activitypub.blog
8.1.0 — By the Numbers
If 8.0.0 opened the Fediverse up as a two-way street, **8.1.0** helps you see and share what travels down it. A new Fediverse statistics feature leads the release, with a dashboard widget, email reports, and a shareable stats block. Alongside it: a new ActivityPub API that lets third-party Fediverse apps post to your blog, Starter Pack imports, and richer image metadata for photographers.
## Your Fediverse, By the Numbers
The headline work this release is a brand-new **Fediverse statistics** feature, three connected pieces that finally let you see (and share) how your site is doing on the open social web.
### The Dashboard Widget
When you log into your WordPress admin, there’s now a **Fediverse Stats** widget on the dashboard.
It’s built around three things:
* **Stat highlights** : followers, posts, and engagement counts, with a comparison to the previous period so you can tell if the line is going up or down.
* **A monthly engagement chart** : an interactive SVG line chart of engagement over time.
* **Top supporter and top posts** : the people most engaged with your blog, and the posts that travelled furthest.
If you have both a user actor and a blog actor enabled, a selector lets you switch between them.
### Monthly and Annual Email Reports
Not everyone logs into `wp-admin` every day, so the plugin can now also **email you your stats**.
There are two report types:
* **Annual reports** , a wrap-up of your year on the Fediverse. On by default.
* **Monthly reports** , a smaller recap for the previous month. Opt-in, for the folks who like a regular pulse check.
Both are delivered through the WordPress email system and available as notification preferences, so you can turn them on or off per actor.
### The Stats Block, With a Sharepic
The same statistics also power a new **Fediverse Stats block** , a yearly snapshot you can drop into any post or page.
On the page, it renders as a clean card styled to match your theme, with colors and fonts picked up automatically from the active block theme, so it feels at home without fiddling.
Underneath, it also generates a **shareable image version** , a sharepic ready to post to the Fediverse itself. Think of it as your Fediverse year-in-review, without firing up a design tool.
And to make the timing easier, there’s a new **seasonal starter pattern** that suggests sharing your stats when you create a new post in December or January, the moment when everyone on the timeline is already in reflection mode.
## Open for Apps: The ActivityPub API
For a long time, the plugin has spoken the server-to-server half of ActivityPub fluently, which is how your posts reach Mastodon, Pixelfed, and the rest. With 8.1.0, the plugin now also exposes an **ActivityPub API** , an implementation of the Client-to-Server (C2S) half of the protocol.
In plain language: third-party Fediverse apps can now **create, edit, and delete posts on your blog** directly, the same way they would on a Mastodon account. Alongside the basics, the ActivityPub API also supports **Block** , **Add** (pin a post), and **Remove** (unpin a post) activities. To make app discovery smoother, actor profiles now also expose **OAuth server metadata and a registration endpoint** , so clients can find their way in without manual setup.
The ActivityPub API is **experimental and hidden behind a feature flag**. To try it, open the _ActivityPub_ settings page, click _Screen Options_ in the top right, enable **Advanced Settings** , and save. Under the new **Advanced** tab, flip on **ActivityPub API** and you’re off. Once enabled, connected apps can be managed from your profile page.
This is foundational work. Most of what it enables will show up over time, as more apps start treating your WordPress site as something they can post _from_ , not just _to_.
## Bring Your Friends: Starter Pack Imports
Starter Packs are one of the easier ways to onboard onto a new Fediverse platform: follow a curated list of people and you land somewhere with a timeline already humming.
8.1.0 adds support for **importing Starter Packs in both the Pixelfed and Mastodon formats**. If you’re moving to WordPress from another Fediverse platform, or setting up a new blog and want to bootstrap your Following list, point the importer at a Starter Pack and the plugin will take care of the rest.
## EXIF Metadata for Images
Photographers, this one’s for you. Image attachments now carry **EXIF metadata** (camera body, lens, focal length, aperture, shutter speed, ISO) using the **Vernissage namespace**.
The short version: the information that makes a photo worth reading about no longer gets stripped on the way out. Vernissage and other photo-focused Fediverse platforms can pick up the metadata and display it alongside the image, the way they would for a native post.
## Changelog
### Security
* Add rate limiting to app registration to prevent abuse.
* Fix blog actor outbox exposing private activities to unauthenticated visitors.
* Restrict localhost URL allowance to local development environments only.
* Verify that the signing key belongs to the same server as the activity actor.
### Added
* Add a “Posts and Replies” tab bar for author archives that filters between posts and replies, similar to Mastodon’s profile view.
* Add a liked collection to actor profiles, showing all posts the actor has liked.
* Add a seasonal starter pattern that suggests sharing Fediverse stats when creating a new post in December and January.
