--- title: "August 2026 Update: WordPress 7.1 Ships, Nexter’s Biggest Security Hardening Pass, and a Customizer Redesign" url: https://nexterwp.com/blog/august-2026-update/ date: 2026-09-16 modified: 2026-09-16 lang: en author: "Aditya Sharma" description: "WordPress 7.1 shipped August 19 at WordCamp US, and Nexter matched it the same week: Abilities API support, a major Nexter Extension security hardening pass, and a Nexter Theme Customizer redesign." image: https://nexterwp.com/wp-content/uploads/2026/09/august-2026-update-featured-1024x538.jpg word_count: 1140 --- # August 2026 Update: WordPress 7.1 Ships, Nexter’s Biggest Security Hardening Pass, and a Customizer Redesign ## Key Takeaways - Nexter Blocks now sets the unified public exposure flag from WordPress 7.1 on every ability, so AI and MCP clients can discover them without a workaround. - Nexter Extension adds file guards across fifteen files, switches token comparison to timing-safe, and closes a Media Replacement bug that let one user read or delete another user’s attachment. - Nexter Blocks Pro hardens Login, Form, and Dynamic Content by rate-limiting login, forgot-password, and magic-link requests, validating reCAPTCHA server-side, and restricting ACF lookups and REST output to authorized, published data. - Nexter Theme redesigns the Customizer with a live typography preview above the Font Family field, a rebuilt color picker that combines swatch and current value in one field, and Escape closing an open color picker. We shipped a lot of small conveniences this month, but the real story in August is trust. WordPress 7.1 landed with the Abilities API maturing into something AI agents can actually rely on, and we spent the same week hardening both Nexter Extension and Nexter Blocks Pro: fifteen files’ worth of fixes on the Extension side, a full Login, Form, and Dynamic Content hardening pass on Blocks Pro. A Customizer you can actually see yourself using while you build it. That is the shape of this release: less “look what’s new,” more “here is what we made harder to break.” The bigger story this month happens outside our codebase too. WordPress 7.1 shipped August 19th at WordCamp US in Phoenix, timed almost to the hour. The Abilities API, the thing that turns a WordPress site into something an AI agent can discover and operate, picked up a standardized exposure flag and a filterable execution lifecycle in this release. Google finished rolling its Generative AI performance reports out to every Search Console property worldwide. Here is everything in one place, with our honest take blended in. Table of Contents ## 🎉 What’s New ![New in Nexter for August 2026: security hardening, WordPress 7.1 support, smarter regenerate thumbnails, precise SEO ALT warnings, hardened login and register, and a refreshed theme customizer](https://nexterwp.com/wp-content/uploads/2026/09/nexter-whats-new-august-2026-768x812.png)What’s new in Nexter — August 2026. - [**Nexter Blocks, WordPress 7.1 Abilities API Support**](https://nexterwp.com/nexter-blocks/): every Nexter Blocks ability now sets the unified public exposure flag WordPress 7.1 introduced, so AI and MCP clients can discover them without a workaround. Result caching for read-only abilities and input presets for faster block building shipped alongside it, plus full tested compatibility with 7.1 itself. - [**Nexter Extension, a Security Hardening Pass**](https://nexterwp.com/nexter-extension/): file guards added across fifteen files, a token comparison switched to timing-safe, a Media Replacement bug that let a user read or delete another user’s attachment closed, 2FA resend rate-limited, and the SMTP/Google OAuth credentials you already saved now encrypt at rest and convert automatically on your next save. - [**Nexter Blocks Pro, a Parallel Hardening Pass**](https://nexterwp.com/nexter-blocks/): Login & Register now rate-limits login, forgot-password, and magic-link requests and validates reCAPTCHA server-side; Form Actions validate their target URLs and block internal or private addresses; Dynamic Content restricts ACF lookups and REST output to authorized, published data; License activation now verifies its TLS certificate. - [**Nexter Theme, Customizer Redesign**](https://nexterwp.com/nexter-theme/): a live typography preview now sits above the Font Family field for body and heading text, the color picker got rebuilt so the swatch and current value share one field, and Escape now closes an open color picker instead of leaving it stuck open. ***Also Read:** [Nexter Abilities Explained](https://nexterwp.com/blog/nexter-abilities-explained/) if you want the longer version of what the Abilities API actually lets an AI agent do on your site.