Free tools Windows power users keep installed
One-click scans. No signup required.
WordPress already has a REST API and, as of WordPress 7.0, a provider-agnostic AI Client for PHP. The priority is not to stop building AI features; it is to make WordPress capabilities discoverable, permissioned and safely reusable before adding more AI on top. That gives developers a stronger foundation for useful integrations without treating an AI model as a substitute for a well-designed interface.
What “APIs before more AI” means
An API is a defined way for software to request or change information in another system. WordPress’s REST API uses standard HTTP methods and JSON to expose resources such as posts, pages, comments, media, taxonomies and settings. It supports the Block Editor as well as separate applications, interactive front ends and alternative administrative experiences. WordPress’s REST API overview explains that role; the REST API Handbook reference documents the available resources.
In this context, putting APIs first means ensuring that a capability has a clear interface, can be discovered by software, and enforces the right permissions before an AI feature is layered onto it. It is a sequencing argument, not a claim that APIs alone make AI safe or that WordPress has no AI infrastructure.
Why WordPress APIs are the foundation
Each site has its own API surface
The REST API is distributed: every supporting WordPress site has its own API root. Software can inspect the API index, and an OPTIONS request can describe routes and their capabilities. This discoverability is preferable to relying on undocumented assumptions or a one-off integration that each client must learn separately. The precise routes available can vary by site and installed extensions, so an integration should discover and handle the interface it actually encounters rather than assume every site exposes an identical set of features. The REST API Handbook reference describes the index and route discovery.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Access can be separated by resource and action
Public content is generally available anonymously, but private or sensitive resources and actions require authentication and appropriate permissions. That distinction matters for AI: a feature that summarizes public posts has different access needs from one that edits a draft, reads private content or changes site settings. An API endpoint can enforce the authorization appropriate to that particular action rather than granting a model or client broad access by default. The REST API Handbook reference and WordPress Core’s AI Client guidance cover API access and permission checks.
What WordPress 7.0 adds—and what it does not
WordPress 7.0 includes a provider-agnostic PHP AI Client, giving plugin developers a consistent interface for making model requests. Provider implementations are separate: the Core client does not itself supply model access credentials, and it does not mean every provider is bundled with WordPress. A common interface can reduce the need for each plugin to build its own provider-specific connection, but it does not remove the need to configure a provider or decide which information a feature may send. The WordPress 7.0 announcement describes the client and its boundaries.
Rank #2
- Book - 1, 000 books to read before you die: a life-changing list (1000 before you die)
- Language: english
- Binding: hardcover
The same guidance makes a distinction between server-side PHP use and JavaScript-driven features. For client-side AI features, it recommends a separate REST endpoint for each feature, granular permission checks, and handling prompts and configuration on the server. The JavaScript package is separately available and is still being evaluated for general use; its existence should not be read as a recommendation to expose unrestricted model access to browser code. The official AI Client guidance details this approach.
Why feature-specific endpoints matter for AI
A browser-facing feature should ask the site to perform a defined task—such as drafting a summary of an authorized post—not send an arbitrary prompt that can invoke whatever model behavior the client chooses. The server can validate the request, check the user’s permission for that feature, apply configuration, and decide what content may be included. This creates a narrower boundary between the site and the AI provider than a general-purpose prompt endpoint would.
- Discoverability: The REST API index and OPTIONS requests can describe routes and capabilities; bespoke or undocumented integrations leave clients with less to inspect. REST API reference.
- Permission scope: Feature-specific endpoints can make granular checks; broad arbitrary-prompt access is harder to constrain to one intended task. WordPress Core guidance.
- Execution boundary: Server-side prompt handling and configuration keep control with the site rather than exposing prompt execution in client-side code. WordPress Core guidance.
- Provider coupling: The provider-agnostic PHP client offers a shared interface, while provider implementations remain separate. WordPress Core guidance.
These are architectural trade-offs, not measured performance claims. The official material cited here does not establish a benchmark ranking, adoption level or quantified cost difference between these approaches.
What is planned next in WordPress AI
The September 18, 2026 roadmap to WordPress 7.2 describes further work as being pursued in the AI plugin, without guaranteeing that it will ship in 7.2. The listed areas include expanding abilities, updating the MCP Adapter and standardizing its plugin distribution. They are roadmap work, not functionality that should be assumed to be included in Core or available in a released version. The WordPress 7.2 roadmap says: “The 7.1 cycle gave clear guidance that AI features must first demonstrate clear adoption and practical value before being considered for Core.” This is a statement from the Core Development Team roadmap, not a quote attributed to an individual.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to judge a proposed WordPress AI feature
For a site owner, plugin author or developer, the useful question is not simply whether a feature uses AI. Ask whether the underlying capability has a clear, controlled interface first:
- Can an integration discover the relevant route and understand what it accepts?
- Does the endpoint check the user’s permission for this specific task and data?
- Are prompts, provider configuration and sensitive content handled on the server rather than exposed to arbitrary client-side execution?
- Does the feature use the shared AI Client where appropriate while keeping provider setup explicit?
- Is the capability already shipped and documented, or is it experimental plugin work or a forward-looking roadmap item?
A feature that answers these questions well is easier to reuse across interfaces and easier for a site to govern. Adding a model call without those foundations may create a demo, but it does not by itself create a dependable WordPress capability.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
