Support for WP REST Cache

[obenland]

See https://wordpress.org/support/topic/caching-activity-pub-endpoints/
See https://epiph.yt/en/blog/2025/accidental-ddos-through-activitypub-plugin/

Proposed changes:

Other information:

• Have you written new tests for your changes, if applicable?

Testing instructions:

• Go to '..'

Changelog entry

• Automatically create a changelog entry from the details below.

Changelog Entry Details

Significance

• Patch
• Minor
• Major

Type

• Added - for new features
• Changed - for changes in existing functionality
• Deprecated - for soon-to-be removed features
• Removed - for now removed features
• Fixed - for any bug fixes
• Security - in case of vulnerabilities

Message

/cc @MatzeKitt

[obenland]

Proper cache invalidation will be the biggest challenge. New posts, new comments, user meta updates, blog user option updates, etc.

It would also be nice if we could avoid blanket-invalidating all cached ActivityPub endpoints for all of these, and be more targeted.

[MatzeKitt]

So we need to keep track of any change regarding any of the endpoints? Also, do we need to check whether the change does actually change the API endpoint response or should we always invalidate the cache when it might change the response?

I guess we currently have no decorated list of changes we need to look for?

[obenland]

Also, do we need to check whether the change does actually change the API endpoint response or should we always invalidate the cache when it might change the response?

Looking a bit more at the plugin, I think we'll have to be pretty broad about invalidating caches. Most of the endpoints are user/actor-based, and WP REST Cache doesn't have a concept for that. It's post type and post_id, and that seems to be pretty much it.

I think your approach of defining a custom type and invalidating all associated endpoints is probably the safest.