* *For everything else this month, [**check the complete changelog here**](https://roadmap.nexterwp.com/updates).* ### What’s Coming Up WordPress 7.1’s execution-lifecycle work gives us more to build against, and we are already extending it: faster repeat reads and automatic post-insert verification for more of the block library, not just the abilities that shipped this round. If you build with AI tools against your Nexter site, that surface keeps getting more reliable. ## 📹 Video Tutorials [![How to Add a WooCommerce Simple Product (2026) YouTube tutorial thumbnail](https://i.ytimg.com/vi/Qgw_a6cPoDU/hqdefault.jpg)](https://www.youtube.com/watch?v=Qgw_a6cPoDU)How to Add a WooCommerce Simple Product (2026) [![Customize WordPress Login Page for Agencies (Nexter 2026) YouTube tutorial thumbnail](https://i.ytimg.com/vi/3P4bzwa9AeU/hqdefault.jpg)](https://www.youtube.com/watch?v=3P4bzwa9AeU)Customize WordPress Login Page for Agencies (Nexter 2026) [![WooCommerce Tutorial: Build A Full Store With Woo Blocks In WordPress YouTube tutorial thumbnail](https://i.ytimg.com/vi/qc1CFcVIPIE/hqdefault.jpg)](https://www.youtube.com/watch?v=qc1CFcVIPIE)WooCommerce Tutorial: Build a Full Store With Woo Blocks in WordPress [![Stop Brute Force Attacks NOW with Limit Login Attempts in WordPress YouTube tutorial thumbnail](https://i.ytimg.com/vi/9Bk-5KGlmbk/hqdefault.jpg)](https://www.youtube.com/watch?v=9Bk-5KGlmbk)Stop Brute Force Attacks Now With Limit Login Attempts in WordPress ## 📊 — Quick Poll Which August release matters most to your sites? 🔐 The Extension + Blocks Pro security hardening pass 🤖 WordPress 7.1 Abilities API support 🎨 The Customizer redesign 🧭 Honestly, none of these? Tell us what you want next Reply in the comments with the letter. Takes a second. Helps us prioritize the next release. ## 🗞️ WordPress and Tech Bytes *The news, with my honest take on each one, and what it means if you build with **Nexter**.* - **WordPress 7.1 shipped August 19th, timed to WordCamp US in Phoenix.** The headline for builders is the Abilities API maturing: a standardized flag controlling which abilities are exposed to external clients, a filterable execution lifecycle, and JSON Schema support. Responsive Block Styles (tablet and mobile breakpoints in Global Styles) and pseudo-state styling for hover, focus, and active states on Button and Navigation Link blocks also landed. Our Nexter Blocks 7.1 compatibility, including the same exposure flag, shipped the same week. [**What’s new for developers, August 2026 →**](https://developer.wordpress.org/news/2026/08/whats-new-for-developers-august-2026/) - **Gutenberg 23.8 shipped the same day as 7.1**: shareable URLs and a code diff view for visual revisions, plus a List View performance pass that took “select all” on a 1,000-paragraph post from 16.8 seconds down to 0.4. Small numbers to read, large difference to feel if you have ever waited on that exact spinner. [**Gutenberg 23.8 release notes →**](https://make.wordpress.org/core/2026/08/19/whats-new-in-gutenberg-23-8-19-august/) - **WordPress 7.0.3 shipped August 6th as a security release**, fixing twelve issues including one CVSS 8.9 vulnerability (CVE-2026-64638) that could allow malicious PHP execution under certain conditions. If you are still on the 7.0 branch and have not updated since early August, this is the one to check first. [**WordPress 7.0.3 release notes →**](https://wordpress.org/news/2026/08/wordpress-7-0-3-release/) - **Google finished rolling its Generative AI performance reports out to every Search Console property worldwide on August 31st.** You can now see AI Overview and AI Mode impressions broken down by page, country, device, and date, no matter how small your site is. It still will not tell you which query triggered the impression, so treat it as a visibility signal, not a keyword report. [**Search Console AI reports go worldwide →**](https://www.searchenginejournal.com/google-search-console-ai-reports-rolled-out-worldwide/587836/) - **Google’s own new AI-search guidance says AEO and GEO are, in its words, “still SEO.”** No new discipline, no new ranking system to chase, just the same fundamentals applied to a surface that answers instead of linking. It is the same position we have taken with **RankReady** since day one. [**Google’s AEO/GEO guidance →**](https://www.searchenginejournal.com/googles-new-ai-search-guide-calls-aeo-and-geo-still-seo/575026/) ***Also Read:** [MCP Security for WordPress](https://nexterwp.com/blog/mcp-security-wordpress/) for what an AI-agent-facing site is actually exposing, and why the Abilities API’s exposure flag matters.