- WordPress.org released 7.2 Beta 1 on October 20, 2026, with a Secrets API for storing API keys and tokens and a wider Abilities API.
- A shared place for credentials matters most to organisations whose sites connect to outside services, including AI tools. The beta is for testing only, not production.
- Ask your team which plugins hold keys today, whether they plan to use the Secrets API, and who tests the beta before the December 8 final release.
Where do your site's keys live?
A WordPress site that connects to a payment service, a mailing platform or an AI tool has to hold a credential for each one. Those credentials are API keys and authentication tokens. Every plugin or integration that uses one needs somewhere to keep it.
WordPress 7.2 Beta 1 offers a common answer. WordPress.org released it on October 20, 2026. Most of the announcement covers editing features. Two items in it matter more to people who sign security budgets: a Secrets API and a wider Abilities API.
This is the thesis of this piece. When a site is built to be used by software as well as people, the credentials and permissions become the important part. The 7.2 beta brings both topics into WordPress core.
What the Secrets API does
WordPress.org describes the Secrets API as a standardized, secure way for developers to store sensitive credentials. It names API keys and authentication tokens as examples.
The announcement lists three capabilities. The first is encryption at rest. That means a key is stored in scrambled form, so someone who copies a database does not automatically get a usable key. How much protection that gives depends on where the decryption key is kept. The second capability is credential rotation, which is the routine swapping of old keys for new ones. The third is customizable storage providers. This lets a key be held somewhere other than the default location.
The announcement does not say where keys are stored by default. It also does not say how many plugins will adopt the API. Both answers decide how much protection a site actually gets.
The Abilities API opens the other door
The Abilities API also grows in 7.2. Outside software gets additional ways to read and search the data a site holds. WordPress.org states the aim as a steadier base for connecting systems, automating work and running AI tools.
Read the two items together. The Abilities API concerns how outside software reaches a site's data. The Secrets API concerns how the site holds the keys it uses to reach others. One covers access in, and the other covers access out.
The announcement does not say the two were designed as a pair. That link is this publication's reading. It is a reasonable lens for anyone planning to connect AI tools to a WordPress site.
Why the reach of WordPress matters here
WebPulse scanned the Tranco top 10,000 domains in September 2026. Of those, 7,064 responded and a platform was detected on 2,491. WordPress was detected on 719 of them, or 28.9% of detected sites. That is a share of detected sites in this sample, not of the whole web.
So a change to WordPress core touches the second most common detected platform in that sample, found on 719 of the 2,491 sites where a platform was identified. A shared credential API changes what developers can build on. It does not change what they choose to build.
Other changes worth a test run
Two other items touch how a site behaves. WordPress.org says 7.2 loads admin scripts and stylesheets individually instead of in large combined files, for better browser caching. It also adds prefetching, which loads the likely next admin screen ahead of time.
The release also expands client-side media processing. Images can be resized, compressed and converted in the browser before upload. WordPress.org says this can help particularly on hosting with limited image-processing capabilities.
WebPulse's advice: any change to how admin assets load or how images are processed is worth checking against custom admin code and your hosting setup. The announcement does not say these changes cause problems. Testing is how you find out.
WordPress.org is clear that the beta is for testing and development only. It asks people not to run it on production or mission-critical sites. The scheduled final release date is December 8, 2026.
What to ask your team
Start with an inventory. Which plugins and integrations on your sites hold API keys today, and where does each one store its key? If nobody can answer in a day, that is the first finding.
Next, ask which of those vendors plan to use the Secrets API, and when. Ask who on your team will test 7.2 Beta 1 on a staging copy before the final release. Include any custom admin code in that test.
Finally, ask who decides which outside tools may use the Abilities API on your sites, and how that decision gets reviewed.
A standard place for keys is a good start. It only helps if someone moves the keys in.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: WordPress.org.
