{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "wordpress", "name": "WordPress", "vendor": "WordPress.org (open-source project)", "vendorUrl": "https://wordpress.org", "kind": "http-api", "category": "cms", "summary": "WordPress is an open-source content management system that its owner hosts. Agents create, revise and publish posts, pages and media through the built-in REST API, WP-CLI or the official MCP Adapter plugin.", "url": "https://www.anchorterminal.com/tools/wordpress", "markdownUrl": "https://www.anchorterminal.com/tools/wordpress.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/wordpress.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/wordpress.json", "repo": "https://github.com/WordPress/wordpress-develop", "license": "GPL-2.0-or-later. The MCP Adapter plugin is GPL-2.0-or-later too", "transports": [ "http", "stdio" ], "packages": [], "auth": "api-key", "authNotes": "Self-serve on your own site, with no app review or approval by WordPress.org. A user creates an Application Password on their profile, through `/wp/v2/users/\u003cid\u003e/application-passwords` or with `wp user application-password create`, and the agent sends it as Basic auth over HTTPS. A password has no scopes or expiry and carries every capability of its user, so access is set by the user's role. Each password can be revoked on its own. The MCP Adapter's HTTP transport takes the same credential, and its STDIO transport runs as the user named in `--user`.", "pricing": "free", "pricingNotes": "Free software with nothing to buy from WordPress.org, so an agent can start without a contract or a card. The owner pays for their own hosting. WordPress.com and other hosts sell hosted WordPress under their own prices, which aren't graded here (checked 2026-10-08).", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the REST API handbook, wordpress.org/llms.txt or the core and MCP Adapter repositories (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 21460, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://developer.wordpress.org/rest-api/", "llmsTxt": "https://wordpress.org/llms.txt", "capabilities": [ "cms.content", "cms.publish", "cms.assets" ], "tags": [ "open-source", "self-hosted", "rest", "mcp", "cli", "php", "llms-txt", "security-txt", "bug-bounty" ], "lastRelease": "2026-10-06", "graded": true, "anchor": { "graded": true, "score": 64.8, "grade": "B", "agentReady": false, "rank": 249, "ranked": true, "rankOf": 629, "categoryRank": 5, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 74, "maintenance": 83, "payments": 60, "reliability": 78, "schema": 65, "security": 62, "transparency": 68 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 78, "points": 15.6, "reason": "Read with the local-software lines, since each site runs on its owner's host and WordPress.org runs no hosted API. Official download from wordpress.org with PHP 7.4 and MySQL 5.5.5 stated as the minimum (20). PHPUnit, end-to-end and coding standards workflows on wordpress-develop all showed passing on trunk on 8 October 2026 (25). core.trac.wordpress.org refused our request with a 403, so open ticket counts are unread. From the release posts, 7.1.1 fixed 36 bugs four weeks after 7.1 and 7.1.3 fixed 4 more (10 of 25). Version numbers aren't semver. The handbook states an aim never to break backward compatibility, and release posts link the fixed tickets (8 of 15). 7.1.3 is a stable release and the REST API has been in core since 4.7 (15). No rate limits or 429 handling in core, which these lines don't score." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 65, "points": 10.56, "reason": "No published OpenAPI file. Each site describes its routes and their JSON Schema arguments at /wp-json and on OPTIONS requests, which needs a live site, and abilities carry input and output schemas (15 of 25). wordpress.org/llms.txt is a 5.7 KB index of links. developer.wordpress.org/llms.txt returned 404 and no Markdown copies of the handbook were found (5 of 10). The reference describes each endpoint and argument, with little on when not to use one (12 of 20). Arguments are typed with enums for `status` and `context` and limits on `per_page`, while `content` is one HTML or block markup string and `meta` is open (11 of 15). Each reference page carries example requests. Errors return `code`, `message` and `data.status`, with no list of codes per endpoint (9 of 15). The wp/v2 namespace is versioned and every release has a dated post (13 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 74, "points": 12.03, "reason": "`_fields` trims a response down to nested properties, `context` picks view, embed or edit, and the MCP Adapter's default server lists three meta-tools however many