ActivityPub

Changelog

8.3.0 – 2026-05-18

Security

• Block a recently compromised JavaScript dependency from being installed during builds.

Added

• Allow site administrators to post from third-party apps on behalf of the site’s blog account.
• Store content warnings from posts published through third-party ActivityPub apps so they federate correctly.

Changed

• Improve compatibility with newer Fediverse servers by recognizing the FEP-3b86 Object Intent link when resolving remote follow and other intent endpoints.
• Improve compatibility with newer Fediverse servers by recognizing the standardized FEP-3b86 follow link for remote follows.
• Refresh bundled scripts to pick up the latest WordPress component updates.
• Stagger background data processing after plugin updates to reduce server load on hosts running many sites.

Fixed

• Allow third-party apps connected to your site to look up Fediverse users by their handle (like @user@example.com).
• Fix ActivityPub blocks and widgets failing to load on cross-origin embeds (such as WordPress.com sites) due to a missing nonce header in the CORS allow-list.
• Fix a JavaScript console error that could appear on pages with the Follow, Reactions, Followers, Following, or Remote Reply blocks.
• Fix posting an Undo of a Follow through the outbox API failing with a server error or silently leaving the follow in place.
• Prevent a PHP warning during the monthly statistics backfill when an outbox item disappears between lookup steps.
• Prevent private outbox items authored by the site account from being visible to logged-out visitors at their permalink URLs.
• Prevent the site’s follower and following lists from being visible to logged-out visitors when the social graph is set to private.
• Reduce database overhead on sites with many deleted posts by moving the tombstone registry to its own storage.
• Set a real author on posts created via the blog actor outbox so they no longer appear without a byline.
• Silence the upcoming WordPress 7.0 deprecation warning about data-wp-on-async by switching the plugin’s interactive blocks to the new withSyncEvent() helper.

8.2.1 – 2026-05-01

Security

• Hardened how the inbox processes large recipient lists in incoming activities.

Fixed

• Fix monthly and annual Fediverse Stats emails being sent more than once per period when the scheduler ran multiple times.

8.2.0 – 2026-04-27

Security

• ActivityPub REST endpoints no longer advertise credentialed cross-origin access. Browser-based clients using OAuth bearer tokens continue to work as before.
• Aligned the deprecated signature verifier’s clock tolerance with the supported verifiers.
• Blocked additional reserved IPv6 ranges from outbound request safety checks.
• Decoded percent-encoded forms in the follower sync authority before the safety check.
• Fail closed when an OAuth request can’t be tied to a client IP, instead of sharing one rate-limit bucket.
• Hardened input handling for incoming federated activity types.
• Hardened outbound request handling for third-party app connections and live activity streams.
• Hardened outbound request safety to cover IPv6-only third-party hosts.
• Per-IP rate limits now only trust the actual TCP peer by default, so an attacker on a directly-exposed site cannot bypass the cap by spoofing X-Forwarded-For or similar proxy headers. Sites behind a trusted reverse proxy (Cloudflare, Akamai, nginx) can opt the relevant header back in via the new “activitypub_client_ip_sources” filter.
• Reject follower sync requests targeted at internal-network hosts at the route layer.
• Required signatures on HEAD requests to peer-only endpoints.

Changed

• Development tooling: require PHPUnit 9.6.33 or newer (security fix CVE-2026-24765). No runtime impact for end users.
• OAuth public clients must now use PKCE by default, matching OAuth 2.1. Site operators can relax this via the activitypub_oauth_require_pkce filter if legacy clients need to connect.
• Returned the standard rate-limit response from the OAuth token endpoint when too many requests are sent.

Fixed

• Delete activities no longer bypass signature verification on endpoints that explicitly require it.
• OAuth token revocation now verifies the caller owns the token being revoked.
• Tighten HTTP signature verification: narrow the clock-skew window, reject signatures that carry no freshness timestamp, and cap unreasonable expiry times. Peers that sign without a Date or creation timestamp will no longer verify.
• Trim dev-only configuration files from the plugin release package.

8.1.1 – 2026-04-22

Added

• Added the activitypub_post_object_type filter so plugins can override the federated object type (Note, Article, Page) for a post.

Changed

• Always flush rewrite rules at the end of a plugin migration so that users upgrading across multiple versions do not miss a flush.

