Make WordPress

“What’s new in GutenbergGutenberg The Gutenberg project is the new Editor Interface for WordPress. The editor improves the process and experience of creating new content, making writing rich content much simpler. It uses ‘blocks’ to add richness rather than shortcodes, custom HTML etc. https://wordpress.org/gutenberg/…” posts (labeled with the #gutenberg-new tag) are posted following every Gutenberg release on a biweekly basis, showcasing new features included in each release. As a reminder, here’s an overview of different ways to keep up with Gutenberg and the Editor.

Gutenberg 24.4 is released and available for download!

This release adds emoji reactions and search to Notes, improves content-only editing across more blocks, and brings more controls in line with the WordPress Design System. The experimental Media Editor gains PDF previews and clearer file details. Draft content gets extra protection when restoring browser backups, while Rich Text and blockBlock Block is the abstract term used to describe units of markup that, composed together, form the content or layout of a webpage using the WordPress editor. The idea combines concepts of what in the past may have achieved with shortcodes, custom HTML, and embed discovery into a single consistent API and user experience. parsing get performance improvements. Developers also get an experimental PHPPHP The web scripting language in which WordPress is primarily architected. WordPress requires PHP 7.4 or higher runtime for wp-env. All of this thanks to a fantastic team of contributors, including five first-timers.

Find the right note faster

Notes gain search across comments, replies, and author names, plus filtering by open/resolved status.

Compact note emoji reaction picker

Reacting to notes now takes less space, with a compact horizontal emoji picker that keeps the conversation in view (#85819). New thumbs-up and plus reactions give you more ways to show agreement or support without adding another reply (#85565).

Understand what’s overriding your Global Styles

Global Styles now shows an “Overridden by” list for elements such as headings, links, and buttons, making it clearer when coreCore Core is the set of software required to run WordPress. The Core Development Team builds WordPress. blocks have styles that take precedence (#84671). Each item links directly to the block’s style settings, so you can find and adjust the override without hunting through the block list.

Changelog

Features

• wp-env: Add an experimental runtime using locally installed PHP and SQLite. (85512)

Enhancements

Components

• RadioControl: Place group help text below the fieldset label and remove its legacy components-base-control__help class. (85126)
• UIUI User interface: Add Menu width presets and make Select and SelectControl popup presets size to content up to a maximum width. Use CSSCSS Cascading Style Sheets. when a fixed width is required. (84086)
• DataViews: Standardize action-label punctuation. Consumers should supply labels without ellipses; modal menu actions add translated ellipses. (85396)
• Align focus indicators across AlignmentMatrixControl, DataViews grids, FormToggle, Modal scrollable content, RangeControl, RotationRuler, and disabled items. (85528, 85364, 85285, 85251, 85536, 85535, 86125)
• Badge: Add optional infotips using a consumer-supplied Popover. (85309)
• Align Modal colors and corners, and Tooltip backgrounds, with the design system. (85855, 85858)
• Migrate CustomGradientPicker and BackgroundClipControl select controls to @wordpress/ui. (85750, 86046)
• DataViews: Migrate Sort by and relative-date Unit controls to @wordpress/ui. (86167)
• DataViews: Use @wordpress/ui buttons in the bulk actions bar. (85939)
• Align the standalone Spinner appearance with the design system and scale its stroke width with its size. (85859, 85378)
• Theme: Report insufficient contrast of focus-ring and strong brand-fill colors against theme surfaces. (85449)
• Use solid brand highlights for popup items. (84583)

Block Library

• Improve content-only editing for Button content, Comments Pagination link labels, and Query LoopLoop The Loop is PHP code used by WordPress to display posts. Using The Loop, WordPress processes each post to be displayed on the current page, and formats it according to how it matches specified criteria within The Loop tags. Any HTML or PHP code in the Loop will be processed on each post. https://codex.wordpress.org/The_Loop pagination link labels. (84854, 86175, 70165)
• Add border support to Comments Pagination Numbers, and border and padding support to Query Pagination Numbers. (85164, 85245)
• Migrate select controls in the Archives, Audio, File, Latest Comments, List, Playlist, Post Author AvatarAvatar An avatar is an image or illustration that specifically refers to a character that represents an online user. It’s usually a square box that appears next to the user’s name., Social Icons, and Tag Cloud blocks to @wordpress/ui. (86137, 86194, 86199, 86138, 86141, 86161, 86160, 86196, 86198)
• Remove the Auto/Manual grid toggle and add an experimental Canvas variation of the Group block. (85985)
• Social Icon: Support editing the link from the inspector. (84860)

Block and Site Editors

• Rich Text: Give formats in the More dropdown a consistent order and reserve dedicated name-based toolbar slots for known core formats. (85843)
• Add an alignment-menu action to select the block constraining a child block’s width. (82607)
• Guard entity preload filters and share entity actions and fields logic. (85390)
• Experimental Site Editor v2: Unregister the View revisionsRevisions The WordPress revisions system stores a record of each saved draft or published update. The revision system allows you to see what changes were made in each revision by dragging a slider (or using the Next/Previous buttons). The display indicates what has changed in each revision. action on the server. (85279)