* Add a stats block that displays annual Fediverse statistics as a card on the site and as a shareable image on the Fediverse, with automatic color and font adoption from the site’s theme.
* Add Fediverse statistics dashboard widget with engagement metrics, charts, and monthly/annual email reports.
* Added `activitypub_pre_get_by_id` filter to allow plugins to register custom virtual actors resolved by ID.
* Add EXIF metadata support for image attachments using Vernissage namespace.
* Add new Fediverse Following Page and Profile Page block patterns.
* Add OAuth server metadata and registration endpoint discovery to actor profiles.
* Add real-time streaming for inbox and outbox updates via Server-Sent Events (SSE).
* Add support for Block, Add (pin post), and Remove (unpin post) activities via Client-to-Server API.
* Add support for check-in activities posted via compatible apps.
* Add support for importing Starter Packs in both the Pixelfed and Mastodon formats.
* Add tags.pub integration to supplement tag timelines with posts from across the Fediverse.
* Support for ActivityPub Client-to-Server (C2S) protocol, allowing apps like federated clients to create, edit, and delete posts on your behalf.
### Changed
* Block patterns for follow, following, and profile pages are now only suggested when editing pages.
* Fix notification pagination when using Enable Mastodon Apps: use date-constrained queries instead of truncating the shared notification pool, and expose `$limit`, `$before_date`, and `$after_date` as additional filter arguments so third-party handlers can fetch the correct window.
* Improve the pre-publish format suggestion panel with clearer messages and a confirmation after applying a format.
* Podcast episodes now respect the configured object type setting instead of always being sent as “Note”.
* Show reaction action buttons even when a post has no reactions yet.
### Fixed
* ActivityPub endpoints that surface comment, reply, like, share, and remote-reply metadata now honor the parent post’s visibility setting.
* Added validation for SSE access tokens passed via query parameter.
* Fix account migration (Move) not working when moving back to an external account.
* Fix a fatal error during activity delivery when the outbox item has been deleted.
* Fix a fatal error when receiving activities with a non-string language property.
* Fix a fatal `array_keys(null)` in `Comment::get_comment_type_slugs()` that could take down any request where a third-party plugin transitioned a custom comment type before `add_comment_type()` had been called.
* Fix a missing script dependency notice on the admin page in WordPress 6.9.1 and later.
* Fix BuddyPress @mention filter corrupting Fediverse Followers and Following blocks.
* Fix cleanup jobs silently doing nothing on sites where purge retention options were not set.
* Fix comments on remote posts being incorrectly held in moderation.
* Fix double-encoded HTML entities in post titles on the Fediverse Stats dashboard.
* Fixed an issue where quote authorization stamps could reference unrelated posts.
* Fixed double-encoding of special characters in comment author names on updates.
* Fixed emoji shortcode replacement to handle special characters in emoji names correctly.
* Fix fatal error when other plugins hook into the user agent filter expecting two arguments.
* Fix Fediverse Preview showing the standard web view instead of the ActivityPub preview for draft posts.
* Fix OAuth authentication failing for local development clients using localhost subdomains.
* Fix performance regression from reply-exclusion filter by skipping it for queries targeting non-ActivityPub post types.
* Fix Reader feed failing to load with newer WordPress versions.
* Fix remote actor avatars getting stuck on broken URLs when the original image becomes unavailable.
* Fix Site Health check showing an empty error message when the WebFinger endpoint is not reachable.
* Fix the Fediverse profile “Joined” date showing the oldest post date instead of when the site started federating.
* Fix the Fediverse profile showing an inflated post count by excluding incoming comments from the total.
* Fix Update handler using stale local actor data instead of the activity payload.
* Improved HTTP Signature validation for requests with a missing Date header.
* Only allow S256 as PKCE code challenge method for OAuth authorization.
* Prevent third-party plugin UI elements and scripts from appearing in federated content.
* Require signed peer requests for the followers synchronization endpoint per FEP-8fcf.
* Show a styled error page instead of raw technical output when an OAuth application cannot be reached during authorization.
* Strip private recipient fields from all outgoing activities to prevent leaking private audiences.
* Sync ActivityPub blog actor settings via Jetpack.
* Use ap_actor post ID for remote account IDs instead of remapping URI strings.
* Use safe HTTP request for signature retry to prevent requests to private IP ranges.
* Validate emoji updated timestamps before storing them.
## Get It
Download from WordPress.org or grab it on GitHub.
A huge thank you to everyone who contributed code, testing, bug reports, and ideas to this release.
Update, drop a stats block into your next recap post, and let us know what you think. Which number surprised you most? Which Fediverse app are you most excited to try with your blog?
