Title: ActivityPub Author: Automattic Published: 24 An t-Sultain 2018 Last modified: 29 An Dàmhair 2026 --- Search plugins ![](https://ps.w.org/activitypub/assets/banner-772x250.png?rev=2977113) ![](https://ps.w.org/activitypub/assets/icon.svg?rev=3325036) # ActivityPub By [Automattic](https://profiles.wordpress.org/automattic/) [Download](https://downloads.wordpress.org/plugin/activitypub.9.4.0.zip) [Live Preview](https://gd.wordpress.org/plugins/activitypub/?preview=1) * [Details](https://gd.wordpress.org/plugins/activitypub/#description) * [Reviews](https://gd.wordpress.org/plugins/activitypub/#reviews) * [Installation](https://gd.wordpress.org/plugins/activitypub/#installation) * [Development](https://gd.wordpress.org/plugins/activitypub/#developers) [Support](https://wordpress.org/support/plugin/activitypub/) ## Description Enter the fediverse with **ActivityPub**, broadcasting your blog to a wider audience! Attract followers, deliver updates, and receive comments from a diverse user base of **ActivityPub**-compliant platforms. With the ActivityPub plugin installed, your WordPress blog itself functions as a federated profile, along with profiles for each author. For instance, if your website is `example.com`, then the blog-wide profile can be found at `@example.com@example. com`, and authors like Jane and Bob would have their individual profiles at `@jane@ example.com` and `@bob@example.com`, respectively. An example: I give you my Mastodon profile name: `@pfefferle@mastodon.social`. You search, see my profile, and hit follow. Now, any post I make appears in your Home feed. Similarly, with the ActivityPub plugin, you can find and follow Jane’s profile at `@jane@example.com`. Once you follow Jane’s `@jane@example.com` profile, any blog post she crafts on ` example.com` will land in your Home feed. Simultaneously, by following the blog- wide profile `@example.com@example.com`, you’ll receive updates from all authors. **Note**: If no one follows your author or blog instance, your posts remain unseen. The simplest method to verify the plugin’s operation is by following your profile. If you possess a Mastodon profile, initiate by following your new one. The plugin works with the following tested federated platforms, but there may be more that it works with as well: * [Mastodon](https://joinmastodon.org/) * [Pleroma](https://pleroma.social/)/[Akkoma](https://akkoma.social/) * [friendica](https://friendi.ca/) * [Hubzilla](https://hubzilla.org/) * [Pixelfed](https://pixelfed.org/) * [Socialhome](https://socialhome.network/) * [Misskey](https://join.misskey.page/) Some things to note: 1. The blog-wide profile is only compatible with sites with rewrite rules enabled. If your site does not have rewrite rules enabled, the author-specific profiles may still work. 2. Many single-author blogs have chosen to turn off or redirect their author profile pages, usually via an SEO plugin like Yoast or Rank Math. This is usually done to avoid duplicate content with your blog’s home page. If your author page has been deactivated in this way, then ActivityPub author profiles won’t work for you. Instead, you can turn your author profile page back on, and then use the option in your SEO plugin to noindex the author page. This will still resolve duplicate content issues with search engines and will enable ActivityPub author profiles to work. 3. Once ActivityPub is installed, _only new posts going forward_ will be available in the fediverse. Likewise, even if you’ve been using ActivityPub for a while, anyone who follows your site will only see new posts you publish from that moment on. They will never see previously-published posts in their Home feed. This process is very similar to subscribing to a newsletter. If you subscribe to a newsletter, you will only receive future emails, but not the old archived ones. With ActivityPub, if someone follows your site, they will only receive new blog posts you publish from then on. So what’s the process? 1. Install the ActivityPub plugin. 2. Go to the plugin’s settings page and adjust the settings to your liking. Click the Save button when ready. 3. Make sure your blog’s author profile page is active if you are using author profiles. 4. Go to Mastodon or any other federated platform, and search for your profile, and follow it. Your new profile will be in the form of either `@your_username@example. com` or `@example.com@example.com`, so that is what you’ll search for. 5. On your blog, publish a new post. 6. From Mastodon, check to see if the new post appears in your Home feed. **Note**: It may take up to 15 minutes or so for the new post to show up in your federated feed. This is because the messages are sent to the federated platforms using a delayed cron. This avoids breaking the publishing process for those cases where users might have lots of followers. So please don’t assume that just because you didn’t see it show up right away that something is broken. Give it some time. In most cases, it will show up within a few minutes, and you’ll know everything is working as expected. ## Screenshots [⌊The "Follow me"-Block in the Block-Editor⌉⌊The "Follow me"-Block in the Block- Editor⌉[ The “Follow me”-Block in the Block-Editor [⌊The "Followers"-Block in the Block-Editor⌉⌊The "Followers"-Block in the Block- Editor⌉[ The “Followers”-Block in the Block-Editor [⌊The "Federated Reply"-Block in the Block-Editor⌉⌊The "Federated Reply"-Block in the Block-Editor⌉[ The “Federated Reply”-Block in the Block-Editor [⌊A "Federated Reply" in a Post⌉⌊A "Federated Reply" in a Post⌉[ A “Federated Reply” in a Post [⌊A Blog-Profile on Mastodon⌉⌊A Blog-Profile on Mastodon⌉[ A Blog-Profile on Mastodon ## Blocks This plugin provides 15 blocks. * ActivityPub Dashboard Stats ActivityPub statistics dashboard widget * Fediverse Extra Fields Display extra fields from Fediverse user profiles. * ActivityPub Quote Intent Handler Handles quote intents in the block editor. * ActivityPub Stats Display your annual Fediverse