Design Tools and Global Styles

• Show an icon for each aspect ratio option in the Dimensions tool. (85812)
• Global Styles: List core block types that override an element’s styles. (84671)
• Place background and text colors first in the color palette. (62548)

Media

• Experimental media editor: Show file type and size in the headerHeader The header of your site is typically the first thing people will experience. The masthead or header art located across the top of your page is part of the look and feel of your website. It can influence a visitor’s opinion about your content and you/ your organization’s brand. It may also look different on different screen sizes. and reposition the settings dropdown. (86154, 86020)
• Add PDF previews to the experimental media editor. (86002)
• Animate the media editor sidebarSidebar A sidebar in WordPress is referred to a widget-ready area used by WordPress themes to display information that is not a part of the main content. It is not always a vertical column on the side. It can be a horizontal rectangle below or above the content area, footer, header, or any where in the theme. when opening and closing it. (85889)
• Group Reset and Restore original under a History menu. (85891)
• Prevent MediaEdit item-removal animations. (85372)

Collaboration

• Hide collaborator avatars while typing. (83490)
• Notes: Add search and a status filterFilter Filters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output. to the All Notes sidebar. (84060)
• Notes: Add thumbs-up and plus reactions, and show the reaction picker as a row of emoji. (85565, 85819)

Dashboard and Widgets

• WidgetWidget A WordPress Widget is a small block that performs a specific function. You can add these widgets in sidebars also known as widget-ready areas on your web page. WordPress widgets were originally created to provide a simple and easy-to-use way of giving design and structure control of the WordPress theme to the user. Dashboard: Forward grid settings to the surface. Stop applying the automatic 600px and 960px breakpoints to numeric column counts; hosts that relied on them must supply a column-step map. Render positive row heights without snapping to presets. (85228)
• Add useWidgetIdentity for translated widget titles. (85729)
• Support an example declaration in widget.json. (85240)
• Grid: Support column-count steps based on container width. (85216)

Icons

• Add the database icon and expose error, info, and postComments in the core-admin collection. (85273, 85452)
• Promote Dashicon replacements to the core-admin collection and map their Dashicons. (85541)

Developer Tools

• Design System MCP: Add pattern tools using Storybook MDX manifest output. (84864)
• Storybook: Show icon details in the Icon Library. (86057)
• Limit wp-build esbuild concurrency. (79889)

Bug Fixes

Components

• CheckboxControl: Use design system color tokens; legacy --wp-components-color-accent and --wp-components-color-accent-inverted overrides no longer apply. Use ThemeProvider for customization. (85856)
• Widget Dashboard: Give the footer strip a consistent height. (85237)
• BoxControl: Add fallback units for the input slider. (70288)
• DataViews: Correct filter-chip focus styling and prevent the remove button from overlapping chip text. (85374)
• ColorPicker: Preserve hex and RGB edits when the picker closes. (85734)
• ControlWithError: Skip unchanged validity-state updates. (85479)
• Core fields: Preserve status-icon sizing when labels wrap and remove extra spacing in slug inputs. (85828, 85935)
• DataViews: Use a page-number input for pagination above 100 pages. (85303)
• DropdownMenu: Account for Button borders in menu-item padding. (85503)
• Keep MenuItem and ToggleGroupControl widths stable when selection changes. (85831, 85454)
• Modal: Restore each modal’s aria-hidden state when modals close out of order. (85720)
• PaletteEdit: Preserve existing slugs when deduplicating presets. (85817)
• ToolsPanel: Keep Reset labels visible on highlighted menu items. (86045)
• Calendar: Show only the day number in day cells. (86010)

Block Library

• Table: Keep the selected cell on the first click into an unselected table. (86757)
  This was introduced in 24.4.1.
• Comment Author Avatar: Pass the configured size to get_avatar(). (86113)
• Comments Pagination Next: Remove the link filter from the correct hook. (85244)
• Cover: Prevent Navigation overlays from being clipped in Safari. (86041)
• Playlist: Preserve track metadata after failed replacement uploads, handle URLs containing query-string ampersands, and render tracks without attachment IDs. (86018, 85931, 83880)
• Table of Contents: Show previewed headings in published-post previews and keep list styles editable in templates. (86155, 86251)
• Heading: Preserve combining marks in generated anchors. (85096)
• Navigation Link: Preserve text formatting when editing in the sidebar. (85223)
• Page List: Keep pages visible in the Navigation sidebar. (85357)
• Paragraph: Support removing theme-disabled drop caps and avoid empty toolbar groups when alignment controls are unavailable. (84839, 85796)
• Social Icon: Prevent closing a popover from stealing focus. (86215)
• Social Links: Restore the larger icon size for the Logos Only style. (85506)
• Tabs: Correct the classic-theme selector for tab-button styles. (85504)

