ActivityPub

82 Quality Score

Active Installs

17/30

With 6,000 active installs the plugin sits in niche territory, which makes sense given the still-niche audience for Fediverse integration, but it is far smaller than comparable social plugins.

Update Freshness

25/25

It was updated very recently and is tested against WordPress 7.0, so maintenance signals are excellent.

User Rating

15/15

A 98 out of 100 from 40 ratings is an unusually high score that suggests the people who need this plugin tend to love it.

Support Health

10/15

Only 4 of 13 support threads are resolved, which is a meaningful gap and worth considering if you anticipate needing hands-on help.

WP Compatibility

15/15

It requires WordPress 6.5 and PHP 7.4, both reasonable, and it tracks the latest core releases.

Scores higher than 86% of indexed plugins

About

Connect your site to the Open Social Web and let millions of users follow, share, and interact with your content from Mastodon, Pixelfed, and more.

Active Installs 6k+

Rating ★★★★½ 4.9/5

Last Updated 2026-09-02 1:38pm GMT

Requires WordPress 6.5+

Tested Up To 7.1

Requires PHP 7.4+

Security History

6 known vulnerabilities, all patched

1 High 5 Medium

Most recent: March 18, 2026

View details ▸

ActivityPub < 8.0.2 - Unauthenticated Information Epxosure High

March 18, 2026 Patched in ["8.0.2"] CVE-2026-4338

ActivityPub <= 1.0.5 - Missing Authorization Medium

January 5, 2024 Patched in ["1.0.6"] CVE-2023-52199

ActivityPub <= 0.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content Medium

September 25, 2023 Patched in ["1.0.0"] CVE-2023-3746

ActivityPub <= 0.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via User Metadata Medium

September 25, 2023 Patched in ["1.0.0"] CVE-2023-5057

ActivityPub <= 0.17.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Post Content Exposure Medium

September 25, 2023 Patched in ["1.0.0"] CVE-2023-3707

ActivityPub <= 0.17.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Post Title Exposure Medium

September 25, 2023 Patched in ["1.0.0"] CVE-2023-3706

What It Does

ActivityPub turns a WordPress site into a federated account on the Fediverse, so visitors on Mastodon, Pixelfed, and other ActivityPub-compatible platforms can follow, like, boost, and reply to posts without leaving their own app. It adds profile, follower, and post endpoints under the hood and pushes new entries to the network automatically when you publish.

Who It's For

This is a good fit for independent writers, small publications, artists, podcasters, and community or nonprofit sites that want to reach readers who live on Mastodon rather than on traditional social media. It is especially useful for anyone already familiar with the Fediverse and comfortable debugging the occasional protocol edge case.

Who Should Skip It

If your audience is entirely on mainstream platforms like Instagram, X, or Facebook and you have no interest in the open social web, this plugin adds complexity you do not need. Large commerce or membership sites that require deep analytics, scheduled posting, or polished social previews should also look elsewhere.

The Bottom Line

ActivityPub delivers a genuinely useful bridge to the Fediverse for WordPress and earns its top marks in maintenance and compatibility. The weak support resolution rate and small install base mean it is best suited to users who are patient and self-directed. If you want to publish to the open social web from WordPress today, this is the most complete option available, but go in with realistic expectations about the rough edges.

Related Plugins

WebSub (FKA. PubSubHubbub) 85/100

Pick WebSub if you only need real-time pings to RSS subscribers and want a far more mature, broadly supported solution without the Fediverse layer.

Share on Mastodon 75/100

Pick Share on Mastodon if you just want visitors to cross-post your articles to their own Mastodon account and do not need a full federated identity for your site.

WebFinger 68/100

Pick WebFinger if you only need to expose a discoverable identity endpoint and want to pair it with a separate Fediverse client instead of a full server stack.