abilities exist (22 of 25). `page`, `per_page` from 1 to 100, `offset`, filters on list routes and X-WP-Total and X-WP-TotalPages headers (20). Errors carry `code`, `message` and `data.status`, without a published list of codes (14 of 20). No idempotency keys. Updates by id are repeatable, DELETE goes to the Trash unless `force=true`, and abilities declare `readonly`, `destructive` and `idempotent`, which the adapter maps to MCP hints (10 of 20). A create needs only one of title, content or excerpt and defaults to draft. Official clients are JavaScript only, plus WP-CLI (8 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 62, "points": 10.85, "reason": "Application Passwords are per application, revocable one at a time, sent only in the Authorization header and refused on plain HTTP outside a local environment. They have no scopes or expiry and carry every capability of their user, so we scored plain revocable keys plus 2 for role-based limits (22 of 30). A Contributor account can draft but not publish, deletes go to the Trash by default, and MCP abilities are private unless marked public. Nothing asks a person to approve a publish by a user who holds that capability (14 of 20). Posts and comments hold text written by other people, and no prompt-injection guidance was found in the REST handbook or the MCP Adapter docs (3 of 15). Revisions record author and date, and each password records its last use and IP. Core has no log of API calls (6 of 15). security.txt is valid until 30 June 2027, reports go through HackerOne, and fixes are published with CVE and GHSA identifiers and backported to 4.7. Certifications don't apply to self-hosted software (17 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 60, "points": 7.5, "reason": "Scored with the self-hosted rule. No x402, MPP or L402 (0). The software is free under the GPL with nothing to buy from WordPress.org (20). No card or account is needed (20). `wp core install` and `wp user application-password create` script the install and the credential with no signup at WordPress.org (20). Hosting is a cost the owner chooses." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 83, "points": 7.26, "reason": "7.1.3 was released on 6 October 2026, two days before this check (30). Six stable releases since 6 August 2026 (7.0.3, 7.0.4, 7.1, 7.1.1, 7.1.2 and 7.1.3) (20). Trac refused our request, so ticket handling is unread. Trunk had commits on 8 October, the critical fix of 22 September shipped with backports, and security reports are credited by name in each release post (15 of 25). The MCP Adapter reached v0.7.0 on 2 October 2026. WP-CLI's newest tag is v2.12.0 of 7 May 2025, and the official MCP registry timed out twice, so its listing is unread (8 of 15). CI, PHPStan and PHP compatibility workflows run on trunk (10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 68, "points": 5.95, "note": "editorial 72, provenance 63", "reason": "GPL version 2 or later, with the source public (30). Content stays on the owner's server. The privacy policy covers the WordPress.org sites, names api.wordpress.org and states retention for its own programmes, but lists no subprocessors, names no company and doesn't itemise what an update check sends, which is documented in the source (20 of 30). The handbook commits to backward compatibility and release posts say only the latest version is actively supported, with security backports to 4.7 as a courtesy. No notice period with dates was found (12 of 20). Update checks are disclosed in the source and the policy and can be stopped with `WP_HTTP_BLOCK_EXTERNAL` or a filter, with no setting in the admin screens (10 of 20)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "`_fields` trims a response down to nested properties, `context` picks view, embed or edit, and the MCP Adapter's default server lists three meta-tools however many abilities exist (22 of 25). `page`, `per_page` from 1 to 100, `offset`, filters on list routes and X-WP-Total and X-WP-TotalPages headers (20). Errors carry `code`, `message` and `data.status`, without a published list of codes (14 of 20). No idempotency keys. Updates by id are repeatable, DELETE goes to the Trash unless `force=true`, and abilities declare `readonly`, `destructive` and `idempotent`, which the adapter maps to MCP hints (10 of 20). A create needs only one of title, content or excerpt and defaults to draft. Official clients are JavaScript only, plus WP-CLI (8 of 15).", "maintenance": "7.1.3 was released on 6 October 2026, two days before this check (30). Six stable releases since 6 August 2026 (7.0.3, 7.0.4, 7.1, 7.1.1, 7.1.2 and 7.1.3) (20). Trac refused our request, so ticket handling is unread. Trunk had commits on 8 