stats as a shareable card. * ActivityPub Post Format Suggestions Suggests optimal post formats for ActivityPub federation before publishing. * ActivityPub Command Palette Registers ActivityPub commands for the WordPress Command Palette. * Follow me on the Fediverse Display your Fediverse profile so that visitors can follow you. * Fediverse Followers Display your followers from the Fediverse on your website. * Fediverse Following Display the accounts you follow in the Fediverse on your website. * ActivityPub Editor Integration Adds ActivityPub settings and controls to the WordPress block editor. * Posts and Replies Display a tab bar to filter between posts only and posts with replies on author archives. * Fediverse Reactions Display Fediverse likes and reposts for your posts. * Federated Reply Reply to posts, notes, and other content on the Fediverse directly from the block editor. * ActivityPub Reply Intent Handler Handles reply intents for federated conversations in the block editor. * Federated Quote Quote a post from the Fediverse. The author is asked for permission and the quote is marked as verified once they agree. ## Installation Follow the normal instructions for [installing WordPress plugins](https://wordpress.org/support/article/managing-plugins/). #### Automatic Plugin Installation To add a WordPress Plugin using the [built-in plugin installer](https://codex.wordpress.org/Administration_Screens#Add_New_Plugins): 1. Go to [Plugins](https://codex.wordpress.org/Administration_Screens#Plugins) > [Add New](https://codex.wordpress.org/Plugins_Add_New_Screen). 2. Type “`activitypub`” into the **Search Plugins** box. 3. Find the WordPress Plugin you wish to install. 4. a. Click **Details** for more information about the Plugin and instructions you may wish to print or save to help setup the Plugin. b. Click **Install Now** to install the WordPress Plugin. 5. The resulting installation screen will list the installation as successful or note any problems during the install. 6. If successful, click **Activate Plugin** to activate it, or **Return to Plugin Installer** for further actions. #### Manual Plugin Installation There are a few cases when manually installing a WordPress Plugin is appropriate. * If you wish to control the placement and the process of installing a WordPress Plugin. * If your server does not permit automatic installation of a WordPress Plugin. * If you want to try the [latest development version](https://github.com/pfefferle/wordpress-activitypub). Installation of a WordPress Plugin manually requires FTP familiarity and the awareness that you may put your site at risk if you install a WordPress Plugin incompatible with the current version or from an unreliable source. Backup your site completely before proceeding. To install a WordPress Plugin manually: * Download your WordPress Plugin to your desktop. - Download from [the WordPress directory](https://wordpress.org/plugins/activitypub/) - Download from [GitHub](https://github.com/pfefferle/wordpress-activitypub/releases) * If downloaded as a zip archive, extract the Plugin folder to your desktop. * With your FTP program, upload the Plugin folder to the `wp-content/plugins` folder in your WordPress directory online. * Go to [Plugins screen](https://codex.wordpress.org/Administration_Screens#Plugins) and find the newly uploaded Plugin in the list. * Click **Activate** to activate it. ## FAQ ### tl;dr This plugin connects your WordPress blog to popular social platforms like Mastodon, making your posts more accessible to a wider audience. Once installed, your blog can be followed by users on these platforms, allowing them to receive your new posts in their feeds. ### What is “ActivityPub for WordPress” _ActivityPub for WordPress_ adds Fediverse features to WordPress, but it is not a replacement for platforms like Friendica or Mastodon. If you’re looking to host a decentralized social network, consider using [Mastodon](https://joinmastodon.org/) or [Friendica](https://friendi.ca/). ### Is this a Mastodon crossposter? Can it post to my existing Mastodon account? No. A crossposter pushes copies of your posts to a _separate_ account you already have on someone else’s server. _ActivityPub for WordPress_ does the opposite: it makes your own site a first-class Fediverse account (`@you@example.com`), so people follow your site directly and replies come back as WordPress comments, with no second account required. The plugin will not add crossposting to an existing account; that is a deliberate choice, not a missing feature. If you would rather mirror articles to an established Mastodon account, that is a job for a dedicated crossposter plugin. ### Why “ActivityPub”? The name ActivityPub comes from the two core ideas behind the protocol: * Activity: It is based on the concept of activities, like “Create”, “Like”, “Follow”,“ Announce”, etc. These are structured messages (usually in [ActivityStreams](https://www.w3.org/TR/activitystreams-core/) format) that describe what users do on the network. * Pub: Short for publish or publication. It refers to the fact that this is a publish- subscribe (pub-sub) protocol — one user can “follow” another, and receive their published activities. Put together, ActivityPub is a protocol for publishing and subscribing to activities, which enables decentralized social networking — where different servers can interact and users can follow each other across the Fediverse. ### How do I solve… We have an **FAQ** section in the [docs](https://github.com/Automattic/wordpress-activitypub/tree/trunk/docs/faq) directory with checklists for the most common problems — for example [follow requests stuck on “pending”](https://github.com/Automattic/wordpress-activitypub/blob/trunk/docs/faq/pending-follow-requests.md) and [comments from the Fediverse not showing up](https://github.com/Automattic/wordpress-activitypub/blob/trunk/docs/faq/missing-comments.md)— and a **How-To** section in the [docs](https://github.com/Automattic/wordpress-activitypub/tree/trunk/docs/how-to) directory for configuring specific setups. ### Constants The plugin uses PHP Constants to enable, disable or change its default behaviour. Please use them with caution and only if you know what you are doing. * `ACTIVITYPUB_REST_NAMESPACE` – Change the default Namespace of the REST endpoint. Default: `activitypub/1.0`. * `ACTIVITYPUB_EXCERPT_LENGTH` – Change the length of the Excerpt. Default: `400`. * `ACTIVITYPUB_MAX_IMAGE_ATTACHMENTS` – Change the number of attachments, that should be federated. Default: `4`. * `ACTIVITYPUB_HASHTAGS_REGEXP` – Change the default regex to detect hashtext in a text. Default: `(?:(?<=\s)|(?<=

