Just when you thought things were settling down… boom 💥 — the ActivityPub plugin gets another big upgrade. Say hello to **version 7.0.0**, a release packed with new features, polish, and under-the-hood improvements to help your WordPress site federate smoother, smarter, and more securely than ever.
Let’s dive into what’s new.##
Following the FediverseWe’ve added the **initial building blocks for Following support** — both sending and managing follow requests for remote actors. It’s not in the UI just yet (we’re rolling it out carefully), but that’s not far away. A big step toward richer, two-way federation.
We’ll work with developers of third-party plugins — including those behind **[Friends]( )** and **[Event Bridge]( )** — to migrate their custom follow implementations to this new core feature. This collaboration helps ensure a consistent, reliable follow experience across the ecosystem.
**This foundational support for following is also the first step toward a full-featured reader experience right inside WordPress** — something we’re excited to keep building toward.##
Refined SignatureThis release brings **support for RFC-9421-style HTTP signatures**, both incoming and (optionally) outgoing. That’s a mouthful, but it basically means supporting the latest standard in how we verify and send activities — including a fallback to good old Draft Cavage when needed.
Check out the blog post to learn more: [HTTP Signature Upgrades Coming Soon]( ) ##
Full Changelog###
Added<li>Added basic support for handling remote rejections of follow requests.</li><li>Added basic support for RFC-9421 style signatures for incoming activities.</li><li>Added initial Following support for Actors, hidden for now until plugins add support.</li><li>Added missing “Advanced Settings” details to Site Health debug information.</li><li>Added option to auto-approve reactions like likes and reposts.</li><li>Added support for namespaced attributes and the dcterms:subject field (FEP-b2b8), as a first step toward phasing out summary-based content warnings.</li><li>Added support for the WP Rest Cache plugin to help with caching REST API responses.</li><li>Documented support for FEP-844e.</li><li>Optional support for RFC-9421 style signatures for outgoing activities, including retry with Draft-Cavage-style signature.</li><li>Reactions block now supports customizing colors, borders, box-shadows, and typography.</li><li>Support for sending follow requests to remote actors is now in place, including outbox delivery and status updates—UI integration will follow later.</li>###
Changed<li>Comment feeds now show only comments by default, with a new <code>type</code> filter (e.g., <code>like</code>, <code>all</code>) to customize which reactions appear.</li><li>Consistent naming of Blog user in Block settings.</li><li>hs2019 signatures for incoming REST API requests now have their algorithm determined based on their public key.</li><li>Likes, comments, and reposts from the Fediverse now require either a name or <code>preferredUsername</code> to be set when the Discussion option <code>require_name_email</code> is set to true. It falls back to “Anonymous”, if not.</li><li>Management of public/private keys for Actors now lives in the Actors collection, in preparation for Signature improvements down the line.</li><li>Notification emails for new reactions received from the Fediverse now link to the moderation page instead of the edit page, preventing errors and making comment management smoother.</li><li>Plugins now have full control over which Settings tabs are shown in Settings > Activitypub.</li><li>Reworked follower structure to simplify handling and enable reuse for following mechanism.</li><li>Screen options in the Activitypub settings page are now filterable.</li><li>Setting the blog identifier to empty will no longer trigger an error message about it being the same as an existing user name.</li><li>Step completion tracking in the Welcome tab now even works when the number of steps gets reduced.</li><li>The image attachment setting is no longer saved to the database if it matches the default value.</li><li>The welcome page now links to the correct profile when Blog Only mode was selected in the profile mode step.</li><li>Unified retrieval of comment avatars and re-used core filters to give access to third-part plugins.</li>###
Fixed<li>Allow interaction redirect URLs that contain an ampersand.</li><li>Comments received from the Fediverse no longer show an Edit link in the comment list, despite not being editable.</li><li>Fixed an issue where links to remote likes and boosts could open raw JSON instead of a proper page.</li><li>Fixed a potential error when getting an Activitypub ID based on a user ID.</li><li>HTTP signatures using the hs2019 algorithm now get accepted without error.</li><li>Improved compatibility with older follower data.</li><li>Inbox requests that are missing an <code>algorithm</code> parameter in their signature no longer create a PHP warning.</li><li>Interaction attempts that pass a webfinger ID instead of a URL will work again.</li><li>Names containing HTML entities now get displayed correctly in the Reactions block’s list of users.</li><li>Prevent storage of empty or default post meta values.</li><li>The amount of avatars shown in the Reactions block no longer depends on the amount of likes, but is comment type agnostic.</li><li>The command-line interface extension, accidentally removed in a recent cleanup, has been restored.</li><li>The image attachment setting now correctly respects a value of 0, instead of falling back to the default.</li><li>The Welcome screen now loads with proper styling when shown as a fallback.</li><li>Using categories as hashtags has been removed to prevent conflicts with tags of the same name.</li><li>When verifying signatures on incoming requests, the digest header now gets checked as expected.</li>##
Downloads<li>WordPress.org: <a href="https://downloads.wordpress.org/plugin/activitypub.7.0.0.zip">https://downloads.wordpress.org/plugin/activitypub.7.0.0.zip</a></li><li>GitHub: <a href="https://github.com/Automattic/wordpress-activitypub/releases/tag/7.0.0">https://github.com/Automattic/wordpress-activitypub/releases/tag/7.0.0</a></li>##
Thank you!Huge thanks to everyone who contributed code, feedback, tests, or moral support. This community makes the fediverse feel a little more federated with every release. ❤️
Update now, test things out, and let us know how 7.0.0 works for you!
Friends – WordPress plugin | WordPress.org
Event Bridge for ActivityPub – WordPress plugin | WordPress.org
HTTP Signature Upgrades Coming Soon – ActivityPub for WordPress
