If you manage a WordPress site, the practical question is what the new AI infrastructure changes about the tools you already use.
WordPress 6.9 introduced the Abilities API, and WordPress 7.0 added an AI Client and a Connectors interface. Together, these give developers shared ways to connect AI providers, send requests, and describe actions that software can perform on a site. Furthermore, WordPress 7.1 expanded this foundation with new execution filters and a public flag for abilities.
The distinction between infrastructure and features matters. Connecting an AI provider does not automatically give your site an editing assistant or an agent that can manage your store. Those features depend on the plugins you install, the capabilities they expose, and the permissions you configure.
The Main Components
1. Settings → Connectors
The Connectors screen gives site administrators a central place to configure supported AI connections.
For plugins that use this infrastructure, a shared provider connection can replace separate API key fields in each plugin’s settings. That can make setup and maintenance easier, especially when several tools use the same provider.
When Tenacity built the AI-powered pitch deck analysis tool for BizBlip, WordPress had no shared way to talk to an AI provider. The OpenAI API integration, secure credential storage, and error handling all required custom code.
If built today on WordPress 7.0, the same feature could call the shared AI Client and use a key configured once in Settings → Connectors. Switching the underlying model from OpenAI to Anthropic would no longer mean rewriting the integration—it would just be a simple settings change.
Provider integrations still need to be installed and configured. Adding an OpenAI connection, for example, does not change how an existing plugin works unless that plugin supports the shared interface. However, once keys are entered, every compatible plugin can use that connection. A shared connection is also shared spend, unless someone gates it. The official AI plugin (version 1.4.0) addresses this with a “Connector Approvals” experiment, which requires admin sign-off before a plugin or theme can use a connector.
Credential storage also deserves attention. Unencrypted storage is the default, not the only option. Keys entered through the Connectors screen are stored as database settings. They are masked in the interface but are not encrypted in the database by default. The AI plugin includes a “Key Encryption” experiment that protects stored keys, but disabling the experiment or deactivating the plugin puts them back in plaintext. This temporary protection actually supports the case for a core Secrets API (which is currently pending, with a status update expected around the WordPress 7.2 Beta 1 release in late October). WordPress also supports configuration through environment variables or PHP constants for administrators who want to keep keys out of the database.
The practical benefit is a consistent place to manage supported connections. Treat those credentials with the same care as other service keys used by your site.
2. The WordPress AI Client
The WordPress AI Client provides a common PHP interface for making requests to configured AI providers.
Without a shared client, a plugin developer may need separate integrations for different providers, each with its own request format and response handling. The AI Client handles some of that provider-specific work through a consistent interface.
A basic text request looks like this:
$result = wp_ai_client_prompt(
'Summarize the following article in three sentences.'
)->with_text( $article_content )->generate_text();
if ( is_wp_error( $result ) ) {
// Handle the failed request.
}
Developers still need to decide what information to send, select suitable models, handle failures, and validate the result before using it.
The shared interface can reduce repeated integration work for supported operations. It does not make providers interchangeable in terms of output quality, available features, response time, or cost.
3. The Abilities API
The Abilities API lets developers register specific actions that their code can perform.
An ability includes a name, a description, an execution callback, a permission callback, and schemas that describe the relevant inputs and outputs. This gives other software a structured way to discover and call registered functionality. As of WordPress 7.1, a public flag and execution filters provide finer control over visibility and runtime filtering.
For example, an SEO plugin could register an ability that analyzes a post. A commerce plugin could register an ability that retrieves stock information. Those actions become available only when the plugin implements and exposes them.
Developers register abilities with the wp_register_ability() function during the wp_abilities_api_init action.
Permission checks belong in a callable. For an ability that accepts a post ID, the permission callback might look like this:
'permission_callback' => static function ( $input ) {
return current_user_can(
'edit_post',
(int) $input['post_id']
);
},
Checking access to the specific post is more precise than checking whether a user can edit posts generally. The appropriate check depends on what the ability does and which resources it touches.
4. The Model Context Protocol Adapter
The MCP Adapter is a separate plugin that connects WordPress abilities to clients that support the Model Context Protocol.
It gives compatible external tools a way to discover and invoke exposed abilities. It bridges external agent commands into native REST API endpoints. Depending on the integration, that could allow an assistant in a development environment or desktop application (like Claude Desktop or Cursor) to retrieve information, schedule batch updates, or perform a defined action on a site directly.
The adapter does not automatically make all WordPress functionality available to an agent. Access depends on which abilities are registered, which are exposed, and whether the request passes the relevant authentication and permission checks.
For developers, the useful starting point is a narrow task with a clear result. Retrieving a post’s metadata is easier to review and test than giving an agent a broad instruction to improve a website.
5. AI Features in the Editor
User-facing AI features build on the underlying infrastructure, but their availability depends on the plugin or integration providing them.
