With decentralized content and federated services growing in popularity, many existing web technologies are adopting the ActivityPub open standard. Services like Meta’s Threads, Tumblr, Medium, Flipboard, Mozilla, and WordPress.com have all added or announced support of ActivityPub, allowing for their content to be accessible via the fediverse. For those who self-host their website, or manage WordPress websites, ActivityPub integration has been available since 2019, thanks to the ActivityPub plugin, created by Matthias Pfefferle, and now managed by Automattic, the maker of WordPress. This guide is for webmasters and hobbyists to install and configure ActivityPub for self-hosted WordPress websites, allowing their website content to be followed, tagged, and commented on via services like Mastodon, Lemmy, Pixelfed, and Threads.

What is ActivityPub and the Fediverse?

ActivityPub is an open standard for social networks published by the World Wide Web Consortium. The standard allows for creating, updating, deleting, content, following/subscribing to content, threading (commenting) on content, and more. Essentially, any activity that a social network would include, ActivityPub has a way of handling it. Contrast this with a closed standard like Twitter. To follow, reply to, or message a user on Twitter you need to create an account on Twitter. Twitter has an API that other software companies can use to access content, but you still need a Twitter account to interact with the content. This is not the case with an open standard like ActivityPub.

For example, if I have an account on a server running the Mastodon software, which I do, I can follow users on other Mastodon servers. I don’t need to create more than one Mastodon account. There are over 7 million Mastodon users across 11 thousand servers. With my one Mastodon account, I can follow any other of those users on any server. Servers can also be created with a particular topic in mind or based in a specific location, creating a local community amongst users on that server.

In addition to being able to follow any Mastodon account on any server, I can follow accounts on different platforms. If there is a photographer on Pixelfed that I want to follow, I only need to look them up via my Mastodon server and follow them to see their posts. This is typically done by searching for the user using an email-like format of @username@domain. For example, if I wanted to follow my Pixelfed account, I would search @jseggers and then I could follow that account via Mastodon.

The fediverse is the collection of all of the different servers federating content between each other. When a user on a server follows a user on another server the originating server subscribes to content from that server. When you have an account on a Mastodon server you can view posts from the accounts you follow, all posts on your specific Mastodon server, or all posts across all federated servers.

Why Set Up ActivityPub for Self-Hosted WordPress Websites?

Simply put, ease of access. Setting up ActivityPub allows readers to follow your content and be notified of new posts on your WordPress website via their favorite federated social media platform. It also allows followers to comment on your website posts without having to leave their social media platforms, which builds engagement. Furthermore, supporting the ActivityPub open standard promotes an open and decentralized internet.

Just like my example above, if users search for @jonathan@jseggers.com in Mastodon or another ActivityPub-based platform they can follow posts I make to my blog the same way they follow any other user. When I add a new post to my site that post will appear in the site’s followers’ feeds. That post can be “boosted” (aka, retweeted) and commented on. Followers can also enable notifications if they don’t want to miss a post. Making your content easier to find and reducing the barrier to engagement is a win-win.

What Plugins Do I Need?

Only one plugin is required to achieve the full effect of ActivityPub on your self-hosted WordPress website. Other plugins are useful and add additional capabilities. The following list is my roundup of all plugins that you may want to consider for your deployment of ActivityPub for WordPress.

