WordPress · Clorith · Feb 18, 2025 · Feb 18, 2025 · Feb 18, 2025 · Feb 18, 2025
diff --git a/src/js/_enqueues/wp/theme.js b/src/js/_enqueues/wp/theme.js
@@ -1605,8 +1605,8 @@ themes.view.InstallerSearch =  themes.view.Search.extend({
 		$( 'body' ).removeClass( 'show-filters filters-applied show-favorites-form' );
 		$( '.drawer-toggle' ).attr( 'aria-expanded', 'false' );
 
-		// Get the themes by sending Ajax POST request to api.wordpress.org/themes
-		// or searching the local cache.
+		// Get the themes by sending Ajax POST request to the `/themes` endpoint of
+		// the WordPress API, or searching the local cache.
 		this.collection.query( request );
 
 		// Set route.
@@ -1696,8 +1696,8 @@ themes.view.Installer = themes.view.Appearance.extend({
 		// Create a new collection with the proper theme data
 		// for each section.
 		if ( 'block-themes' === section ) {
-			// Get the themes by sending Ajax POST request to api.wordpress.org/themes
-			// or searching the local cache.
+			// Get the themes by sending Ajax POST request to the `/themes` endpoint
+			// of the WordPress API, or searching the local cache.
 			this.collection.query( { tag: 'full-site-editing' } );
 		} else {
 			this.collection.query( { browse: section } );
@@ -1775,8 +1775,8 @@ themes.view.Installer = themes.view.Appearance.extend({
 		filter = _.union( [ filter, this.filtersChecked() ] );
 		request = { tag: [ filter ] };
 
-		// Get the themes by sending Ajax POST request to api.wordpress.org/themes
-		// or searching the local cache.
+		// Get the themes by sending Ajax POST request to the `/themes` endpoint
+		// of the WordPress API, or searching the local cache.
 		this.collection.query( request );
 	},
 
@@ -1813,8 +1813,8 @@ themes.view.Installer = themes.view.Appearance.extend({
 			filteringBy.append( '<span class="tag">' + name + '</span>' );
 		});
 
-		// Get the themes by sending Ajax POST request to api.wordpress.org/themes
-		// or searching the local cache.
+		// Get the themes by sending Ajax POST request to the `/themes` endpoint
+		// of the WordPress API, or searching the local cache.
 		this.collection.query( request );
 	},
 
@@ -1840,8 +1840,8 @@ themes.view.Installer = themes.view.Appearance.extend({
 				username: username
 			},
 			success: function () {
-				// Get the themes by sending Ajax POST request to api.wordpress.org/themes
-				// or searching the local cache.
+				// Get the themes by sending Ajax POST request to the `/themes` endpoint
+				// of the WordPress API, or searching the local cache.
 				that.collection.query( request );
 			}
 		} );

diff --git a/src/wp-admin/includes/class-wp-community-events.php b/src/wp-admin/includes/class-wp-community-events.php
@@ -67,7 +67,7 @@ public function __construct( $user_id, $user_location = false ) {
 	 * with nearby events.
 	 *
 	 * The browser's request for events is proxied with this method, rather
-	 * than having the browser make the request directly to api.wordpress.org,
+	 * than having the browser make the request directly to the WordPress API (`api.wordpress.org` by default),
 	 * because it allows results to be cached server-side and shared with other
 	 * users and sites in the network. This makes the process more efficient,
 	 * since increasing the number of visits that get cached data means users
@@ -98,7 +98,7 @@ public function get_events( $location_search = '', $timezone = '' ) {
 		// Include an unmodified $wp_version.
 		require ABSPATH . WPINC . '/version.php';
 
-		$api_url                    = 'http://api.wordpress.org/events/1.0/';
+		$api_url                    = wp_get_api_hostname() . '/events/1.0/';
 		$request_args               = $this->get_request_args( $location_search, $timezone );
 		$request_args['user-agent'] = 'WordPress/' . $wp_version . '; ' . home_url( '/' );
 

diff --git a/src/wp-admin/includes/class-wp-debug-data.php b/src/wp-admin/includes/class-wp-debug-data.php
@@ -273,21 +273,26 @@ private static function get_wp_core(): array {
 		);
 
