WordPress 7.0 added three pieces of AI plumbing: the Connectors API, the AI Client and the Abilities API. This guide is for site owners, bloggers, agency owners and small business teams who will not write code but do need to decide which plugins to install, where to paste an API key and what to check before switching AI features on.
Short version: WordPress core now provides the wiring. It does not provide the AI itself. Everything below is based on the official WordPress release announcement and the core team’s developer notes, listed in the Sources section.
What shipped in WordPress 7.0, and what did not
WordPress 7.0, codenamed “Armstrong”, was announced on May 20, 2026. The announcement says it “lays the foundation for AI across the WordPress experience.” It lists a new AI Client in core, the Abilities API (with a new JavaScript counterpart) and a Connectors screen for managing external connections.
One thing that did not ship: real-time collaboration. In a post dated May 8, 2026, the core team said Matt Mullenweg decided to remove it from 7.0 because he was not confident the current approach was robust enough for core. The team said the feature remains important and that a plan for broader testing would follow. If you read pre-release articles promising simultaneous editing in 7.0, they are out of date.
Later versions exist as well. WordPress 7.1 “Mary Lou” was released on August 19, 2026. Its announcement mentions AI only in passing, in the Abilities API section, which it says gained filterable execution behavior, custom validation and shared discovery. It does not mention the Connectors screen or the AI Client, so this guide treats the 7.0 behavior as the baseline and does not claim anything further changed.
The three building blocks in plain language
Connectors API: the key cabinet
The Connectors API is a framework for registering and managing connections to external services. Its first focus is AI providers. You see it as a new screen at Settings, then Connectors, where each provider appears as a card showing its status and where its key comes from. WordPress 7.0 features three connectors: Anthropic, Google and OpenAI. You can also add your own.
AI Client: the switchboard
The AI Client is a single, provider-agnostic interface that lets plugins send prompts to AI models and get results back. WordPress routes each request to a suitable model from a provider you have configured. Plugins can use it for text, images, speech and video, or structured output. The important point for owners: the core team’s developer note says WordPress core does not bundle any AI providers. The AI Client is the switchboard, not the caller.
Abilities API: the menu of actions
An ability is one specific thing a site can do, such as a plugin action, described in a machine-readable way with defined inputs and outputs. Any plugin or theme can register abilities, and a permission check can decide who may run them. The developer documentation says AI agents can run abilities only within the bounds of WordPress permissions and validation rules. The Abilities API first appeared in WordPress 6.9. Version 7.0 added a JavaScript counterpart with a built-in interface and a command palette, and built the Abilities API into the AI Client so abilities can run one after another in workflows.
Core versus plugins: a quick reference
| Feature | What it does | What you need to use it |
|---|---|---|
| Connectors API and screen | Central place to manage connections and API keys | Built into core; a provider plugin and an account with that provider for AI use |
| AI Client | Lets plugins send prompts to AI models through one interface | Built into core; a configured provider, since core bundles none |
| Abilities API | Registry of actions that plugins, themes and AI tools can discover and run | Built into core; plugins must register abilities for it to be useful |
| Provider plugins | Connect WordPress to Anthropic, Google or OpenAI | Separate plugins, for example AI Provider for OpenAI, plus an API key |
| AI plugin (optional) | Adds image generation and editing, title and excerpt creation, and alt text suggestions | Separate plugin installed by you |
What this means when choosing plugins
Because any provider plugin that registers with the AI Client gets a connector automatically, and AI features in other plugins can share the same connection, you may not need a separate key for every plugin. A plugin built on the AI Client can ask WordPress to do the routing. Before installing an AI plugin, check whether it uses the core AI Client or ships its own connection. The first approach keeps credentials in one place. The second leaves you managing several.
The same logic applies when you review your stack. If you are still deciding which plugins earn a place on your site, our guide to essential WordPress plugins is a useful starting checklist. For one example of an AI writing plugin, see our Jetpack AI content generator article.
Privacy, API keys and cost
Where keys live
For key-based connectors, WordPress checks three places in order: an environment variable, a PHP constant (for example in wp-config.php), then the database, where the Connectors screen saves it. The developer note states that keys stored in the database are not encrypted, only masked in the interface, and that encryption is being explored. If your host supports environment variables, that route keeps keys out of the database.
Keys are site-wide
The same note explains that a configured key is a site setting, so every plugin can access it, and that third-party code you install can reach keys set as environment variables or constants too. Per-plugin scoping is not described. In practice: only connect a provider if you trust every plugin on the site, and remove plugins you no longer use.
Who can send prompts
The AI Client note says the client-side JavaScript API is restricted to a high-privilege capability that only administrators have by default, to prevent untrusted users from sending any prompt to any configured provider. It also describes a filter, wp_ai_client_prevent_prompt, that plugins or site code can use to block specific prompts. It does not describe a single site-wide off switch, so the simplest control is not to install or activate a provider plugin.
Cost and data
The official posts do not give pricing or privacy guidance, so treat these as your own checks. Requests go to the provider you connect, under that provider’s account, terms and billing. Read the provider’s data-handling terms and set any spending limits it offers. The developer note shows that plugins can read token usage from results, and that checking whether a feature is supported makes no API call. A reader comment on that note asks for per-site usage limits and dashboards, and the post itself does not say core provides them. Budget accordingly, and for general site budgeting see our guide to WordPress website costs.
Checklist before turning on AI features
- Back up the site and test on a staging copy first.
- Decide the purpose: titles and excerpts, alt text, images, or something else. Install only the plugin you need.
- Create a dedicated API key for the site, with spending limits where the provider offers them.
- Prefer an environment variable or constant over the database, if your host allows it.
- Open Settings, then Connectors, and confirm which providers are active and where each key comes from.
- Review who has administrator access, and audit installed plugins, since any of them can use a configured key.
- Read the provider’s data and privacy terms, and update your own privacy policy if visitor or customer data could be sent.
- Review every AI-generated title, excerpt or alt text before publishing.
Common mistakes
- Assuming WordPress 7.0 includes a free AI. It includes the client, not a model or an account.
- Pasting one shared key into several unrelated tools, which makes it hard to trace usage or revoke access.
- Leaving unused plugins active while a key is configured.
- Expecting real-time collaboration in 7.0.
Key takeaways
- The Connectors API manages keys, the AI Client routes prompts, and the Abilities API lists what a site can do.
- Core bundles no AI provider. You need a provider plugin and your own account and key.
- Keys saved in the database are masked but not encrypted, and any plugin on the site can use them.
- Prefer plugins that use the core AI Client so credentials stay in one place.
- Real-time collaboration was removed from 7.0. WordPress 7.1 was released on August 19, 2026.
FAQ
Does WordPress 7.0 include AI by default?
It includes the AI Client, the Connectors screen and the Abilities API. It does not bundle any AI providers, so you must install a provider plugin and supply a key before AI features work.
Which providers are supported?
The Connectors screen features Anthropic, Google and OpenAI, with separate provider plugins listed for each. You can add other connections, and any provider plugin that registers with the AI Client gets a connector automatically.
Are my API keys safe?
Database-stored keys are masked in the interface but not encrypted, and any plugin on the site can access a configured key. Environment variables or constants are an alternative, but the same exposure to installed code applies.
Did WordPress 7.1 change any of this?
The 7.1 announcement says the Abilities API gained filterable execution, custom validation and shared discovery. It does not mention changes to the Connectors screen or the AI Client.