• ActivityPub – This is the core plugin that adds the ActivityPub features to your WordPress website. This plugin is required for ActivityPub to work. You could stop here if you want, as this is the only required plugin.
• Friends – The Friends plugin allows you to follow ActivityPub-based accounts, as well as other WordPress websites with the Friends plugin. This isn’t a necessary plugin; however, besides following, it allows you to comment on, like, and boost ActivityPub content. I don’t recommend using this as your daily driver for ActivityPub content. However, I do recommend using this as it provides you with additional functionality, which I discuss below.
• Hum – The Hum plugin is a URL shortener plugin. The value of Hum for ActivityPub integration is debatable. Mastodon allows for any length URL to be used while only counting towards 23 characters of the post limit. From an SEO perspective, having the full URL is beneficial. I include it in this post as it is listed as a recommended plugin by the ActivityPub plugin, although I don’t use it myself. This plugin doesn’t have any customizable settings.
• NodeInfo – The Nodeinfo plugin adds additional metadata about your WordPress site/server so that ActivityPub and other open standards get information about the software you’re using. The ActivityPub plugin has everything you need for the ActivityPub standard already, including nodeinfo support. This plugin is only recommended if you want to expand nodeinfo capabilities for other purposes. This plugin doesn’t have any customizable settings.
• WebFinger – This plugin adds additional information about users on the WordPress site/server. The ActivityPub plugin has everything you need for the ActivityPub standard, including webfinger support. This plugin is only recommended if you want to expand webfinger capabilities for other purposes. This plugin doesn’t have any customizable settings.
• Webmention – Webmention is an open standard for notifying one webpage that another website is linking to it. This isn’t listed as a recommended plugin by the ActivityPub plugin, but I have found it useful for cross-posting between my site and social media platforms, which I will discuss below.
• Enable Mastodon Apps – This optional plugin allows you to log in to your website using a Mastodon app. This plugin requires the Friends and ActivityPub plugins. The plugin allows you to use your site via a Mastodon app. I’ve tested this with elk.zone and it works as intended. You can see the same content as with the Friends plugin. You can also post from the Mastodon app, which means posting a new post to your website. There isn’t much else I’ve been able to do with it.

What are the Recommended Settings?

ActivityPub Settings

Once installed, there are only a few steps to configure in the ActivityPub plugin. You can find the ActivityPub plugin under Settings in WordPress. First, you need to decide if you want to allow people to follow the blog, authors, or both. If you have multiple authors, allowing both makes sense. This configuration allows following all of the posts on a blog or only the posts from specific authors on the site. If your site is only one author you may want to opt for only publishing the blog or only the author. If you select the author option, the author pages must be publicly available. Once you start getting followers, changing your blog or username may cause your users to stop receiving updates, so it’s best to get these set up right the first time.

When you click on ActivityPub under Settings, the first page you will see is an information page. Here you can see your Author Profile and/or Blog Profile (depending on what you have enabled), including your Usernames and Profile URLs. You can not change these settings here. The author settings are pulled from your WordPress account. Your username for ActivityPub is your username for WordPress. This does pose some security risk, as it exposes your username to the internet. If you move forward with this, I recommend utilizing captcha and MFA plugins for additional security.

At the top, click Settings. On the settings page, you have the following options:

• Enable Authors – check this to allow every author on the site to be followed
• Enable blog – check this to allow the blog as a whole to be a profile that can be followed. Note: the profile ID cannot be the same as any Author ID.
• Activities – You can use one of the default settings or you can build your own. What has worked well for me is selecting the custom setting, then I use the following options:
  • [ap_title] – The title of the post
  • [ap_excerpt] – The excerpt of the post
  • [ap_hashtags] – Uses the post’s tags as hashtags
  • [ap_permalink type=”html”] – Uses the full URL of the post.
• Media attachments – Here you can set the total number of media attachments to be used for a post. I have mine set to 1, but the default setting is 3.
• Activity-Object-Type – The default is Note and I recommend using that option. However, if you do more with photography and plan on encouraging others to follow your site via Pixelfed (an Instagram-like platform), the Image options may be a better choice.
• Supported post types – Here you can enable different post types to be published. I only have Posts enabled, but you can enable pages and attachments as well.
• Hashtags – This enables the option to include WordPress tags as hashtags on the post.

Friends Settings

The Friends plugin settings are more in-depth. As this plugin doesn’t impact the functionality of ActivityPub, it’s really up to you to decide how you want to configure the plugin. Here are a few things I changed right off the bat:

• By default, the plugin creates a page called “Friends” that is publicly viewable. I set it to Private so that only logged-in users could see it. I also verified that it wasn’t listed in my sitemap.
• If you follow your accounts you will probably want to go to Friends -> Notification Manager and turn off email notifications for your accounts that you follow from your blog. Otherwise, the plugin sends you an email every time you post something.