)|(?<=
)|^)#([A-Za-z0-9_]+)(?:(?=\s|[[: punct:]]|$))`. * `ACTIVITYPUB_USERNAME_REGEXP` – Change the default regex to detect @-replies in a text. Default: `(?:([\p{L}\p{M}\p{N}\._+%-]+)@((?:[\p{L}\p{M}\p{N}_-]+\.) +(?:[Xx][Nn]--[A-Za-z0-9-]*[A-Za-z0-9]|[\p{Latin}\p{M}]+|(?:(?![\x00-\x7F])[\ p{L}\p{M}])+)))`. The pattern is used with the `u` modifier. * `ACTIVITYPUB_URL_REGEXP` – Change the default regex to detect urls in a text. Default: `(www.|http:|https:)+[^\s]+[\w\/]`. * `ACTIVITYPUB_CUSTOM_POST_CONTENT` – Change the default template for Activities. Default: `[ap_title]\n\n[ap_content]\n\n[ap_hashtags]\n\n[ap_shortlink]`. * `ACTIVITYPUB_AUTHORIZED_FETCH` – Enable AUTHORIZED_FETCH. * `ACTIVITYPUB_DISABLE_REWRITES` – Disable auto generation of `mod_rewrite` rules. Default: `false`. * `ACTIVITYPUB_DISABLE_INCOMING_INTERACTIONS` – Block incoming replies/comments/ likes. Default: `false`. * `ACTIVITYPUB_DISABLE_OUTGOING_INTERACTIONS` – Disable outgoing replies/comments/ likes. Default: `false`. * `ACTIVITYPUB_DISABLE_REMOTE_CACHE` – Disable remote media caching (avatars, media, emoji). Default: `false`. Replaces `ACTIVITYPUB_DISABLE_SIDELOADING` from 7.9.1. * `ACTIVITYPUB_SHARED_INBOX_FEATURE` – Enable the shared inbox. Default: `false`. * `ACTIVITYPUB_SEND_VARY_HEADER` – Enable to send the `Vary: Accept` header. Default:` false`. ### Where can you manage your followers? If you have activated the blog user, you will find the list of his followers in the settings under `/wp-admin/options-general.php?page=activitypub&tab=followers`. The followers of a user can be found in the menu under “Users” -> “Followers” or under `wp-admin/users.php?page=activitypub-followers-list`. For reasons of data protection, it is not possible to see the followers of other users. ## Reviews ![](https://secure.gravatar.com/avatar/15fb84635c304663ee27a6654ad79fe11052aaa916919870cf4b4fc63f886db3? s=60&d=retro&r=g) ### 󠀁[Great project](https://wordpress.org/support/topic/great-project-10/)󠁿 [Quentin Le Duff (–Q–)](https://profiles.wordpress.org/quentinldd/) 23 An Giblean 2026 A project to follow, great job 🙂 ![](https://secure.gravatar.com/avatar/d900e13228b51bf288600df6b94215aa8dfb61012c1c00d45a3cfc2b43fb6c15? s=60&d=retro&r=g) ### 󠀁[Makes my WP posts look great in the fediverse](https://wordpress.org/support/topic/makes-my-wp-posts-look-great-in-the-fediverse/)󠁿 [Chuck Grimmett](https://profiles.wordpress.org/cagrimmett/) 28 Am Faoilleach 2026 Great plugin with regular updates. Does what it says on the label, and does it well. It makes my WP posts look great in the fediverse and boost, replies, and likes quickly make their way back to my site. ![](https://secure.gravatar.com/avatar/62655840fd27b0a4acf8570555c64e7aecfcf5a334203fa8333c351f85feb604? s=60&d=retro&r=g) ### 󠀁[Thank You for Making Fediverse Connections Possible](https://wordpress.org/support/topic/thank-you-for-making-fediverse-connections-possible/)󠁿 [Jiwoon Kim](https://profiles.wordpress.org/kimjiwoon/) 10 An t-Sultain 2025 As someone working on the Korean translation of this plugin, I have seen first-hand how important it is for WordPress users to connect with the Fediverse. This plugin provides a bridge that makes such integration possible. Thanks to the developers, Korean users can now more easily explore and join the open social web. I deeply appreciate the effort, vision, and continuous improvements behind this project. ![](https://secure.gravatar.com/avatar/25fa6e5133fb9e188722d1263d2bca4807ca3c7502474a00729aa863df907834? s=60&d=retro&r=g) ### 󠀁[Worked out of the box. Brilliant.](https://wordpress.org/support/topic/worked-out-of-the-box-brilliant/)󠁿 [Writeworks](https://profiles.wordpress.org/cruiseshipholiday/) 3 An Lùnastal 2025 I've installed and setup other ActivityPub servers usually some time & testing required along with tweaks. However with the WP ActivityPub plug-in it, surprisingly, functioned properly right after install. What a joy. Thank you. ![](https://secure.gravatar.com/avatar/bda14b8e4d0c81153be6ea95f5eb1dba9eb9ba1b70dbaac3e729da8ac378fdfc? s=60&d=retro&r=g) ### 󠀁[Excellent plugin, easily join the Fediverse in minutes!](https://wordpress.org/support/topic/excellent-plugin-easily-join-the-fediverse-in-minutes/)󠁿 [Louis Chance](https://profiles.wordpress.org/louischan/) 23 An t-Iuchar 2025 Great plugin (actively maintained!), great support, a very nice way to join the Fediverse and automatically share posts and any kind of CPT to the Fediverse audience. I was initially sharing posts using my personal Mastodon account, but it's much nicer to have your dedicated account for your blogs (and/or authors). Thanks for this plugin! ![](https://secure.gravatar.com/avatar/48235f821287a7abe1436472add16fd44f87be1b808b00b33e4f3ddf1967135a? s=60&d=retro&r=g) ### 󠀁[Best thing since WordPress](https://wordpress.org/support/topic/best-thing-since-wordpress/)󠁿 [xuv](https://profiles.wordpress.org/juego/) 6 An t-Ògmhios 2025 Why wouldn't you want your blog to federate with Mastodon and all the other apps on the Fediverse? This plugin in such an important piece in the social web ecosystem. Install eyes closed. [ Read all 40 reviews ](https://wordpress.org/support/plugin/activitypub/reviews/) ## Contributors & Developers “ActivityPub” is open source software. The following people have contributed to