WordPress 4.7 Puts Content on the Menu: The REST API Arrives for Real

WordPress 4.7 ‘Vaughan’ shipped on December 6. The surface release is genuinely pleasant. The Twenty Seventeen theme with its business-site slant. PDF thumbnail previews. Editor shortcuts. Custom CSS with live preview in the Customizer. Beneath it sits the change we have been waiting two years to record. The REST API’s content endpoints are now in core, enabled by default.

Posts, pages, users. Taxonomy terms and media. Readable, and with authentication writable, by anything that speaks HTTP.

Readers with long memories will recall the sequence. 4.4 shipped the API’s infrastructure in December 2015 with no content endpoints. The plumbing without the faucets, as our coverage put it. The endpoints matured through a year of plugin-territory iteration and one vigorous community debate about readiness. Vaughan opens the doorway for the platform that runs somewhere around a quarter of the web.

Which makes this a fine subject for the year’s final post, because the theme of 2016 turns out to be assumptions reversing. This is the platform’s own reversal. WordPress, the system that renders websites, is now equally a system that answers questions about content. Those are different species of thing.

What changes immediately

The near-term wins are unglamorous and real, and they land on ordinary sites that will never say the word ‘headless.’

Integration work sheds a decade of accumulated hackery. The campus-portal aggregation. The digital-signage feed. The mobile app that needs the news list. The sister-site content sharing. Every project that previously meant custom feed endpoints or screen-scraping now writes against a stable, documented, core-supported interface.

Editorial tooling gets the same door. The custom dashboard, the bulk-operations script, the migration pipeline all speak to WordPress through supported channels rather than through the admin screens’ assumptions. This converts an entire genre of bespoke glue into standard work, and the estimate lines on integration projects are already reflecting it.

The security note belongs in the same paragraph, because default-on endpoints change the audit posture. Content your site renders publicly is now also listable publicly. User listings deserve particular review, because the endpoint exposes authors in ways some sites will want filtered. Authenticated write access joins the hardening checklist alongside the login and XML-RPC files. And the WAF-and-updates routine from our maintenance work now covers an API surface. None of this is alarming. All of it goes on the checklist this quarter.

What it opens, priced honestly

The decoupled question we have tracked since the headless piece now includes the world’s most widely deployed CMS as a candidate backend, and the sober framing from that file transfers intact.

What 4.7 changes: the option is now real at commodity scale. WordPress’s editorial experience, its actual crown jewel, per fifteen years of client behavior, is available behind whatever front end a project’s requirements genuinely demand. The React-rendered experience where interactivity merits its box. The kiosk. The app. The multi-channel site our content-fragment and translation coverage keeps circling.

What 4.7 does not change: the decoupling math. Going headless still spends WordPress’s greatest asset, the built-in preview-theme-plugin loop that makes editors self-sufficient, to buy front-end freedom. It still adds an infrastructure layer with its own operations bill. And it still deserves the default-no our headless piece prescribed for the content sites that are most of the institutional web.

The house sort, updated once. Full decoupling remains the exception requiring a reason. Partial decoupling is now simply how integrations get built. The conventional WordPress site that also feeds an app, a portal, a sign. It requires no ceremony, and it is where the API will quietly do its decade of work.

The next durability-rubric review will treat ‘has a real API’ as table stakes for every platform on the sheet, which is perhaps the cleanest one-line summary of what shipped.

Three January projects, sketched from the queue

To ground the abstraction in the work, three items from our own January queue that 4.7 rewrites. Each was previously quoted under the old physics.

A university digital-signage network fed by screen scraping is a good example. Rebuild it as a signage client consuming the posts endpoint, with a custom field for display duration, and theme changes no longer break the integration. The implementation can also be materially simpler and cheaper than maintaining the scraping layer.

A multi-site professional association whose chapter sites re-key national news by hand. Rebuilt as scheduled syndication against the national site’s API, with attribution and canonical handling per our duplicate-content rules. A compliance chore becomes infrastructure.

And an internal one. Our own editorial tooling (the content-inventory reports, the stale-page audits our governance work runs quarterly) gets rewritten. From per-project scripts against database exports to a standard toolkit speaking REST to any client site that grants it credentials. That is the kind of compounding investment an agency gets to make when a quarter of the web agrees on an interface.

None of these say ‘headless.’ All of them are the API doing exactly what infrastructure does: making a category of previously bespoke work boring. That, and not the architecture debates, is what a default-on interface on this install base actually purchases. January’s estimates already show it.

Closing out 2016

And so 2016 closes, with the pattern named. This was the year the copies became originals and the add-ons became defaults. The mobile version became the indexed version. The link penalty became ambient evaluation. The app tricks became web capabilities. The pop-up became a ranking liability. And the API became part of WordPress rather than a proposal orbiting it.

Underneath everything this year, the same motion. Practices maturing from event into infrastructure. The absorption story we have tracked since we were a two-person shop writing about semantic markup.

The reading habit that keeps paying is unchanged. Watch what users already do. Watch what platforms signal. Distinguish the durable from the seasonal. Adopt with an exit.

Next year’s file has its openers queued. The interstitial deadline lands January 10. Mobile-first indexing’s experiments will start reporting. The framework licensing question wants watching. And machine learning in search is due its own post. We will check our predictions on schedule.

A decade into writing this blog, the trade’s fundamentals keep proving portable across every reversal. Build things that deserve their audience. Read the terms. Keep the exits. See you in January.