wordpress

Alongside our upcoming plans, we’ve already shipped several important features in recent releases. Here are some highlights of what’s now available in the ActivityPub plugin.

Onboarding

We’ve added an onboarding flow after plugin activation to help guide new users through key decisions — such as selecting the Actor Mode.

It’s also a great opportunity to explain Fediverse concepts for users who are new to them.

More details:

👉 5.9.0 — Easier onboarding for your Fediverse experience

Move

The Move Activity is used by Mastodon to migrate accounts to different servers — and can also be used for domain or username changes.

In the WordPress ecosystem, one of the main motivations for implementing Move was to support changing the domain of a WordPress blog — a common scenario for WordPress site owners.

We’ve built a solid foundation in the plugin to both send and receive Move Activities. However, because Move is not yet widely adopted across the Fediverse, we’ve decided to pause further work on this feature until there is broader ecosystem support.

Account migration remains a crucial capability for a healthier, more portable social web. If you’re interested in the broader context and challenges around this, we recommend watching Cory Doctorow’s keynote from the June FediForum:

https://www.youtube.com/watch?v=7_Gs1t0qe78

We’ll revisit this as the standard matures and more servers implement consistent handling of Move.

More details:

👉 GitHub — Move Milestone

Outbox

Earlier versions of the plugin supported only the federation of custom post types, sending all messages in one bulk.

That approach works up to about 1000 followers, but does not support retries, logging, or error handling.

To support larger blogs or news sites — we needed a more robust system.

We now have mechanisms to:

Federate activities to more than 1000 followers.
Use a staggered delivery system that prioritizes servers.
Provide a stable and scalable architecture.
Support retries and error reporting.

This improved Outbox system also makes it easier for third-party plugin developers to federate their own content types in a reliable and scalable way.

More details:

👉 GitHub — Outbox Milestone

Changelogs

These are just the major milestones. If you’re interested in everything we ship, be sure to subscribe or follow the blog — we publish detailed changelog posts with every new plugin release, listing all new features and improvements.

As always, we welcome your feedback and ideas — they help shape the future of the ActivityPub plugin and the growing WordPress Fediverse community! 🚀

ALT

ALT

Ever wonder how your site proves it’s really you talking to the rest of the Fediverse? It’s not magic—it’s HTTP signatures, the digital equivalent of a secret handshake. With our next release, we’re making that handshake a lot more universal (and a little less awkward).

Why HTTP Signatures Matter

When you interact with the Fediverse, you want to know that the messages you send and receive are genuine. HTTP signatures are the technology that makes this possible. Every time your site sends a message, it includes a digital signature—like sealing an envelope with your personal stamp. This signature proves that your content really came from your account and that no one has tampered with it along the way. As a result, you can trust that your interactions across the network are authentic.

A Bit of Background: draft-cavage and RFC 9421

If you’ve heard about HTTP signatures, you might have come across terms like “draft-cavage” and “RFC 9421.” These are just different versions of the rules for how those digital signatures are created and checked.

For a long time, most of the Fediverse has used what’s called the draft-cavage-12 specification. Think of this as a set of instructions that people agreed to try out, but that hadn’t been officially finalized. It worked well enough to let sites talk to each other securely, but because it was just a draft, there were sometimes small differences in how different software used it.

Recently, the community agreed on a final, official version of these rules, called RFC 9421. This is now the standard way to create and verify HTTP signatures. This makes it easier for sites and servers to understand each other and work together, since everyone is following the same process.

Incoming Support for the New Standard, Out of the Box

With this update, the plugin will support incoming HTTP signatures that use the new standard right away. There’s nothing extra you need to do. This means that when other servers use the new, official approach for signatures, your site will recognize and accept them. By making support for the new standard easy and automatic, the plugin helps move the Fediverse forward, encouraging more sites to adopt this approach and making connections across the network more reliable.

