Skip to content

Piero Bosio Social Web Site Personale Logo Fediverso

Social Forum federato con il resto del mondo. Non contano le istanze, contano le persone

WordLand on self-hosted sites

Herve Family
3 2 16
  • Are you familiar with WordLand? I’ve mentioned it on this blog a few times: it’s a WordPress editor, designed for writers.

    @davew built WordLand using the WordPress.com REST API, thus making the app available to everyone with a WordPress.com account. Once you’re logged in, you can pick any WordPress site connected to your account. It can be a WordPress.com site. It can also be a site hosted on another platform but using the Jetpack plugin to allow it to communicate with WordPress.com.

    It works really well. It allows you to log in only once, to manage and publish on multiple sites from a central editor dashboard. This was one of the ideas behind the WordPress.com REST API when it was first built.

    Screenshot of the WorldLand.social homepage

    Of course, this means the WordLand app is only available to folks with a WordPress.com account, and using a site that’s either hosted on WordPress.com or where they’re able to install plugins like Jetpack.

    If WordLand were to drop that requirement, it would be immediately usable by more people. It would open it to authors on sites where they don’t have permissions to install plugins, for example.

    In this post, Dave outlined his idea for making WordLand available for self-hosted WordPress sites.

    I’ve thought a bit about what that switch would mean in practice. I thought I’d share my first ideas here, for you Dave to consider as you start working on this project.

    In my mind there are a few things to consider to get WordLand to work with self-hosted WordPress sites.

    Mapping endpoint requirements

    Self-hosted sites ship with a REST API and endpoints, listed here.
    Those endpoints allow viewing, publishing and editing posts, which is the base of what WordLand does. They also allow listing and editing categories, uploading media,…

    A first step may be to map the WordPress.com API endpoints used by WordLand with their equivalents on self-hosted sites.
    The REST API docs will be a big help there. I am thinking you may have all WordLand needs with the endpoints available on all self-hosted WordPress sites today.

    As part of that mapping project, you’ll see that the expected schema is different for the 2 APIs. Although similar, there are differences. You’ll find the biggest differences may be in how categories are handled for example, since they are different from site to site. That’s something worth mapping as well, since it will mean making changes to the app accordingly.

    Authentication

    Once you have the endpoints figured out, you’ll need to tackle what’s probably going to be the hardest part: authentication.

    With self-hosted sites, there is no centralized way to handle authentication. Folks will need to authenticate for each site where they want to publish. Application passwords are probably the best approach to take. They are available for all self-hosted sites and don’t require site owners to install anything. You’ll need to build a flow where site owners start by providing a site URL instead of clicking a log in button. That site URL, when passed to WordLand, allows the app to hit the REST API for that site, get the authentication URL, and redirect the site owner there so they can log in and go through the flow to create an application password and then come back to WordLand with that password.
    They’ll need to repeat that for every new site they want to use with WordLand.

    A WordLand.social account for everyone?

    Another alternative may be to first offer every WordLand user an option to log in to an account created with WordLand. The different connections and authentication information for one or more sites would be stored in that account. It would allow WordLand.social to keep working like it does today, as a central platform from which you can publish to multiple sites.

    And the extra

    Keep in mind that Jetpack and WordPress.com also provide more than just the REST API endpoint and the authentication layers. They also provide other features you rely on in WordLand, like markdown support.

    That’s all what comes to mind at first. Hopefully it helps you get started!

  • Why not offer both options? Access WordLand.social and any connected sites with or without WordPress.com and Jetpack.

    And what about Gravatar as the gateway to federated WordPress and the whole Fediverse/open web?

    Technically a Gravatar account also comes with a WordPress.com account, “but it does not require you to have a WordPress site, or use any other services from WordPress.com or Automattic.”

    The optics of independence are better and more manageable with the Gravatar brand — even better if the .com requirement is minimized and clarified.

  • Why not offer both options? Access WordLand.social and any connected sites with or without WordPress.com and Jetpack.

    And what about Gravatar as the gateway to federated WordPress and the whole Fediverse/open web?

    Technically a Gravatar account also comes with a WordPress.com account, “but it does not require you to have a WordPress site, or use any other services from WordPress.com or Automattic.”

    The optics of independence are better and more manageable with the Gravatar brand — even better if the .com requirement is minimized and clarified.

    @dpknauss Yep, I agree we could have both options.

    I don’t know if Gravatar is a good alternative to WordPress.com as a login system, though. As you mentioned, Gravatar and WordPress.com are ultimately the same thing ; it’s a different brand but the same logging system in practice.


Gli ultimi otto messaggi ricevuti dalla Federazione
  • @deadsuperhero

    What kind of customizations did you have in mind? What would you like your site to look like?