this plugin. Contributors * [ Automattic ](https://profiles.wordpress.org/automattic/) * [ Matthias Pfefferle ](https://profiles.wordpress.org/pfefferle/) * [ Matt Wiebe ](https://profiles.wordpress.org/mattwiebe/) * [ Konstantin Obenland ](https://profiles.wordpress.org/obenland/) * [ Alex Kirk ](https://profiles.wordpress.org/akirk/) * [ Jeremy Herve ](https://profiles.wordpress.org/jeherve/) * [ Django ](https://profiles.wordpress.org/mediaformat/) * [ nuriapenya ](https://profiles.wordpress.org/nuriapena/) * [ Donna Fontenot ](https://profiles.wordpress.org/cavalierlife/) * [ André Menrath ](https://profiles.wordpress.org/andremenrath/) “ActivityPub” has been translated into 26 locales. Thank you to [the translators](https://translate.wordpress.org/projects/wp-plugins/activitypub/contributors) for their contributions. [Translate “ActivityPub” into your language.](https://translate.wordpress.org/projects/wp-plugins/activitypub) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/activitypub/), check out the [SVN repository](https://plugins.svn.wordpress.org/activitypub/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/activitypub/) by [RSS](https://plugins.trac.wordpress.org/log/activitypub/?limit=100&mode=stop_on_copy&format=rss). ## Changelog ### 9.4.0 – 2026-10-29 #### Security * Accounts you blocked can no longer reply to, like, repost or quote your posts and comments. * Improve the safety of imported Fediverse posts and comments. * Improve verification of signing keys fetched from other servers. * Incoming activities are now only accepted when they are signed with the sending account’s own key. * Signatures on incoming requests now have to cover the address they were sent to and the content they carry. #### Added * Add a Counts style to the Fediverse Reactions block that shows comments and reactions as a line of simple links, for example to replace the comments link in a query loop. * Add an option to show images attached to Fediverse replies in comments, with local caching and image descriptions. * Added a custom name and avatar for the blog profile. Your Fediverse blog account can now use its own display name and profile picture, independent of the WordPress site title and site icon. * Added a Federated Quote block to quote posts from the Fediverse. The author of the quoted post is asked for permission, and the quote is marked as verified once they agree. * Added a filter that lets plugins decide which comment types are shared with the Fediverse, so custom comment types can be kept local or sent out as replies. * Added a Source column to the Comments screen that links incoming replies and quote posts to the post they came from. * Fediverse apps can now jump directly to the page of a collection that contains a specific item, instead of paging through from the start. * Posts and comments on sites using Polylang are now federated with the language Polylang assigned to them. * Posts published from a Mastodon app are now federated with the language the app set, and on sites using Polylang or WPML that language is stored with the multilingual plugin. * Profiles and posts now point at the shared Fediverse definitions for content warnings, hashtags, manual follower approval and account moves. * Support handles with non-Latin characters and domains with special characters, like @renée@café.example, in mentions, search and profile lookups. * The Counts style of the Fediverse Reactions block now uses your theme’s link color, adds a link color setting, and underlines links on hover. * The Fediverse Reactions block now has margin and padding settings. * The Social Web feed can be filtered by date, to show only posts from before or after a day you pick. * You can now log in as a different WordPress user while authorizing an ActivityPub app without losing the authorization request. #### Changed * Endpoints that other sites and apps call now answer a limited number of requests per minute from the same caller, and say so in the `RateLimit-Limit`, `RateLimit- Remaining` and `RateLimit-Reset` response headers. * Only accounts that are enabled for ActivityPub can authorize apps to act for them. * Posts and profiles fetched from other servers are now cached through the WordPress object cache when the site has one. Updates and confirmed deletions clear the cached copy. * The Fediverse Reactions block now lines up its buttons with the same width and shows a lighter label for reactions you can’t answer from the block. #### Removed * The option to turn off content filters in the post template was removed. Federated posts now always use the regular content filters. #### Fixed * Account moves are only accepted when the new account lists the old one by its ActivityPub ID, as Mastodon does. * Accounts on other servers that change their signing key are no longer rejected until their profile is refreshed. * Activities between accounts on the same site are now delivered on sites installed in a subdirectory or using plain permalinks. * Activities delivered to accounts on the same site now only reach ActivityPub inboxes. * Activities read through the ActivityPub API now fall back to the date your site recorded when the activity itself carries none, so client apps show consistent timestamps. * Apps connected to your account now only see what you granted them access to. * Apps that post on behalf of the blog can now only change or delete content that the connected user is allowed to change or delete. * A queued activity that cannot be read no longer stops the ones queued behind it from being sent. * Blocking a remote account now removes it from your followers and following lists, whichever form of its address you used. * Connection problems with other servers now explain what went wrong instead of failing without a reason. * Descriptions of remote accounts with quotes or links in them are no longer saved with stray backslashes. * Domain blocks now also apply to handles that have a path after the domain, like@ user@example.com/x. * Duplicate copies of cached profile pictures and images that earlier versions left behind are removed on update, and `wp activitypub cache cleanup` removes them on demand. * Emoji in the blog profile ID are now dropped instead of being turned into a string of codes that other servers could not resolve. * Ensure that only account deletions delivered to your site can skip the usual sender verification. * Feature requests are now only approved for collections that belong to the account asking. * Federated posts and comments now always show what a logged-out visitor sees, not the version shown to the logged-in author. * Fewer duplicate email notifications when another server delivers the same message more than once, and a reply that mentions you no longer also sends a separate mention email. * Fixed a fatal error on sites using the Photon snippet, which now also serves images in Fediverse replies through the CDN. * Fixed a possible error when preparing an activity in the outbox whose object is not a full object. * Fixed deprecation notices on PHP 8.5. * Fixed followers, remote profiles and received activities not being found again when their address contains an ampersand, including on WordPress 7.2. * Fixed LiteSpeed Cache possibly showing visitors the technical ActivityPub version of a page instead of the normal page. * Fixed math formulas, and everything after them, disappearing from posts on WordPress 7.2 when the formula includes an HTML annotation. * Fixed normal replies from distant accounts sometimes being auto-approved just because that account had previously liked or reposted a post. * Fixed oversized images in email notifications from remote users. Avatars and inline post images now resize to fit the email width instead of overflowing the screen. * Fixed profile pictures being downloaded again on every page view, leaving a copy behind each time and filling up the uploads folder. * Fixed requests to servers on a non-standard port being rejected because their signature did not include the port. * Fixed signed requests from other servers being rejected on sites behind a proxy that changes the host name. * Fixed the ActivityPub API, relay mode, and OpenGraph metadata silently staying off on some multisite hosts that select the site after plugins have loaded. * Fixed the plugin answering WebFinger, NodeInfo and OAuth server discovery requests meant for other plugins, such as IndieAuth. * Fixed the reaction buttons using the browser font instead of the theme font, which made them smaller than the placeholder for reactions without an action. * Fixed the search page and the posts page redirecting to a category or tag, or being served as one, on sites that filter content by language, such as Polylang. * Fixed the user selection in the Follow Me and other ActivityPub blocks disappearing when the site has a user you are not allowed to edit. * Fix Fediverse account migration being ignored by some servers when the new account is entered using an alternate address. * Fix Fediverse account migration so a move is verified before it takes effect and reliably reaches your followers on other servers. * Fix local account post counts in Mastodon apps when using Enable Mastodon Apps. * Follow requests are now only accepted when they are meant for the account that received them, and profile links on other sites no longer count as accounts on your site. * Handle incomplete Fediverse object references without errors. * Hidden recipients of a received activity are no longer included when an app reads or streams your inbox. * Improve handling of post URLs when changing publication status. * Incoming requests and account lookups now only match the site address, not the WordPress address. * Links in replies received from the Fediverse now display correctly on WordPress 7.1. * Links to a comment now open the page it is actually on, instead of a later page, on posts with many likes or reposts. * Links to the pages of a collection no longer pass on unknown query arguments, which could point them at the wrong address. * Notifications in the Social Web screen no longer show up twice. * Only image attachments are accepted for the blog avatar and the header images. * Opening a post in the Social Web screen no longer distorts the panel corners or folds the list. * Password-protected sticky posts are no longer listed in your featured posts on the Fediverse. * People mentioned in a post written from a Mastodon app are notified about it again. * Podcast episodes and other attached files hosted outside your media library are now included when a post is sent to the Fediverse. * Posts no longer send a second, smaller copy of the featured image, or the site icon when there is no featured image, which some apps showed as an extra image under the post. * Post summaries now respect plugins that change or hide parts of the post content. * Post summaries now stop at the “Read more” tag everywhere and keep the title of Details blocks. * Queued activities now record their publication and edit times correctly on sites that are not set to UTC. * Quote and feature requests are now only answered when they were sent to the account they ask. * Quote requests are now only approved for posts that belong to the account asking. * Reaction types added by other plugins no longer cause PHP warnings and are now included in Jetpack. * Replies and likes from the Fediverse can now only be changed or removed by the person who sent them, also for older ones. * Replies found by searching for their address now follow your comment moderation settings instead of being approved right away. * Replies sent through the ActivityPub API to posts on other servers are now delivered instead of being rejected. * Replies to posts from accounts you follow no longer show up in your comments feed and comment widgets. * Replies written through an ActivityPub app no longer mention the person you are replying to twice. * Restore spam-protection checks for regular comments after