Editors and Saving

• Rich Text: Handle full-content deletion through beforeinput, including Safari deletion commands. (85886)
• Copy the text of bound fields. (85403)
• Preserve HTMLHTML HyperText Markup Language. The semantic scripting language primarily used for outputting content in web browsers. anchors when editing as HTML and converting Classic blocks. (82836)
• Inserter: Keep focused results below the sticky search field. (85706)
• Link Control: Preserve preview focus while the selected post’s record loads. (85945)
• Match the block-visibility viewport once per canvas. (85808)
• Preserve child layout attributes when transforming a block. (85045)
• Rich Text: Remove stale format boundaries when a field loses selection. (86168)
• Correct non-breaking-space replacement behavior and its tooltip. (85873, 85777)
• Writing flow: Correct triple-click list selection, parent-block select-all behavior, and arrow-key navigation at viewport edges. (85569, 85987, 85408)
• Raw handling: Keep shortcodes within text inline. (85795)
• Vertically center the Categories loading spinner. (85563)
• Save current content before restoring a browser backup. (85406)
• Revisions: Include only revisioned metadata in revision REST responses. (85509)
• Command Palette: Correct the classic-theme guard for template commands. (86142)

Design Tools and Global Styles

• Apply globally: Show the block type’s current value. (84823)
• Contrast checker: Check the visible color of text clipped to its background. (86148)
• Global Styles: Preserve individual sides when editing padding and margin shorthand. (85437)
• Typography: Clear the synced link color when resetting all settings. (85376)
• Pass blockName to style-state inspector slots. (86084)
• Allow separate row and column block gaps in the block-style theme.jsonJSON JSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML. schema. (86044)
• Allow CSS custom properties when sanitizing block gaps. (82817)
• KSES: Allow CSS color functions in inline styles. (84213)
• Correct the deprecated duotone render wrapper’s arguments and document known limitations in deprecated duotone functions. (68397)
• Duotone: Avoid undefined-array-key warnings when parsing hue units. (68399)

Media

• Experimental media editor: Correct canvas border radii and footer controls. (86143)
• RotationRuler: Keep the center marker visible in forced-colors mode. (85546)
• Prevent endless image-sideloading loops when the browser cannot decode a large image. (83530)

Collaboration

• Notes: Handle inline notes in merged text. (85744)
• Notes: Handle notes shared by duplicated or split blocks. (85906)
• Notes: Share thread-focus recovery across actions. (85455)
• Notes: Correct reaction-deletion permissions, including author checks and preventing changes on resolved threads. (85415, 85883)

Interactivity APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways.

• Ignore router regions and attachTo targets inside data-wp-html content. (84919)
• Load Interactivity Router script modules without eval() or WebAssembly to support Content Security Policy restrictions. (84056)

Developer Tools

• Storybook: Match icon labels when searching the icon library. (85399)
• Storybook: Remove BaseControl from the component manifest. (85847)
• Update the sprintf dependency to resolve TypeScript module-resolution issues. (85562)
• wp-env: Preserve Debian security updates in Bullseye-based images. (85469)
• wp-env: Report the PHP runtime’s actual automatically selected port and preserve it when resetting the site. (85574)

AccessibilityAccessibility Accessibility (commonly shortened to a11y) refers to the design of products, devices, services, or environments for people with disabilities. The concept of accessible design ensures both “direct access” (i.e. unassisted) and “indirect access” meaning compatibility with a person’s assistive technology (for example, computer screen readers). (https://en.wikipedia.org/wiki/Accessibility)

• Prevent invalidinvalid A resolution on the bug tracker (and generally common in software development, sometimes also notabug) that indicates the ticket is not a bug, is a support request, or is generally invalid. LaTeX from trapping keyboard focus in the Math block and inline math controls. (86027)
• Migrate Separator and Table of Contents select controls to @wordpress/ui. (86047)
• Modal: Preserve dialog boundaries in forced-colors mode. (85888)
• UI: Add Notice.List with live announcements. (85209)
• Notes: Show reaction pills’ pressed state in forced-colors mode. (85904)
• Give URLURL A specific web address of a website or web page on the Internet, such as a website’s URL www.wordpress.org submit buttons consistent identification. (85725)
• Improve the accessibility and usability of the error copy button. (85477)
• Grid: Preserve tile content semantics when dragging is disabled. (84869)

Performance

• Reduce Rich Text initialization and editing overhead by batching DOM updates, parsing unfocused fields on mount, and simplifying field registration, event listeners, selection tracking, and undo handling. (85177, 85874, 86007, 86021, 85887, 85994, 85983)
• Reduce block action and store-subscription overhead. (85991, 85804)
• Preserve unchanged blocks when resetting content so undo does not re-render the entire post. (85427)
• Skip measuring the collaborators overlay when there is nothing to draw. (85179)
• ThemeProvider: Use prebuilt color ramps for the default seeds. (85182)
• withFilters: Track mounted instances in a Set. (86012)
• Log block migrations only when SCRIPT_DEBUG is enabled. (85736)
• Expose script exports on globals as data properties. (85180)
• Reduce parser memory use and processing time for documents with deeply nested, unclosed blocks. (74427)