    I’ve learned to really appreciate the flexibility of the block-based themes in WordPress ; they offer a lot that was previously only available to folks comfortable with PHP. That said, this is mostly about layout and display. If you want to display custom data, you may still have to dive into code to get what you need. That is, unless someone else already developed it 🙂

    The ActivityPub plugin includes more and more blocks that can help bring Fediverse functionality to your site, to create real Fediverse profiles for authors. If you have ideas of more things we could implement, please let us, either in the WordPress.org support forums for the plugin, on GitHub, or right here (you can ping @pfefferle or me any time!)

    read more

  • @nicosomb

    Notre commune a un site officiel qui sert beaucoup. Toutes les annonces officielles y sont publiées, et sont ensuite partagées sur les réseaux sociaux, essentiellement Facebook, mais aussi LinkedIn. YouTube aussi est de plus en plus utilisé ; les réunions du conseil y sont streamés en live, puis donc disponibles sur le long terme, et mises à disposition sur le site (et donc dispo par RSS aussi). De nombreuses catégories peuvent être suivies via des flux différents, ce qui est très utile.

    Certaines communications sont encore seulement publiées sur Facebook malheureusement, mais le pense que les choses se sont améliorées de ce côté là. On peut maintenant se tenir au courant d’une grande majorité des nouvelles de la commune sans se rendre sur Facebook. Bon, on est loin de la présence sur le Fediverse tout de même 🙂

    Toute cette présence est à mon avis le résultat de beaucoup d’éducation et de discussions, et pas quelque chose de forcément naturel pour chacun des élus. Il y a un grand contraste avec les communications de tous les partis se présentant aux élections, y compris le parti de la majorité, qui communiquent essentiellement via Facebook, ont des sites qui ne sont pas à jour, ont leurs programmes disponibles sur Facebook et pas sur le site, …

    read more

  • @nicosomb

    One vaut, 4 main folders (using the PARA method), many (too many) subfolders. I think it could be better, but I haven’t found a better way yet. I’m not too worried about it though, I rely on search, bases, and internal links to navigate across my vault and it works.

    read more

  • I’ve been building an RSS reader for the past year. No unread counts, no inbox to clear. Just a river that flows at its own pace.

    Today it’s live on iPhone, iPad, and Mac. I wrote about everything that went into it.

    Current, an RSS Reader, by @tg

    Current is a new RSS reader that takes a really interesting approach to how we consume feeds. Instead of treating your subscriptions as a to-do list with an ever-growing unread count, it presents your feeds as a river; articles flow in, linger for a while, and eventually fade away on their own.

    Although the app is mac / iOS only, and paid, it’s not completely closed. You can hook it up to existing RSS backends like Feedbin or Miniflux.

    The completionist part of me does miss the idea of reaching “inbox zero.” For me, inbox zero was never about obsessive consumption (or at least I like to think so); it was the permission to walk away. When I’ve read everything, I’m done. I can close the app and move on with my day. I wouldn’t want my RSS experience to turn into a TikTok-like endless scroll where I just keep going without thinking. Current isn’t exactly that though, and that’s where its velocity system gets really interesting.

    Each feed gets assigned a half-life that determines how long its articles stay visible. Breaking news fade away faster than blog posts for example. This means the app naturally surfaces content proportionally to its nature; a prolific news site won’t drown out the small blogs you actually care about. The pace of consumption adapts to the pace of creation, which feels much more respectful of both the reader’s attention and the author’s intent.

    On top of that, Current watches your reading patterns and offers suggestions to help you “quiet” noisy sources. If a feed floods your timeline with 18 articles in one day, or if you keep skipping posts from the same source, it’ll nudge you to rate-limit or mute it.

    I would give the app a try, but it’s iOS and mac-only so far, so I guess I’ll have to wait! 🙂

    read more

  • @dilmandila

    Could you check that the ActivityPub plugin is still active on your site? You seem to be using the Friends plugin but the ActivityFun plugin itself seems disabled.

    You can also post in the plugin’s support forums if that doesn’t help ; we’ll be happy to help!

    read more

  • If you’re an old-time blogger, you probably remember Freshly Pressed. 16 years ago (!), the folks at WordPress.com launched a new blog where they highlighted interesting blog posts from the WordPress.com community every week.

    We iterated on the idea a few times over the years but the main idea stayed the same:

    a curated collection of posts that entertained, enlightened, and inspired. It was our way of saying “we like you, we really like you” to creators, and amplifying their great work for others to find.

    Great Writing Deserves a Spotlight: Freshly Pressed Is Back

    Freshly Pressed went away for the past few years, but I’m happy to say that my team brought it back! It’s got a fresh coat of paint and most importantly, it’s got quite a few interesting blog posts already!

    Im really happy and proud that we were able to get this done. Today, more than ever, I think we could use a bit more humanity on the web.

    The old web felt like a city. You could turn down a random alley and find a weird little shop. You could get lost and discover something beautiful by accident. You could end up in a tiny shop you didn’t know existed or sit on a bench and people-watch.

    Now it’s a mall. Every path leads past a store. Every store wants something from you. Even the “public” space is engineered to keep you moving toward purchase.

    Straight from today’s Freshly Pressed post, I miss being unmarketable on the internet.

