WordPress 7.2 Beta 1 brings a Secrets API and a faster admin

# TagsWordPress

The WPhost team21 Oct 20269 min read

WordPress 7.2 Beta 1, the first test build of the next major release, came out on 20 October 2026. The final 7.2 is scheduled for 8 December, and before then the schedule has three more betas and three release candidates (RC).

The beta is for testing only and does not belong on a live site. Now is the time, though, to find out whether your theme and plugins will work with the new version. Below you will find which changes matter to the owner of a WordPress site or WooCommerce store, and how to try the beta on a copy.

What WordPress 7.2 Beta 1 brings

For a site owner the changes that matter most are the new way plugins will store passwords and keys, image processing in the browser and the faster admin, and the next sections cover them. The rest mostly concerns the people who write and design the content.

An "On This Day" widget on the dashboard shows posts published on the same date in earlier years.
Notes now sit in the editor itself, next to the block settings, and get emoji reactions.
Global Styles get a filter for blocks with changed styles, styling for form elements and text shadows.
The Gallery gets separate settings for different screen sizes.
A random post can be opened through a dedicated URL.

Developers get new capabilities in the Abilities API, the Interactivity API and the HTML API. The testing post published the same day also mentions a new default theme, Ipsum, which the beta announcement does not cover.

The Secrets API and the keys plugins store

Many plugins connect to outside services and keep a key or a password for them, for a courier, an email service or an invoicing tool, say. According to the Secrets API proposal, plugins typically write such a key to the database in plain text. That puts it in every backup, every copy of the site and every database export.

The Secrets API gives plugins a standard, secure way to store this kind of data. The announcement says the keys are encrypted at rest, can be rotated, and can be kept in a different storage provider.

The benefit will not arrive on its own. The API only helps plugins that start using it, and keys already in the database are not moved over automatically. According to the proposal, 7.2 will not have an admin screen for them either, and keys will be managed by plugins and through WP-CLI.

The proposal has the encryption key come from a dedicated constant or, if there is none, from the salts in wp-config.php. If the salts are changed, as they are after cleaning up a hacked site, the stored keys have to be entered again. The same goes for moving the site and for a test copy. The details may still change before 7.2 ships.

Images are resized in the browser

When you upload an image, WordPress makes several smaller sizes of it for different places on the site. Until now that happened on the server. In 7.2, images can be resized, compressed and converted in the browser before they are uploaded. According to the testing post, this also covers uploads through Media > Add New.

For a store whose product photos come straight from a phone, that means less work for the server on every upload. The announcement promises better support for modern image formats but gives no figures for file sizes or page speed. If the browser cannot do the work, WordPress is meant to fall back to processing on the server, so on the copy, upload images from different browsers.

A faster admin

Until now WordPress combined the admin's scripts and stylesheets into large shared files. In 7.2 they load individually, so the browser can keep them in its cache instead of downloading them again. WordPress also prefetches the screen you are likely to open next. The announcement gives no figures, so compare for yourself on the copy, for example while moving between orders and products.

How to test WordPress 7.2 on a copy of your site

First make a backup as described in the backup guide, and restore it as a copy on a subdomain such as test.primer.bg. If your cPanel has WP Toolkit with cloning, the copy takes a few clicks, as shown in the WP Toolkit guide. Turn off search engine indexing for the copy under Settings > Reading, and on a store make sure the copy does not email real customers. If your host is updating PHP these days because of today's security release, check that the copy and the live site run the same version.

There are two ways to put the beta on the copy.

With the WordPress Beta Tester plugin. Install it on the copy, open Tools > Beta Testing, choose the Bleeding edge channel and the Beta/RC Only stream, save, and update from Dashboard > Updates.
With WP-CLI, if your cPanel has Terminal. How to work with it is covered in the WP-CLI guide.

The commands below show the version, update the copy to Beta 1 and show the version again. Run them in the copy's folder, never in the live site's. To go back, restore the backup.

Bash

# cPanel > Terminal, in the copy's folder, not the live site
wp core version
wp core update --version=7.2-beta1
wp core version

What to check before 8 December

On the copy, go through the things your sales depend on.

Place a test order with cash on delivery and see whether your Econt and Speedy plugins calculate shipping.
Check that invoices are issued.
Go through orders, products and plugin settings in the admin.
Open Tools > Site Health and look for new warnings.

If something breaks, note where and after which step it happened, then write to the author of the plugin or theme.

Sites installed with WordPress 5.6 or later get major versions automatically by default, unless the host has changed that. The same applies if you have turned on automatic updates for all versions in Dashboard > Updates. In that case 7.2 may install itself soon after 8 December, so do not leave the check for the last week. Before you update the live site, look at each plugin's page on wordpress.org to see which WordPress version it has been tested up to (Tested up to).

What we do

Under monthly maintenance, WordPress, theme and plugin updates are tried first in staging. Every change is in Git and reaches the live site only after the tests, as described in how we work. Write to us through the inquiry form and we will get in touch.

Frequently asked questions

When does WordPress 7.2 come out?

The final WordPress 7.2 is scheduled for 8 December 2026. The first test build, WordPress 7.2 Beta 1, came out on 20 October 2026, and before the final release the schedule has three more betas and three release candidates (RC).

Can I install WordPress 7.2 Beta 1 on my live site?

No. WordPress explicitly asks that the beta not be installed or tested on production or mission-critical sites. Try it on a copy of the site instead, for example on a subdomain such as test.primer.bg.

What is the Secrets API in WordPress 7.2?

A standard, secure way for plugins to store passwords and keys for outside services, such as a courier, an email service or an invoicing tool. Today plugins typically write such a key to the database in plain text, which puts it in every backup, copy and database export. According to the announcement, the Secrets API keeps keys encrypted at rest, lets them be rotated and allows them to live in a different storage provider.

Will the Secrets API protect the keys on my site straight away?

No. The Secrets API only helps plugins that start using it, and keys already in the database are not moved over automatically. According to the proposal, WordPress 7.2 will not have an admin screen for them either, and keys will be managed by plugins and through WP-CLI.

What happens to Secrets API keys if I change the salts in wp-config.php?

According to the proposal, the encryption key comes from a dedicated constant or, if there is none, from the salts in wp-config.php. If the salts change, as they do after cleaning up a hacked site, the stored keys have to be entered again. The same goes for moving the site and for a test copy, and the details may still change before 7.2 ships.

What does WordPress 7.2 change about image uploads?

In WordPress 7.2, images can be resized, compressed and converted in the browser before they are uploaded, including through Media > Add New. For a store whose product photos come straight from a phone, that means less work for the server on every upload. If the browser cannot do the work, WordPress is meant to fall back to processing on the server.

Will the admin be faster in WordPress 7.2?

WordPress 7.2 loads the admin's scripts and stylesheets individually instead of in large shared files, so the browser can keep them in its cache. WordPress also prefetches the screen you are likely to open next. The announcement gives no figures, so compare for yourself on a copy, for example while moving between orders and products.

Will my site update itself to WordPress 7.2?

Sites installed with WordPress 5.6 or later get major versions automatically by default, unless the host has changed that. The same applies if you have turned on automatic updates for all versions in Dashboard > Updates. In that case 7.2 may install itself soon after 8 December 2026, so do not leave checking your theme and plugins for the last week.

Sources