Features such as image, excerpt, and alt text generation require the optional WordPress AI plugin. Other integrations may add translation, writing assistance, or layout tools.
Block Editor Only: The AI plugin requires the Block Editor, and there are no plans to support the Classic Editor. If your clients use the Classic Editor or a page builder like Elementor, these features will not be visible or functional.
Cost and Data Privacy: While the AI plugin itself is free, the chosen AI provider bills for API usage. Alternatively, local providers like Ollama are an option for those who want to avoid external API costs. Additionally, keep in mind that securing credentials and deciding what content gets sent to a provider are two distinct issues. You must carefully evaluate the actual site data sent in prompts.
For content teams, evaluate the actual editing task. An excerpt generator should produce an accurate summary in the right length and tone. An alt text tool needs human review for accuracy and context. A convenient interface does not remove that responsibility.
How the Components Work Together
There are two main paths to understand.
When a plugin needs generated content, it can use the AI Client to send a request to a configured provider. The Connectors interface manages the supported provider connection.
When an external agent needs to perform a site action, the MCP Adapter can expose a registered ability. The Abilities API checks the ability’s permission callback before executing it.
These paths can be combined in an application, but they serve different purposes. Generating a summary and updating a published post involve different permissions and failure cases.
You also need to implement a permission callback correctly. Registering an ability does not, by itself, establish that the action is appropriate for a particular user or safe for a particular workflow.
Where Core Still Falls Short: Governance and Visibility
While WordPress 7.1 and the official AI plugin introduce significant foundational improvements, managing the exact capabilities exposed to AI agents still presents governance challenges. The AI plugin’s Abilities Explorer shows you what’s registered on your site and allows you to test them. However, it lacks granular control—its built-in toggle is an all-or-nothing switch for its own abilities.
This is where targeted governance tools become necessary. Abilities Audit, a development plugin we built here at Tenacity, lets you switch individual abilities off without touching code. By leveraging the new filters in 7.1, it allows site administrators to completely disable specific actions on a per-ability basis and hide them from MCP client discovery.
| Capability | Core (7.1) | AI Plugin (1.4.0) | Abilities Audit (Tenacity) |
|---|---|---|---|
| List registered abilities | Code only (wp_get_abilities()) | Yes (Abilities Explorer) | Yes, filterable by origin (core, theme, plugin) |
| Test an ability from an admin screen | No | Yes (Abilities Explorer) | No (Relies on Explorer for testing) |
| Turn off one ability without code | No (Code only via wp_pre_execute_ability) | No (Custom Abilities toggle is all-or-nothing) | Yes (Granular per-ability toggles) |
| Control exposure to REST and MCP | Code only (meta.public, show_in_rest) | No | Yes (UI toggle for meta.public flag) |
| Require approval before a plugin uses a connector | No | Yes (Connector Approvals) | No (Relies on AI plugin’s approvals) |
| Log AI requests | No | Yes (AI Request Logging) | No (Focuses exclusively on ability execution audit trails) |
WordPress AI Adoption
When evaluating whether to adopt the new core AI features, it is helpful to look at actual usage data. However, we must keep three adoption layers separate: active plugin installs, publicly detectable integrations, and actual server-side usage.
Active Install Counts
Here’s where the core pieces stood in the WordPress.org plugin directory in late October:
| Component | What It Does | Active Installs |
|---|---|---|
| AI Provider for Anthropic | Anthropic connector | 60,000+ |
| AI Provider for OpenAI | OpenAI connector | 60,000+ |
| AI (official AI plugin) | AI features and experiments | 60,000+ |
| AI Provider for Google | Google connector | 50,000+ |
| MCP Adapter | Exposes abilities to MCP clients | 50,000+ |
MCP Adapter only landed in the directory in October after a long beta, so that 50,000+ is mostly existing users moving over, not a month of new growth.
Caveat: These figures are rounded bands and should not be summed together, as a single site may run the AI plugin alongside multiple providers. Furthermore, the global share of sites running WordPress 7.x currently sits at 72.6%.
The Wider AI Plugin Ecosystem
Beyond core, the WordPress Plugin Directory has nearly 2,500 plugins built primarily around AI. Most of them barely register: nearly three-quarters have fewer than 10 active installs, and fewer than 50 have reached 1,000. That count leaves out established plugins that have added AI features, like Elementor or All in One SEO.