Fixed

• Fix the Fediverse stats widget on sites where the REST namespace is remapped, such as WordPress.com.
• Harden the reactions API response so stored author names and URLs cannot introduce markup or non-HTTP schemes into the JSON output.
• Stop hiding posts that contain a federated reply block from the main blog listing and the admin post list on sites that do not use the Posts and Replies block.

8.1.0 – 2026-04-21

Security

• Add rate limiting to app registration to prevent abuse.
• Fix blog actor outbox exposing private activities to unauthenticated visitors.
• Restrict localhost URL allowance to local development environments only.
• Verify that the signing key belongs to the same server as the activity actor.

Added

• Add a “Posts and Replies” tab bar for author archives that filters between posts and replies, similar to Mastodon’s profile view.
• Add a liked collection to actor profiles, showing all posts the actor has liked.
• Add a seasonal starter pattern that suggests sharing Fediverse stats when creating a new post in December and January.
• Add a stats block that displays annual Fediverse statistics as a card on the site and as a shareable image on the Fediverse, with automatic color and font adoption from the site’s theme.
• Added activitypub_pre_get_by_id filter to allow plugins to register custom virtual actors resolved by ID.
• Add EXIF metadata support for image attachments using Vernissage namespace.
• Add new Fediverse Following Page and Profile Page block patterns.
• Add OAuth server metadata and registration endpoint discovery to actor profiles.
• Add real-time streaming for inbox and outbox updates via Server-Sent Events (SSE).
• Add support for Block, Add (pin post), and Remove (unpin post) activities via Client-to-Server API.
• Add support for check-in activities posted via compatible apps.
• Add support for importing Starter Packs in both the Pixelfed and Mastodon formats.
• Add tags.pub integration to supplement tag timelines with posts from across the Fediverse.
• Support for ActivityPub Client-to-Server (C2S) protocol, allowing apps like federated clients to create, edit, and delete posts on your behalf.

Changed

• Block patterns for follow, following, and profile pages are now only suggested when editing pages.
• Fix notification pagination when using Enable Mastodon Apps: use date-constrained queries instead of truncating the shared notification pool, and expose $limit, $before_date, and $after_date as additional filter arguments so third-party handlers can fetch the correct window.
• Improve the pre-publish format suggestion panel with clearer messages and a confirmation after applying a format.
• Podcast episodes now respect the configured object type setting instead of always being sent as “Note”.
• Show reaction action buttons even when a post has no reactions yet.

Fixed

• ActivityPub endpoints that surface comment, reply, like, share, and remote-reply metadata now honor the parent post’s visibility setting.
• Added validation for SSE access tokens passed via query parameter.
• Fix account migration (Move) not working when moving back to an external account.
• Fix a fatal error during activity delivery when the outbox item has been deleted.
• Fix a fatal error when receiving activities with a non-string language property.
• Fix a fatal array_keys(null) in Comment::get_comment_type_slugs() that could take down any request where a third-party plugin transitioned a custom comment type before add_comment_type() had been called.
• Fix a missing script dependency notice on the admin page in WordPress 6.9.1 and later.
• Fix BuddyPress @mention filter corrupting Fediverse Followers and Following blocks.
• Fix cleanup jobs silently doing nothing on sites where purge retention options were not set.
• Fix comments on remote posts being incorrectly held in moderation.
• Fix double-encoded HTML entities in post titles on the Fediverse Stats dashboard.
• Fixed an issue where quote authorization stamps could reference unrelated posts.
• Fixed double-encoding of special characters in comment author names on updates.
• Fixed emoji shortcode replacement to handle special characters in emoji names correctly.
• Fix fatal error when other plugins hook into the user agent filter expecting two arguments.
• Fix Fediverse Preview showing the standard web view instead of the ActivityPub preview for draft posts.
• Fix OAuth authentication failing for local development clients using localhost subdomains.
• Fix performance regression from reply-exclusion filter by skipping it for queries targeting non-ActivityPub post types.
• Fix Reader feed failing to load with newer WordPress versions.
• Fix remote actor avatars getting stuck on broken URLs when the original image becomes unavailable.
• Fix Site Health check showing an empty error message when the WebFinger endpoint is not reachable.
• Fix the Fediverse profile “Joined” date showing the oldest post date instead of when the site started federating.
• Fix the Fediverse profile showing an inflated post count by excluding incoming comments from the total.
• Fix Update handler using stale local actor data instead of the activity payload
• Improved HTTP Signature validation for requests with a missing Date header.
• Only allow S256 as PKCE code challenge method for OAuth authorization.
• Prevent third-party plugin UI elements and scripts from appearing in federated content.
• Require signed peer requests for the followers synchronization endpoint per FEP-8fcf.
• Show a styled error page instead of raw technical output when an OAuth application cannot be reached during authorization.
• Strip private recipient fields from all outgoing activities to prevent leaking private audiences.
• Sync ActivityPub blog actor settings via Jetpack.
• Use ap_actor post ID for remote account IDs instead of remapping URI strings.
• Use safe HTTP request for signature retry to prevent requests to private IP ranges.
• Validate emoji updated timestamps before storing them.

