Security
What stops an AI breaking your site
Giving a language model write access to a production site is a real risk, and pretending otherwise would not help you. Here is exactly what the plugin does about it, and what it deliberately leaves in your hands.
Application password authentication
Connections use a WordPress application password, not your login. Your account password is never shared with the AI client.
Your roles and capabilities still apply
Every action runs as the connected user. An editor cannot install plugins through the AI, because an editor cannot install plugins.
New content is created as a draft
Publishing is a separate, explicit step. Nothing reaches your visitors until you say so.
Deletions go to trash
Posts, pages, and media are trashed rather than removed, so a mistake is one click to undo.
Destructive actions need approval
Permanent deletion, bulk overwrites, and settings changes that affect the whole site stop and ask before they run.
Search and replace runs dry first
You see the list of every match and what it would become, then decide whether to apply it.
Credentials are stored encrypted
Tokens are encrypted at rest in your database. They are never sent to us, because there is no server of ours in the path.
Revoke access in one click
A single button in wp-admin invalidates the connection. The AI loses access immediately, with no cleanup on your side.
Every action is logged
An audit log records what ran, when, and as which user, so you can answer "what changed" without guessing.
File editing is off by default
Theme and plugin file access is opt-in. Turn it on when you want it and leave it off when you do not.
What is still your job
Keep backups. Try it on staging before you point it at a site that earns money. Read what it says it did before you publish. The guardrails make mistakes recoverable, not impossible, and an AI with administrator access can still do something you did not intend if you approve it without reading.
Report a vulnerability
If you have found a security problem in the plugin or on this site, tell us privately first and give us a chance to fix it. We will confirm receipt within two working days, keep you updated, and credit you when the fix ships unless you would rather we did not.
Please do not open a public issue, post it on social media, or test against a site you do not own.
Cautious defaults, free plugin.
Try it on a staging site first. That is what we would do.
One plan. $0. No credit card.