The most installed AI plugins tend to do one thing:
| Plugin | What It Does | Active Installs |
|---|---|---|
| LocoAI | Translation add-on for Loco Translate | 70,000+ |
| Website LLMs.txt | llms.txt generation | 50,000+ |
| Alt Text AI | Image alt text | 20,000+ |
| Hyve Lite | Chatbot trained on site content | 7,000+ |
| AIKO Developer Lite | Developer tooling | 6,000+ |
| Chatbase | Hosted chatbot | 5,000+ |
| Jotform AI Chatbot | Hosted chatbot | 5,000+ |
| WPBot | Chatbot | 5,000+ |
| LLMs.txt and LLMs-Full.txt Generator | llms.txt generation | 5,000+ |
| Auto Alt Text | Image alt text | 4,000+ |
Alt text, chatbots, and llms.txt files dominate the list. The two biggest general-purpose AI plugins, Angie and AI Engine, also run MCP servers, so they appear in the MCP table below.
Connectors
| Plugin | Active Installs |
|---|---|
| AI Agent by SiteGround* | 1,000,000+ |
| AI Provider for Anthropic | 60,000+ |
| AI Provider for OpenAI | 60,000+ |
| AI Provider for Google | 50,000+ |
Outside the three official providers, connectors fall off a cliff.. The next most popular (OpenRouter, DeepSeek, and Ollama) report 300 to 400 installs each.
* SiteGround pushed this plugin onto its customers’ sites rather than letting site owners opt in, and its 1.7-star rating reflects the backlash. It’s an AI agent that registers SiteGround’s own AI service as a connector, not a standalone provider plugin.
MCP Plugins
| Plugin | Type | Active Installs |
|---|---|---|
| Angie (Elementor) | Agent with MCP server | 100,000+ |
| AI Engine | Chatbot and AI framework with MCP server | 90,000+ |
| WPVibe (SeedProd) | MCP server | 80,000+ |
| MCP Adapter (WordPress.org) | Official adapter for abilities | 50,000+ |
| Easy MCP AI (Themeisle) | MCP server | 20,000+ |
| AI Puffer | Chatbot with MCP server | 10,000+ |
| Royal MCP | MCP server | 10,000+ |
| Secure MCP Server (miniOrange) | MCP server | 6,000+ |
| Enable Abilities for MCP | Abilities enabler for MCP | 5,000+ |
MCP Adapter is the official route for exposing a site’s abilities to agents. Most of the others run their own MCP server, either as their whole purpose or alongside an agent or chatbot.
Publicly Detectable Integrations
Install counts tell you what’s been downloaded, not what’s running on real sites. To see what actually shows up, we analyzed the top 10,000 sites in CrUX history data and identified 793 WordPress websites. High-traffic WordPress leans heavily toward media, streaming, and adult sites, so this isn’t a picture of the typical business site.
The first thing we ran into was visibility. About 40% of those sites block or hide their REST index, so we can’t see what they run. The numbers below are based on what we could see.
| What We Found | Sites | Share |
|---|---|---|
| Abilities API | 397 | 82% of visible sites |
| MCP Adapter | 127 | 26% of visible sites |
| Another MCP route | 37 | 8% of visible sites |
| OAuth metadata for MCP | 75 | 59% of MCP Adapter sites |
| AI Engine | 4 | Under 1% |
| Official AI plugin | 0 | 0% |
| AI provider plugin | 1 | Under 1% |
| Names AI crawlers in robots.txt | 153 | 19% |
The Abilities API showing up on most sites isn’t AI adoption. It has been in core since 6.9, so it mostly tells you a site is up to date.
MCP Is The Surprise
About a quarter of the top WordPress sites we could see expose MCP Adapter’s default server, and most of those also publish the OAuth metadata that MCP clients use to authenticate. Meanwhile, the official AI plugin didn’t show up on a single site.
Connectors Are Almost Nowhere
Provider plugins leave very little public footprint, so the only way to spot them from outside is the plugin’s file fingerprint, which gave us a clear answer on about 60% of sites. We found exactly one provider plugin (OpenAI, paired with Angie). Add the missing AI plugin and only four sites running AI Engine, and it’s clear that tools letting a site call an AI model itself haven’t caught on with top sites.
It might seem like a contradiction, but it’s not. MCP lets an outside agent like Claude or ChatGPT work on your site using its own model. A connector only matters when your site needs to call a model itself. So, you can have one without the other. For a high traffic website, we think this setup makes sense, it would be interesting to analyze a denser cohort that matches WordPress usage more closely.
About one in five sites also names AI crawlers like GPTBot or ClaudeBot in robots.txt. That’s a deliberate decision about AI access, though naming a crawler can mean letting it in as well as keeping it out.
One thing we want to say clearly, a public scan cannot see server-side AI Client calls or editor-only features (such as excerpt or alt text generation). Actual AI use is inherently higher than anything we can detect from the outside.
Site data collected with Ardea, Tenacity’s website research & analysis tool.
What to Evaluate in Practice
Where the Shared Infrastructure Helps
Shared connections and request interfaces let developers reduce repeated setup and integration work.
A plugin that uses the AI Client can work with supported, configured providers through a common interface. A plugin that registers abilities can make specific functions available to compatible automation tools without designing a separate discovery format.