October, the critical fix of 22 September shipped with backports, and security reports are credited by name in each release post (15 of 25). The MCP Adapter reached v0.7.0 on 2 October 2026. WP-CLI's newest tag is v2.12.0 of 7 May 2025, and the official MCP registry timed out twice, so its listing is unread (8 of 15). CI, PHPStan and PHP compatibility workflows run on trunk (10).", "payments": "Scored with the self-hosted rule. No x402, MPP or L402 (0). The software is free under the GPL with nothing to buy from WordPress.org (20). No card or account is needed (20). `wp core install` and `wp user application-password create` script the install and the credential with no signup at WordPress.org (20). Hosting is a cost the owner chooses.", "reliability": "Read with the local-software lines, since each site runs on its owner's host and WordPress.org runs no hosted API. Official download from wordpress.org with PHP 7.4 and MySQL 5.5.5 stated as the minimum (20). PHPUnit, end-to-end and coding standards workflows on wordpress-develop all showed passing on trunk on 8 October 2026 (25). core.trac.wordpress.org refused our request with a 403, so open ticket counts are unread. From the release posts, 7.1.1 fixed 36 bugs four weeks after 7.1 and 7.1.3 fixed 4 more (10 of 25). Version numbers aren't semver. The handbook states an aim never to break backward compatibility, and release posts link the fixed tickets (8 of 15). 7.1.3 is a stable release and the REST API has been in core since 4.7 (15). No rate limits or 429 handling in core, which these lines don't score.", "schema": "No published OpenAPI file. Each site describes its routes and their JSON Schema arguments at /wp-json and on OPTIONS requests, which needs a live site, and abilities carry input and output schemas (15 of 25). wordpress.org/llms.txt is a 5.7 KB index of links. developer.wordpress.org/llms.txt returned 404 and no Markdown copies of the handbook were found (5 of 10). The reference describes each endpoint and argument, with little on when not to use one (12 of 20). Arguments are typed with enums for `status` and `context` and limits on `per_page`, while `content` is one HTML or block markup string and `meta` is open (11 of 15). Each reference page carries example requests. Errors return `code`, `message` and `data.status`, with no list of codes per endpoint (9 of 15). The wp/v2 namespace is versioned and every release has a dated post (13 of 15).", "security": "Application Passwords are per application, revocable one at a time, sent only in the Authorization header and refused on plain HTTP outside a local environment. They have no scopes or expiry and carry every capability of their user, so we scored plain revocable keys plus 2 for role-based limits (22 of 30). A Contributor account can draft but not publish, deletes go to the Trash by default, and MCP abilities are private unless marked public. Nothing asks a person to approve a publish by a user who holds that capability (14 of 20). Posts and comments hold text written by other people, and no prompt-injection guidance was found in the REST handbook or the MCP Adapter docs (3 of 15). Revisions record author and date, and each password records its last use and IP. Core has no log of API calls (6 of 15). security.txt is valid until 30 June 2027, reports go through HackerOne, and fixes are published with CVE and GHSA identifiers and backported to 4.7. Certifications don't apply to self-hosted software (17 of 20).", "transparency": "GPL version 2 or later, with the source public (30). Content stays on the owner's server. The privacy policy covers the WordPress.org sites, names api.wordpress.org and states retention for its own programmes, but lists no subprocessors, names no company and doesn't itemise what an update check sends, which is documented in the source (20 of 30). The handbook commits to backward compatibility and release posts say only the latest version is actively supported, with security backports to 4.7 as a courtesy. No notice period with dates was found (12 of 20). Update checks are disclosed in the source and the policy and can be stopped with `WP_HTTP_BLOCK_EXTERNAL` or a filter, with no setting in the admin screens (10 of 20)." }, "sources": [ { "what": "latest version and minimum PHP and MySQL", "url": "https://api.wordpress.org/core/version-check/1.7/", "seen": "2026-10-08" }, { "what": "release posts", "url": "https://wordpress.org/news/category/releases/", "seen": "2026-10-08" }, { "what": "7.1.2 security release", "url": "https://wordpress.org/news/2026/09/wordpress-7-1-2-release/", "seen": "2026-10-08" }, { "what": "7.1.3 release", "url": "https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/", "seen": "2026-10-08" }, { "what": "7.1.1 