WordPress 7.3 targets native MCP, a baseline of Abilities and OAuth, with 7.2 as the foundation. What the 28 October plan says, what it leaves open, and what plugin authors can do now.
The WP-CLI commands that cover most day-to-day work, tested on WordPress 7.1.3, and how AI agents use them: MCP over STDIO, aliases, and a tested allow-list wrapper that keeps an agent read-only.
WordPress 7.2 Beta 1 ships a Secrets API: encrypted, versioned storage for API keys and tokens. What it does, what it does not protect against, the functions in the Beta 1 source, and what to ask your plugin vendors.
Build a custom WordPress REST API endpoint that holds up in production: versioned routes, permission_callback, typed args with validation and sanitization, a JSON schema, WP_Error status codes, pagination headers, and tests with curl, rest_do_request and PHPUnit.
AI assistants invent plausible URLs. Find them in GA4, stop core's loose 404 guess, and show related results with keyword search plus the AI Client.
Register an ability with the WordPress Abilities API: a tested example, the permission callback mistake shown with real output, and what to return.
WordPress 7.2 turns off the NO_BACKSLASH_ESCAPES SQL mode on its own connection. What it does (tested), which plugins to check, and the beta schedule.
Classic meta boxes now sit in a resizable pane in the always-iframed editor. How to test them, move key fields to a sidebar panel, and migrate safely.
WordPress 7.1 fixed the biggest limitation of PHP-only block registration: the editor preview now knows which post it is on. The exact rules core applies to autoRegister blocks, the failures that produce no error, and when you still need React.
Content changes shape at five boundaries between save and render, and four of them report nothing. A map of what each one removes, plus a four-command diff harness that identifies the responsible boundary in a minute.
Core annotates the hook registry's keys as strings and PHP hands you integers. Reproduce it in thirty seconds, then the four-question test for telling a contract from an internal.
WordPress suppresses activation hooks on every update, deliberately. The class of plugin bug that produces, why every test environment hides it, and where to put the work instead.
Edge is moving to Manifest V3 and Firefox is the only major browser left supporting uBlock Origin. The technical change, the strongest case for it, the case against, and the adjacency with Chrome's agent APIs.
Chrome opened a WebMCP origin trial and shipped Lighthouse agentic audits. Safari shipped an MCP server. The line buried in Chrome's docs that matters most: agents use the accessibility tree as their primary data model.
WordPress 7.1 adds a unified public exposure flag and a shared filtering pipeline to wp_get_abilities(). The resolution order, the two callbacks, the two global filters, the REST metadata trap, and why filtering is discovery and not authorisation.
Why we stored community data in 20 custom tables rather than a custom post type. Sortable values as real columns, cursor pagination instead of OFFSET, denormalised counters, and an honest account of what custom tables cost.
The iframed post editor becomes unconditional in WordPress 7.1. In 7.0 a single legacy block in your test post switched the iframe off, which means many blocks were never actually tested in it.
The Custom HTML block can now interleave static markup with real, editable inner blocks that are locked in place. The markup pattern, the innerContent variation field, a legacy conversion walkthrough, and where this beats a pattern or a custom block.
The WordPress Icons API in 7.1 turns the built-in icon set into a public registry. The registration functions, wp_get_icon(), REST routes, what the SVG sanitizer strips, and a five-stage migration plan.
WordPress 7.1 ships jQuery UI 1.14.2 and four functions disappear. What moved, the compatibility flag core flips for you, and a 20 minute audit.