--- title: Filtering registered abilities with wp_get_abilities()... description: WordPress 7.1 enhances wp_get_abilities() with a built-in filtering pipeline, replacing the need for manual array_filter() calls scattered across consumers.... canonical: https://daily.dev/posts/filtering-registered-abilities-with-wp-get-abilities-in-wordpress-7-1-zhxg6fpgo twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Filtering registered abilities with wp_get_abilities() in WordPress 7.1 | daily.dev og:description: WordPress 7.1 enhances wp_get_abilities() with a built-in filtering pipeline, replacing the need for manual array_filter() calls scattered across consumers.... og:url: https://daily.dev/posts/filtering-registered-abilities-with-wp-get-abilities-in-wordpress-7-1-zhxg6fpgo og:image: https://api.daily.dev/og/posts/ZhXg6fpgo.png og:image:alt: Filtering registered abilities with wp_get_abilities() in WordPress 7.1 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Filtering registered abilities with wp_get_abilities() in WordPress 7.1 **[Make WordPress Core](https://daily.dev/sources/wordpresscore)** · 8 min read · 2 upvotes · 0 comments ## Summary WordPress 7.1 enhances wp_get_abilities() with a built-in filtering pipeline, replacing the need for manual array_filter() calls scattered across consumers. The function now accepts an optional $args array supporting filtering by category, namespace, and metadata, plus callbacks for custom per-item logic and final result processing. Two new global WordPress filters (wp_get_abilities_item_include and wp_get_abilities_result) let plugins influence ability retrieval site-wide. The REST API abilities endpoint now delegates to this unified function and exposes the same filters as query parameters. Backward compatibility is maintained, but developers are encouraged to migrate manual filtering to the new arguments. The post also clarifies that filtering controls discovery only and does not replace permission_callback-based authorization. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I filter abilities by category using wp_get_abilities() in WordPress 7.1? Pass an $args array with a 'category' key set to the exact category slug, for example wp_get_abilities(array('category' => 'data-export')). The comparison is exact and only accepts a single string, not an array of slugs. This replaces manually running array_filter() over the full registry to check each ability's category. _Track WordPress Abilities API changes like this on daily.dev before your plugin's filtering code breaks._ ### What are the new wp_get_abilities_item_include and wp_get_abilities_result filters in WordPress 7.1? wp_get_abilities_item_include runs per-ability after declarative category, namespace, and meta conditions and any item_include_callback have passed, receiving $include, $ability, and $args, and can exclude or include abilities globally. wp_get_abilities_result runs on the complete matched array after result_callback, receiving $abilities and $args, for site-wide sorting or reordering. Both apply even when wp_get_abilities() is called with no arguments. _Developers extending the WordPress Abilities API can follow hook changes like these on daily.dev._ ### Does filtering abilities with wp_get_abilities() control whether a user can execute that ability in WordPress? No, filtering only controls which abilities are returned during discovery and is not a security boundary. An ability's permission_callback remains solely responsible for authorization, so an ability appearing in a filtered result is not necessarily executable by the current user, and excluding it from results does not prevent execution if invoked directly. _Anyone securing WordPress plugin abilities can keep up with API changes like this via daily.dev._ ## Similar posts on daily.dev - [Introducing the WordPress Abilities API](https://daily.dev/posts/introducing-the-wordpress-abilities-api-7cle9rxc4) · WordPress Developer · 18 upvotes · 0 comments - [Client-Side Abilities API in WordPress 7.0](https://daily.dev/posts/client-side-abilities-api-in-wordpress-7-0-r5rn6n5ar) · Make WordPress Core · 1 upvotes · 0 comments - [Meet Abilities, WordPress’ New Functional Core](https://daily.dev/posts/meet-abilities-wordpress-new-functional-core-gmlkcjl5r) · Make WordPress Core · 0 upvotes · 0 comments - [WP-CLI vs REST API