This proposes merging the WP AI Client into WordPress Core Core is the set of software required to run WordPress. The Core Development Team builds WordPress. for WordPress 7.0.
WP AI Client is developer infrastructure: a provider-agnostic API An API or Application Programming Interface is a software intermediary that allows programs to interact with each other and share data in limited, clearly defined ways. for WordPress code to call generative AI models via a consistent interface, with WordPress integrations for HTTP HTTP is an acronym for Hyper Text Transfer Protocol. HTTP is the underlying protocol used by the World Wide Web and this protocol defines how messages are formatted and transmitted, and what actions Web servers and browsers should take in response to various commands. transport, event handling, caching, credentials, and a browser-friendly REST/JS JavaScript, a web scripting language typically executed in the browser. Often used for advanced user interfaces and behaviors. layer.
Providing this foundation, in collaboration with the Abilities API that is already part of Core, will make WordPress ready for AI, both as a consumer and as a tool.
This merge does not ship any AI providers or automatically enable AI calls. Without explicit configuration and explicit calling code, WordPress will not send prompts or data to any external service. Site owners will be able to install plugins to enable usage of specific AI providers, built on top of this foundation.
Purpose & Goals
Goals
- Provide a stable, provider-agnostic AI client foundation in Core, with seamless integration with the Abilities API
- Reduce duplicated SDKs/settings pages by centralizing common infrastructure (transport, auth storage, prompt invocation, access controls).
- Enable plugins to detect availability and gracefully disable AI features when no model is configured.
Non-goals
- No bundled credentials or providers.
- No end-user “AI assistant” UI User interface in core.
- No product-level experiences standardized in this merge (those remain plugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory https://wordpress.org/plugins/ or can be cost-based plugin from a third-party/ecosystem territory for now, e.g. AI Experiments plugin).
Proposed Scope
- PHP The web scripting language in which WordPress is primarily architected. WordPress requires PHP 7.4 or higher API + Prompt Builder – A WordPress-friendly API to construct prompts and invoke model capabilities A capability is permission to perform one or more types of task. Checking if a user has a capability is performed by the
current_user_can function. Each user of a WordPress site might have some permissions but not others, depending on their role. For example, users who have the Author role usually have permission to edit their own posts (the “edit_posts” capability), but not permission to edit other users’ posts (the “edit_others_posts” capability).. The underlying PHP AI Client will be bundled as an external library, while the WordPress specific wrapper code will become a direct part of Core.
- Provider/model abstraction – A consistent interface so hosts/site owners can choose providers via plugins, and plugins that use AI can remain vendor-neutral.
- Discoverability – Plugins can dynamically enable AI features, based on detecting whether any configured model on the site is able to respond to the relevant prompt(s).
- WordPress HTTP integration – Transport aligned with WP HTTP conventions and WP_Error behavior.
- Credentials management in wp-admin (and super admin) – Admin UI/storage for provider credentials, used across plugins.
- REST endpoints + JavaScript JavaScript or JS is an object-oriented computer programming language commonly used to create interactive effects within web browsers. WordPress makes extensive use of JS for a better user experience. While PHP is executed on the server, JS executes within a user’s browser. https://www.javascript.com/. API – A REST-backed JS API for browser contexts (wp-admin/editor use cases).
- Simple control mechanism for prompt execution – A filter Filters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output. allows allowing or disallowing certain prompts or prompt configurations, or even AI use in general.
Security, Privacy, Performance
- Security: REST/JS execution must remain capability A capability is permission to perform one or more types of task. Checking if a user has a capability is performed by the
current_user_can function. Each user of a WordPress site might have some permissions but not others, depending on their role. For example, users who have the Author role usually have permission to edit their own posts (the “edit_posts” capability), but not permission to edit other users’ posts (the “edit_others_posts” capability).-gated; secrets must not leak via REST/script data/logging.
- Privacy: no outbound AI calls by default; calls only happen via explicit configuration + explicit invocation.
- Performance: minimal footprint when unused; admin-only work should avoid affecting typical frontend requests.
Call for Feedback and Testing
Feedback is welcome via comments on this proposal or on the Trac ticket which has been opened for this change.
In particular, feedback is needed for:
- Is the REST/JS surface area and capability model appropriate for long-term support?
- Any missing core requirements for transport, errors, or credential storage?
As of now, there is no pull request yet. Please follow the Trac ticket to be notified when a pull request has been opened. Here are the steps you will need to follow for testing:
- Apply the core PR (install a test build or utilize the WordPress Playground instance from the PR) and confirm the admin credentials UI is access-limited.
- Configure a provider (or install/register a provider integration as needed).
- Run a minimal prompt test:
- server-side (small MU plugin/snippet)
- browser-side (JS API), verifying capability checks
- Verify behavior with no provider configured:
- no unexpected network (versus site, blog) calls
- no UI regressions
- plugins can detect and gracefully disable AI features
Props to @isotropic @jason_the_adams @jeffpaul for collaborating on this post.
#core-ai