 		// WordPress features requiring processing.
-		$wp_dotorg = wp_remote_get( 'https://wordpress.org', array( 'timeout' => 10 ) );
+		$fields['dotorg_api_hostname'] = array(
+			'label' => __( 'WordPress API source used by this site' ),
+			'value' => wp_get_api_hostname(),
+		);
+
+		$wp_dotorg = wp_remote_get( wp_get_api_hostname(), array( 'timeout' => 10 ) );
 
 		if ( ! is_wp_error( $wp_dotorg ) ) {
 			$fields['dotorg_communication'] = array(
-				'label' => __( 'Communication with WordPress.org' ),
-				'value' => __( 'WordPress.org is reachable' ),
+				'label' => __( 'Communication with the WordPress API' ),
+				'value' => __( 'The WordPress API is reachable' ),
 				'debug' => 'true',
 			);
 		} else {
 			$fields['dotorg_communication'] = array(
-				'label' => __( 'Communication with WordPress.org' ),
+				'label' => __( 'Communication with the WordPress API' ),
 				'value' => sprintf(
-				/* translators: 1: The IP address WordPress.org resolves to. 2: The error returned by the lookup. */
-					__( 'Unable to reach WordPress.org at %1$s: %2$s' ),
-					gethostbyname( 'wordpress.org' ),
+					/* translators: 1: The IP address the WordPress API resolves to. 2: The error returned by the lookup. */
+					__( 'Unable to reach the WordPress API at %1$s: %2$s' ),
+					gethostbyname( wp_get_api_hostname() ),
 					$wp_dotorg->get_error_message()
 				),
 				'debug' => $wp_dotorg->get_error_message(),

diff --git a/src/wp-admin/includes/class-wp-site-health.php b/src/wp-admin/includes/class-wp-site-health.php
@@ -1284,15 +1284,15 @@ public function get_test_sql_server() {
 	}
 
 	/**
-	 * Tests if the site can communicate with WordPress.org.
+	 * Tests if the site can communicate with the WordPress API.
 	 *
 	 * @since 5.2.0
 	 *
 	 * @return array The test results.
 	 */
 	public function get_test_dotorg_communication() {
 		$result = array(
-			'label'       => __( 'Can communicate with WordPress.org' ),
+			'label'       => __( 'Can communicate with the WordPress API' ),
 			'status'      => '',
 			'badge'       => array(
 				'label' => __( 'Security' ),
@@ -1307,7 +1307,7 @@ public function get_test_dotorg_communication() {
 		);
 
 		$wp_dotorg = wp_remote_get(
-			'https://api.wordpress.org',
+			wp_get_api_hostname(),
 			array(
 				'timeout' => 10,
 			)
@@ -1317,7 +1317,17 @@ public function get_test_dotorg_communication() {
 		} else {
 			$result['status'] = 'critical';
 
-			$result['label'] = __( 'Could not reach WordPress.org' );
+			$result['label'] = __( 'Could not reach the WordPress API' );
+
+			/*
+			 * By validating that the parsed URL does not return `null`,
+			 * we avoid a deprecation warning when running `gethostbyname()` later.
+			 */
+			$api_hostname    = wp_get_api_hostname();
+			$parsed_hostname = parse_url( $api_hostname, PHP_URL_HOST );
+			if ( null === $parsed_hostname ) {
+				$parsed_hostname = $api_hostname;
+			}
 
 			$result['description'] .= sprintf(
 				'<p>%s</p>',
@@ -1326,9 +1336,9 @@ public function get_test_dotorg_communication() {
 					/* translators: Hidden accessibility text. */
 					__( 'Error' ),
 					sprintf(
-						/* translators: 1: The IP address WordPress.org resolves to. 2: The error returned by the lookup. */
-						__( 'Your site is unable to reach WordPress.org at %1$s, and returned the error: %2$s' ),
-						gethostbyname( 'api.wordpress.org' ),
+						/* translators: 1: The IP address the WordPress API resolves to. 2: The error returned by the lookup. */
+						__( 'Your site is unable to reach the WordPress API at %1$s, and returned the error: %2$s' ),
+						gethostbyname( $parsed_hostname ),
 						$wp_dotorg->get_error_message()
 					)
 				)

diff --git a/src/wp-admin/includes/credits.php b/src/wp-admin/includes/credits.php
@@ -32,7 +32,7 @@ function wp_credits( $version = '', $locale = '' ) {
 		|| str_contains( $version, '-' )
 		|| ( isset( $results['data']['version'] ) && ! str_starts_with( $version, $results['data']['version'] ) )
 	) {
-		$url     = "http://api.wordpress.org/core/credits/1.1/?version={$version}&locale={$locale}";
+		$url     = wp_get_api_hostname( true ) . "/core/credits/1.1/?version={$version}&locale={$locale}";
 		$options = array( 'user-agent' => 'WordPress/' . $version . '; ' . home_url( '/' ) );
 
