HostingHosting A web hosting service is a type of Internet hosting service that allows individuals and organizations to make their website accessible via the World Wide Web. team: this is a call to test three WordPress 7.2 changes on your platform before RC1 on November 17, and to post what you find in the comments. RC1 is the string freeze; after it, a change needs coreCore Core is the set of software required to run WordPress. The Core Team builds WordPress. committers to sign off on it. WordPress 7.2 ships on December 8, 2026. Three changes behave differently on a hosting platform than on a single test site: the new Secrets APIAPI An Application Programming Interface (API) is a computing interface that defines interactions between multiple software intermediaries. It defines the kinds of calls or requests that can be made, how to make them, the data formats that should be used, the conventions to follow, etc. is disabled by default on any site without a WP_SECRETS_KEY, the new /random/ route needs a rewrite flush after an upgrade, and the two upgrade paths leave different files behind. Results below come from testing 7.2-beta4 and beta5 on one managed platform and local test fleets – run the tests on your own stack, on staging or test sites, and never on production. Catching problems now keeps them from reaching your customers as support tickets after release.

The short checklist

1. Count sites reaching 7.2 without a WP_SECRETS_KEY, and decide where their key comes from.
2. Update your one-click installers and provisioning scripts to write a WP_SECRETS_KEY for every new site.
3. Search your objectObject In computer science, an object can be a variable, a data structure, a function, or a method, and as such, is a value in memory referenced by an identifier. cacheCache A cache is a component that stores data so that future requests for that data can be served faster; the data stored in a cache might be the result of an earlier computation or a copy of data stored elsewhere. and databaseDatabase A database is an organized collection of data. Access to this data is usually provided by a "database management system" (DBMS) consisting of an integrated set of computer software that allows users to interact with one or more databases and provides access to all of the data contained in the database. Because of the close relationship between them, the term "database" is often used casually to refer to both a database and the DBMS used to manipulate it. for a test secret’s plaintext.
4. Rebuild any wp-content/secrets.php drop-in against BetaBeta Beta is the software development phase following alpha. A Beta phase generally begins when the software is feature complete but likely to contain a number of known or unknown bugs. Software in the beta phase will generally have many more bugs in it than completed software, speed or performance issues, and may still cause crashes or data loss. The focus of beta testing is reducing impacts to users, often incorporating usability testing. 5 now, and again at RC1.
5. Upgrade one test site through the Dashboard and one with WP-CLIWP-CLI WP CLI is the Command Line Interface for WordPress, used to do administrative and development tasks in a programmatic way., and compare checksums.
6. After every upgrade, flush rewrite rules on every site, then purge your page cache.
7. Check how /random/ behaves at your edge and on your largest databases.

Secrets API: the key is now your job

7.2 adds encrypted storage for credentials such as API tokens (Trac #66187, proposal). The Secrets API dev note covers the whole API. Beta 5 changed how its key is found:

• No salt fallback (changeset 65385). Without WP_SECRETS_KEY, the API is off and returns secret_key_unavailable.
• Only the browser installer writes a key (changeset 65389). Upgraded sites get none, and neither does any new site whose wp-config.php your own tooling writes: wp config create, one-click installers and provisioning scripts. If your tool copies wp-config-sample.php and fills in only the eight salts, the key placeholder that file now ships stays in place, and the API rejects it.
• The extension points are abstract classes (changeset 65390). A drop-in written against Beta 4’s interfaces is a fatal error until it uses extends.

Both sites upgraded on the managed platform had no key. Core doesn’t call the API yet, so this breaks sites only once plugins move credentials into it.

Test 1: count the sites without a key.

wp config has WP_SECRETS_KEY
wp eval 'var_dump( wp_is_secrets_api_available() );'

With a custom provider, store and read a test secret instead (Test 3).