For site administrators, the benefit depends on adoption. Check whether your installed plugins support the shared infrastructure before consolidating their settings.
Where Application Work Remains
Developers still need to handle provider failures, timeouts, usage costs, and unsuitable output.
Cost Limits: The AI plugin currently offers an “AI Request Logging” experiment that correctly records provider errors. However, there is no built-in budget or token cap. The real gap for site owners is in spending limits rather than just visibility.
Browser streaming is another detail to verify against the specific client and version being used. A PHP request interface does not automatically provide the browser transport and editor behavior an application needs.
Agent workflows require further decisions: which tools can run, which actions require review, how results are checked, and what happens when a task fails partway through.
Potential Benefits and Concerns
The infrastructure addresses some recurring integration problems, but its usefulness depends on the site and the work involved.
| User Group | Perspective | Reasons for Support or Concern |
|---|---|---|
| Developers & Agencies | Positive about the infrastructure, cautious about implementation | Shared connections and a common request interface can reduce repeated integration work. The practical benefit depends on provider support, plugin compatibility, and how much application logic developers still need to build. |
| E-Commerce & Enterprise | Interested, with operational reservations | Registered abilities could support tasks such as retrieving inventory information or preparing product content. Actions that change stock, pricing, or customer communications require tighter permissions, testing, and review. |
| Traditional Site Builders & Freelancers | Skeptical about necessity and content quality | For a small client site, AI tools may add setup, cost, and maintenance without solving a recurring problem. Concerns include low-quality generated content and the scope of access granted to agents. |
These perspectives lead back to the same practical question: does a particular integration improve the work someone needs to do? A development agency may value a shared provider interface, while a small business owner needs to see whether the resulting feature saves time after setup and review.
An AI feature should earn its place through a useful result. Its availability alone is not a reason to add it to a client site.
What to Do Next: The Responsible AI Checklist
WordPress now provides more shared infrastructure for AI integrations, but whether it improves your site depends on the tools built on top of it and the governance you put in place. To help you navigate this transition safely, we’ve compiled the WordPress Responsible AI Checklist.
DOWNLOAD THE WORDPRESS RESPONSIBLE AI CHECKLIST
Key storage is one of 26 checks in our Responsible AI for WordPress checklist, which also covers ownership, spending, backups and revisions, testing, and AI agents.
Need Expert Guidance?
If you are looking to modernize your WordPress infrastructure or need help running an AI Readiness Review for your platform, reach out to the professionals at Tenacity. Explore our web development services to ensure your site is secure, highly optimized, and ready to leverage the future of WordPress.
FAQs
No. WordPress 7.0 and 7.1 introduce developer infrastructure—specifically the Connectors settings screen, the WP_AI_Client PHP abstraction layer, and the Abilities API. To use generative tools like automated excerpts or alt-text creation, you must install an AI-enabled plugin such as the official WordPress AI plugin.
By default, keys entered directly into the admin interface are masked in the UI but stored as plaintext database options. While the official AI plugin includes an experimental key-encryption toggle, deactivating the plugin reverts keys to plaintext. Site owners requiring stronger security should define keys in server environment variables or PHP constants in wp-config.php.
The AI Client handles outbound requests, giving WordPress plugins a single, standardized PHP interface to prompt external models like OpenAI, Anthropic, or Google. The Model Context Protocol (MCP) Adapter handles inbound requests, allowing external AI clients (like Claude Desktop or Cursor) to authenticate, read site data, and execute registered site abilities.
No. The official WordPress AI plugin requires the Block Editor (Gutenberg). The project FAQ states there are no plans to support the Classic Editor, and users running page builders like Elementor cannot access native block AI generation tools.
Because any compatible plugin can share a central connector key, usage costs can escalate quickly. Administrators should use the “Connector Approvals” feature in the official AI plugin to require manual sign-off before a plugin can access a provider, and set hard usage quotas directly within the provider’s account dashboard.
Not within core or the official AI plugin alone. The AI plugin includes an Abilities Explorer to browse and test abilities, but its toggle is an all-or-nothing switch for the plugin’s own tools. Disabling specific core or third-party abilities without code requires a dedicated governance tool like Tenacity’s Abilities Audit, which leverages 7.1 filters to deactivate specific routines and hide them from MCP clients.
Sources:
- WordPress AI Infrastructure: Connectors, MCP & Abilities API | Crocoblock Developer Hub
- Abilities API | Make WordPress AI Blog
- AI for WordPress changes | Reddit (r/Wordpress)
- Boost your conversions with AI-powered marketing | WooCommerce
- AI Content Generator for WooCommerce | WordPress Plugin Repository
- Settings Connectors Screen Documentation | WordPress Official Documentation
- WordPress 7.0 Ships with AI Foundations in Core | InfoQ Technical News