vs Abilities API: Choosing the Right WordPress Interface for the Job](https://daily.dev/posts/wp-cli-vs-rest-api-vs-abilities-api-choosing-the-right-wordpress-interface-for-the-job-h96lae84c) · WP Mayor · 2 upvotes · 0 comments - [A unified public exposure flag for Abilities in WordPress 7.1](https://daily.dev/posts/a-unified-public-exposure-flag-for-abilities-in-wordpress-7-1-bjm7y8wez) · Make WordPress Core · 1 upvotes · 1 comments --- Tags: [#php](https://daily.dev/tags/php), [#wordpress](https://daily.dev/tags/wordpress), [#rest-api](https://daily.dev/tags/rest-api) [View this post on daily.dev](https://daily.dev/posts/filtering-registered-abilities-with-wp-get-abilities-in-wordpress-7-1-zhxg6fpgo) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Filtering registered abilities with wp_get_abilities() in WordPress 7.1","url":"https://daily.dev/posts/filtering-registered-abilities-with-wp-get-abilities-in-wordpress-7-1-zhxg6fpgo","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/filtering-registered-abilities-with-wp-get-abilities-in-wordpress-7-1-zhxg6fpgo"},"datePublished":"2026-08-05T12:09:13.674Z","dateModified":"2026-09-13T20:44:19.744Z","description":"WordPress 7.1 enhances wp_get_abilities() with a built-in filtering pipeline, replacing the need for manual array_filter() calls scattered across consumers....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6ad4f5b66be737a1618019916626b1bd?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6ad4f5b66be737a1618019916626b1bd?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Make WordPress Core","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Make WordPress Core","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/892d1a79e30e4e8a911b5726c6fb1a06","url":"https://daily.dev/sources/wordpresscore"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/filtering-registered-abilities-with-wp-get-abilities-in-wordpress-7-1-zhxg6fpgo","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"php,wordpress,rest-api","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Make WordPress Core","item":"https://daily.dev/sources/wordpresscore"},{"@type":"ListItem","position":3,"name":"Filtering registered abilities with wp_get_abilities() in WordPress 7.1"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/filtering-registered-abilities-with-wp-get-abilities-in-wordpress-7-1-zhxg6fpgo#faq","mainEntity":[{"@type":"Question","name":"How do I filter abilities by category using wp_get_abilities() in WordPress 7.1?","acceptedAnswer":{"@type":"Answer","text":"Pass an $args array with a 'category' key set to the exact category slug, for example wp_get_abilities(array('category' => 'data-export')). The comparison is exact and only accepts a single string, not an array of slugs. This replaces manually running array_filter() over the full registry to check each ability's category. Track WordPress Abilities API changes like this on daily.dev before your plugin's filtering code breaks."}},{"@type":"Question","name":"What are the new wp_get_abilities_item_include and wp_get_abilities_result filters in WordPress 7.1?","acceptedAnswer":{"@type":"Answer","text":"wp_get_abilities_item_include runs per-ability after declarative category, namespace, and meta conditions and any item_include_callback have passed, receiving $include, $ability, and $args, and can exclude or include abilities globally. wp_get_abilities_result runs on the complete matched array after result_callback, receiving $abilities and $args, for site-wide sorting or reordering. Both apply even when wp_get_abilities() is called with no arguments. Developers extending the WordPress Abilities API can follow hook changes like these on daily.dev."}},{"@type":"Question","name":"Does filtering abilities with wp_get_abilities() control whether a user can execute that ability in WordPress?","acceptedAnswer":{"@type":"Answer","text":"No, filtering only controls which abilities are returned during discovery and is not a security boundary. An ability's permission_callback remains solely responsible for authorization, so an ability appearing in a filtered result is not necessarily executable by the current user, and excluding it from results does not prevent execution if invoked directly. Anyone securing WordPress plugin abilities can keep up with API changes like this via daily.dev."}}]} ```