 		if ( wp_http_supports( array( 'ssl' ) ) ) {

diff --git a/src/wp-admin/includes/dashboard.php b/src/wp-admin/includes/dashboard.php
@@ -1811,7 +1811,7 @@ function wp_check_browser_version() {
 	$response = get_site_transient( 'browser_' . $key );
 
 	if ( false === $response ) {
-		$url     = 'http://api.wordpress.org/core/browse-happy/1.1/';
+		$url     = wp_get_api_hostname( true ) . '/core/browse-happy/1.1/';
 		$options = array(
 			'body'       => array( 'useragent' => $_SERVER['HTTP_USER_AGENT'] ),
 			'user-agent' => 'WordPress/' . wp_get_wp_version() . '; ' . home_url( '/' ),

diff --git a/src/wp-admin/includes/import.php b/src/wp-admin/includes/import.php
@@ -146,7 +146,7 @@ function wp_get_popular_importers() {
 				'locale'  => $locale,
 				'version' => wp_get_wp_version(),
 			),
-			'http://api.wordpress.org/core/importers/1.1/'
+			wp_get_api_hostname( true ) . '/core/importers/1.1/'
 		);
 		$options = array( 'user-agent' => 'WordPress/' . wp_get_wp_version() . '; ' . home_url( '/' ) );
 

diff --git a/src/wp-admin/includes/misc.php b/src/wp-admin/includes/misc.php
@@ -1581,7 +1581,7 @@ function wp_check_php_version() {
 	$response = get_site_transient( 'php_check_' . $key );
 
 	if ( false === $response ) {
-		$url = 'http://api.wordpress.org/core/serve-happy/1.0/';
+		$url = wp_get_api_hostname( true ) . '/core/serve-happy/1.0/';
 
 		if ( wp_http_supports( array( 'ssl' ) ) ) {
 			$url = set_url_scheme( $url, 'https' );

diff --git a/src/wp-admin/includes/network.php b/src/wp-admin/includes/network.php
@@ -554,7 +554,7 @@ function network_step2( $errors = false ) {
 
 		if ( ! empty( $keys_salts ) ) {
 			$keys_salts_str = '';
-			$from_api       = wp_remote_get( 'https://api.wordpress.org/secret-key/1.1/salt/' );
+			$from_api       = wp_remote_get( wp_get_api_hostname() . '/secret-key/1.1/salt/' );
 			if ( is_wp_error( $from_api ) ) {
 				foreach ( $keys_salts as $c => $v ) {
 					$keys_salts_str .= "\ndefine( '$c', '" . wp_generate_password( 64, true, true ) . "' );";

diff --git a/src/wp-admin/includes/plugin-install.php b/src/wp-admin/includes/plugin-install.php
@@ -146,7 +146,7 @@ function plugins_api( $action, $args = array() ) {
 
 	if ( false === $res ) {
 
-		$url = 'http://api.wordpress.org/plugins/info/1.2/';
+		$url = wp_get_api_hostname( true ) . '/plugins/info/1.2/';
 		$url = add_query_arg(
 			array(
 				'action'  => $action,

diff --git a/src/wp-admin/includes/theme.php b/src/wp-admin/includes/theme.php
@@ -542,7 +542,7 @@ function themes_api( $action, $args = array() ) {
 	$res = apply_filters( 'themes_api', false, $action, $args );
 
 	if ( ! $res ) {
-		$url = 'http://api.wordpress.org/themes/info/1.2/';
+		$url = wp_get_api_hostname( true ) . '/themes/info/1.2/';
 		$url = add_query_arg(
 			array(
 				'action'  => $action,

diff --git a/src/wp-admin/includes/translation-install.php b/src/wp-admin/includes/translation-install.php
@@ -50,7 +50,7 @@ function translations_api( $type, $args = null ) {
 	$res = apply_filters( 'translations_api', false, $type, $args );
 
 	if ( false === $res ) {
-		$url      = 'http://api.wordpress.org/translations/' . $type . '/1.0/';
+		$url      = wp_get_api_hostname( true ) . '/translations/' . $type . '/1.0/';
 		$http_url = $url;
 		$ssl      = wp_http_supports( array( 'ssl' ) );
 		if ( $ssl ) {

diff --git a/src/wp-admin/includes/update.php b/src/wp-admin/includes/update.php
@@ -129,7 +129,7 @@ function find_core_auto_update() {
  * @return array|false An array of checksums on success, false on failure.
  */
 function get_core_checksums( $version, $locale ) {
-	$http_url = 'http://api.wordpress.org/core/checksums/1.0/?' . http_build_query( compact( 'version', 'locale' ), '', '&' );
+	$http_url = wp_get_api_hostname( true ) . '/core/checksums/1.0/?' . http_build_query( compact( 'version', 'locale' ), '', '&' );
 	$url      = $http_url;
 
