WordPress 7.1 adds `wp_ability_validate_input()` and `wp_ability_validate_output()` while clarifying that REST-style `validate_callback` and `sanitize_callback` schema keywords are not executed by the Abilities API. The new `wp_ability_invoked` action runs before normalization, validation, permission checks, and short circuits, including failed calls, so careless audit logging can store secrets or personal data.
Use this for plugin developers, AI integrations, administrators, security teams, observability owners, and any site exposing custom Abilities or user-information fields.
Quick answer
Test the complete invocation lifecycle, not only successful execution. Feed valid, malformed, oversized, unauthorized, short-circuited, and exception-producing inputs. Log an allowlisted event envelope with a generated correlation ID, ability name, actor class, outcome, timing, and redacted field names. Never write raw input at the pre-validation hook unless a narrow incident procedure explicitly requires it.
What to check first
- Inventory registered Abilities, input and output schemas, permission callbacks, execution callbacks, lifecycle filters, user-information fields, remote consumers, and every logger attached to invocation events.
- Create valid, missing-required, wrong-type, unknown-field, oversized, secret-bearing, unauthenticated, unauthorized, short-circuited, callback-error, and invalid-output fixtures.
- Trace the pre-invocation action, normalization, input validation, permission check, pre-execution filter, callback, output validation, post-execution filter, response, and exception path with one correlation ID.
- Verify that audit counts include failed attempts while redaction removes tokens, passwords, prompts, personal fields, payment data, free text, and nested values before persistence or export.
- Exercise `get-user-info` field selection with minimum necessary fields and confirm callers cannot request or infer data outside their permission and purpose.
Diagnostic table
Use this table to keep the work practical. It connects the symptom to evidence and a verification step.
| Action | Evidence to collect | How to verify |
|---|
| Map the full invocation lifecycle | Inventory registered Abilities, input and output schemas, permission callbacks, execution callbacks, lifecycle filters, user-information fields, remote consumers, and every logger attached to invocation events. | Malformed and unauthorized requests never reach the execution callback or external service. |
| Build failure and permission fixtures | Create valid, missing-required, wrong-type, unknown-field, oversized, secret-bearing, unauthenticated, unauthorized, short-circuited, callback-error, and invalid-output fixtures. | Audit events distinguish invoked, rejected, short-circuited, executed, output-invalid, and failed outcomes. |
| Redact before audit persistence | Trace the pre-invocation action, normalization, input validation, permission check, pre-execution filter, callback, output validation, post-execution filter, response, and exception path with one correlation ID. | A seeded secret in every nesting level is absent from files, database logs, traces, exports, screenshots, and alerts. |
| Validate input and output explicitly | Verify that audit counts include failed attempts while redaction removes tokens, passwords, prompts, personal fields, payment data, free text, and nested values before persistence or export. | Repeated retries use stable operation identity and create no duplicate external effect. |
Why this usually happens
- The invocation action is intentionally early enough to observe calls that never reach permission or execution.
- Raw input has not been normalized or validated when that action fires.
- Developers may assume REST schema callbacks execute because the schema keywords look familiar.
- An output schema failure can occur after an external side effect unless the ability is designed for idempotency.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
add_action( 'wp_ability_invoked', function( $ability_name ) {
my_audit_log( array(
'ability' => sanitize_key( $ability_name ),
'event' => 'invoked',
'input' => '[redacted]',
) );
}, 10, 1 );
// Validate explicit fixtures with the new helper functions.
Safe fix order
Do the work in a sequence that makes each result easy to prove. Stop if a step produces new evidence that changes the incident scope.
- Map the full invocation lifecycle
- Build failure and permission fixtures
- Redact before audit persistence
- Validate input and output explicitly
- Minimize exposed user fields
Decision rule
Pass when authorized valid calls produce schema-valid output, every failure is counted without raw sensitive values, unauthorized calls create no side effect, short circuits are attributable, and user-information responses contain only explicitly requested permitted fields.
What to tell the client or owner
Give the owner the affected versions, exact workflow, observed result, business impact, evidence location, temporary control, named owner, and next review time. Remove credentials and personal data from shared screenshots and logs.
Production verification checklist
- Malformed and unauthorized requests never reach the execution callback or external service.
- Audit events distinguish invoked, rejected, short-circuited, executed, output-invalid, and failed outcomes.
- A seeded secret in every nesting level is absent from files, database logs, traces, exports, screenshots, and alerts.
- Repeated retries use stable operation identity and create no duplicate external effect.
Mistakes to avoid
- Do not change several plugins, cache rules, firewall settings, or integrations before preserving a baseline.
- Do not treat one successful browser test as proof for APIs, retries, alternate clients, background jobs, or mixed-version fleets.
- Do not paste secrets, personal data, complete production payloads, or customer records into tickets, screenshots, or long-lived logs.
- Do not close the test until the final user-visible state and the server-side evidence agree.
Questions teams ask during testing
Does `wp_ability_invoked` mean an Ability executed?
No. It fires before validation and permission checks, so invocation and successful execution need separate metrics.
Do REST `validate_callback` schema keywords run here?
No. The WordPress 7.1 dev note says those REST-specific callbacks are not executed by the Abilities API.
When HandL WP should help
Bring in HandL WP when a production checkout, form, editor, security gate, performance incident, or attribution workflow is at risk. We can preserve evidence, isolate the failing layer, make the smallest corrective change, and verify the result across WordPress, connected services, logs, and the user journey.
If this is active on a production site, review a WordPress Abilities integration.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Separate ability exposure from authorization
Use the WordPress 7.1 public flag migration checklist to classify client exposure, then run the REST and MCP permission boundary test with allowed, denied, wrong-object, and revoked-credential fixtures.
Trace ability discovery before authorization
Run the WordPress 7.1 wp_get_abilities filter-order and REST query test to compare declarative arguments, callbacks, global filters, REST visibility, and metadata coercion before the separate permission assertion.
Add route-level first-day budgets
Turn validation evidence into the WordPress 7.1 REST API first-day error budget with client, authentication, schema, type, latency, retry, owner, and rollback gates.
Audit public ability fields and caches
Continue with the WordPress 7.1 ability public-flag sensitive-field audit to separate discovery from execution and test schemas, errors, roles, caches, logs, and tool transcripts.
Helpful references