release", "url": "https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/", "seen": "2026-10-08" }, { "what": "REST API authentication", "url": "https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/", "seen": "2026-10-08" }, { "what": "REST global parameters", "url": "https://developer.wordpress.org/rest-api/using-the-rest-api/global-parameters/", "seen": "2026-10-08" }, { "what": "REST pagination", "url": "https://developer.wordpress.org/rest-api/using-the-rest-api/pagination/", "seen": "2026-10-08" }, { "what": "posts reference", "url": "https://developer.wordpress.org/rest-api/reference/posts/", "seen": "2026-10-08" }, { "what": "core repository, REST controllers, abilities, update checks, SECURITY.md (clone)", "url": "https://github.com/WordPress/wordpress-develop", "seen": "2026-10-08" }, { "what": "CI badge, PHPUnit on trunk", "url": "https://github.com/WordPress/wordpress-develop/actions/workflows/phpunit-tests.yml/badge.svg?branch=trunk", "seen": "2026-10-08" }, { "what": "MCP Adapter repository, changelog and docs (clone)", "url": "https://github.com/WordPress/mcp-adapter", "seen": "2026-10-08" }, { "what": "WP-CLI repository and tags", "url": "https://github.com/wp-cli/wp-cli", "seen": "2026-10-08" }, { "what": "WP-CLI application password command", "url": "https://developer.wordpress.org/cli/commands/user/application-password/create/", "seen": "2026-10-08" }, { "what": "llms.txt", "url": "https://wordpress.org/llms.txt", "seen": "2026-10-08" }, { "what": "security.txt", "url": "https://wordpress.org/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "security overview", "url": "https://wordpress.org/about/security/", "seen": "2026-10-08" }, { "what": "privacy policy", "url": "https://wordpress.org/about/privacy/", "seen": "2026-10-08" }, { "what": "requirements", "url": "https://wordpress.org/about/requirements/", "seen": "2026-10-08" }, { "what": "version numbering and backward compatibility", "url": "https://make.wordpress.org/core/handbook/about/release-cycle/version-numbering/", "seen": "2026-10-08" }, { "what": "domain registration", "url": "https://rdap.org/domain/wordpress.org", "seen": "2026-10-08" } ], "openQuestions": [ "unchecked: core.trac.wordpress.org answered 403, so open ticket counts and reply times are unread and the Reliability and Maintenance lines that depend on them are scored from release posts", "unchecked: the official MCP registry timed out twice, so whether the MCP Adapter is listed there is unread", "unchecked: the HackerOne programme page (scope and bounty amounts) and the advisory GHSA-7hp8-65ch-5whp itself. The flaw's description comes from the 7.1.2 release post", "unchecked: api.github.com reached its rate limit, so star counts for the MCP Adapter and WP-CLI are unread. The star count shown is for the WordPress/WordPress mirror (wordpress-develop has 3,478)", "The lead named WordPress Foundation / Automattic as the vendor. The pages we read name only WordPress.org and give the trademark to the WordPress Foundation. Automattic appears only as publisher of the @automattic/mcp-wordpress-remote proxy", "No terms document governs the software, so `provenance.terms` is left out. The privacy policy is WordPress.org's and covers update checks to api.wordpress.org, not content on a self-hosted site", "We didn't run a site, so route behaviour comes from the handbook and the source on trunk at 8 October 2026", "Disclosure. The 7.1.1 and 7.1.3 release posts credit Anthropic for five of the reported vulnerabilities, and these grades are written by an agent on Anthropic's Claude models. The checklist was applied as for any listing", "cms.localisation and cms.schema aren't claimed. Core has no content translation, and post types are registered in PHP, not through the REST API" ] }, "negative": -5, "negativeNotes": [ "22 September 2026. WordPress 7.1.2 fixed a critical flaw, CVE-2026-87902 (GHSA-7hp8-65ch-5whp), in which an unauthenticated attacker could, where server and theme conditions were met, make template resolution include a local PHP file and reach remote code execution. 