 	$ssl = wp_http_supports( array( 'ssl' ) );

diff --git a/src/wp-admin/maint/repair.php b/src/wp-admin/maint/repair.php
@@ -82,7 +82,7 @@
 		'</h2>';
 
 		/* translators: 1: wp-config.php, 2: Secret key service URL. */
-		echo '<p>' . sprintf( __( 'While you are editing your %1$s file, take a moment to make sure you have all 8 keys and that they are unique. You can generate these using the <a href="%2$s">WordPress.org secret key service</a>.' ), '<code>wp-config.php</code>', 'https://api.wordpress.org/secret-key/1.1/salt/' ) . '</p>';
+		echo '<p>' . sprintf( __( 'While you are editing your %1$s file, take a moment to make sure you have all 8 keys and that they are unique. You can generate these using the <a href="%2$s">WordPress.org secret key service</a>.' ), '<code>wp-config.php</code>', wp_get_api_hostname() . '/secret-key/1.1/salt/' ) . '</p>';
 	}
 } elseif ( isset( $_GET['repair'] ) ) {
 

diff --git a/src/wp-admin/plugin-editor.php b/src/wp-admin/plugin-editor.php
@@ -295,7 +295,7 @@
 		<div id="documentation" class="hide-if-no-js">
 			<label for="docs-list"><?php _e( 'Documentation:' ); ?></label>
 			<?php echo $docs_select; ?>
-			<input disabled id="docs-lookup" type="button" class="button" value="<?php esc_attr_e( 'Look Up' ); ?>" onclick="if ( '' !== jQuery('#docs-list').val() ) { window.open( 'https://api.wordpress.org/core/handbook/1.0/?function=' + escape( jQuery( '#docs-list' ).val() ) + '&amp;locale=<?php echo urlencode( get_user_locale() ); ?>&amp;version=<?php echo urlencode( get_bloginfo( 'version' ) ); ?>&amp;redirect=true'); }" />
+			<input disabled id="docs-lookup" type="button" class="button" value="<?php esc_attr_e( 'Look Up' ); ?>" onclick="if ( '' !== jQuery('#docs-list').val() ) { window.open( '<?php echo wp_get_api_hostname(); ?>/core/handbook/1.0/?function=' + escape( jQuery( '#docs-list' ).val() ) + '&amp;locale=<?php echo urlencode( get_user_locale() ); ?>&amp;version=<?php echo urlencode( get_bloginfo( 'version' ) ); ?>&amp;redirect=true'); }" />
 		</div>
 	<?php endif; ?>
 

diff --git a/src/wp-admin/setup-config.php b/src/wp-admin/setup-config.php
@@ -358,7 +358,7 @@ function setup_config_display_header( $body_classes = array() ) {
 			$no_api = isset( $_POST['noapi'] );
 
 			if ( ! $no_api ) {
-				$secret_keys = wp_remote_get( 'https://api.wordpress.org/secret-key/1.1/salt/' );
+				$secret_keys = wp_remote_get( wp_get_api_hostname() . '/secret-key/1.1/salt/' );
 			}
 
 			if ( $no_api || is_wp_error( $secret_keys ) ) {

diff --git a/src/wp-admin/theme-editor.php b/src/wp-admin/theme-editor.php
@@ -324,7 +324,7 @@
 			<div id="documentation" class="hide-if-no-js">
 				<label for="docs-list"><?php _e( 'Documentation:' ); ?></label>
 				<?php echo $docs_select; ?>
-				<input disabled id="docs-lookup" type="button" class="button" value="<?php esc_attr_e( 'Look Up' ); ?>" onclick="if ( '' !== jQuery('#docs-list').val() ) { window.open( 'https://api.wordpress.org/core/handbook/1.0/?function=' + escape( jQuery( '#docs-list' ).val() ) + '&amp;locale=<?php echo urlencode( get_user_locale() ); ?>&amp;version=<?php echo urlencode( get_bloginfo( 'version' ) ); ?>&amp;redirect=true'); }" />
+				<input disabled id="docs-lookup" type="button" class="button" value="<?php esc_attr_e( 'Look Up' ); ?>" onclick="if ( '' !== jQuery('#docs-list').val() ) { window.open( '<?php echo wp_get_api_hostname(); ?>/core/handbook/1.0/?function=' + escape( jQuery( '#docs-list' ).val() ) + '&amp;locale=<?php echo urlencode( get_user_locale() ); ?>&amp;version=<?php echo urlencode( get_bloginfo( 'version' ) ); ?>&amp;redirect=true'); }" />
 			</div>
 		<?php endif; ?>
 

diff --git a/src/wp-includes/load.php b/src/wp-includes/load.php
@@ -370,6 +370,52 @@ function wp_is_development_mode( $mode ) {
 	return $mode === $current_mode;
 }
 