a comment arrives from the fediverse. * Searching for the address of a reply that cannot be imported now shows the normal search results instead of a broken link. * Signed requests from other servers are now checked more strictly, and requests that are not meant for your site are rejected before the sender’s key is fetched. * Signed requests from other servers are now only accepted when they are addressed to your site’s address. Sites reached under more than one domain can allow the others with the `activitypub_signature_original_hosts` filter. * Sites that turned off comment flood protection no longer get it switched back on by an incoming comment from the Fediverse. * Skip unusable attachments on posts from other servers instead of showing them as broken images. * Stop ActivityPub Likes, Reposts, and Quotes from leaking into the front-end comment list on sites that also use other comment-filtering plugins. * Tags with underscores, like veranda_vestli, now keep their underscores when shared to the fediverse instead of being changed to camelCase. * The “Powered by WordPress” profile field no longer shows up twice, no longer comes back after you delete it, and no longer triggers a warning when the plugin is first activated. * The browser tab title of the settings page now shows the name of the current tab. * The Followers and Following blocks now take their colours and font from the theme, so they are readable on dark themes, and they offer the usual colour, font size and spacing controls in the editor. * The Reactions block no longer requests reactions in the editor for drafts, pages, and other content that is not shared to the Fediverse, which caused failed requests on every editor load. * Tightened the checks on the screen where you approve apps for your account. ### 9.3.1 – 2026-09-02 #### Security * Links to remote profiles in the Followers and Following blocks are now limited to regular web addresses when paging through the list. * Replies cached on posts in the blog profile’s reader feed are no longer readable by logged-out visitors through the WordPress REST API. * Signatures on incoming requests are now checked against the address the request was actually sent to. ### 9.3.0 – 2026-09-02 #### Security * Block markup in posts from remote accounts is now removed before the post is saved. * Follow, reply and reaction links advertised by other Fediverse servers now have to be regular web addresses. * Followers, cached remote profiles, and reader posts are no longer readable by logged-out visitors through the WordPress REST API, and the setting that hides your follower list is now honoured everywhere. * Inline styles are now removed from posts and profiles that come from remote accounts. * Posts from remote accounts are now shown in the Social Web reader exactly as the site stored them. * Replies from remote accounts are now filtered before they are saved when an administrator imports them through search. #### Added * Add a notification setting to turn off emails about likes, reposts, and quotes without silencing real comments and replies. * Add the Fediverse and ActivityPub logos to the block editor’s icon library on WordPress 7.1 and newer. * Federate podcast episodes published with Jetpack, including their audio file and cover art. #### Changed * Enable RFC 9421 HTTP Message Signatures by default. #### Fixed * Apps connected through the ActivityPub API now use the standard ActivityPub API permission names. Fetching remote content through your site is treated as reading rather than posting, so an app needs read permission for it. * Apps now see the real error when a post they open through your site is missing, instead of a generic failure. * Comment author names are no longer altered on comments that did not come from the fediverse. * Fixed a crash that could fill the error log when another server edited a reply to a post that is no longer shared to the Fediverse. * Fixed an error that could break embeds of Fediverse posts whose author was sent in an unexpected format. * Fixed an error that could occur when looking up a profile on another Fediverse server that sends back an unexpected response. * Fixed backslashes disappearing from titles and content in posts from remote accounts. * Fixed responses to ActivityPub addresses written with different capitalisation not being cached correctly. * Fixed the Application actor not being found when its address was written with different capitalisation. * Fixed the Mastodon importer creating duplicate posts when an archive was imported a second time. * Fixed titles, summaries, captions and display names from remote accounts being stored with stray markup. * Imported Mastodon media descriptions now have unsafe HTML removed before they are saved. * Imported Mastodon replies now have unsafe HTML removed before they are saved as comments. * Improve how blocked accounts are matched. * Improve permission checks for third-party apps connected through the ActivityPub API. * Improve validation of incoming activities from other servers. * Screen readers now announce errors in the follow, reply and reaction dialogs. * Text inside hidden page elements, like invisible dialog pop-ups, no longer shows up in posts shared to the Fediverse. * The blog profile can be found again from other Fediverse servers on sites that also run Polylang. ### 9.2.2 – 2026-08-11 #### Fixed * Fixed avatars and emoji occasionally failing to cache, and the file warnings that came with it. * Fixed deletions from Mastodon and other servers not removing the corresponding comment on your site. * Fixed some styles not loading on the Fediverse admin screens and in the Followers and Following blocks. * Fixed the editor warning about unsaved changes right after saving a post with an older date. ### 9.2.1 – 2026-08-03 #### Fixed * Fixed duplicate entries and failed undo actions for activities received from other WordPress sites. * Fixed posts and profiles not being found on Mastodon and other Fediverse