think!

  • 7.0.0 – I will follow you!

    Just when you thought things were settling down… boom 💥 — the ActivityPub plugin gets another big upgrade. Say hello to version 7.0.0, a release packed with new features, polish, and under-the-hood improvements to help your WordPress site federate smoother, smarter, and more securely than ever.

    Let’s dive into what’s new.

    Following the Fediverse

    We’ve added the initial building blocks for Following support — both sending and managing follow requests for remote actors. It’s not in the UI just yet (we’re rolling it out carefully), but that’s not far away. A big step toward richer, two-way federation.

    Wapuu that "follows" a Mastodon, Pixelfed and Ghost mascot.

    We’ll work with developers of third-party plugins — including those behind Friends and Event Bridge — to migrate their custom follow implementations to this new core feature. This collaboration helps ensure a consistent, reliable follow experience across the ecosystem.

    This foundational support for following is also the first step toward a full-featured reader experience right inside WordPress — something we’re excited to keep building toward.

    Refined Signature

    This release brings support for RFC-9421-style HTTP signatures, both incoming and (optionally) outgoing. That’s a mouthful, but it basically means supporting the latest standard in how we verify and send activities — including a fallback to good old Draft Cavage when needed.

    Check out the blog post to learn more: HTTP Signature Upgrades Coming Soon

    Full Changelog

    Added

    • Added basic support for handling remote rejections of follow requests.
    • Added basic support for RFC-9421 style signatures for incoming activities.
    • Added initial Following support for Actors, hidden for now until plugins add support.
    • Added missing “Advanced Settings” details to Site Health debug information.
    • Added option to auto-approve reactions like likes and reposts.
    • Added support for namespaced attributes and the dcterms:subject field (FEP-b2b8), as a first step toward phasing out summary-based content warnings.
    • Added support for the WP Rest Cache plugin to help with caching REST API responses.
    • Documented support for FEP-844e.
    • Optional support for RFC-9421 style signatures for outgoing activities, including retry with Draft-Cavage-style signature.
    • Reactions block now supports customizing colors, borders, box-shadows, and typography.
    • Support for sending follow requests to remote actors is now in place, including outbox delivery and status updates—UI integration will follow later.

    Changed

    • Comment feeds now show only comments by default, with a new type filter (e.g., like, all) to customize which reactions appear.
    • Consistent naming of Blog user in Block settings.
    • hs2019 signatures for incoming REST API requests now have their algorithm determined based on their public key.
    • Likes, comments, and reposts from the Fediverse now require either a name or preferredUsername to be set when the Discussion option require_name_email is set to true. It falls back to “Anonymous”, if not.
    • Management of public/private keys for Actors now lives in the Actors collection, in preparation for Signature improvements down the line.
    • Notification emails for new reactions received from the Fediverse now link to the moderation page instead of the edit page, preventing errors and making comment management smoother.
    • Plugins now have full control over which Settings tabs are shown in Settings > Activitypub.
    • Reworked follower structure to simplify handling and enable reuse for following mechanism.
    • Screen options in the Activitypub settings page are now filterable.
    • Setting the blog identifier to empty will no longer trigger an error message about it being the same as an existing user name.
    • Step completion tracking in the Welcome tab now even works when the number of steps gets reduced.
    • The image attachment setting is no longer saved to the database if it matches the default value.
    • The welcome page now links to the correct profile when Blog Only mode was selected in the profile mode step.
    • Unified retrieval of comment avatars and re-used core filters to give access to third-part plugins.

    Fixed

    • Allow interaction redirect URLs that contain an ampersand.
    • Comments received from the Fediverse no longer show an Edit link in the comment list, despite not being editable.
    • Fixed an issue where links to remote likes and boosts could open raw JSON instead of a proper page.
    • Fixed a potential error when getting an Activitypub ID based on a user ID.
    • HTTP signatures using the hs2019 algorithm now get accepted without error.
    • Improved compatibility with older follower data.
    • Inbox requests that are missing an algorithm parameter in their signature no longer create a PHP warning.
    • Interaction attempts that pass a webfinger ID instead of a URL will work again.
    • Names containing HTML entities now get displayed correctly in the Reactions block’s list of users.
    • Prevent storage of empty or default post meta values.
    • The amount of avatars shown in the Reactions block no longer depends on the amount of likes, but is comment type agnostic.
    • The command-line interface extension, accidentally removed in a recent cleanup, has been restored.
    • The image attachment setting now correctly respects a value of 0, instead of falling back to the default.
    • The Welcome screen now loads with proper styling when shown as a fallback.
    • Using categories as hashtags has been removed to prevent conflicts with tags of the same name.
    • When verifying signatures on incoming requests, the digest header now gets checked as expected.