    So check some of those blogs out. Give them a Like. Leave a comment. Start following them. And if you find good potential candidates for the next Freshly Pressed post, send them my way! All you need to be featured is a WordPress.com or self-hosted WordPress site running the Jetpack plugin, and most importantly, an interesting, or funny, or unique story to tell!

    Bonus: if you’re more of an RSS person, you can also get Freshly Pressed posts straight in your RSS reader via this feed. Pinging @davew, I know you’re always looking for good feeds 🙂

    read more

  • @jeremy @king I think it has to be a private message!?

    read more

  • read more
Post suggeriti
  • 0 Votes
    1 Posts
    7 Views
    Si parla di:ToggleLa vulnerabilità CVE-2026-23550Il trucco con l’header OriginImpatto e rispostaI ricercatori hanno scoperto una vulnerabilità critica nel plugin Modular DS per WordPress che ha permesso a hacker di compromettere oltre 40.000 siti con un metodo sorprendentemente semplice.La vulnerabilità CVE-2026-23550Il plugin Modular DS, installato su decine di migliaia di siti WordPress, presentava una falla di privilege escalation classificata con un punteggio CVSS di 10.0, il massimo livello di severità. Questa debolezza, identificata come CVE-2026-23550 e catalogata nel database di Positive Technologies, riguardava le versioni 2.5.1 e 2.5.2 e derivava da una mancanza di autenticazione adeguata nell’endpoint API /apimodular-connector/login. Gli attaccanti potevano inviare una richiesta GET a questo endpoint senza credenziali, sfruttando parametri come login, server-information e manager per elevare i privilegi e ottenere accesso amministrativo completo, inclusi moduli per il login, la gestione del server e i backup.Patchstack ha rilevato le prime exploitation il 13 gennaio 2026 alle 02:00 UTC, con richieste anomale provenienti da IP come 45.11.89.19 e 185.196.0.11, che puntavano proprio a quell’endpoint vulnerabile. La tecnica non richiedeva payload complessi né exploit zero-day elaborati: bastava una semplice chiamata HTTP per bypassare i controlli e iniettare un account amministratore, permettendo l’esecuzione di comandi arbitrari sul server sottostante.Il trucco con l’header OriginGli hacker hanno affinato l’attacco aggiungendo un header HTTP "Origin: mo.", una stringa apparentemente innocua che il plugin Modular DS interpretava come indicatore di una richiesta legittima proveniente dal dominio “originmo”. Questo header, combinato con la mancanza di validazione sull’API apimodular-connector, convinceva il sistema a trattare la chiamata come interna, eludendo ulteriori verifiche di sicurezza. In pratica, l’attaccante simulava una richiesta dal pannello di controllo del plugin stesso, ottenendo accesso istantaneo a funzionalità sensibili come la gestione dei backup e le informazioni sul server.Tale approccio, definito il “metodo più pigro” dagli analisti, ha colpito siti vulnerabili in modo massivo perché non necessitava di scansioni personalizzate o tool avanzati: una semplice modifica all’header in una richiesta GET standard era sufficiente per compromettere l’intero ambiente WordPress. Positive Technologies ha dettagliato come questo meccanismo permettesse non solo l’elevazione di privilegi ma anche l’inserimento di backdoor persistenti, con potenziali ramificazioni su database e file system.Impatto e rispostaL’exploit ha interessato circa 40.000 installazioni attive del plugin, esponendo siti a rischi di defacement, furto dati e ulteriore propagazione di malware tramite i manager di backup integrati. Patchstack ha rilasciato una patch urgente nella versione 2.5.2, che introduce validazioni rigorose sugli header Origin e sull’autenticazione API, bloccando richieste non autorizzate attraverso controlli nonce e verifica IP whitelisting.Gli amministratori di WordPress devono verificare immediatamente la presenza del plugin Modular DS, aggiornarlo alla versione corretta e monitorare i log di accesso per endpoint sospetti come /apimodular-connector/.Questa discussione è aperta anche su Feddit in @informatica
  • 0 Votes
    5 Posts
    43 Views
    @thibaultmol @activitypub.blog I added the alt-text, thanks for the reminder!
  • 0 Votes
    1 Posts
    9 Views
    ActivityPub für WordPress, ein kurzer Vortrag.Matthias Pfefferle, der Entwickler des ActivityPub-Plugins für WordPress, hat einen sehr interessanten Vortrag darüber gehalten, wie es mit dem Plugin weitergehen soll und welche Probleme es gibt.https://blog.fedispace.de/activitypub-fuer-wordpress-ein-kurzer-vortrag/#WordPress #ActivityPub
  • 0 Votes
    1 Posts
    15 Views
    "The conversation also pulled in voices from outside the WordPress bubble. Web pioneer @davew, known for his work on blogging, RSS & podcasting, left a comment on Hamze’s post: “I love this piece—I see the same rebirth possible.” He linked to his August essay, Think Different about #WordPress, where he compared its potential to federated platforms like Mastodon & Bluesky and highlighted underused strengths like its stable APIs and real-time RSS features."https://www.therepository.email/nick-hamzes-cool-kids-post-kicks-off-fresh-debate-on-wordpresss-image-problem