ActivityPub

Changelog

9.4.0 – 2026-10-29

Security

• Accounts you blocked can no longer reply to, like, repost or quote your posts and comments.
• Improve the safety of imported Fediverse posts and comments.
• Improve verification of signing keys fetched from other servers.
• Incoming activities are now only accepted when they are signed with the sending account’s own key.
• Signatures on incoming requests now have to cover the address they were sent to and the content they carry.

Added

• Add a Counts style to the Fediverse Reactions block that shows comments and reactions as a line of simple links, for example to replace the comments link in a query loop.
• Add an option to show images attached to Fediverse replies in comments, with local caching and image descriptions.
• Added a custom name and avatar for the blog profile. Your Fediverse blog account can now use its own display name and profile picture, independent of the WordPress site title and site icon.
• Added a Federated Quote block to quote posts from the Fediverse. The author of the quoted post is asked for permission, and the quote is marked as verified once they agree.
• Added a filter that lets plugins decide which comment types are shared with the Fediverse, so custom comment types can be kept local or sent out as replies.
• Added a Source column to the Comments screen that links incoming replies and quote posts to the post they came from.
• Fediverse apps can now jump directly to the page of a collection that contains a specific item, instead of paging through from the start.
• Posts and comments on sites using Polylang are now federated with the language Polylang assigned to them.
• Posts published from a Mastodon app are now federated with the language the app set, and on sites using Polylang or WPML that language is stored with the multilingual plugin.
• Profiles and posts now point at the shared Fediverse definitions for content warnings, hashtags, manual follower approval and account moves.
• Support handles with non-Latin characters and domains with special characters, like @renée@café.example, in mentions, search and profile lookups.
• The Counts style of the Fediverse Reactions block now uses your theme’s link color, adds a link color setting, and underlines links on hover.
• The Fediverse Reactions block now has margin and padding settings.
• The Social Web feed can be filtered by date, to show only posts from before or after a day you pick.
• You can now log in as a different WordPress user while authorizing an ActivityPub app without losing the authorization request.

Changed

• Endpoints that other sites and apps call now answer a limited number of requests per minute from the same caller, and say so in the RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset response headers.
• Only accounts that are enabled for ActivityPub can authorize apps to act for them.
• Posts and profiles fetched from other servers are now cached through the WordPress object cache when the site has one. Updates and confirmed deletions clear the cached copy.
• The Fediverse Reactions block now lines up its buttons with the same width and shows a lighter label for reactions you can’t answer from the block.

Removed

• The option to turn off content filters in the post template was removed. Federated posts now always use the regular content filters.

