- Improved Security<\/a><\/li>
- Performance Enhancements<\/a><\/li>
- Style Book Improvements<\/a><\/li>
- Additional Design Updates<\/a>
- Setting Any Image as Featured<\/a><\/li>
- Style Selection in Zoom Out<\/a><\/li>
- Undoing Image Edits<\/a><\/li><\/ul><\/li>
- Improved Data Views<\/a><\/li>
- Query Loop Block Refinements<\/a><\/li>
- Additional Changes<\/a><\/li>
- Focused on Refinement<\/a><\/li><\/ul>\n\t\t\t<\/div>\n\t\t<\/div><\/div>\n\n\n
Improved Security<\/h2>\n\n\n\n
We want to begin with something that we hold near and dear to our hearts: security. WordPress 6.8 introduces a new hashing method for password storage<\/a>.<\/p>\n\n\n\n
Up until this point, WordPress has been using the Portable PHP Password Hashing Framework (phpass)<\/a> for its hashing algorithm. Now, the platform is moving to a more secure and modern one: bcrypt<\/em><\/a>. Now, what does this mean to the normal user?<\/p>\n\n\n\n
To explain, we should first establish what password hashing is. Simply put, password hashing is taking the plaintext passwords that users input when creating their account or updating their existing one, scrambling and lengthening them to create a string of random characters. A key to unscramble them is assigned to each password, and they are stored in that way. Here is a quick step-by-step of the process that will make everything crystal clear.<\/p>\n\n\n\n
- \n
- Password Creation – <\/strong>The first step is creating the password itself. Users create new passwords when registering an account or updating their old password to a new one. This password is in plaintext when submitted to WordPress, meaning it is not encrypted or hashed in any way;<\/li>\n\n\n\n
- Salt Generation – <\/strong>Next, the system generates a \u2018salt\u2019 that will ensure that every password is unique. Even passwords that are the same will be distinguishable from one another via this salt. That is because identical passwords do not have the same salt. That helps security immensely. The salt is a simple string of random characters assigned to each plaintext password;<\/li>\n\n\n\n
- Hashing the Password – <\/strong>After the salt is generated, it and the password are passed through a hashing algorithm. Via complex mathematical operations, the algorithm turns the salt and the plaintext password into a fixed-length string (a hash) of characters to protect them. Then, the hash and the salt are stored in the database;<\/li>\n\n\n\n
- Verification – <\/strong>When a user logs in with their plaintext password, the system pulls the salt associated with the user\u2019s account. Then, it combines it with the provided password and hashes it according to the algorithm. If the result is the same as the previously stored hash, , and they log in.<\/li>\n<\/ol>\n\n\n\n
As you can see, upgrading the hashing algorithm to a more robust one is definitely a huge benefit for WordPress users. Fortunately, there is nothing that you, as an administrator or user, have to worry about. The process will not affect any of the passwords on your website; none of them will need changing. Additionally, existing sessions will remain valid, meaning users will stay logged in as well. The rehashing with bcrypt <\/em>will happen only when a user logs in or changes their credentials. It might be a good idea to ask your users to relog.<\/p>\n\n\n\n
Performance Enhancements<\/h2>\n\n\n\n
Performance is something else we at FastComet are passionate about. We always love it when our favorite platforms become even faster. WordPress 6.8 introduces speculative loading<\/em><\/a> to give websites a boost when it comes to loading pages and resources. So, what is speculative loading?<\/p>\n\n\n\n
As the name suggests, this performance tool will anticipate which URLs users are most likely to click on next and then load them in the background. The URLs and the resources within them still have to load, so the server will still put in the work. On the client side, however, the browsing experience will be much smoother because those subsequent pages will load much more quickly or instantly.<\/p>\n\n\n\n
This is possible by leveraging the Speculation Rules API<\/a>. Users could previously boost their website via the Speculative Loading<\/strong> plugin<\/a> that uses those rules. However, this functionality will be native to WordPress and require no plugin. The native functionality will have specific rules by default (such as loading a URL ahead of time when the user hovers over it), but developers will also have full control over them.<\/p>\n\n\n\n
Speculative loading<\/em> is an awesome new addition to WordPress. We strongly recommend reading all the pages we linked in this part to learn more about it if you want to customize the rules.<\/p>\n\n\n\n
Style Book Improvements<\/h2>\n\n\n\n
The Style Book<\/em> was introduced in WordPress 6.2<\/a> and has since been the one-stop shop for defining global (site-wide) site elements such as colors, typography, and block styles. This update brings two major improvements to the style book<\/em>.<\/p>\n\n\n\n
The style book<\/em> was only available to block themes at first. That changes with WordPress 6.8, which introduces support for the style book<\/em> to classic themes<\/a>. It is located under Appearance > Design<\/strong>, where you can easily preview and apply global changes to your site.<\/p>\n\n\n\n
![\"FastComet](\"https:\/\/www.fastcomet.com\/blog\/wp-content\/uploads\/2025\/04\/wordpress-6-8-classic-style-book-1024x472.png\")
- Salt Generation – <\/strong>Next, the system generates a \u2018salt\u2019 that will ensure that every password is unique. Even passwords that are the same will be distinguishable from one another via this salt. That is because identical passwords do not have the same salt. That helps security immensely. The salt is a simple string of random characters assigned to each plaintext password;<\/li>\n\n\n\n
- Style Selection in Zoom Out<\/a><\/li>
- Performance Enhancements<\/a><\/li>