software, which happened when a request asked for ActivityPub data but also accepted HTML as a low-priority fallback. * Fixed remote profiles and followers not being found when their address contains unusual characters. * Improved checks on boosted content so it is only accepted from the server that published it. * Improve escaping of embedded link URLs in federated content. * Improve permission checks for admin-only actions. * Improve validation of incoming federated activities so the signing key and referenced objects are bound to the sender. ### 9.2.0 – 2026-07-31 #### Changed * ActivityPub responses are now served only to clients that ask for ActivityPub data and nothing else, which keeps that data out of page caches meant for regular web pages. * Only users enabled for ActivityPub can obtain and use OAuth access tokens. #### Removed * Remove support for the WP REST Cache plugin. #### Fixed * Hide the heading on the Followers and Following blocks when its text is cleared, matching the Reactions block. * Under Authorized Fetch, ActivityPub responses are no longer stored by page caches such as LiteSpeed or Surge. ### 9.1.0 – 2026-07-22 #### Security * Ensure apps you connect can only act within the access you granted them, and not make wider changes to your site. * Ensure remote profiles and content are served from the address they claim before storing them. * Fix a security issue where a remote actor’s profile link could run scripts in the admin area. * Ignore an incoming follow request whose actor resolves to a different account than the one that sent it. #### Added * Add a filter that allows federating with servers on private or internal networks. * Add an actor autocomplete endpoint so Fediverse apps can offer typeahead search when mentioning people. * Federate the episode summary for Podlove Podcast Publisher episodes. #### Changed * Improve reliability of the Social Web admin screen loading. * Improve the internal handling of the Application actor used for server-to-server requests. #### Fixed * Ensure a follow can only be declined by the account you followed. * Fixed using the correct cache representation in Surge config * Fix follow requests from some fediverse services staying pending after they are accepted. * Fix likes from some accounts being recorded as multiple duplicate comments. * Fix posts being removed from the Fediverse when edited while scheduled for a future publish date. * Fix repeated deliveries of a like or repost creating new comments after the original was marked as spam or moved to the trash. * Fix Starter Kit imports failing on Fediverse servers that require signed requests. * Fix the scheduled refresh of remote profiles so it actually re-fetches from the remote server. Previously, stale avatars and bios for commenters never updated until they sent a new activity to your site. * Fix URLs with multiple query parameters (such as avatars, images, profile links, and podcast media) being corrupted in content sent to the Fediverse. * Prevent caching non-actor objects (such as notes) as remote profiles. * Refresh cached remote profiles in place during scheduled updates to avoid creating duplicate copies. * Show the Fediverse Preview for scheduled posts instead of the regular post preview. * Stop storing responses from remote servers in the database when they were requested uncached. ### 9.0.2 – 2026-06-29 #### Fixed * Improve handling of content received from other servers. ### 9.0.1 – 2026-06-15 #### Added * Add FAQ guides that help solve follow requests stuck on “pending” and comments from the Fediverse not showing up. #### Fixed * Notify followers about your new preference when the Starter Kit policy setting changes, so other servers no longer act on an outdated one. * Publish the Starter Kit consent policy only on your own blog and author profiles, no longer on system or third-party profiles. * Starter Kit consent now also works for the blog profile, not just for individual authors. ### 9.0.0 – 2026-06-10 #### Security * Enforce the signing-key host check on incoming federated activities regardless of how the key identifier is formatted. * Fix the real-time activity stream so it only returns the requesting user’s own activities. * Harden the Site Health connectivity check so it cannot be used to reach unsafe network addresses. * Only share comment replies in the Fediverse when the post they belong to is itself federated, so replies on private or non-federated posts stay private. * Prevent a remote server from discovering which of your followers belong to a third-party server it does not control. * Prevent logged-in users from viewing another user’s private outbox activities. * Prevent remote servers from modifying or deleting federated profiles, posts, and interactions they do not own. * Rate-limit the remote-follow lookup to prevent it from being abused to trigger outbound requests. * Stop the OAuth token introspection endpoint from revealing another user’s token details to logged-in users. * Stop the quote-authorization stamp from exposing a post’s other metadata. #### Added * Add a Distribution Mode setting to control how quickly posts are delivered to followers. * Add an opt-in setting to consent to inclusion in Starter Kits (also called Starter Packs or Featured Collections). Off by default. Find it under Settings, ActivityPub, Activities. * C2S clients can now request canonical SWICG ActivityPub API scope names such as `activitypub:read:all` and `activitypub:write:all`, and the OAuth discovery metadata advertises them. * C2S token responses now include `activitypub_actor_id` so clients following the SWICG ActivityPub API Basic Profile can discover the authenticated actor. * Generate a blurred color preview (blurhash) for images so other fediverse apps can show a placeholder while your photos load. * Quote notification emails now include a link to the post that quoted you, so you can review and respond more quickly. * Warn in the editor before making a post that’s already