    Downloads

    Thank you!

    Huge thanks to everyone who contributed code, feedback, tests, or moral support. This community makes the fediverse feel a little more federated with every release. ❤️

    Update now, test things out, and let us know how 7.0.0 works for you!

  • HTTP Signature Upgrades Coming Soon

    Ever wonder how your site proves it’s really you talking to the rest of the Fediverse? It’s not magic—it’s HTTP signatures, the digital equivalent of a secret handshake. With our next release, we’re making that handshake a lot more universal (and a little less awkward).

    Why HTTP Signatures Matter

    When you interact with the Fediverse, you want to know that the messages you send and receive are genuine. HTTP signatures are the technology that makes this possible. Every time your site sends a message, it includes a digital signature—like sealing an envelope with your personal stamp. This signature proves that your content really came from your account and that no one has tampered with it along the way. As a result, you can trust that your interactions across the network are authentic.

    A Wapuu dressed as a detective holds a sealed envelope marked with an RFC 9421 checkmark, symbolizing secure and verified communication, with a key floating nearby against a starry background.

    A Bit of Background: draft-cavage and RFC 9421

    If you’ve heard about HTTP signatures, you might have come across terms like “draft-cavage” and “RFC 9421.” These are just different versions of the rules for how those digital signatures are created and checked.

    For a long time, most of the Fediverse has used what’s called the draft-cavage-12 specification. Think of this as a set of instructions that people agreed to try out, but that hadn’t been officially finalized. It worked well enough to let sites talk to each other securely, but because it was just a draft, there were sometimes small differences in how different software used it.

    Recently, the community agreed on a final, official version of these rules, called RFC 9421. This is now the standard way to create and verify HTTP signatures. This makes it easier for sites and servers to understand each other and work together, since everyone is following the same process.

    Incoming Support for the New Standard, Out of the Box

    With this update, the plugin will support incoming HTTP signatures that use the new standard right away. There’s nothing extra you need to do. This means that when other servers use the new, official approach for signatures, your site will recognize and accept them. By making support for the new standard easy and automatic, the plugin helps move the Fediverse forward, encouraging more sites to adopt this approach and making connections across the network more reliable.

    Outgoing Requests and the Double Knock Approach

    There’s a new setting for outgoing requests, but for most people, there’s no need to touch it. This option is really for the folks who like to be on the cutting edge and want to start using the new standard for outgoing messages right away. If that sounds like you, here’s how to find it: head to the ActivityPub settings in your dashboard, open “Screen Options” at the top right, and enable “Advanced Settings.” Then, click on the Advanced Settings tab and turn on “Use modern signature format for Fediverse communications.”

    But don’t feel any pressure—leaving this setting off is perfectly fine. The plugin already handles incoming messages with the new standard out of the box, and we’ll automatically enable outgoing support for everyone once the wider Fediverse is ready. For now, this is just an option for early adopters.

    If you do turn it on, the plugin uses what we call the “double knock” approach. It’ll try the new standard first, and if the other server isn’t ready for it, it’ll automatically fall back to the older method. So, you can experiment without worrying about breaking communication with anyone.

    Improved Verification for Existing Signatures

    The plugin also brings improvements to how it handles signatures that use the older method, especially those using the hs2019 algorithm. Now, when a signed message arrives, the plugin fetches the sender’s public key and uses it to determine the correct way to verify the signature, following the specification more closely. This means more reliable verification and fewer errors, making your experience smoother and more predictable.

    Looking Forward

    With this update, the plugin helps move the Fediverse toward a shared standard for signing and verifying messages. By supporting both the new standard and the older method, you’re making it easier for everyone to communicate using the same agreed-upon approach. There’s no change in security, but you’re part of making the network more consistent and helping the community take the next step forward.

    We hope this explanation helps clarify these technical changes. If you have any questions about HTTP signatures or how our plugin interacts with the Fediverse, please don’t hesitate to reach out in the comments below.