Settings Screens

Five of the eight screens are plain HTML forms that post to wp-admin/options.php. That file holds an allow list of option names per screen (the $allowed_options array, filtered by allowed_options), checks the nonce and the manage_options capability, saves only the options in the list for the submitted screen, and redirects back. Plugins add their own fields to these screens with the Settings API (register_setting(), add_settings_field()), which appends to the same allow list; that API is covered in Administration Menus and Settings API.

Source: Common APIs Handbook: Settings API

The menu order in 7.1 is General, Connectors, Writing, Reading, Discussion, Media, Permalinks, Privacy; plugins usually add their own pages below Privacy. Connectors is a JavaScript application that saves through the REST API, and Permalinks and Privacy process their own form. On a Multisite network, a sub-site’s General screen has no URL fields and no Membership section, because those belong to the network (Multisite Networks).

Part of the same options is exposed by the REST API at /wp/v2/settings to users with manage_options. On the Lumen Press site, the endpoint returned these keys (plus one per active AI provider, see Connectors (7.0)):

Source: REST API Handbook: Settings

The REST names are aliases: title is blogname, description is blogdescription, url is home, email is admin_email, timezone is timezone_string and language is WPLANG.

General holds the identity of the site and how it formats dates.

Source: WordPress.org Documentation: Settings General screen

The two URL fields are the most dangerous fields in the admin. A typo in either one makes the dashboard unreachable, because every redirect then points to the wrong host. The recovery is to fix the value outside the admin: with wp option update home and wp option update siteurl, or by defining WP_HOME and WP_SITEURL in wp-config.php, which overrides the database and locks the fields. Both URLs differ only when WordPress is given its own directory. Changing the domain of an existing site needs a search and replace through the content as well, covered in Importing, Exporting and Migrating.

The administration email is where WordPress sends update results, fatal-error recovery-mode links, new-user and comment-moderation notices. Since 4.9, a change made on the screen is stored in new_admin_email, a hash goes into adminhash, and a confirmation link is mailed to the new address; admin_email changes only when the link is followed. On a site that cannot send mail, the change never completes. There is no WP_ADMIN_EMAIL constant, which one older book suggests; the address can only be changed through the screen, the REST API or WP-CLI. Writing the option directly skips the confirmation:

Source: Code Reference: update_option_new_admin_email()

The time zone is stored in one of two options. Choosing a city stores timezone_string (for example Europe/Madrid) and leaves gmt_offset alone; choosing a "UTC+1" style entry stores gmt_offset and empties timezone_string. When timezone_string is set, a filter (wp_timezone_override_offset()) recomputes gmt_offset on every read: on the Lumen Press site, wp option get gmt_offset printed 1 while the stored row still held 0. Code should call wp_timezone() or wp_date() instead of reading either option.

WordPress 7.0 added the AI Client, a provider-neutral PHP API (wp_ai_client_prompt()) that plugins use to send prompts, and the Connectors API that stores the credentials for it. Settings > Connectors is the screen for those credentials. Core bundles no AI provider: the screen lists three featured connectors (Anthropic, Google and OpenAI), and each needs its provider plugin (ai-provider-for-anthropic, ai-provider-for-google, ai-provider-for-openai) before a key can be entered. The screen also lists Akismet, the one non-AI connector core registers, which reuses Akismet’s existing wordpress_api_key option. A notice on the screen offers the separate "AI" plugin, which adds a Settings > AI screen and the editor features (titles, excerpts, alt text, images) that actually use the connectors.

Each connector is a card with its name, description, a link to the provider’s key page, an Install or Activate button when its plugin is missing, and, once the plugin is active, a key field and the connection status. The screen needs JavaScript; without it, it shows only an error notice.

Source: Make WordPress Core: Introducing the Connectors API in WordPress 7.0

How keys behave, as verified on WordPress 7.1.3:

The recommended way to provide Lumen Press’s key is an environment variable, so the key never reaches the database or a backup. In the Compose file of the site (the full file is in Local Development Environments):

Source: WordPress.org Documentation: Settings Connectors screen

The checks below were run on the Lumen Press site with the Anthropic provider plugin installed. The placeholder key is deliberately invalid, and the application password is the placeholder <app-password>:

Source: Code Reference: wp_supports_ai()

Only administrators can open the screen (manage_options). The AI Client dev note also recommends that plugins expose each AI feature through their own REST endpoint with its own permission check, rather than letting lower roles send arbitrary prompts with the site’s key; the Lumen Press blurb generator follows that pattern in AI Client and Connectors. Plugins that are not AI providers can add their own connector cards with the wp_connectors_init action. None of the older books covers this screen: it did not exist before 7.0.