Test 2: choose where the key lives. Make sure migrations, rebuilds and restores never regenerate it. A key shared across environments lets a live database cloned to staging read its secrets. With a different key, the Secrets API is off on the clone: old secrets can’t be read and new ones can’t be saved, and Site HealthSite Health This WordPress functionality will perform a number of checks on your installation to detect common configuration errors and known issues, and also allows plugins and themes to add their own checks. shows two Critical items. To change a key later, use the steps under Changing a key below. Generate a key with openssl rand -base64 32, and trim values from a file or store: a trailing newline makes a different key. The API also rejects a copied salt or the placeholder from the sample file.

Test 3: check that plaintext stays out of your cachesCache A cache is a component that stores data so that future requests for that data can be served faster; the data stored in a cache might be the result of an earlier computation or a copy of data stored elsewhere., with a control value:

S="secret-canary-$(openssl rand -hex 8)"
C="control-canary-$(openssl rand -hex 8)"
wp eval "var_dump( wp_set_secret( 'hosting-test/canary', '$S' ) );"
wp option update hosting_test_control "$C"
wp db export - | grep -c "$S"   # expect 0
wp db export - | grep -c "$C"   # expect 1 or more

Search your object cache for both too. On the platform tested, the secret was in none of 51 RedisRedis Redis (Remote Dictionary Server) is an in-memory data structure store, in-memory key–value database. It is open-source software.. keys; the control was in Redis and the database. Clean up with wp eval "wp_delete_secret( 'hosting-test/canary' );" and wp option delete hosting_test_control.

Test 4: keep drop-ins small. Core checks only that a custom provider has the right type, not how it stores secrets, and a read-only one makes pluginPlugin A plugin is a piece of software containing a group of functions that can be added to a WordPress website. They can extend functionality or add new features to your WordPress websites. WordPress plugins are written in the PHP programming language and integrate seamlessly with WordPress. These can be free in the WordPress.org Plugin Directory or can be cost-based plugin from a third-party. saves fail with secret_provider_read_only. If your provider is read-only, save a credential through each plugin your customers use for API keys and confirm the plugin reports the failure instead of appearing to save. Plugins can check wp_secrets_provider_is_writable() first. The safest drop-in only defines WP_SECRETS_KEY.

Test 5: multisiteMultisite Multisite is a WordPress feature which allows users to create a network of sites on a single WordPress installation. Available since WordPress version 3.0, Multisite is a continuation of WPMU or WordPress Multiuser project. WordPress MultiUser project was discontinued and its features were included into WordPress core. Advanced Administration Handbook -> Create A Network.. Archived, spam and deactivated subsites miss the new manage_secrets capability; run wp core update-db --url=<site> when you reactivate one.

Changing a key. Put the old key in WP_SECRETS_KEY_PREVIOUS and run the wp eval command in the Secrets API dev note. Test sites that stored secrets on Beta 1–4 without a key can recover them the same way, using LOGGED_IN_KEY . LOGGED_IN_SALT as the old key (tested on one site).

Support will see a Site Health notice with a paste-ready define() whose key changes on every page load, rated only Recommended; decide whether your docs point customers to it.

Upgrades: test both paths

Upgrading from 7.1.4 through the Dashboard or auto-update leaves 10 files under wp-includes/ that 7.2 doesn’t ship, because $_old_files hasn’t been updated for 7.2 yet (Trac #66456). Core adds removed files to $_old_files at RC1, so this is expected during the betas; repeat the comparison on RC1. WP-CLI’s wp core update removes them, so checksum-based integrity monitoringMonitoring Website monitoring is the process of testing and verifying that end-users can interact with a website or web application as expected. Website monitoring is often used by businesses to ensure website uptime, performance, and functionality is as expected. flags one path and not the other. Upgrade a test site each way and run wp core verify-checksums on both. It lists leftover files as warnings but still prints Success and exits 0, so make your monitoring read the warnings. WP-CLI also removes the files only when it can reach api.wordpress.orgWordPress.org The community site where WordPress code is created and shared by the users. This is where you can download the source code for WordPress core, plugins and themes as well as the central location for community conversations and organization. https://wordpress.org/; otherwise it skips them with a warning and still reports success.