Documentation

• Add agent guidance for escaping PHP output and preventing cross-site scripting. (84596)
• Add migrationMigration Moving the code, database and media files for a website site from one server to another. Most typically done when changing hosting companies. guides for CustomSelectControl and SelectControl. (85377, 85220)
• Document createInterpolateElement in the internationalization guide. (86015)
• Clarify the design system introduction and document the legacy-component replacement process. (85764, 85480)
• Focus package changelogs on consumer-facing changes. (85079)
• Document SelectControl callbacks when reselecting the current value. (86200)
• Add DropdownMenu selection stories. (85551)
• Document the 7.1.4 security patchpatch A special text file that describes changes to code, by identifying the files and lines which are added, removed, and altered. It may also be referred to as a diff. A patch can be applied to a codebase for testing. releases. (85930)
• Add a Design System MCP page to Storybook. (85464)
• Add guidance for agents reading Storybook without JavaScriptJavaScript JavaScript or JS is an object-oriented computer programming language commonly used to create interactive effects within web browsers. WordPress makes extensive use of JS for a better user experience. While PHP is executed on the server, JS executes within a user’s browser. https://www.javascript.com. (85757)
• Complete Storybook guidance for copy-to-clipboard feedback. (85745)
• Correct minified component names in Storybook code snippets. (85966)
• Make the Save & Submit Canvas example fully copyable and add a Notice disclosure composition example. (85766, 84627)
• Keep documentation before attached, named MDX pages in Storybook. (85308)
• Remove ThemeProvider’s private badge in Storybook. (85529)
• Update Figma border-import documentation. (85304)
• Document npm run other:cherry-pick -- --dry-run in the release guides. (85465)

Code Quality

• Remove unused files and dependencies across packages and workspaces. (85197, 85196)

Components

• Remove the public checkbox-control and radio-control Sass mixins from @wordpress/base-styles; their styles now live in CheckboxControl and RadioControl. (85248)
• Require distinct aliases for legacy IconButton, Menu, Notice, Popover, Tabs, validated controls, Card, and VisuallyHidden imports. (85846, 85845, 85839, 85838, 85852, 85950, 85519, 85837)
• Replace legacy DataViews selection-indicator mixins. (85191)
• Deprecate the legacy FormToggle, Tooltip, ProgressBar, TabbableContainer, and CustomGradientPicker components. (85517, 85518, 85520, 85521, 85953)
• Restore change-case for component class-name generation. (85192)

Icons

• Update lock to use the former outline artwork and remove the lockOutline and lockSmall exports. (85740)
• Remove the insertBefore, insertAfter, and offline icon exports. (85445)

Blocks and Editors

• Reduce effects in core blocks using render-time state, core-data, useEvent, and useRefEffect, and restrict new effects with a lint rule. (85814, 85864, 85810, 85862, 85867)
• Remove unused Button outline styles and redundant Site Title fit-text CSS. (85471, 85166)
• Correct PHPDocPHPDoc (docblock, inline docs), private static access, redundant conditions, and return values in block rendering and style support. (86092, 86090, 86094, 86091)
• Use null-coalescing assignment for Navigation, Tab Panel, and background-size defaults. (86033, 85548)
• Navigation: Replace the button block appender with a dropdown appender. (70524)
• Remove ignored parseFloat radix arguments and an unused SpacingSizesControl constant. (85163, 85877)
• Centralize focus-capture prevention once per canvas. (85815)
• Remove non-iframeiframe iFrame is an acronym for an inline frame. An iFrame is used inside a webpage to load another HTML document and render it. This HTML document may also contain JavaScript and/or CSS which is loaded at the time when iframe tag is parsed by the user’s browser. metaMeta Meta is a term that refers to the inside workings of a group. For us, this is the team that works on internal WordPress sites like WordCamp Central and Make WordPress.-box code from Edit Post. (86009)
• Set welcome-guide preferences to false when closing the guides. (85742)

Media

• Simplify cropper state and instruction handling and remove unnecessary media-editor effects. (85881, 86147, 85882, 85880)
• Tidy cropper code before exposing it. (85429)

Styles and Server APIs

• Correct theme JSON types, cached-property PHPDoc, and private static calls, and simplify CSS-variable matching. (68407, 86111, 86096, 68386, 68401)
• Make PHP types explicit and simplify duotone, layout, shadow, style-variation, typography, and compatibility code. (68405, 68389, 68404, 68398, 68396, 68392, 86099)
• Remove the Global Styles inheritance-indicators experiment. (85884)
• Use gutenberg_prepare_json_value_for_client() for view configurations and entity fields. (85206)
• Move the Site patterns view-configuration change into the WordPress 7.2 compatibility directory. (85905)
• Remove obsolete --wp-components-color-* overrides. (85938)

TypeScript

• Expand TypeScript coverage for block-editor components, core-data utilities and actions, Patterns stores, and Core Commands; add split TypeScript configuration and a typed test to Blocks. (84950, 85058, 85070, 85534, 85253, 84385)
• Convert package tests and test utilities to TypeScript across Components, DOM, LaTeX to MathML, Redux Routine, Element, API Fetch, Viewport, Plugins, E2E Test Utils, HooksHooks In WordPress theme and development, hooks are functions that can be applied to an action or a Filter in WordPress. Actions are functions performed when a certain event occurs in WordPress. Filters allow you to modify certain functions. Arguments used to hook both filters and actions look the same., and Preferences Persistence. (85150, 85161, 85084, 85121, 85159, 85145, 85115, 85088, 84917, 85141, 85162)