7.1.1 on 17 September and 7.1.3 on 6 October fixed 18 further security issues. All were published by the project with the fix and backported, and we found no report of exploitation in the release posts, so we deduct 5 of a possible 15. https://wordpress.org/news/2026/09/wordpress-7-1-2-release/ ; https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/" ], "verdict": "The REST API is part of core, and a post created without a status is saved as a draft with revisions kept on the owner's server. Application Passwords carry no scopes, so limits come only from the user's role. Revisions can be read and deleted but not restored over REST, and a critical flaw was fixed on 22 September 2026.", "bestFor": "Sites that already run WordPress, where an agent drafts posts and uploads media under a Contributor or Author account and a person publishes.", "strengths": [ "Posts created without `status` are saved as drafts, and DELETE moves a post to the Trash unless `force=true` is passed", "Every REST or WP-CLI update to a post writes a revision that `/wp/v2/posts/\u003cid\u003e/revisions` lists with author and date", "`_fields` trims responses down to nested properties, with `per_page` up to 100 and X-WP-Total headers on every list", "Six stable releases between 6 August and 6 October 2026, and security fixes backported to 4.7", "GPL-2.0-or-later, free to self-host, with a valid security.txt and a HackerOne programme for core" ], "weaknesses": [ "Application Passwords have no scopes or expiry. Each one carries every capability of its user", "The revisions route supports GET and DELETE only, so a rollback means writing the old content back as a new update", "Core has no rate limit, no idempotency keys and no log of API calls beyond revisions and a password's last use", "A critical flaw (CVE-2026-87902) fixed in 7.1.2 on 22 September 2026 allowed remote code execution under certain server and theme conditions", "No published OpenAPI file. Each site describes its own routes at `/wp-json`, and core has no content localisation" ], "agentNotes": [ "Ask the owner for a dedicated user with the lowest role that fits. A Contributor can draft and edit its own posts but can't publish them", "Send the Application Password as Basic auth over HTTPS only. Core disables Application Passwords on plain HTTP outside a local environment", "Upload a file with POST `/wp-json/wp/v2/media` first, then set `featured_media` or reference the returned URL in the post content", "To roll back, GET `/wp/v2/posts/\u003cid\u003e/revisions/\u003crev\u003e?context=edit` and POST its title and content to the post. There's no restore route", "Pass `_fields=id,status,link,modified` on lists and read X-WP-TotalPages. `per_page` stops at 100" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "B", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 64.8 } ], "editorialScores": { "ergonomics": 74, "maintenance": 83, "payments": 60, "reliability": 78, "schema": 65, "security": 62, "transparency": 72 }, "provenanceScore": 63 }, "connect": { "install": "wp core download \u0026\u0026 wp core install --url=\u003curl\u003e --title=\u003ctitle\u003e --admin_user=\u003cuser\u003e --admin_email=\u003cemail\u003e", "http": "curl --user \"USERNAME:PASSWORD\" https://HOSTNAME/wp-json/wp/v2/users?context=edit", "config": { "mcpServers": { "wordpress": { "args": [ "--path=/path/to/your/wordpress/site", "mcp-adapter", "serve", "--server=mcp-adapter-default-server", "--user=admin" ], "command": "wp" } } } }, "letme": { "capability": "https://letme.dev/cms.content", "tool": "https://letme.dev/wordpress" }, "notable": [ "The REST API has been part of core since 4.7. Routes for posts, pages, media, revisions, autosaves, comments, terms, users, settings and templates sit under /wp-json/wp/v2 (https://developer.wordpress.org/rest-api/)", "Application Passwords, in core since 5.6, are created per application on a user's profile, through `/wp/v2/users/\u003cid\u003e/application-passwords` or with `wp user application-password create`, and are sent as Basic auth over HTTPS (https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/)", "The revisions controller registers GET for the list, and GET and DELETE for one revision. It has no restore route (https://github.com/WordPress/wordpress-develop/blob/trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php)", "The Abilities API arrived in 6.9 with REST routes to list and run abilities. Core registers three, all read-only (site information, user information, environment info), so content writes go through the REST API or abilities a plugin adds (https://github.com/WordPress/wordpress-develop/blob/trunk/src/wp-includes/abilities.php)", "The MCP Adapter plugin, v0.7.0 of 2 October 2026, turns abilities into MCP tools over STDIO (`wp mcp-adapter serve`) or HTTP at /wp-json/mcp/mcp-adapter-default-server, with three meta-tools on its default server (https://github.com/WordPress/mcp-adapter)", "WordPress 7.1.2 of 22 September 2026 fixed a critical flaw, CVE-2026-87902, in which an unauthenticated attacker could under certain conditions make template resolution include a local PHP file (https://wordpress.org/news/2026/09/wordpress-7-1-2-release/)", "7.1.1 (17 September 2026) carried 11 security fixes and 7.1.3 (6 October 2026) carried 7, among them an authenticated path