+/**
+ * Retrieves the current API hostname.
+ *
+ * The API hostname is used in requests for core, plugin, theme, and translation information,
+ * installation and updates.
+ *
+ * @since 6.8.0
+ *
+ * @param bool $use_http Optional. Whether to use HTTP or HTTPS scheme for the default API endpoint. Default true.
+ * @return string The current API hostname.
+ */
+function wp_get_api_hostname( $use_http = false ) {
+	static $current_hostname = '';
+
+	if ( defined( 'WP_RUN_CORE_TESTS' ) || '' === $current_hostname ) {
+		/*
+		 * We only check the schema for the default API hostname, as anyone overriding it may
+		 * be doing so intentionally, for example an environment that relies on host aliases,
+		 * and are expected to know what they are doing.
+		 */
+		$current_hostname = ( $use_http ? 'http://' : 'https://' ) . 'api.wordpress.org';
+
+		// Check if the environment variable has been set, if `getenv` is available on the system.
+		if ( function_exists( 'getenv' ) ) {
+			$has_env = getenv( 'WP_API_HOSTNAME' );
+			if ( false !== $has_env ) {
+				$current_hostname = $has_env;
+			}
+		}
+
+		// Fetch the hostname from a constant, this overrides the global system variable.
+		if ( defined( 'WP_API_HOSTNAME' ) && WP_API_HOSTNAME ) {
+			$current_hostname = WP_API_HOSTNAME;
+		}
+	}
+
+	/**
+	 * Filters the API hostname.
+	 *
+	 * @since 6.8.0
+	 *
+	 * @param string $current_hostname The current hostname.
+	 */
+	return apply_filters( 'wp_api_hostname', $current_hostname );
+}
+
 /**
  * Ensures all of WordPress is not loaded when handling a favicon.ico request.
  *

diff --git a/src/wp-includes/rest-api/endpoints/class-wp-rest-pattern-directory-controller.php b/src/wp-includes/rest-api/endpoints/class-wp-rest-pattern-directory-controller.php
@@ -114,7 +114,7 @@ public function get_items( $request ) {
 		$raw_patterns = get_site_transient( $transient_key );
 
 		if ( ! $raw_patterns ) {
-			$api_url = 'http://api.wordpress.org/patterns/1.0/?' . build_query( $query_args );
+			$api_url = wp_get_api_hostname( true ) . '/patterns/1.0/?' . build_query( $query_args );
 			if ( wp_http_supports( array( 'ssl' ) ) ) {
 				$api_url = set_url_scheme( $api_url, 'https' );
 			}

diff --git a/src/wp-includes/update.php b/src/wp-includes/update.php
@@ -186,7 +186,7 @@ function wp_version_check( $extra_stats = array(), $force_check = false ) {
 		$query['channel'] = WP_AUTO_UPDATE_CORE;
 	}
 
-	$url      = 'http://api.wordpress.org/core/version-check/1.7/?' . http_build_query( $query, '', '&' );
+	$url      = wp_get_api_hostname( true ) . '/core/version-check/1.7/?' . http_build_query( $query, '', '&' );
 	$http_url = $url;
 	$ssl      = wp_http_supports( array( 'ssl' ) );
 
@@ -434,7 +434,7 @@ function wp_update_plugins( $extra_stats = array() ) {
 		$options['body']['update_stats'] = wp_json_encode( $extra_stats );
 	}
 
-	$url      = 'http://api.wordpress.org/plugins/update-check/1.1/';
+	$url      = wp_get_api_hostname( true ) . '/plugins/update-check/1.1/';
 	$http_url = $url;
 	$ssl      = wp_http_supports( array( 'ssl' ) );
 
@@ -713,7 +713,7 @@ function wp_update_themes( $extra_stats = array() ) {
 		$options['body']['update_stats'] = wp_json_encode( $extra_stats );
 	}
 
-	$url      = 'http://api.wordpress.org/themes/update-check/1.1/';
+	$url      = wp_get_api_hostname( true ) . '/themes/update-check/1.1/';
 	$http_url = $url;
 	$ssl      = wp_http_supports( array( 'ssl' ) );