We shipped a lot of small conveniences this month, but the real story in August is trust. WordPress 7.1 landed with the Abilities API maturing into something AI agents can actually rely on, and we spent the same week hardening both Nexter Extension and Nexter Blocks Pro: fifteen files’ worth of fixes on the Extension side, a full Login, Form, and Dynamic Content hardening pass on Blocks Pro. A Customizer you can actually see yourself using while you build it. That is the shape of this release: less “look what’s new,” more “here is what we made harder to break.”
The bigger story this month happens outside our codebase too. WordPress 7.1 shipped August 19th at WordCamp US in Phoenix, timed almost to the hour. The Abilities API, the thing that turns a WordPress site into something an AI agent can discover and operate, picked up a standardized exposure flag and a filterable execution lifecycle in this release. Google finished rolling its Generative AI performance reports out to every Search Console property worldwide. Here is everything in one place, with our honest take blended in.
🎉 What’s New
- Nexter Blocks, WordPress 7.1 Abilities API Support: every Nexter Blocks ability now sets the unified public exposure flag WordPress 7.1 introduced, so AI and MCP clients can discover them without a workaround. Result caching for read-only abilities and input presets for faster block building shipped alongside it, plus full tested compatibility with 7.1 itself.
- Nexter Extension, a Security Hardening Pass: file guards added across fifteen files, a token comparison switched to timing-safe, a Media Replacement bug that let a user read or delete another user’s attachment closed, 2FA resend rate-limited, and the SMTP/Google OAuth credentials you already saved now encrypt at rest and convert automatically on your next save.
- Nexter Blocks Pro, a Parallel Hardening Pass: Login & Register now rate-limits login, forgot-password, and magic-link requests and validates reCAPTCHA server-side; Form Actions validate their target URLs and block internal or private addresses; Dynamic Content restricts ACF lookups and REST output to authorized, published data; License activation now verifies its TLS certificate.
- Nexter Theme, Customizer Redesign: a live typography preview now sits above the Font Family field for body and heading text, the color picker got rebuilt so the swatch and current value share one field, and Escape now closes an open color picker instead of leaving it stuck open.
Also Read: Nexter Abilities Explained if you want the longer version of what the Abilities API actually lets an AI agent do on your site.
For everything else this month, check the complete changelog here.
What’s Coming Up
WordPress 7.1’s execution-lifecycle work gives us more to build against, and we are already extending it: faster repeat reads and automatic post-insert verification for more of the block library, not just the abilities that shipped this round. If you build with AI tools against your Nexter site, that surface keeps getting more reliable.
📹 Video Tutorials
📊 — Quick Poll
Which August release matters most to your sites?
🔐 The Extension + Blocks Pro security hardening pass
🤖 WordPress 7.1 Abilities API support
🎨 The Customizer redesign
🧭 Honestly, none of these? Tell us what you want next
Reply in the comments with the letter. Takes a second. Helps us prioritize the next release.
🗞️ WordPress and Tech Bytes
The news, with my honest take on each one, and what it means if you build with Nexter.
- WordPress 7.1 shipped August 19th, timed to WordCamp US in Phoenix. The headline for builders is the Abilities API maturing: a standardized flag controlling which abilities are exposed to external clients, a filterable execution lifecycle, and JSON Schema support. Responsive Block Styles (tablet and mobile breakpoints in Global Styles) and pseudo-state styling for hover, focus, and active states on Button and Navigation Link blocks also landed. Our Nexter Blocks 7.1 compatibility, including the same exposure flag, shipped the same week. What’s new for developers, August 2026 →
- Gutenberg 23.8 shipped the same day as 7.1: shareable URLs and a code diff view for visual revisions, plus a List View performance pass that took “select all” on a 1,000-paragraph post from 16.8 seconds down to 0.4. Small numbers to read, large difference to feel if you have ever waited on that exact spinner. Gutenberg 23.8 release notes →
- WordPress 7.0.3 shipped August 6th as a security release, fixing twelve issues including one CVSS 8.9 vulnerability (CVE-2026-64638) that could allow malicious PHP execution under certain conditions. If you are still on the 7.0 branch and have not updated since early August, this is the one to check first. WordPress 7.0.3 release notes →
- Google finished rolling its Generative AI performance reports out to every Search Console property worldwide on August 31st. You can now see AI Overview and AI Mode impressions broken down by page, country, device, and date, no matter how small your site is. It still will not tell you which query triggered the impression, so treat it as a visibility signal, not a keyword report. Search Console AI reports go worldwide →
- Google’s own new AI-search guidance says AEO and GEO are, in its words, “still SEO.” No new discipline, no new ranking system to chase, just the same fundamentals applied to a surface that answers instead of linking. It is the same position we have taken with RankReady since day one. Google’s AEO/GEO guidance →
Also Read: MCP Security for WordPress for what an AI-agent-facing site is actually exposing, and why the Abilities API’s exposure flag matters.
🔥 Tool of the Month
Shots.so turns a plain screenshot into a polished device mockup, iPhone, MacBook, iPad, Android, or browser frame, right in the browser. Pick a frame, pick a background, export. No account needed, no watermark on the free tier.
If you build client sites with Nexter Blocks, it is the fastest way to make a before/after, a portfolio piece, or a changelog screenshot look finished without opening Figma.
Suggested Reading
- Nexter Abilities Explained: The WordPress Abilities API Inside Nexter Blocks
- MCP Security for WordPress: What You Are Actually Exposing
- How to Set Up a WordPress MCP Server, Step by Step
- Nexter Theme vs Blocksy: Which Block Theme Should You Build On in 2026?
- May 2026 Update: 84 New WP Abilities, WordPress 7.0, and WCEU Kraków