8.0.2 – 2026-03-17

Security

• Prevent non-public posts (drafts, scheduled, pending review) from being accessible via ActivityPub.

8.0.1 – 2026-03-11

Changed

• Simplify the follow page block pattern to avoid duplicate headings and improve accessibility.

Fixed

• Fix dark sidebar colors appearing incorrectly with non-default admin color schemes.
• Fix Fediverse Reactions block not aligning with post content in block themes.
• Fix new posts being marked as modified on load, which prevented Gutenberg’s starter pattern modal from appearing.

8.0.0 – 2026-03-04

Security

• Prevent private recipient lists from being shared when sending activities to other servers.

Added

• Add a help section to interaction dialogs explaining the Fediverse and why entering a profile is needed.
• Add a notice on the Settings page to easily switch from legacy template mode to automatic mode.
• Add a pre-publish suggestion that recommends a post format for better compatibility with media-focused Fediverse platforms.
• Add a Site Health check that warns when plugins are causing too many federation updates.
• Add backwards compatibility for the ACTIVITYPUB_DISABLE_SIDELOADING constant and activitypub_sideloading_enabled filter from version 7.9.1.
• Add bot account snippet that marks ActivityPub profiles as automated accounts, displaying a “BOT” badge on Mastodon and other Fediverse platforms.
• Add Cache namespace for remote media caching with CLI commands, improved MIME validation, and filter-based architecture.
• Add federation of video poster images set in the WordPress video block.
• Add Locale from Tags community snippet.
• Add optional Like and Boost action buttons to the Fediverse Reactions block, allowing visitors to interact with posts from their own server.
• Add pre-built Fediverse block patterns for easy profile, follow page, and sidebar setup.
• Add snippet for blockless fediverse reactions
• Add wp activitypub fetch CLI command for fetching remote URLs with signed HTTP requests.

Changed

• Improved active user counting for NodeInfo to include all federated content types and comments.
• Improve language map resolution to strictly follow the ActivityStreams spec.
• Superseded outbox activities are now removed instead of kept, reducing clutter in the outbox.
• The minimum required PHP version is now 7.4.

Fixed

• Accept incoming activities from servers that use standalone key objects for HTTP Signatures.
• Fix a crash on servers where WordPress uses FTP instead of direct file access for media caching.
• Fix a crash when receiving posts from certain federated platforms that send multilingual content.
• Fix automatic cleanup of old activities failing silently on sites with large numbers of outbox, inbox, or remote post items.
• Fix comment count to properly exclude likes, shares, and notes.
• Fix follow button redirect from Mastodon not being recognized.
• Fix modal overlay not covering the full screen on block themes.
• Fix outbox invalidation canceling pending Accept/Reject responses to QuoteRequests for the same post.
• Fix QuoteRequest handler to derive responding actor from post author instead of inbox recipient.
• Fix reactions block buttons inheriting theme background color on classic themes.
• Fix reactions block layout on small screens and remove unwanted button highlight when clicking action buttons.
• Fix signature verification rejecting valid requests that use lowercase algorithm names in the Digest header.
• Fix soft-deleted posts being served instead of a tombstone when the post is re-saved.
• Improve compatibility with federated services that use a URL reference for the actor’s public key.
• Improve handling of all public audience identifiers when sending activities to followers and relays.

See full Changelog on GitHub.