traversal in the REST templates controller (https://wordpress.org/news/category/releases/)", "Update checks send the WordPress, PHP and MySQL versions, locale, user and site counts and the list of PHP extensions to api.wordpress.org (https://github.com/WordPress/wordpress-develop/blob/trunk/src/wp-includes/update.php)" ], "area": "business", "details": [ { "label": "Graded surface", "value": "Self-hosted WordPress 7.1.3 through the core REST API at /wp-json/wp/v2, authenticated with an Application Password. WP-CLI and the MCP Adapter plugin are described but not the basis of the grade. WordPress.com, Automattic's hosted service, is a separate product and isn't graded here" }, { "label": "REST API", "value": "In core since 4.7. Posts, pages, media, revisions, autosaves, comments, categories, tags, users, settings, templates, menus, plugins, themes and custom post types registered with `show_in_rest`. Each site lists its routes and their JSON Schema arguments at /wp-json and on OPTIONS requests" }, { "label": "Credentials", "value": "Application Passwords (core since 5.6), one per application, revocable one at a time, with last used time and last IP recorded. No scopes and no expiry. Sent as Basic auth, and available only over HTTPS or in a `local` environment. An application can request one through `wp-admin/authorize-application.php`, which the user approves in a browser" }, { "label": "Roles", "value": "Access follows the user's role. Core checks capabilities such as `publish_posts` and `edit_others_posts` on every write, so a Contributor account can draft but not publish" }, { "label": "Draft and publish", "value": "`status` is one of the site's registered statuses, such as draft, pending, private, publish and future. A create without `status` is saved as a draft. A user without `publish_posts` can't set publish" }, { "label": "Assets", "value": "POST /wp/v2/media with the file as the request body or as multipart form data. Further routes for post-process, edit, sideload and `finalize` on an attachment" }, { "label": "Version history", "value": "Each update to a post type that supports revisions stores one. GET /wp/v2/posts/\u003cid\u003e/revisions and /revisions/\u003crev\u003e, DELETE with `force=true`. No restore route. Autosaves have their own routes" }, { "label": "Response controls", "value": "`_fields` with nested properties, `_embed` with a list of relations, `context` of view, embed or edit, `page`, `per_page` (1 to 100, default 10), `offset`, and X-WP-Total and X-WP-TotalPages headers" }, { "label": "Deletes", "value": "DELETE moves a post to the Trash unless `force=true`. Revisions and media can't be trashed and need `force=true`" }, { "label": "Abilities and MCP", "value": "Abilities API in core since 6.9, with `readonly`, `destructive` and `idempotent` annotations. Core registers three read-only abilities. The MCP Adapter plugin (v0.7.0, needs WordPress 6.9 and PHP 7.4) maps abilities to MCP tools, resources and prompts for MCP revisions 2025-11-25 and 2026-07-28. Abilities are private unless marked `meta.public`" }, { "label": "WP-CLI", "value": "`wp post create`, `wp post update`, `wp media import`, `wp core install` and `wp user application-password create` among its commands. The newest tag on GitHub is v2.12.0 of 7 May 2025, with commits to 8 October 2026" }, { "label": "Rate limits", "value": "None in core. No 429 handling or Retry-After was found in the REST server source or the handbook" }, { "label": "Runtime", "value": "PHP 7.4 or later and MySQL 5.5.5 or later as the minimum. PHP 8.3, MySQL 8.0 or MariaDB 10.11 and HTTPS are recommended" }, { "label": "Releases", "value": "7.1 on 19 August 2026, then 7.1.1 (17 September), 7.1.2 (22 September) and 7.1.3 (6 October). 7.2 is planned for December 2026. Version numbers aren't semver, and the project states that it aims never to break backward compatibility" }, { "label": "Security", "value": "security.txt valid until 30 June 2027, reports through HackerOne, security fixes backported as a courtesy to 4.7, and only the latest version actively supported" }, { "label": "Data sent to WordPress.org", "value": "Core, plugin and theme update checks to api.wordpress.org. The core check sends versions, locale, user and site counts and PHP extensions. `WP_HTTP_BLOCK_EXTERNAL` and the `core_version_check_query_args` filter change or stop it. There is no setting in the admin screens" } ], "unitPrices": [ { "item": "WordPress, self-hosted", "unit": "month", "usd": 0, "note": "GPL, you pay for your own hosting" } ], "provenance": { "legalEntity": "WordPress.org, an open-source project. The WordPress trademark belongs to the WordPress