Fixed

• Account moves are only accepted when the new account lists the old one by its ActivityPub ID, as Mastodon does.
• Accounts on other servers that change their signing key are no longer rejected until their profile is refreshed.
• Activities between accounts on the same site are now delivered on sites installed in a subdirectory or using plain permalinks.
• Activities delivered to accounts on the same site now only reach ActivityPub inboxes.
• Activities read through the ActivityPub API now fall back to the date your site recorded when the activity itself carries none, so client apps show consistent timestamps.
• Apps connected to your account now only see what you granted them access to.
• Apps that post on behalf of the blog can now only change or delete content that the connected user is allowed to change or delete.
• A queued activity that cannot be read no longer stops the ones queued behind it from being sent.
• Blocking a remote account now removes it from your followers and following lists, whichever form of its address you used.
• Connection problems with other servers now explain what went wrong instead of failing without a reason.
• Descriptions of remote accounts with quotes or links in them are no longer saved with stray backslashes.
• Domain blocks now also apply to handles that have a path after the domain, like @user@example.com/x.
• Duplicate copies of cached profile pictures and images that earlier versions left behind are removed on update, and wp activitypub cache cleanup removes them on demand.
• Emoji in the blog profile ID are now dropped instead of being turned into a string of codes that other servers could not resolve.
• Ensure that only account deletions delivered to your site can skip the usual sender verification.
• Feature requests are now only approved for collections that belong to the account asking.
• Federated posts and comments now always show what a logged-out visitor sees, not the version shown to the logged-in author.
• Fewer duplicate email notifications when another server delivers the same message more than once, and a reply that mentions you no longer also sends a separate mention email.
• Fixed a fatal error on sites using the Photon snippet, which now also serves images in Fediverse replies through the CDN.
• Fixed a possible error when preparing an activity in the outbox whose object is not a full object.
• Fixed deprecation notices on PHP 8.5.
• Fixed followers, remote profiles and received activities not being found again when their address contains an ampersand, including on WordPress 7.2.
• Fixed LiteSpeed Cache possibly showing visitors the technical ActivityPub version of a page instead of the normal page.
• Fixed math formulas, and everything after them, disappearing from posts on WordPress 7.2 when the formula includes an HTML annotation.
• Fixed normal replies from distant accounts sometimes being auto-approved just because that account had previously liked or reposted a post.
• Fixed oversized images in email notifications from remote users. Avatars and inline post images now resize to fit the email width instead of overflowing the screen.
• Fixed profile pictures being downloaded again on every page view, leaving a copy behind each time and filling up the uploads folder.
• Fixed requests to servers on a non-standard port being rejected because their signature did not include the port.
• Fixed signed requests from other servers being rejected on sites behind a proxy that changes the host name.
• Fixed the ActivityPub API, relay mode, and OpenGraph metadata silently staying off on some multisite hosts that select the site after plugins have loaded.
• Fixed the plugin answering WebFinger, NodeInfo and OAuth server discovery requests meant for other plugins, such as IndieAuth.
• Fixed the reaction buttons using the browser font instead of the theme font, which made them smaller than the placeholder for reactions without an action.
• Fixed the search page and the posts page redirecting to a category or tag, or being served as one, on sites that filter content by language, such as Polylang.
• Fixed the user selection in the Follow Me and other ActivityPub blocks disappearing when the site has a user you are not allowed to edit.
• Fix Fediverse account migration being ignored by some servers when the new account is entered using an alternate address.
• Fix Fediverse account migration so a move is verified before it takes effect and reliably reaches your followers on other servers.
• Fix local account post counts in Mastodon apps when using Enable Mastodon Apps.
• Follow requests are now only accepted when they are meant for the account that received them, and profile links on other sites no longer count as accounts on your site.
• Handle incomplete Fediverse object references without errors.
• Hidden recipients of a received activity are no longer included when an app reads or streams your inbox.
• Improve handling of post URLs when changing publication status.
• Incoming requests and account lookups now only match the site address, not the WordPress address.
• Links in replies received from the Fediverse now display correctly on WordPress 7.1.
• Links to a comment now open the page it is actually on, instead of a later page, on posts with many likes or reposts.
• Links to the pages of a collection no longer pass on unknown query arguments, which could point them at the wrong address.
• Notifications in the Social Web screen no longer show up twice.
• Only image attachments are accepted for the blog avatar and the header images.
• Opening a post in the Social Web screen no longer distorts the panel corners or folds the list.
• Password-protected sticky posts are no longer listed in your featured posts on the Fediverse.
• People mentioned in a post written from a Mastodon app are notified about it again.
• Podcast episodes and other attached files hosted outside your media library are now included when a post is sent to the Fediverse.
• Posts no longer send a second, smaller copy of the featured image, or the site icon when there is no featured image, which some apps showed as an extra image under the post.
• Post summaries now respect plugins that change or hide parts of the post content.
• Post summaries now stop at the “Read more” tag everywhere and keep the title of Details blocks.
• Queued activities now record their publication and edit times correctly on sites that are not set to UTC.
• Quote and feature requests are now only answered when they were sent to the account they ask.
• Quote requests are now only approved for posts that belong to the account asking.
• Reaction types added by other plugins no longer cause PHP warnings and are now included in Jetpack.
• Replies and likes from the Fediverse can now only be changed or removed by the person who sent them, also for older ones.
• Replies found by searching for their address now follow your comment moderation settings instead of being approved right away.
• Replies sent through the ActivityPub API to posts on other servers are now delivered instead of being rejected.
• Replies to posts from accounts you follow no longer show up in your comments feed and comment widgets.
• Replies written through an ActivityPub app no longer mention the person you are replying to twice.
• Restore spam-protection checks for regular comments after a comment arrives from the fediverse.
• Searching for the address of a reply that cannot be imported now shows the normal search results instead of a broken link.
• Signed requests from other servers are now checked more strictly, and requests that are not meant for your site are rejected before the sender’s key is fetched.
• Signed requests from other servers are now only accepted when they are addressed to your site’s address. Sites reached under more than one domain can allow the others with the activitypub_signature_original_hosts filter.
• Sites that turned off comment flood protection no longer get it switched back on by an incoming comment from the Fediverse.
• Skip unusable attachments on posts from other servers instead of showing them as broken images.
• Stop ActivityPub Likes, Reposts, and Quotes from leaking into the front-end comment list on sites that also use other comment-filtering plugins.
• Tags with underscores, like veranda_vestli, now keep their underscores when shared to the fediverse instead of being changed to camelCase.
• The “Powered by WordPress” profile field no longer shows up twice, no longer comes back after you delete it, and no longer triggers a warning when the plugin is first activated.
• The browser tab title of the settings page now shows the name of the current tab.
• The Followers and Following blocks now take their colours and font from the theme, so they are readable on dark themes, and they offer the usual colour, font size and spacing controls in the editor.
• The Reactions block no longer requests reactions in the editor for drafts, pages, and other content that is not shared to the Fediverse, which caused failed requests on every editor load.
• Tightened the checks on the screen where you approve apps for your account.