Tools

Testing

• Add split TypeScript configuration for most packages to support typed tests, and disable Vitest CommonJS globals injection. (85470, 85878)
• Add npm run browse for driving the local WordPress site from the command line. (85525)
• Stabilize drag tests by handling insertion-indicator remounts and setting the initial caret position. (85270, 85988)
• Improve synchronization in autocomplete, rich-text selection, link-field, cut-and-paste, template, and editor-canvas tests. (85572, 85975, 85996, 85976, 85978, 85974)
• Stabilize the Interactivity Router URL-fragment navigation test. (85473)
• Replace the Page List unit testunit test Code written to test a small piece of code or functionality within a larger application. Everything from themes to WordPress core have a series of unit tests. Also see regression. with end-to-end coverage, update entity-fields assertions for Core trunktrunk A directory in Subversion containing the latest development code in preparation for the next major release cycle. If you are running “trunk”, then you are on the latest revision., and use real components in interface tests. (85564, 85201, 86171)
• Remove redundant Site Editor and comments-count checks and simplify entity-action loader test labels. (85259, 85979, 85798)
• Shrink and speed up the block Notes end-to-end tests. (86209)
• Measure page-load performance without tracing and record end-to-end traces only on failed-test retries. (86025, 85428)
• Run end-to-end tests in parallel with a separate wp-env site per two CPU cores. (85420)
• Stabilize web-editor selection tests in iOSiOS The operating system used on iPhones and iPads. Safari. (85461, 85481)

Build Tooling

• Docgen: Remove Babel core, project Babel-configuration support, and support for syntax requiring custom parsers, including Flow. (85183)
• Move theme build and Stylelint plugins to @wordpress/theme-build-tools and remove their old @wordpress/theme exports; consumers must update their imports. (83568)
• wp-build: Pass false instead of an empty string as the source in wp_register_script(). (86106)
• Introduce PHPStan level-5 analysis, a dedicated tooling workspace, updated WordPress stubs, and corrected baseline configuration. (66693, 86222, 86109, 86093)
• Load Storybook previews from a Blueprint bundle. (85946)
• Update Storybook to 10.6.5 and @storybook/icons to 2.2.0, including Vitest addon fixes. (86172, 85741)
• Update Vite to 8.3.5 and Vitest to 5.0.5. (85739, 86173)
• Streamline CI with lighter runners, scoped changelog checks, updated baseline tooling, and fresher reads of unfinished-job status. (85907, 85459, 85076, 85077)
• Warn when a bugbug A bug is an error or unexpected result. Performance improvements, code optimization, and are considered enhancements, not defects. After feature freeze, only bugs are dealt with, with regressions (adverse changes from the previous version) being the highest priority. fix’s new end-to-end test also passes on trunk. (85717)
• Migrate the build pipeline from esbuild to Rolldown. (85476)
• Remove the legacy Storybook manifest shim and type-check manifest post-processing scripts. (85778, 85769)
• Declare @wordpress/theme as a peer dependency of @wordpress/theme-build-tools. (85388)
• Update Terrazzo token-generation tools to 2.10.0. (85737)
• Remove redundant tsconfig.test.json files from split packages. (85516)
• Derive wp-build CSS-module class names from each stylesheet’s CSS. (85900)
• Improve ESLint component recommendations with migration-guide links, getWpCompatOverlaySlot guidance, and per-import exceptions. (85752, 85835, 85188)

Repository and Release Management

• Update PHPStan tooling ownership rules. (86204, 86112)
• Move backportbackport A port is when code from one branch (or trunk) is merged into another branch or trunk. Some changes in WordPress point releases are the result of backporting code from trunk to the release branch. changelog entries into the appropriate WordPress 7.2 and 7.3 directories. (85064, 85418)
• Configure the props bot’s introduction through the action input. (83917)
• Require a hash-prefixed issue number or full issue URL when assigning fixed issues. (86130)
• Correct the .gitignore comment about re-included .cache paths. (85375)

First-time contributors

The following PRs were merged by first-time contributors:

• @justlevine: Add PHPStan static analysis at rule level 5. (66693)
• @lucatume: iOS tests: De-flake the selection handle test. (85461)
• @mattmiklic: Theme: Update Figma border import documentation. (85304)
• @RajkiranBagal: DataViews: Use a page number input in the footer pagination above 100 pages. (85303)
• @theritiktiwari: Fix typo in .gitignore comment about re-included .cache paths. (85375)

Contributors

The following contributors merged PRs in this release:

@00kaku @aaronrobertshaw @adamsilverstein @adamwoodnz @aduth @amitraj2203 @andrewserong @ciampo @CookieDarb @DAreRodz @desrosj @DevinWalker @dmsnell @draganescu @drewmt @ekamran @ellatrix @fushar @hbhalodia @himanshupathak95 @huubl @huzaifaalmesbah @im3dabasia @jasmussen @jeryj @jorgefilipecosta @jsnajdr @justlevine @karthikeya-io @kushagra-goyal-14 @lazerg @louwie17 @lucatume @luisherranz @Mamaduka @manzoorwanijk @mattmiklic @mcsf @mikachan @mirka @noruzzamans @ntsekouras @oandregal @peterwilsoncc @R1shabh-Gupta @RajkiranBagal @ramonjd @retrofox @SainathPoojary @salvatorecorsi @sarthaknagoshe2002 @shail-mehta @simison @singhakanshu00 @sirreal @Soean @stokesman @t-hamano @tellthemachines @theaminulai @theritiktiwari @USERSATOSHI @westonruter @yashjawale @youknowriad

Kudos to all the contributors that helped with the release! 👏

Mētis is a theme for creators in an unmapped moment: people who work in more than one form and keep finding their way as the work changes.

It began as our first direction for the next default theme. As we shared when we introduced Ipsum, Mētis continues on its own, and at @matt’s request it’s now our flagship theme. A default has to work for every site; a flagship can go further and show what the Editor can do today.

How We came to It

The theme is named after an ancient Greek word for cunning intelligence: reading a situation as it shifts and finding a way through with whatever is at hand. It is the adjective Homer uses to describe Odysseus in the “mother of all stories,” which inspired this project.

We started from that idea and from the people it describes: writers, designers, and makers whose work keeps changing shape, who hold many things at once and keep going without a complete map. We built the theme in the Site Editor, with real content from the start.

What’s Inside

Templates

Six starter sites, each one a page template and a page pattern you can drop into a new page:

• Business: the studio page, with services, the team, a testimonial, and pricing.
• News: the paper front page, with a featured story, the latest news, and the archive.
• Magazine: the magazine’s current issue, a filterFilter Filters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output. by categoryCategory The ‘category’ taxonomy lets you group posts / content together that share a common bond. Categories are pre-defined and broad ranging., and the people who make it.
• Portfolio: The designer’s profile, selected work, awards, experience, and a playlist.
• Writer: The writer’s home, with a portrait, her new book and its reviews, then writings, books, and talks.
• Personal: The developer’s portrait, selected builds and her latest posts.

Around them sit the everyday templates. Single posts come in three layouts. Pages can show their title or hide it. Three headers and five footers put diversity into practice as templates change with a single swap.

Patterns

Mētis ships with fifty section patterns, grouped by category and named after their description to welcome users and AI agents. And with a few blockBlock Block is the abstract term used to describe units of markup that, composed together, form the content or layout of a webpage using the WordPress editor. The idea combines concepts of what in the past may have achieved with shortcodes, custom HTML, and embed discovery into a single consistent API and user experience. styles to carry on the theme’s character.

Style variations

Six style variations change the type and color of the whole site at once. One is a dark version of the default, and visitors can switch to its colors through some headers and the navigation overlay. Each palette also pairs a day and a night duo to rule the sections with gradients, changing automatically when the visitor’s device switches to dark mode.

Behind all of them, nine open-source type families are bundled with the theme: old-style and blackletter-inspired serifs, geometric and grotesque sans serifs, and a monospace.

Development

As part of the 7.2 release, Carolina Nymark (@poena), Maggie Cabrera (@onemaggie), and Juanfra Aldasoro (@juanfra) are leading development, while Henrique Iamarino (@iamarinoh) is leading design and theme building. The current build reflects the design work; the formal development review comes next, folding in what we hear from you along the way—we look forward to your involvement throughout the process.

Learn more

For information about previous default themes, read the following posts:

• Ipsum
• Twenty Twenty-Five
• Twenty Twenty-Four
• Twenty Twenty-Three
• Twenty Twenty-Two
• Twenty Twenty-One
• Twenty Twenty

Here are a few resources if you’re interested in learning more about Block Themes and the Site Editor:

• Block Theme documentation
• Global Styles & theme.json documentation
• A Developers Guide to Block Themes
• Develop Your First Low-Code Block Theme

+make.wordpress.org/themes/#7-2, #bundled-theme, #core-themes, #ipsum, #metis

Update 2026-11-13: Corrected the betaBeta A pre-release of software that is given out to a large group of users to trial under real conditions. Beta versions have gone through alpha testing in-house and are generally fairly close in look, feel and function to the final product; however, design changes often occur as part of the process. migrationMigration Moving the code, database and media files for a website site from one server to another. Most typically done when changing hosting companies. steps for installs with more than one networknetwork (versus site, blog): each network’s root key has to be re-encrypted, not only the current network’s.

WordPress 7.2 adds the Secrets APIAPI An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways., which stores credentials such as API keys and OAuth client secrets encrypted, with one previous version kept for rotation. The original design is in the proposal and the history is on TracTrac An open source project by Edgewall Software that serves as a bug tracker and project management tool for WordPress. #66187.