Source: Make WordPress Core: Introducing the AI Client in WordPress 7.0

Source: WordPress.org Documentation: Settings Writing screen

There is no setting on this screen to choose between the block editor and the classic editor. One older book describes such a setting; it is added by the Classic Editor plugin, not by core, and core’s only per-type switch is the use_block_editor_for_post_type filter. Post via email is rarely used today: it needs a dedicated, secret POP3 mailbox, anyone who knows the address can publish, and the password sits unencrypted in the database. Lumen Press disables it with add_filter( 'enable_post_by_email_configuration', '__return_false' ); in a must-use plugin. Update Services pings blog directories when a post is published; most of those services no longer exist, and the ping only reveals new URLs early, so many sites empty the list.

Source: WordPress.org Documentation: Settings Reading screen

Block themes ignore part of this screen. The front page shown is still decided by show_on_front and page_on_front, but the templates (front-page.html, home.html, page.html) decide what is rendered and how many posts a Query Loop block shows unless it is set to inherit the main query. The template hierarchy is covered in Template Hierarchy. The screen warns when the Homepage and the Posts page are the same page, or when either is the Privacy Policy page.

The Discussion screen sets the defaults for comments, pingbacks, moderation and avatars. Its fields map to these options; their meaning and the moderation workflow are explained in Categories, Tags and Comments.

Source: WordPress.org Documentation: Settings Discussion screen

The "Anyone posts a note" notification (wp_notes_notify) arrived in 6.9 with Notes, the editorial comments of the block editor. disallowed_keys was called blacklist_keys before 5.5. The two keyword lists are stored with autoload off, unlike the rest of the screen. The "default" settings apply to new posts only; changing them does not touch existing posts, whose comment_status and ping_status columns keep their values.

Source: WordPress.org Documentation: Settings Media screen

The sizes are maximum dimensions, applied when an image is uploaded; changing them does not resize existing images (wp media regenerate does). Core also creates a medium_large size (medium_large_size_w = 768) and the sizes registered by themes and plugins, none of which appears here. The two upload path fields are shown only when they already hold a non-default value, so they cannot be set from a fresh install’s screen; the supported way to move uploads is the UPLOADS constant. The image_default_* options in the allow list are remembered from the classic media dialog, not edited on the screen. An "Embeds" section appears only when a plugin registers fields for it. Image processing, formats and sizes are covered in Media Library.

Permalinks decide the URL of every post, page and archive. The structure is a string of structure tags stored in permalink_structure; WordPress turns it into the regular expressions of the Rewrite API, stored in the rewrite_rules option.

Source: WordPress.org Documentation: Settings Permalinks screen

The tags offered by the screen are %year%, %monthnum%, %day%, %hour%, %minute%, %second%, %post_id%, %postname%, %category% (nested categories become nested paths) and %author%. Plugins add more through the available_permalink_structure_tags filter. The Optional section sets category_base (default category) and tag_base (default tag). Every structure applies to posts only: pages always use their slug path, and each custom post type sets its own base when it is registered (the Lumen Press lp_book type uses books, so a book lives at /books/<slug>/ whatever the post structure), as shown in Custom Post Types and Taxonomies.

Choosing a structure:

The Privacy screen (since 4.9.6, with the GDPR tools) does one thing: it chooses the Privacy Policy page, stored as a page ID in wp_page_for_privacy_policy. The installer already creates a draft page titled "Privacy Policy" with suggested text (ID 3 on a fresh install) and points the option at it. The screen offers to select an existing page or to create a new one, and links to the Policy Guide (Settings > Privacy > Policy Guide tab), where core, themes and plugins add suggested paragraphs through wp_add_privacy_policy_content().

Source: WordPress.org Documentation: Settings Privacy screen

The screen only stores a page ID. The text is the site owner’s legal responsibility, and the draft created at install is a template, not a policy. The personal data export and erasure tools live under Tools, and plugins hook into them as shown in Privacy and Personal Data. Cookie consent and analytics are covered in SEO, Analytics and Privacy.

Clicking through eight screens on every new environment is error-prone. Lumen Press keeps its baseline settings in a shell script run once after wp core install (Installation):

Source: WP-CLI Commands: wp option update

After the script, wp option get returned the values above (the Home and News pages got IDs 5 and 6), and /, /news/, /topics/uncategorized/, /privacy-policy/ and /robots.txt all answered 200. Writing options directly skips the screen’s side effects: the admin email confirmation, the .htaccess rewrite (unless wp rewrite flush --hard is configured as shown above), and the sanitizing done by options.php for values typed by hand. The site language is set with wp language core install es_ES --activate or wp site switch-language, which also download the language files, rather than by writing WPLANG.