9.3.1 – 2026-09-02

Security

• Links to remote profiles in the Followers and Following blocks are now limited to regular web addresses when paging through the list.
• Replies cached on posts in the blog profile’s reader feed are no longer readable by logged-out visitors through the WordPress REST API.
• Signatures on incoming requests are now checked against the address the request was actually sent to.

9.3.0 – 2026-09-02

Security

• Block markup in posts from remote accounts is now removed before the post is saved.
• Follow, reply and reaction links advertised by other Fediverse servers now have to be regular web addresses.
• Followers, cached remote profiles, and reader posts are no longer readable by logged-out visitors through the WordPress REST API, and the setting that hides your follower list is now honoured everywhere.
• Inline styles are now removed from posts and profiles that come from remote accounts.
• Posts from remote accounts are now shown in the Social Web reader exactly as the site stored them.
• Replies from remote accounts are now filtered before they are saved when an administrator imports them through search.

Added

• Add a notification setting to turn off emails about likes, reposts, and quotes without silencing real comments and replies.
• Add the Fediverse and ActivityPub logos to the block editor’s icon library on WordPress 7.1 and newer.
• Federate podcast episodes published with Jetpack, including their audio file and cover art.

Changed

• Enable RFC 9421 HTTP Message Signatures by default.

Fixed

• Apps connected through the ActivityPub API now use the standard ActivityPub API permission names. Fetching remote content through your site is treated as reading rather than posting, so an app needs read permission for it.
• Apps now see the real error when a post they open through your site is missing, instead of a generic failure.
• Comment author names are no longer altered on comments that did not come from the fediverse.
• Fixed a crash that could fill the error log when another server edited a reply to a post that is no longer shared to the Fediverse.
• Fixed an error that could break embeds of Fediverse posts whose author was sent in an unexpected format.
• Fixed an error that could occur when looking up a profile on another Fediverse server that sends back an unexpected response.
• Fixed backslashes disappearing from titles and content in posts from remote accounts.
• Fixed responses to ActivityPub addresses written with different capitalisation not being cached correctly.
• Fixed the Application actor not being found when its address was written with different capitalisation.
• Fixed the Mastodon importer creating duplicate posts when an archive was imported a second time.
• Fixed titles, summaries, captions and display names from remote accounts being stored with stray markup.
• Imported Mastodon media descriptions now have unsafe HTML removed before they are saved.
• Imported Mastodon replies now have unsafe HTML removed before they are saved as comments.
• Improve how blocked accounts are matched.
• Improve permission checks for third-party apps connected through the ActivityPub API.
• Improve validation of incoming activities from other servers.
• Screen readers now announce errors in the follow, reply and reaction dialogs.
• Text inside hidden page elements, like invisible dialog pop-ups, no longer shows up in posts shared to the Fediverse.
• The blog profile can be found again from other Fediverse servers on sites that also run Polylang.

