Heartbeat API
The Heartbeat API is a script in the WordPress dashboard that checks in with the server on a timer. WordPress uses it to keep post locks, carry autosaves and notice an expired login. Each check-in is a request to admin-ajax.php, which is why it shows up in load problems.
- By
- WP Ministry
- Published
In short
- Heartbeat is why an open dashboard tab keeps sending requests to admin-ajax.php with action=heartbeat.
- In the current code it beats every 60 seconds on a dashboard screen, every 10 seconds where posts are edited, and every 120 seconds in a tab left alone.
- Slow it with the heartbeat_settings filter if the server struggles. Do not switch it off, because post locks and the expired-login check depend on it.
The Heartbeat API is how a WordPress dashboard screen stays in touch with the server without being reloaded. WordPress's handbook calls it "a simple server polling API". A script in the page sends a request on a timer, the server answers, and plugins can add data of their own in both directions.
WordPress uses the beat for four jobs:
- Post locks. While you edit a post, each beat renews your lock on it. A lock expires after 150 seconds without one.
- Autosave. In the classic editor, the autosave travels on the beat, and the answer reads "Draft saved at" with the time.
- Session expiry. Each answer says whether you are still logged in. When you are not, a log-in box opens over the screen you were on.
- Fresh security tokens. On an editing screen, the beat renews the tokens that saving needs, so a tab left open for hours can still save.
How often it beats
The handbook says every 15 to 120 seconds. The comment at the top of heartbeat.js says every 15 to 60. The code has no 15-second setting. This is what the current source sets:
| Where and when | Interval |
|---|---|
| A dashboard screen | 60 seconds |
| The post editor and the Posts list | 10 seconds |
| A tab that is hidden or out of focus, or five minutes after your last mouse or keyboard activity | 120 seconds |
| Ten minutes after your last activity | It stops until you come back. On the Add and Edit Post screens it stops after 60 minutes. |
The 60 seconds, the 120 seconds and the stop are in heartbeat.js. The 10 seconds is set by the editing screens themselves, to keep post locks current.
Where you meet it
- The browser's network panel. Leave a dashboard screen open and a
POSTto/wp-admin/admin-ajax.phprepeats. The request carriesaction=heartbeat. - Post lock messages. On the Posts list, a post someone else has open shows their name and "is currently editing". When someone takes a post over from you, the answer WordPress sends gives their name, followed by "has taken over and is currently editing."
- A code snippet. The
heartbeat_settingsfilter changes its settings.minimalIntervaloverrides every shorter interval.
What goes wrong
- Too many requests. Each beat is a request the server has to answer. Several people with several editing tabs each add up. See admin-ajax.php high CPU usage to find out whether Heartbeat is the caller, and the guide to a slow WordPress admin for where it sits among other causes.
- The host rate-limits you. A host that counts requests per address can answer the dashboard's own check-ins with 429 Too Many Requests.
- It was switched off. The notes in
heartbeat.jssay a minimal interval above 120 seconds "will limit or disable" features such as post locks. Slow it and leave it running. - You keep being logged out. The log-in box is Heartbeat reporting an ended session. It is not the cause. See WordPress keeps logging you out.
Common questions
Should I disable the Heartbeat API?
No. Slow it. Without the beat, post locks are not renewed and nothing tells you that your login has expired. A minimalInterval of 60 seconds cuts the editor's rate to a sixth and keeps those working.
Does Heartbeat keep running in a tab I forgot about?
It slows down, then stops, as the table above shows. The Add and Edit Post screens keep going longest, for 60 minutes after your last activity.
Is Heartbeat the same as autosave?
No. Heartbeat is the channel and autosave is one thing sent over it in the classic editor. The block editor saves through the REST API and uses Heartbeat for the post lock and the security tokens.