* ## 🔥 Tool of the Month [**Shots.so**](https://shots.so/) turns a plain screenshot into a polished device mockup, iPhone, MacBook, iPad, Android, or browser frame, right in the browser. Pick a frame, pick a background, export. No account needed, no watermark on the free tier. If you build client sites with Nexter Blocks, it is the fastest way to make a before/after, a portfolio piece, or a changelog screenshot look finished without opening Figma. [![Shots.so, a free browser-based mockup and screenshot tool for developers and designers](https://nexterwp.com/wp-content/uploads/2026/09/shots-so-tool-of-the-month-1024x576.png)](https://shots.so/)Shots.so, this month’s pick for polished device mockups without Figma. #### Suggested Reading - [Nexter Abilities Explained: The WordPress Abilities API Inside Nexter Blocks](https://nexterwp.com/blog/nexter-abilities-explained/) - [MCP Security for WordPress: What You Are Actually Exposing](https://nexterwp.com/blog/mcp-security-wordpress/) - [How to Set Up a WordPress MCP Server, Step by Step](https://nexterwp.com/blog/wordpress-mcp-server/) - [Nexter Theme vs Blocksy: Which Block Theme Should You Build On in 2026?](https://nexterwp.com/blog/nexter-theme-vs-blocksy/) - [May 2026 Update: 84 New WP Abilities, WordPress 7.0, and WCEU Kraków](https://nexterwp.com/blog/may-2026-nexter-update/) #### Stay updated with Helpful WordPress Tips, Insider Insights, and Exclusive Updates – Subscribe now to keep up with Everything Happening on WordPress! Subscribe **Subscribe to our Newsletter, get Monthly & Weekly Product updates, News and more.…✉️** ## Frequently Asked Questions **Q: Why does WordPress 7.1 matter for AI agents and MCP clients?** A: WordPress 7.1 matters because the Abilities API now has a standardized public exposure flag and a filterable execution lifecycle. That makes abilities easier for AI agents and MCP clients to discover without workarounds. In Nexter Blocks, every ability now sets that unified exposure flag, so the site surface is more predictable for machine clients. The practical takeaway is that discovery is no longer an accidental side effect, it is part of the model. **Q: What changed in Nexter Extension’s security hardening pass?** A: Nexter Extension got a broad hardening pass across fifteen files, which is the kind of cleanup that closes off small attack paths before they become real problems. The page calls out timing-safe token comparison, a Media Replacement bug fix that stopped one user from reading or deleting another user’s attachment, 2FA resend rate limiting, and SMTP/Google OAuth credentials encrypting at rest on the next save. That mix matters because it covers both access control and stored secrets. **Q: How did Nexter Blocks Pro get hardened against abuse?** A: Nexter Blocks Pro tightened three common abuse points: Login & Register now rate-limit login, forgot-password, and magic-link requests; Form Actions validate target URLs and block internal or private addresses; Dynamic Content restricts ACF lookups and REST output to authorized, published data. License activation also verifies its TLS certificate. The pattern here is simple: stop request spam, stop unsafe destinations, and stop private data from leaking through dynamic output. **Q: Does Nexter work with WordPress 7.1 right away?** A: Nexter shipped compatibility the same week WordPress 7.1 landed on August 19, 2026 at WordCamp US in Phoenix. Nexter Blocks specifically includes tested compatibility with 7.1 and uses the same public exposure flag WordPress introduced for abilities. That matters if you are building around AI or MCP clients, because compatibility here is not just version matching, it is about exposing abilities in the format WordPress now standardizes. **Q: What should I use if I want a safer WordPress site for AI-agent-facing features?** A: The safer path on this page is to pair WordPress 7.1’s Abilities API changes with the hardening work in Nexter Extension and Nexter Blocks Pro. The founder’s note makes the point clearly: the exposure flag separates what an AI agent can technically find from what it is supposed to find. If you are building for AI-facing workflows, [MCP Security for WordPress](https://nexterwp.com/blog/mcp-security-wordpress/) is the right companion read because it focuses on what you are actually exposing. **Q: What changed in the Nexter Theme Customizer redesign?** A: The Customizer redesign focused on making live design feedback easier to trust while you build. A live typography preview now sits above the Font Family field for body and heading text, the color picker was rebuilt so the swatch and current value share one field, and Escape now closes an open color picker instead of leaving it stuck open. That last detail sounds small, but it removes a common UI annoyance when you are iterating quickly.