9.2.2 – 2026-08-11

Fixed

• Fixed avatars and emoji occasionally failing to cache, and the file warnings that came with it.
• Fixed deletions from Mastodon and other servers not removing the corresponding comment on your site.
• Fixed some styles not loading on the Fediverse admin screens and in the Followers and Following blocks.
• Fixed the editor warning about unsaved changes right after saving a post with an older date.

9.2.1 – 2026-08-03

Fixed

• Fixed duplicate entries and failed undo actions for activities received from other WordPress sites.
• Fixed posts and profiles not being found on Mastodon and other Fediverse software, which happened when a request asked for ActivityPub data but also accepted HTML as a low-priority fallback.
• Fixed remote profiles and followers not being found when their address contains unusual characters.
• Improved checks on boosted content so it is only accepted from the server that published it.
• Improve escaping of embedded link URLs in federated content.
• Improve permission checks for admin-only actions.
• Improve validation of incoming federated activities so the signing key and referenced objects are bound to the sender.

9.2.0 – 2026-07-31

Changed

• ActivityPub responses are now served only to clients that ask for ActivityPub data and nothing else, which keeps that data out of page caches meant for regular web pages.
• Only users enabled for ActivityPub can obtain and use OAuth access tokens.

Removed

• Remove support for the WP REST Cache plugin.

Fixed

• Hide the heading on the Followers and Following blocks when its text is cleared, matching the Reactions block.
• Under Authorized Fetch, ActivityPub responses are no longer stored by page caches such as LiteSpeed or Surge.

9.1.0 – 2026-07-22

Security

• Ensure apps you connect can only act within the access you granted them, and not make wider changes to your site.
• Ensure remote profiles and content are served from the address they claim before storing them.
• Fix a security issue where a remote actor’s profile link could run scripts in the admin area.
• Ignore an incoming follow request whose actor resolves to a different account than the one that sent it.

Added

• Add a filter that allows federating with servers on private or internal networks.
• Add an actor autocomplete endpoint so Fediverse apps can offer typeahead search when mentioning people.
• Federate the episode summary for Podlove Podcast Publisher episodes.

Changed

• Improve reliability of the Social Web admin screen loading.
• Improve the internal handling of the Application actor used for server-to-server requests.

Fixed

• Ensure a follow can only be declined by the account you followed.
• Fixed using the correct cache representation in Surge config
• Fix follow requests from some fediverse services staying pending after they are accepted.
• Fix likes from some accounts being recorded as multiple duplicate comments.
• Fix posts being removed from the Fediverse when edited while scheduled for a future publish date.
• Fix repeated deliveries of a like or repost creating new comments after the original was marked as spam or moved to the trash.
• Fix Starter Kit imports failing on Fediverse servers that require signed requests.
• Fix the scheduled refresh of remote profiles so it actually re-fetches from the remote server. Previously, stale avatars and bios for commenters never updated until they sent a new activity to your site.
• Fix URLs with multiple query parameters (such as avatars, images, profile links, and podcast media) being corrupted in content sent to the Fediverse.
• Prevent caching non-actor objects (such as notes) as remote profiles.
• Refresh cached remote profiles in place during scheduled updates to avoid creating duplicate copies.
• Show the Fediverse Preview for scheduled posts instead of the regular post preview.
• Stop storing responses from remote servers in the database when they were requested uncached.