If you tested an earlier WordPress 7.2 beta or created a secrets.php drop-in, review the breaking changes since Beta 1 and beta migration instructions before upgrading.

Storing and reading a secret

$result = wp_set_secret( 'my-plugin/api-key', $api_key );

if ( is_wp_error( $result ) ) {
	// Nothing was stored. Keep the existing storage.
}

$secret = wp_get_secret( 'my-plugin/api-key' );

if ( $secret instanceof WP_Secret ) {
	$client->authenticate( $secret->reveal() );
} elseif ( null === $secret ) {
	// Never stored. Ask the user for it.
} else {
	// WP_Error: it exists but can't be read right now. Don't ask for a new one.
}

wp_get_secret() returns null only when the secret was never stored. When it exists but can’t be read, because the key or the database is unavailable, it returns a WP_Error. Keep the two apart: asking for a new credential on an error can replace one that still works.

Names take the form plugin-slug/secret-name, in lowercase letters, digits, hyphens and underscores. A name without a slash works but triggers _doing_it_wrong(). The prefix stops plugins from overwriting each other’s secrets. It isn’t access control, since any code running on the site can read any secret.

A name also cannot start or end with a hyphen or an underscore and only one slash is allowed.

WP_Secret shows [secret:my-plugin/api-key] when it is printed, logged, JSONJSON JSON, or JavaScript Object Notation, is a minimal, readable format for structuring data. It is used primarily to transmit data between a server and web application, as an alternative to XML.-encoded, or passed to var_dump() or var_export(). Serializing or cloning it throws an exception. Only reveal() returns the value, so call it where you use the value, and don’t cache the object.

Writing a new value moves the current one to WP_Secret_Version::PREVIOUS, so you can fall back to it while a rotated credential rolls out. Saving the same value again, as a settings form does, keeps the previous version. wp_retire_secret_version() deletes it when you’re done.

The other functions:

• wp_delete_secret().
• wp_list_secrets() returns names and metadata, never values.
• wp_import_option_as_secret() copies an existing option into a secret. It leaves the option for you to delete and flags the secret for rotation, since the old value has already been through your backups.
• wp_set_network_secret() and the other *_network_secret() functions store secrets for a whole network on multisitemultisite Used to describe a WordPress installation with a network of multiple blogs, grouped by sites. This installation type has shared users tables, and creates separate database tables for each blog (wp_posts becomes wp_0_posts). See also network, blog, site. The site and network functions never fall back to each other.

The functions don’t check capabilitiescapability A capability is permission to perform one or more types of task. Checking if a user has a capability is performed by the current_user_can function. Each user of a WordPress site might have some permissions but not others, depending on their role. For example, users who have the Author role usually have permission to edit their own posts (the “edit_posts” capability), but not permission to edit other users’ posts (the “edit_others_posts” capability)., because they have to work from cron and REST. Check them wherever a user enters or manages a value. The wp_secret_changed action fires when a secret is created, updated, imported, deleted, or retired. It passes fingerprints, never values.

Checking that the API is available

The API needs WP_SECRETS_KEY, covered in the next section. Before moving an existing credential into it, check:

if ( wp_is_secrets_api_available() ) {
	// Move the credential.
} else {
	// Keep the existing storage.
}

This returns false in three cases:

• the secrets.php drop-in failed to load;
• WP_SECRETS_KEY is missing or not usable;
• the key can’t decrypt the root key that is already stored, which happens when someone changes the key after secrets are stored.

A keyring or provider from a working drop-in counts as available. If its backend fails on a request, that call returns a WP_Error.

Host-managed secrets

Some hosts provide secrets through a read-only provider, where values are managed in the host’s dashboard or CLICLI Command Line Interface. Terminal (Bash) in Mac, Command Prompt in Windows, or WP-CLI for WordPress. rather than in WordPress. On those sites wp_secrets_provider_is_writable() returns false and wp_set_secret() returns a WP_Error.

if ( ! wp_secrets_provider_is_writable() ) {
	// The host manages this secret. Show a notice instead of an input field.
	return;
}

$result = wp_set_secret( 'my-plugin/api-key', $api_key );

if ( is_wp_error( $result ) ) {
	// Show $result->get_error_message() to the admin.
	// Don't fall back to storing the value in an option.
}

Reads work the same on every provider, so wp_get_secret() needs no special handling.

Setting WP_SECRETS_KEY

Secrets are encrypted with libsodium (XChaCha20-Poly1305) and stored in the options tables. Their keys are derived from a random root key, which is stored encrypted with WP_SECRETS_KEY from wp-config.php.

Without a usable WP_SECRETS_KEY, the API stores nothing, and every write, and every read of a stored secret, returns a secret_key_unavailable error. An empty key, the wp-config-sample.php placeholder, or a value copied from one of the authentication keys or salts doesn’t count.

