A client’s AI plugins each shipped their own settings screen and each asked for API keys they had already entered. The Core AI check-in from October 8th, 2025 covers both fixes: categories on the Abilities API, and one provider settings screen.
An off-the-shelf AI plugin left a client with a slow backend and alt text that had nothing to do with the images. The core AI discussions point somewhere better: content summaries, post titles and image descriptions behind one PHP AI Client.
A WooCommerce shop inherited custom plugins that broke on every update and dragged the admin down. The fix was not more hotfixes, it was the basics: prefixed functions, core hooks, sanitized input and capability checks.
A client wanted AI features on his WordPress site and every plugin used a different API. The new WordPress AI Client SDK gives plugins and themes one consistent, WP-native API for multiple providers.
A client spent six months stuck on API plumbing before any AI features shipped. The lesson: build WordPress AI on a proper AI Client SDK, with a standard way to register providers, before chasing features.
Custom capabilities get messy fast on big WordPress sites. The Abilities API, in development for 6.9 as part of Core-AI, gives a structured way to define and manage them.
A client’s AI prototype broke because their site ran PHP 7.2 while our code used PHP 7.4. Here is how the WordPress Core AI team handles the same version gap, and how to build for it.
A client inherited an AI setup that was really just API calls held together with duct tape, and it kept breaking. Here is the architecture I use instead: provider interfaces and DTOs that let you swap AI models without rewriting everything.
parse_blocks() loads an entire post into memory and can take a server down on large content. WordPress 6.9 adds WP_Block_Processor, a streaming parser that reads block content one pass at a time so you can work with big posts safely.
WordPress 6.9 finally makes HTTPS the default in esc_url() and esc_url_raw() when no scheme is given, as long as ‘https’ comes first in the $protocols array. No more str_replace hacks.