9.0.2 – 2026-06-29

Fixed

• Improve handling of content received from other servers.

9.0.1 – 2026-06-15

Added

• Add FAQ guides that help solve follow requests stuck on “pending” and comments from the Fediverse not showing up.

Fixed

• Notify followers about your new preference when the Starter Kit policy setting changes, so other servers no longer act on an outdated one.
• Publish the Starter Kit consent policy only on your own blog and author profiles, no longer on system or third-party profiles.
• Starter Kit consent now also works for the blog profile, not just for individual authors.

9.0.0 – 2026-06-10

Security

• Enforce the signing-key host check on incoming federated activities regardless of how the key identifier is formatted.
• Fix the real-time activity stream so it only returns the requesting user’s own activities.
• Harden the Site Health connectivity check so it cannot be used to reach unsafe network addresses.
• Only share comment replies in the Fediverse when the post they belong to is itself federated, so replies on private or non-federated posts stay private.
• Prevent a remote server from discovering which of your followers belong to a third-party server it does not control.
• Prevent logged-in users from viewing another user’s private outbox activities.
• Prevent remote servers from modifying or deleting federated profiles, posts, and interactions they do not own.
• Rate-limit the remote-follow lookup to prevent it from being abused to trigger outbound requests.
• Stop the OAuth token introspection endpoint from revealing another user’s token details to logged-in users.
• Stop the quote-authorization stamp from exposing a post’s other metadata.

Added

• Add a Distribution Mode setting to control how quickly posts are delivered to followers.
• Add an opt-in setting to consent to inclusion in Starter Kits (also called Starter Packs or Featured Collections). Off by default. Find it under Settings, ActivityPub, Activities.
• C2S clients can now request canonical SWICG ActivityPub API scope names such as activitypub:read:all and activitypub:write:all, and the OAuth discovery metadata advertises them.
• C2S token responses now include activitypub_actor_id so clients following the SWICG ActivityPub API Basic Profile can discover the authenticated actor.
• Generate a blurred color preview (blurhash) for images so other fediverse apps can show a placeholder while your photos load.
• Quote notification emails now include a link to the post that quoted you, so you can review and respond more quickly.
• Warn in the editor before making a post that’s already shared on the Fediverse a draft, private, or password-protected, since followers’ copies will be removed.

Changed

• Add the blurhash term to the outbound JSON-LD @context so attachments that include a blurhash property are strictly correct JSON-LD, matching Mastodon’s own context shape.
• Federated posts moved to draft, pending, private, trash, or password-protected now send a Delete to followers (previously sent a placeholder “editing” Update or were silent).
• OAuth rate-limit responses now include a Retry-After header so clients know how long to wait before retrying.
• Updated a build dependency to a clean release now that a fixed version is available.

Removed

• Removed functions, methods, and the Follower class that were deprecated in versions 7.0 through 7.4.

Fixed

• Fix a fatal error when receiving a new follower while the Stream plugin is active.
• Fix a follow request being marked as accepted when the confirmation came from a different account than the one being followed.
• Fix the Fediverse settings appearing twice and visibility changes not saving in the block editor when the Classic Editor plugin is also active.
• Fix the introduction video failing to load on the Getting Started help screen.
• Follower synchronization with Mastodon no longer fails, signed requests with query strings now verify correctly.
• Harden the Blurhash encoder: skip decompression-bomb images before decoding, flatten transparency onto white so transparent logos no longer produce near-black placeholders, and defer the cron encode until attachment metadata is saved.
• Images and videos placed in a Media & Text block are now included when a post is shared to the Fediverse.
• Requests from other platforms to feature your posts are now handled correctly instead of being ignored.
• RSS and Atom feeds now show a simple @username mention in place of the reply block’s full embed card, which only renders properly when the plugin’s frontend CSS is loaded.
• Stop a deprecation notice from appearing in the error log when the NodeInfo plugin is also active.

See full Changelog on GitHub.