New installs get a key: the installer fills it in along with the salts. Existing sites need one added. Site Health generates a line to copy into wp-config.php, below the salts:

define( 'WP_SECRETS_KEY', '…a base64-encoded random 32-byte key…' );

You can also make one with php -r 'echo base64_encode( random_bytes( 32 ) ), "\n";'. Hosts and tools that write wp-config.php should add the key when they add the salts. WP-CLIWP-CLI WP-CLI is the Command Line Interface for WordPress, used to do administrative and development tasks in a programmatic way. The project page is http://wp-cli.org/ https://make.wordpress.org/cli/’s wp config create is being updated to do the same.

Don’t treat the key like the salts. Once secrets are stored, changing or removing it makes all of them unreadable until the old value comes back. To replace it, follow the steps in the last section.

Replacing the keyring, store or provider

A host can replace part of the API with a wp-content/secrets.php drop-in, which loads like db.php:

• WP_Secrets_Keyring: keep the key that encrypts the root key in a KMS or HSM.
• WP_Secrets_Store: keep the encrypted records outside the options tables.
• WP_Secrets_Provider: hand the whole API to an external secret manager.

<?php
// wp-content/secrets.php

class My_Host_Keyring extends WP_Secrets_Keyring {
	public function wrap( #[\SensitiveParameter] string $key_material ) { /* … */ }
	public function unwrap( string $wrapped ) { /* … */ }
	public function get_key_source(): string { return 'My Host KMS'; }
}

$wp_secrets_keyring = new My_Host_Keyring();

The drop-in sets $wp_secrets_keyring, $wp_secrets_store or $wp_secrets_provider. If it fails to load, or sets one to the wrong type, every call returns an error and Site Health reports it. The API never falls back to the defaults, because a misconfigured backend shouldn’t look like an empty one.

PHPPHP The web scripting language in which WordPress is primarily architected. WordPress requires PHP 7.4 or higher doesn’t inherit attributes, so add #[\SensitiveParameter] yourself to any parameter that receives a key or a value. Conformance tests for keyrings and providers are in wordpress-develop under tests/phpunit/includes/secrets/.

Site Health

Three tests appear under Security:

• Secrets API key source is recommended when the key is missing or not usable, and critical when it can’t decrypt the stored root key.
• Secrets API: undecryptable secrets is critical when any stored secret can’t be decrypted.
• Secrets API: credentials pending rotation is recommended when secrets are flagged, as imported ones are.

The Info tab has a Secrets API section with the provider, keyring, key source and the number of secrets.

In code, the tests are methods of WP_Site_Health, and the Info section is WP_Debug_Data::get_wp_secrets_api(), under the key wp-secrets-api (r65394). The wp_secrets_site_health_*() functions and the secrets-api key from the betas are gone.

Breaking changes since Beta 1

The following changes affect developers who tested earlier WordPress 7.2 betas or implemented custom drop-ins.

WP_SECRETS_KEY is required (r65385, r65389). In earlier betas, a site without it used a key derived from LOGGED_IN_KEY and LOGGED_IN_SALT, so rotating the salts made every secret unreadable. That fallback is gone. Secrets stored under it can be kept; see the next section.

The keyring, store and provider are abstract classes (r65390). They were interfaces, and an interface can’t gain a method without breaking every class that implements it. The method signatures are unchanged. Change implements to extends in your drop-in, and deployDeploy Launching code from a local development environment to the production web server, so that it’s available to visitors. it together with 7.2. A drop-in that still says implements is a fatal error on every request, and the API can’t catch it.

Smaller changes during the beta:

• Drop-ins can set the overrides as plain variables, not only through $GLOBALS (r65378).
• secrets.php is listed with the other drop-ins on the Plugins screen and in Site Health (r65374).
• Names with a trailing newline are rejected (r65375).
• A failed database read no longer replaces the root key (r65373).

If you stored secrets during the beta

Secrets stored on a beta without WP_SECRETS_KEY are encrypted under the old fallback. After updating, Site Health reports that they can’t be decrypted. They’re still there. Leave the salts alone until you’ve finished these steps, because the old key comes from them.

1. Generate a key with php -r 'echo base64_encode( random_bytes( 32 ) ), "\n";'. Add it and the old key to wp-config.php, below the salts:
   define( 'WP_SECRETS_KEY', '...your new key...' );
define( 'WP_SECRETS_KEY_PREVIOUS', LOGGED_IN_KEY . LOGGED_IN_SALT );
2. Re-encrypt the root key with the new key: wp eval '$r = ( new WP_Secrets_Key_Manager() )->rotate_site_key( new WP_Secrets_Config_Key_Provider( true ), new WP_Secrets_Config_Key_Provider() ); echo is_wp_error( $r ) ? $r->get_error_message() : "Done.";'
3. Remove the WP_SECRETS_KEY_PREVIOUS line.

No stored secret is rewritten. On multisite, one run covers the current network. An install with more than one network has a root key for each, and each one needs re-encrypting before you remove WP_SECRETS_KEY_PREVIOUS. If you already added WP_SECRETS_KEY, keep it and add only the second line. The same steps replace any key: put the old value in WP_SECRETS_KEY_PREVIOUS.

---

Props to @whyisjake for technical review and @jeffpaul for copy review.

#7-2, #dev-notes, #dev-notes-7-2