shared on the Fediverse a draft, private, or password-protected, since followers’ copies will be removed. #### Changed * Add the `blurhash` term to the outbound JSON-LD `@context` so attachments that include a `blurhash` property are strictly correct JSON-LD, matching Mastodon’s own context shape. * Federated posts moved to draft, pending, private, trash, or password-protected now send a Delete to followers (previously sent a placeholder “editing” Update or were silent). * OAuth rate-limit responses now include a `Retry-After` header so clients know how long to wait before retrying. * Updated a build dependency to a clean release now that a fixed version is available. #### Removed * Removed functions, methods, and the Follower class that were deprecated in versions 7.0 through 7.4. #### Fixed * Fix a fatal error when receiving a new follower while the Stream plugin is active. * Fix a follow request being marked as accepted when the confirmation came from a different account than the one being followed. * Fix the Fediverse settings appearing twice and visibility changes not saving in the block editor when the Classic Editor plugin is also active. * Fix the introduction video failing to load on the Getting Started help screen. * Follower synchronization with Mastodon no longer fails, signed requests with query strings now verify correctly. * Harden the Blurhash encoder: skip decompression-bomb images before decoding, flatten transparency onto white so transparent logos no longer produce near-black placeholders, and defer the cron encode until attachment metadata is saved. * Images and videos placed in a Media & Text block are now included when a post is shared to the Fediverse. * Requests from other platforms to feature your posts are now handled correctly instead of being ignored. * RSS and Atom feeds now show a simple `@username` mention in place of the reply block’s full embed card, which only renders properly when the plugin’s frontend CSS is loaded. * Stop a deprecation notice from appearing in the error log when the NodeInfo plugin is also active. See full Changelog on [GitHub](https://github.com/Automattic/wordpress-activitypub/blob/trunk/CHANGELOG.md). ## Community plugin This plugin is developed and supported by a community. [Contribute to this plugin](https://github.com/automattic/wordpress-activitypub) ## Meta * Version **9.4.0** * Last updated **4 uairean a thìde ago** * Active installations **6,000+** * WordPress version ** 6.5 or higher ** * Tested up to **7.1.4** * PHP version ** 7.4 or higher ** * Languages * [Arabic](https://ar.wordpress.org/plugins/activitypub/), [Catalan](https://ca.wordpress.org/plugins/activitypub/), [Chinese (China)](https://cn.wordpress.org/plugins/activitypub/), [Chinese (Taiwan)](https://tw.wordpress.org/plugins/activitypub/), [Czech](https://cs.wordpress.org/plugins/activitypub/), [Dutch](https://nl.wordpress.org/plugins/activitypub/), [English (US)](https://wordpress.org/plugins/activitypub/), [Esperanto](https://eo.wordpress.org/plugins/activitypub/), [Finnish](https://fi.wordpress.org/plugins/activitypub/), [French (France)](https://fr.wordpress.org/plugins/activitypub/), [Frisian](https://fy.wordpress.org/plugins/activitypub/), [Galician](https://gl.wordpress.org/plugins/activitypub/), [German](https://de.wordpress.org/plugins/activitypub/), [Greek](https://el.wordpress.org/plugins/activitypub/), [Hebrew](https://he.wordpress.org/plugins/activitypub/), [Indonesian](https://id.wordpress.org/plugins/activitypub/), [Italian](https://it.wordpress.org/plugins/activitypub/), [Japanese](https://ja.wordpress.org/plugins/activitypub/), [Korean](https://ko.wordpress.org/plugins/activitypub/), [Portuguese (Brazil)](https://br.wordpress.org/plugins/activitypub/), [Russian](https://ru.wordpress.org/plugins/activitypub/), [Spanish (Chile)](https://cl.wordpress.org/plugins/activitypub/), [Spanish (Spain)](https://es.wordpress.org/plugins/activitypub/), [Swedish](https://sv.wordpress.org/plugins/activitypub/), [Turkish](https://tr.wordpress.org/plugins/activitypub/), [Vietnamese](https://vi.wordpress.org/plugins/activitypub/), and [Welsh](https://cy.wordpress.org/plugins/activitypub/). * [Translate into your language](https://translate.wordpress.org/projects/wp-plugins/activitypub) * Tags * [activitypub](https://gd.wordpress.org/plugins/tags/activitypub/)[fediverse](https://gd.wordpress.org/plugins/tags/fediverse/) [indieweb](https://gd.wordpress.org/plugins/tags/indieweb/)[social web](https://gd.wordpress.org/plugins/tags/social-web/) * [Advanced View](https://gd.wordpress.org/plugins/activitypub/advanced/) ## Ratings 4.9 out of 5 stars. * [ 36 5-star reviews ](https://wordpress.org/support/plugin/activitypub/reviews/?filter=5) * [ 3 4-star reviews ](https://wordpress.org/support/plugin/activitypub/reviews/?filter=4) * [ 1 3-star review ](https://wordpress.org/support/plugin/activitypub/reviews/?filter=3) * [ 0 2-star reviews ](https://wordpress.org/support/plugin/activitypub/reviews/?filter=2) * [ 0 1-star reviews ](https://wordpress.org/support/plugin/activitypub/reviews/?filter=1) [Your review](https://wordpress.org/support/plugin/activitypub/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/activitypub/reviews/) ## Contributors * [ Automattic ](https://profiles.wordpress.org/automattic/) * [ Matthias Pfefferle ](https://profiles.wordpress.org/pfefferle/) * [ Matt Wiebe ](https://profiles.wordpress.org/mattwiebe/) * [ Konstantin Obenland ](https://profiles.wordpress.org/obenland/) * [ Alex Kirk ](https://profiles.wordpress.org/akirk/) * [ Jeremy Herve ](https://profiles.wordpress.org/jeherve/) * [ Django ](https://profiles.wordpress.org/mediaformat/) * [ nuriapenya ](https://profiles.wordpress.org/nuriapena/) * [ Donna Fontenot ](https://profiles.wordpress.org/cavalierlife/) * [ André Menrath ](https://profiles.wordpress.org/andremenrath/) ## Support Issues resolved in last two months: 3 out of 3 [View support forum](https://wordpress.org/support/plugin/activitypub/)