WordPress 7.0 lands on Tuesday 20 May, five days after this column publishes, and for the roughly 43 percent of websites built on WordPress globally it is the most significant release in two years. For New Zealand businesses running their own sites, two things matter. First, the headline feature that has been promoted for over a year has been pulled at the last possible moment. Second, what did ship changes how AI gets plugged into your site in a way that introduces a real cost-control problem the platform itself does not solve.
Real-time collaboration, the Google-Docs-style multi-user editing that was meant to be the marquee feature of 7.0, was removed from the release on 8 May. Project lead Matt Mullenweg cited “surface area, race conditions, server load, memory efficiency, and recurring bugs found through fuzz testing”, problems that emerged late in the cycle and could not be cleanly resolved without delaying the release. The decision was made, in the team’s own words, “in service of shipping a stable and reliable WordPress 7.0 release”. Collaborative editing is now slated for 7.1.
What did make the cut is more interesting and, for site owners, more consequential. WordPress 7.0 introduces the Connectors API, a core framework for registering credentials to external services, and the AI Client, a provider-agnostic PHP interface for AI requests. In plain English, when you upgrade to 7.0 you gain a new screen at Settings → Connectors where you paste in a single API key for OpenAI, Anthropic, or Google. After that, any plugin on your site that needs to call an AI model uses your key, automatically, without any extra setup.
That sounds convenient, and it is. It also creates a problem.
The WordPress core team has explicitly chosen not to put any spending controls into 7.0. There is no per-plugin budget, no daily rate cap, and no monthly ceiling anywhere in core. There is a filter called wp_ai_client_prevent_prompt, but it only checks user permissions, it does not limit volume or cost. Every plugin you have installed shares the same key. A misconfigured plugin that fires a prompt on every page load, or runs in a loop because of a coding error, will quietly burn through credits until you happen to look at your provider dashboard. For a small New Zealand business that installs a couple of new plugins to try out AI summaries or chatbots, the first invoice could be the moment the problem is discovered.
This is not a hypothetical concern. The pattern of shared infrastructure with no native rate-limiting has caused real cost incidents in other ecosystems. The pragmatic mitigation is straightforward and worth doing before you upgrade. Set a hard spending cap directly on the provider account first, OpenAI, Anthropic and Google all let you do this in their billing dashboards, and only then paste the key into WordPress. Treat the cap as the brake of last resort. Community rate-limiting plugins will arrive within weeks of the release, but nothing exists in core on day one.
There is a second, less glamorous change that catches a surprising number of New Zealand sites every release. WordPress 7.0 drops support for PHP 7.2 and 7.3. The minimum is now PHP 7.4, and 8.2 or higher is recommended. PHP versions are largely invisible to non-technical site owners because they are set by the hosting plan, not by WordPress itself. On budget shared hosting, particularly older plans that have been quietly running since 2020, PHP versions are sometimes still pinned to obscure defaults. If your site is on a host like SiteGround, Kinsta, or one of the established New Zealand providers, you are probably fine. If you are on a generic cPanel host that you have not touched in years, log in and check. The fix is usually one click in the hosting control panel.
The broader picture is that 7.0 marks WordPress’s first real attempt to build AI integration into the platform itself rather than leaving it to a fragmented plugin ecosystem. The design choice, a shared key, a shared client, and multiple plugins drawing on both, is the same pattern you see in mobile operating systems. When it works, the user experience is simpler. The trust model also shifts. Plugin authors who previously could not afford to build serious AI features now have a free runway, which is good for innovation. It also means the burden of judgment falls on site owners to know which plugins are well-built and which are not. For agencies and developers, the practical implication is that “what plugins are installed on this site” becomes a question with cost consequences, not just security ones.
For most New Zealand businesses, the right approach in the next fortnight is unromantic. Do not upgrade to 7.0 on the day it ships. Wait two or three weeks for the inevitable point releases that fix the issues fuzz testing did not. When you do upgrade, before you enable any AI features, set a provider-side spending cap. Then audit your plugin list and ask whether each plugin really needs AI access, or whether it has been bundled in because the framework now makes it trivial. Treat the new Connectors screen as you would treat a credit card on file. The technology is not the risk. The convenience is.
Roger McSaveney is General Manager of Forge Creative, an Auckland web design and development agency.
What plugins are you running, and have you thought about how they handle AI calls? Tell us in the comments below.
This article was written by AI, briefed to report the facts, hopefully without some of the bias people bring to the job 🙂
Leave a Reply