Outgoing Requests and the Double Knock Approach

There’s a new setting for outgoing requests, but for most people, there’s no need to touch it. This option is really for the folks who like to be on the cutting edge and want to start using the new standard for outgoing messages right away. If that sounds like you, here’s how to find it: head to the ActivityPub settings in your dashboard, open “Screen Options” at the top right, and enable “Advanced Settings.” Then, click on the Advanced Settings tab and turn on “Use modern signature format for Fediverse communications.”

But don’t feel any pressure—leaving this setting off is perfectly fine. The plugin already handles incoming messages with the new standard out of the box, and we’ll automatically enable outgoing support for everyone once the wider Fediverse is ready. For now, this is just an option for early adopters.

If you do turn it on, the plugin uses what we call the “double knock” approach. It’ll try the new standard first, and if the other server isn’t ready for it, it’ll automatically fall back to the older method. So, you can experiment without worrying about breaking communication with anyone.

Improved Verification for Existing Signatures

The plugin also brings improvements to how it handles signatures that use the older method, especially those using the hs2019 algorithm. Now, when a signed message arrives, the plugin fetches the sender’s public key and uses it to determine the correct way to verify the signature, following the specification more closely. This means more reliable verification and fewer errors, making your experience smoother and more predictable.

Looking Forward

With this update, the plugin helps move the Fediverse toward a shared standard for signing and verifying messages. By supporting both the new standard and the older method, you’re making it easier for everyone to communicate using the same agreed-upon approach. There’s no change in security, but you’re part of making the network more consistent and helping the community take the next step forward.

We hope this explanation helps clarify these technical changes. If you have any questions about HTTP signatures or how our plugin interacts with the Fediverse, please don’t hesitate to reach out in the comments below.

ALT

We’ve rolled out an update that makes sharing content to the fediverse via ActivityPub even better—especially when it comes to images in comments. Now, when you include an HTML <img> tag that points to a file in your WordPress media library, that image is bundled as a proper attachment in the ActivityStreams payload. This means your followers on other platforms will see both your comment and its image, making conversations more vivid and engaging.

To protect your privacy and security, only images hosted in your own WordPress media library are supported. Images from external sources are intentionally skipped.

Smoother Following, Better Interactions

If you’ve turned on the “Following User Interface” feature in the advanced settings, you’ll see a few nice improvements. The followers list now shows whether you’re already following someone—and if not, you can follow them back with just one click.

We’ve also made it easier to follow people from other sites. When you click “Follow” on someone else’s blog, you’ll now be taken to your own site to complete it. It keeps things simple and familiar, even when you start following someone from another site.

Better Support for Multibyte Text

Finally, we’ve improved how multibyte characters (like those in Greek and other non-Latin scripts) are handled when generating post summaries for the fediverse. We’ve replaced byte-based string functions with multibyte-safe alternatives and reordered text processing steps to avoid errors.

Full Changelog

Added

Add image attachment support to federated comments – HTML images in comment content now include proper ActivityStreams attachment fields.
Link to the following internal dialog for remote interactions, if the feature is enabled.
The followers list now shows follow status and allows quick follow-back actions.
Trigger Actor updates on (un)setting a post as sticky.
You can now use OrderedCollections as starter packs — just drop in the output from a Follower or Following endpoint.

Changed

Ensure that tests run in production-like conditions, avoiding interference from local development tools.
Moved HTTP request signing to a filter instead of calling it directly.

Fixed

Allow non-administrator users to use Follow Me and Followers blocks.
Correct linking from followers to the following list.
Fix avatar rendering for followers with missing icon property.
Fix multibyte character corruption in post summaries, preventing Greek and other non-ASCII text from being garbled during text processing.
Informational Fediverse blocks are no longer rendered when posts get added to the Outbox.

Downloads

WordPress.org: activitypub.7.2.0.zip
GitHub: tag/7.2.0

Thank you!

Huge thanks to everyone who shared code, gave feedback, tested, or simply cheered us on! Together, we’re building a more connected fediverse, one release at a time. ❤️

We’ve just released version 7.2.0, give it a spin and let us know what you think!

ALT

ALT