For most of the past two years, the conversation about artificial intelligence and your website has been about traffic. Search engines answer questions without sending a click. Shopping assistants compare products on a customer’s behalf. I have written about both in this column. The quieter and more consequential change is now arriving in the plumbing itself. The software that runs a large share of the world’s websites, and a very large share of New Zealand’s small business sites, is being rebuilt so that AI agents can read and act on them directly.
That software is WordPress, and the change has a version number. WordPress 7.1 reached its first beta on 15 July and is scheduled for final release on 19 August, timed to coincide with WordCamp US, according to the official developer blog. Buried in an otherwise ordinary release is a set of features that change what a website is at a technical level. For the first time, a standard WordPress install will ship with a built-in, machine-readable way for an AI agent to understand its settings, its content and its users.
The mechanism is called the Abilities API. Think of it as a structured menu of things a site can do, written in a format that software rather than a human is meant to read. The foundations were laid quietly in WordPress 6.9 and extended in 7.0 earlier this year. What the 7.1 proposal adds, published by the core team on 2 July, is the first set of ready-made abilities that ship with WordPress itself. They are named plainly. One reads a site’s configuration, one retrieves its posts and pages, and one returns information about the people who hold accounts on the site.
I want to be precise about what this does and does not mean, because the headline version tends to frighten people who run a business rather than a server. All three of the new abilities are read only. None of them let an agent change or delete anything. Each one runs a permission check against the account making the request, so an agent can only see what the logged-in user is already allowed to see, and sensitive fields stay hidden unless that user has the right to view them. Settings and content types are not exposed by default either. A developer has to opt each one in through a flag the proposal calls show_in_abilities. Nothing on your site becomes agent-readable until someone deliberately turns it on.
Even inside the WordPress project this has not been a smooth ride, which is worth knowing. Several contributors argued that the new abilities had not been tested enough to belong in core yet, and recommended letting them mature in a plugin for a full release cycle first. That is a healthy argument to have in public, and it tells you the direction of travel is settled even if the timing is contested. The abilities are coming. The debate is only about how fast.
The feature I find more interesting for business owners sits alongside the read abilities and has drawn less attention. WordPress 7.1 proposes a new content type called Knowledge, described by the team as a single place to store site knowledge with permissions and revisions built in. It ships with three kinds of entry, called guideline, memory and note. In plain terms, it is a place to write down the rules of your business in a form an AI agent is expected to consult. Your returns policy, your tone of voice, the fact that you do not ship rural on a Friday, the difference between your two nearly identical products. Today that knowledge lives in a staff member’s head or a scattered set of pages. WordPress is building a proper home for it, with the same versioning and access control the rest of your content already has.
Put the two features together and the shape of the next few years becomes clear. The shopping assistants and AI browsers I have written about before have to guess at your business by scraping whatever your public pages happen to say. Sites built on the newer WordPress will be able to hand an agent a clean, structured, permissioned answer instead. The website stops being only a page a person reads and becomes something a machine can query. For a web design and development agency this is a real shift in what we are asked to build, and it is the first time the standard toolset has met AI agents halfway rather than leaving it to custom code.
So what should a New Zealand business actually do about this. Not much this month, and that is the honest answer. WordPress 7.1 is still in beta, the read abilities are off until switched on, and none of this changes how a customer using a browser experiences your site tomorrow. Rushing to expose data to agents you do not yet understand would be a mistake. The sensible posture is to update as you normally would once 7.1 is stable and well tested, to ask whoever maintains your site whether any abilities are being switched on and why, and to treat user data with the same care you always should. Read only is not risk free when the thing doing the reading is an automated agent you did not build.
The larger point is one I keep returning to. The web your customers see is only half of it. The other half is increasingly a set of interfaces that other software reads on their behalf, and the platforms most New Zealand businesses already run are quietly being fitted to serve that second audience. You do not have to move first. You do want to know it is happening, so the decision about what to expose stays yours rather than a default someone else picked.
Roger McSaveney is General Manager of Forge Creative, an Auckland web design and development agency.
What would you want an AI agent to know about your business, and what would you keep off limits. Share your thoughts in the comments below.
This article was written by AI, briefed to report the facts, hopefully without some of the bias people bring to the job 🙂
Leave a Reply