Foundation", "domain": "wordpress.org", "domainRegistered": "2003-03-28", "endpointOnVendorDomain": false, "terms": "", "privacy": "https://wordpress.org/about/privacy/", "statusPage": "", "changelog": "https://wordpress.org/news/category/releases/", "securityTxt": "valid", "checked": "2026-10-08", "notes": [ "No terms of service govern the software. It is licensed under GPL version 2 or later, and no service agreement or API terms were found, so `terms` is left out.", "The privacy policy covers the WordPress.org websites and names api.wordpress.org, the service installations call to check for updates. It names no company, and gives dpo@wordpress.org as the contact. It doesn't cover content held on a self-hosted site.", "The REST API answers on each owner's own domain.", "https://wordpress.org/.well-known/security.txt returned 200 with Contact https://hackerone.com/wordpress and Expires 2027-06-30.", "RDAP for wordpress.org gives a registration date of 2003-03-28.", "The make.wordpress.org footer says the WordPress trademark is the intellectual property of the WordPress Foundation. `license.txt` gives copyright to the contributors.", "No status page applies to self-hosted software." ], "score": 63, "checks": [ { "check": "Legal entity named", "value": "WordPress.org, an open-source project. The WordPress trademark belongs to the WordPress Foundation", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "wordpress.org, registered 2003-03-28 (23 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": " is not on wordpress.org", "points": 0, "max": 15, "state": "no" }, { "check": "Terms of service", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Privacy policy", "value": "read, states 5 of the 8 things a reader expects", "points": 7.8, "max": 10, "state": "part" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "valid", "points": 10, "max": 10, "state": "ok" } ], "policies": [ { "kind": "terms", "url": "", "state": "none-found", "points": 0, "max": 10 }, { "kind": "privacy", "url": "https://wordpress.org/about/privacy/", "state": "read", "readAt": "2026-10-08", "words": 2252, "points": 7.8, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": false }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": false }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "On WordCamp.org sites, banking/financial data collected as part of a reimbursement request is deleted from WordCamp.org 7 days after the request is marked paid.", "says": "Names a period of 7 days" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "…administrators, employees, contractors, and affiliated organizations, as described above, WordPress.org discloses potentially personally-identifying and personally-identifying information only when required to do so by law, if you give permission to have your information shared, or when WordPress.org believes in good…" }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "We will not sell or lease your personal information to third parties unless we have your permission or are required by law to do so.", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "All of the information that is collected on WordPress.org will be handled in accordance with GDPR legislation." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "Please contact us if you have any questions about our privacy policy or information we hold about you by emailing dpo@wordpress.org.", "says": "dpo@wordpress.org" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": false } ], "notes": [ { "date": "2026-10-08", "text": "Some WordPress.org review and moderation workflows use AI tools, and this may involve sharing relevant data with third-party AI service providers.", "quote": "This processing may involve sharing relevant data with third-party AI service providers." }, { "date": "2026-10-08", "text": "WordPress.org reserves the right to publish a request sent to it, such as a support email, to help it respond or to support other users.", "quote": "If you send us a request (for example via a support email or via one of our feedback mechanisms), we reserve the right to publish it in order to help us clarify or respond to your request or to help us support other users." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/wordpress.json", "live": { "slug": "wordpress", "pages": [ { "url": "https://wordpress.org/news/category/releases/", "kind": "changelog", "status": 200, "checkedAt": "2026-10-08T18:25:52.505193763Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "cbd71d93d029" }, { "url": "https://wordpress.org/about/privacy/", "kind": "privacy", "status": 200, "checkedAt": "2026-10-08T18:25:50.079319583Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "61575a1b129f" } ], "updatedAt": "2026-10-08T18:25:52.505193763Z" } } }