Webmention Settings

The Webmention plugin is not needed for ActivityPub, but it is useful for another purpose, which I will get to later. For now, here are the basic settings that I recommend:

• Self-Ping settings: I have all three disabled. The only one that may be useful is the same domain self-pings. If you link to another page on your domain (which is fairly common) you will see a comment (pingback) on the page you’ve linked to. I don’t find that useful, but others may.
• Post types: I only have Posts enabled, but if you want pingbacks on pages or attachments you can enable those here. I believe you have to have comments enabled on those for it to work.
• Automatically approve Webmention from these domains: If you are setting up an integration, you can auto-approve comments by whitelisting their domains here.
• Show a Webmention form…: this adds a message in the comment section allowing anyone to put in a URL. This allows for manual webmentions. I have it enabled, but it’s not necessary.
• Avatars: Enabled
• Display: Enabled

How do I follow my author page or blog?

Now that you’ve completed the installation and configuration, you want to be sure you can follow your author/blog from Mastodon or another ActivityPub service. For most services, the easiest way to follow your site/author is to search for @username@doamin. For me, that is (@)[email protected]. Or, if you are publishing your blog, it would be @blogname@domain. For me, that is (@)[email protected]. (I had to put the @ in () to prevent WordPress from converting them into links). Remember, the blog name is set in the ActivityPub plugin settings.

If that doesn’t work, you may have to browse to a specific URL on your service. Keep in mind, that you must be logged in to the service for this to work. For example, on Mastodon, the URL for a user is https://<mastodon_server_domain>/@<user>@<domain>. In my case, it would be https://<mastodon_server_domain>/@jonathan@jseggers.com (using the server address for the Mastodon server where you have an account). For a Lemmy server, it would be https://<lemmy_server_domain>/u/<user>@<domain>. If you’re not sure of the correct URL, click on a user in that service and you should get an idea.

Where’s my content?

Because of how Mastodon works, you will not see any old posts. There is no mechanism for pulling up the history of posts and displaying them. The next blog post you publish will appear on your Mastodon account (assuming that’s what you’re using to follow your blog) only after you create a new post. However, you can revert an old post to a draft and re-publish it.

This is also important to keep in mind. If you ever unpublish an old post and then republish it, it will be posted to the feeds of anyone following your site, no matter how old or cringy the post is. If you need to republish an old post (not update a post, but revert a post to a draft and then repost it) You can disable the ActivityPub plugin, repost the post, and then re-enable it.

What about cross-posting?

Capturing discussions that happen on a platform like Mastadon on the post on your website is one of the biggest benefits of going through this whole process. If someone replies to the post directly, it will appear as a comment on your website. In the current version of the ActivityPub plugin (1.3), replies to the comment on the website will not be posted as replies in Mastodon. In the upcoming 2.0 release, this functionality will be enabled.

Regardless, you may want to have the discussion using another account – you may not want your website to be your daily driver. If that’s the case, you can capture the discussion that happens on another account via webmentions. To do this, I use a third-party service called brid.gy. On the Brid.gy homepage you want to click on Mastodon, then select the option, “Cross post to a Mastodon account.” Enter the Mastodon server and authenticate.

Brid.gy will now monitor your Mastodon posts and the replies to your posts. If it sees any URL in your post or any replies to those posts it will use the webmention function to send that comment to that URL. In the Webmention plugin settings on your site, you can add brid.gy to the list of domains that are automatically approved, if you want conversations from your Mastodon account (including replies) to automatically appear on the site. You can also use Brid.gy to monitor accounts on Facebook, flikr, Github, Reddit, and Bluesky.

This comes in very handy when your daily driver on social media is not the same as the author or blog account associated with your WordPress site, which is how I operate. All of the likes and comments on this post (as of January 3, 2024) are responses to my [email protected] account and not my @jonathan@jseggers.com account.

