WordPress 7.0's AI Features, Explained for Agencies

WordPress 7.0 shipped seven weeks ago and most of the coverage went to the admin redesign. The part that actually matters for agencies is quieter: core now ships a standard way to connect a WordPress site to an AI model — Anthropic, OpenAI, Google, or your own self-hosted inference — without every plugin rolling its own API integration and asking the client for a separate key.

If you've ever had three different plugins each wanting their own OpenAI key from a client who doesn't have one, this is the fix. Whether it's a good idea to enable is a separate question, and it depends on what you're connecting and who has access to the bill.

TL;DR

• What shipped: AI Client (core integration layer), Abilities API (structured, permissioned actions AI can take), and a Connectors Hub where you authenticate a model provider once.
• Providers supported: Anthropic, OpenAI, Google, Vercel AI Gateway, and self-hosted models.
• Also in 7.0: a global Command Palette (Cmd/Ctrl+K), content-only pattern editing, a revisions panel for templates and patterns, and a site-wide font library.
• Technical requirement: PHP minimum rises to 7.4 (from 5.6).
• Released: May 20, 2026, with 900+ contributors.
• The catch: the Connectors Hub is a new credential-storage surface, and it's already being flagged as an attractive target. Treat API keys stored there like database credentials, not like a theme setting.

What the AI Client and Abilities API actually do

Before 7.0, "AI in WordPress" meant a plugin shipping its own bespoke integration: its own settings page, its own API key field, its own rate limiting (or lack of it), its own error handling. Every plugin reinvented the same wiring, and every client ended up with API keys scattered across plugin settings pages with no central view of what was connected to what.

The AI Client standardizes that wiring at the core level: authentication, rate limiting, content sanitization, and context management live in one place instead of being duplicated per plugin. The Abilities API sits on top of it and defines specific, permissioned actions a plugin can ask an AI model to perform — generating an image, writing an excerpt, tagging content — rather than giving a model unrestricted access to your site. That distinction matters: an "ability" is a scoped, auditable action, not a blank check.

Practically, this means a plugin built against the Abilities API can request "generate alt text for this image" and nothing more — it doesn't get a general-purpose door into your database. Compare that to earlier third-party AI plugins that often requested broad REST API access because there was no standard scoped-permission model to build against.

The Connectors Hub: one key, many plugins

This is the part with the most immediate practical value for agencies. The Connectors Hub is a dedicated admin screen for authenticating an AI provider — Anthropic, OpenAI, Google, Vercel AI Gateway, or a self-hosted model endpoint — once per site. Any plugin written against the AI Client can then request access to that existing connection instead of demanding its own key.

For a client who's nervous about "the AI stuff," self-hosted is the honest answer if data residency or model-training opt-out is the actual concern — it keeps inference off third-party infrastructure entirely, at the cost of you managing the model yourself.

What ships alongside it

The AI infrastructure gets the headlines, but 7.0 also shipped a handful of admin-quality-of-life changes worth knowing about before a client asks:

• Command Palette — global search-and-action launcher, Cmd/Ctrl+K, works across posts, settings, and plugin screens.
• Content-only pattern editing — lets an editor change copy and images inside a pattern without being able to break the underlying structural design. Useful if you build client sites on reusable patterns and want to stop clients from accidentally wrecking layout.
• Revisions panel for templates and patterns — previously revisions only tracked post content; now template and pattern edits are recoverable too.
• Site-wide font library — fonts registered once are available across all themes on the site, not scoped per-theme.
• @wordpress/grid package — a standardized grid-layout primitive for block developers, reducing the custom CSS grid hacks block themes have relied on.

None of these require any configuration to benefit from — they're just available once you update.

The security conversation to have with clients

Every new credential-storage surface is a new target, and a WordPress core feature that centralizes API keys for AI providers is a genuinely attractive one — Patchstack's founder has already publicly flagged this, and it's the correct instinct. A leaked Anthropic or OpenAI key isn't just a WordPress problem; it's a billing problem, since usage-based API pricing means a compromised key can run up real charges before anyone notices.

Before you enable any Connectors Hub integration on a client site:

1. Scope the API key on the provider's side to the minimum permissions and, where the provider supports it, the minimum spend cap. Don't reuse a key that has access to other projects.
2. Set a billing alert on the provider account, not just a WordPress-side setting. If the WordPress site is compromised, you want to know from the bill, not from the client's surprised phone call.
3. Treat the Connectors Hub credential the same as a database password in your documentation and handoff — it goes in the password manager, not a shared doc.
4. Audit which plugins have requested access to the connection periodically, the same way you'd audit REST API application passwords.

Our WordPress security hardening checklist covers the general credential-hygiene practices this extends; the Connectors Hub is just a new place those practices apply.

Should you turn it on for a client?

Depends on the client. A content-heavy blog client who wants faster alt-text generation and excerpt drafting is a low-risk, clear-value case — connect a provider, let the built-in AI plugin (available for images, titles, excerpts, and alt text) handle the boring parts of publishing. A client in a regulated industry, or one who's explicitly nervous about AI touching customer data, is a case where the honest answer is "not yet, or self-hosted only."

Either way, the decision is now something you can make deliberately per client rather than something that arrives bundled invisibly inside a random plugin update — which is the actual improvement 7.0 delivers here, more than any specific AI capability.

If you're evaluating hosting for a client who wants to run this stack, make sure the PHP minimum (7.4, up from 5.6) is covered — our WordPress hosting speed test and best managed WordPress hosting roundups both note which hosts default to modern PHP versions out of the box.

WordPress 7.0's AI features are infrastructure, not a mandate. Update, leave it dormant if you're not ready, and when a client does want it, you now have a single, auditable place to turn it on instead of a plugin quietly wiring in its own AI integration behind your back.