Three significant developments landed across the wordpress ecosystem this month. WordPress 7.1 has reached Release Candidate status, independent penetration testing has exposed serious gaps in managed hosting security claims, and practical methods for connecting AI agents directly to WordPress via MCP are gaining traction. Our team has been tracking each of these threads closely. Here is what matters for agencies and site owners right now.

Key Takeaways

• WordPress 7.1 RC1 is now available for testing, following a steady beta cycle that included Beta 3 in July.
• Penetration testing of major WordPress hosting providers revealed that most failed to block WordPress-specific vulnerabilities despite marketing themselves as “secure.”
• AI agent integration with WordPress through the Model Context Protocol (MCP) is now a documented, step-by-step process.
• Agencies should be staging WordPress 7.1 RC1 now to identify plugin and theme conflicts before the stable release.
• Hosting provider selection requires hands-on security validation, not reliance on marketing copy.

WordPress 7.1 RC1 Is Live — Start Testing Immediately

The first Release Candidate for WordPress 7.1 dropped in August, as confirmed by the official WordPress 7.1 RC1 announcement. This follows the WordPress 7.1 Beta 3 release in July, which was the final beta before the RC phase began.

RC1 means the core team considers the release feature-complete. Bug fixes may still land, but no new features will be added. For our clients, this is the signal to begin structured compatibility testing. We spin up staging environments mirroring each production site, apply the RC, and run through critical user flows: forms, checkout processes, membership areas, custom blocks.

Plugin and theme developers have a narrow window to patch any incompatibilities. We flag issues upstream where possible and document workarounds for client sites that depend on slower-moving third-party code. Waiting until stable release day to discover a conflict is not an option we accept.

“Secure Hosting” Claims Fail Under Penetration Testing

Maciek Palmowski’s WordCamp Europe presentation delivered hard data on a question we hear constantly from clients: does managed WordPress hosting actually protect against WordPress-specific attacks? The answer, based on his findings discussed in this WP Tavern podcast episode on testing secure WordPress hosting, is largely no.

Palmowski ran penetration tests against multiple providers. The majority of WordPress-specific vulnerabilities passed straight through their defences. Generic server-level protections were present, but application-layer threats — the kind that exploit plugin vulnerabilities, XML-RPC abuse, or authentication weaknesses — were not consistently blocked.

This matters for every agency recommending hosting to clients. We now treat hosting security claims as unverified until we can confirm specific protections are in place:

• Web Application Firewall (WAF) rules targeting known WordPress exploit patterns
• Active file integrity monitoring
• Automated malware scanning at the application layer
• Rate limiting on wp-login.php and xmlrpc.php

If a host cannot demonstrate these capabilities, we layer in additional security tooling ourselves. The marketing copy on a hosting provider’s landing page is not a security strategy.

AI Agents Now Connect Directly to WordPress via MCP

The Model Context Protocol (MCP) is enabling AI agents to interact with WordPress programmatically. WPBeginner published a detailed walkthrough on this integration, which has generated active community discussion as seen in their guide on connecting AI agents with WordPress using MCP.

MCP provides a standardised way for AI tools to read, create, and manage WordPress content. For our team, the immediate applications are content drafting workflows, bulk metadata updates, and automated reporting pulls. We are evaluating MCP-based connections for clients with high-volume publishing needs where manual CMS interaction creates bottlenecks.

Security is the primary concern. Any AI agent with write access to a WordPress installation must operate under tightly scoped permissions with full audit logging. We treat MCP endpoints with the same caution as any other API surface.

The WordPress ecosystem is moving fast across three fronts simultaneously. Core development is on schedule, hosting security assumptions are being challenged with real data, and AI integration is becoming practical rather than theoretical. Our team is acting on all three right now.

Frequently Asked Questions

What is WordPress 7.1 RC1 and should I install it on my live site?

WordPress 7.1 RC1 is a Release Candidate, meaning it is feature-complete but still undergoing final bug fixes. You should only install it on staging or test environments — never on production sites.

How do web designers test whether their hosting is actually secure for WordPress?

Run targeted penetration tests that focus on WordPress-specific attack vectors like plugin exploits and authentication brute-forcing. If your host only provides generic server-level protections, you need additional application-layer security tooling.

Why does managed WordPress hosting sometimes fail to block known vulnerabilities?

Many hosts focus on infrastructure-level security such as DDoS protection and firewalls but lack WordPress-specific WAF rules. This means application-layer threats that exploit plugin or theme vulnerabilities can pass through undetected.

What is MCP and how does it connect AI agents to WordPress?

MCP (Model Context Protocol) is a standardised protocol that allows AI tools to read, write, and manage WordPress content programmatically. It enables automated workflows like content drafting and metadata management directly within the CMS.