/random/: flush after upgrades, and early performance notes

7.2 adds a /random/ route that redirects to a random published post (Trac #64498, dev note). After an upgrade it’s a 404 until rewrite rules are flushed, which core does on the first wp-admin request, per site on multisite (Trac #64498 comment 73).

Run wp rewrite flush on every site after each upgrade, then purge your page cache, in that order. Check by requesting the URLURL A specific web address of a website or web page on the Internet, such as a website’s URL www.wordpress.org: wp rewrite list can show the rule while the site still returns 404. On the platform tested, a cached 404 survived the upgrade until a purge. after_db_upgrade fires right after core’s flush, a good hook for a purge. Check that your cache code doesn’t replace core’s no-cache headers; on the platform tested, a plugin’s did.

Early performance notes, from reading the Beta 5 source, not measured:

• Every request runs ORDER BY RAND() LIMIT 0, 1 over the eligible published posts, so the cost grows with post count.
• Neither the object cache nor the edge absorbs repeats, and ?random on search and archive URLs runs the same query.

Check your slow-query log on your largest sites and whether your edge rate-limits these URLs. The wp_enable_random_content_redirect filterFilter Filters are one of the two types of Hooks https://codex.wordpress.org/Plugin_API/Hooks. They provide a way for functions to modify data of other functions. They are the counterpart to Actions. Unlike Actions, filters are meant to work in an isolated manner, and should never have side effects such as affecting global variables and output. turns the route off; add it before upgrading, or flush afterwards.

Other quick checks

• wp-admin/load-scripts.php and load-styles.php answer 410 (changeset 64585).
• KSES uses the HTMLHTML Hypertext Markup Language (HTML) is the standard markup language for documents designed to be displayed in a web browser. HTML describes the structure of a web page semantically and originally included cues for the appearance of the document. API by default (Trac #66208, progress report).
• Client-side media processing needs the Document-Isolation-Policy headerHeader The header of your site is typically the first thing people will experience. The masthead or header art located across the top of your page is part of the look and feel of your website. It can influence a visitor’s opinion about your content and you/ your organization’s brand. It may also look different on different screen sizes.; check it survives your edge.
• Network upgrades can report “All done!” after a subsite’s upgrade fails (Trac #66477). Check db_version per site.

Where to send feedback

Please test before RC1 on November 17. Post your results as a comment on this post: what you tested, what you saw, and your stack (PHPPHP PHP (PHP: Hypertext Preprocessor) is a general-purpose scripting language especially suited to web development. PHP code is usually processed on a web server by a PHP interpreter. On a web server, the result of the interpreted and executed PHP code would form the whole or part of an HTTP response., database, object cache, page cache or CDNCDN A Content Delivery Network (CDN) is a geographically distributed network of proxy servers and their data centers. The goal is to provide high availability and performance by distributing the service spatially relative to end users. CDNs have grown to serve a large portion of the Internet content today, including web objects (text, graphics and scripts), downloadable objects (media files, software, documents), applications (e-commerce, portals), live streaming media, on-demand streaming media, and social media sites.). Test the setup most of your customers run, not a fresh install, and describe your platform by type, such as shared or managed; you don’t need to name your company. File WordPress bugs on Core Trac, and ask questions in #hosting on Making WordPress Slack. Results from subdomain multisite, PHP 8.x, MemcachedMemcached Memcached is a general-purpose distributed memory-caching system. It is often used to speed up dynamic database-driven websites by caching data and objects in RAM to reduce the number of times an external data source must be read. Memcached is free and open-source software. and very large sites help the most. The full test list, with scripts, is in this unofficial hosting guide for WP 7.2.

Thank you for testing. Props to @huzaifaalmesbah, @jns141191 and @r1k0 for reviewing and testing this post, and to @amykamala for bringing it to the 7.2 test leads.

#7-2, #hosting-team