What should I expect?

This is not a perfect solution, but it gets the job done. I’ve been running with this setup for several months and haven’t had any issues (apart from my host causing problems – I’ll cover that in the next section). Some of the caveats that I’ve run into so far:

• If you edit a post, your followers may see a notification that a post has been edited in their feed. This only applies to posts that were published after your account was followed. Still, it’s best practice to go live with a finished post and avoid editing. If you must edit a post, you can disable the ActivityPub plugin and then save your changes then enable the plugin again.
• Conversations appear in your comment section, which is great. However, you can’t favorite or boost it directly from the comments, you have to go to the Friends feed and “Show hidden items” to see the replies. From there you can boost and favorite. I have not been able to remove a favorite once favorited in Friends.
• If you reply to a Mastodon comment on your website it will not crosspost to Mastodon. You are not able to use the Friends plugin to reply either. This will be addressed in the 2.0 release of the ActivityPub plugin.
• Your posts won’t appear immediately on other services – in my testing, it can take 5-10 minutes for a new post to appear on Mastodon.

It’s just not working!

The developers of these plugins have done a tremendous job getting the functionality to its current state. With Automatic joining the development of the ActivityPub plugin, I expect that the adoption of these open standards may one day become a part of the WordPress core.

Regardless, sometimes things just don’t work the way we expect. I’ve run into issues with the functionality of ActivityPub, WebFinger, and Nodeinfo on my host because those standards utilize the /.well-known URI. Some hosts (Hostinger and Dreamhost confirmed) do not allow the use of /.well-know on their shared hosting plans. Requests to a URI that contains /.well-know will not be passed through to WordPress for processing. ActivityPub, WebFinger, and Nodeinfo all make use of redirects to point traffic destin for /.well-known to a different path.

Some report creating files called “webfinger” and “nodeinfo” in a .well-known folder, with the requisite server and author details, on their host to get around this, while others cannot. It took me quite a bit of digging around to find my solution.

I run my site’s DNS through Cloudflare, so I used their redirect options to create redirects at the DNS layer rather than relying on the server. The redirects ActivityPub makes use of are as follows:

• /.well-known/nodeinfo -> /wp-json/activitypub/1.0/nodeinfo
• /.well-known/x-nodeinfo2 -> /wp-json/activitypub/1.0/nodeinfo2
• /.well-known/webfinger -> /wp-json/activitypub/1.0/webfinger

If you have the Nodeinfo plugin installed, you can use the following:

• /.well-known/nodeinfo -> /index.php?rest_route=/nodeinfo/discovery
• /.well-known/x-nodeinfo2 -> /index.php?rest_route=/nodeinfo2/1.0

If you have the Webfinger plugin installed, you can use the following:

• /.well-known/webfinger?resource=acct%3Ajonathan%40jseggers.com -> /?well-known=webfinger&resource=acct%3Ajonathan%40jseggers.com (replace your username where appropriate).

In the Cloudflare options I used the options URI CONTAINS then the /.well-known path for the incoming request and then used the STATIC option for the redirection URL. For the first five entries, I check the box to preserve the query string. For the last webfinger entry I do not since the query has to be hard coded with the account names.

Other settings?

Besides the above issues, which are unique to my host. I use a redirection plugin and have been monitoring 404 logs for any requests. I’ve seen several requests regarding nodeinfo or webfinger that result in 404 errors. Because I have issues with my host and the /.well-known URI, this may be unique to me, or it may not. I’ve added redirects where I see requests for webfinger or nodeinfo.

Lastly, if you’re using a caching program I recommend excluding the following paths:

• /friends/
• /author/
• /.well-known/
• /well-known/
• /api/
• /wp-json/

Questions?

Feel free to ask questions in the comments. I will do my best to answer, but I’m no expert in any of these plugins. If you’re having an issue with a specific plugin I recommend asking in the support section of the specific plugin page on WordPress.org or linking through to the GitHub page for each plugin and asking your questions there.