Description
Let your AI assistant manage your WordPress site. WP Agent connects ChatGPT, Claude, Cursor, and other AI systems to your site so they can create and edit content, manage media, menus, and settings — keyless, using a standard WordPress Application Password.
Most of WP Agent works through the WordPress core REST API with no plugin at all. This companion plugin adds the pieces core REST cannot do:
- Reliable authentication on any host — many hosts (LiteSpeed, Apache without CGIPassAuth) strip the
Authorizationheader before WordPress sees it, which silently breaks Application Password logins. The plugin accepts the same Application Password in a customX-WPAgent-Authorizationheader that survives, and validates it with WordPress’s own native check. No new secret, no weaker check. - SEO meta read/write — Yoast SEO, Rank Math, and All in One SEO store their fields as protected meta (or, for AIOSEO v4, in a custom table) that core REST cannot write. The plugin adds safe, permission-checked endpoints so your assistant can set SEO titles, descriptions, and focus keywords.
- Site overview — one endpoint that tells the assistant what it’s working with: WordPress/PHP version, active theme, detected SEO plugin, WooCommerce presence, and (for admins) the plugin inventory.
All endpoints live under one wp-agent/v1 REST namespace and every one of them requires an authenticated WordPress user with the appropriate capability. Nothing is exposed to anonymous visitors.
Security
- No new credentials — authentication uses WordPress’s built-in Application Passwords, validated by WordPress core
- Your WordPress account password is never stored or transmitted
- Every REST endpoint checks WordPress capabilities; key access requires an administrator
- Revoking the Application Password (Users Profile) instantly disconnects WP Agent
External Service Disclosure
This plugin communicates with external services only in these cases:
- WP Agent (mcp.getwpagent.com / getwpagent.com) — the “Connect WP Agent” button on the admin page is a link that opens the WP Agent website with your site URL and site name pre-filled, so you can pair the site to your WP Agent account. The plugin itself sends nothing to WP Agent in the background; pairing happens on the WP Agent website after you sign in there. Once you connect, your AI assistant manages the site through WP Agent, which sends authenticated requests to your site’s REST API.
WP Agent Terms of Service · WP Agent Privacy Policy
If you never click Connect, the plugin makes no external requests at all.
Installation
- Install the plugin: upload the plugin folder to
/wp-content/plugins/, or install through Plugins Add New. - Activate it through the Plugins screen.
- Go to WP Agent in your admin menu and click Connect WP Agent — or simply tell your AI assistant “connect this site to WP Agent”.
FAQ
-
What does this plugin actually do?
-
It’s a companion to the WP Agent service. It fixes Application Password authentication on hosts that strip the Authorization header, and adds REST endpoints core WordPress lacks for SEO meta writing (Yoast, Rank Math, AIOSEO) and a site overview. Connecting and managing content works even without it — the plugin makes SEO management possible and authentication reliable.
-
Is it free? Do I need an account?
-
The plugin is free. You need a WP Agent account (free tier available) at getwpagent.com to connect your AI assistant; the account is created automatically when you connect through ChatGPT or Claude.
-
No. WP Agent authenticates with a WordPress Application Password — a separate, revocable credential you can delete at any time under Users Profile Application Passwords. Your real password is never transmitted or stored.
-
What data leaves my site?
-
Only what you ask your assistant to do — content it reads or writes goes through your site’s REST API to WP Agent. The Connect button opens getwpagent.com with your site URL. See the External Service Disclosure above.
-
Which SEO plugins are supported?
-
Yoast SEO, Rank Math, and All in One SEO (both the modern v4 line and the legacy version).
-
How do I disconnect?
-
Revoke the WP Agent Application Password under Users Profile Application Passwords, or tell your assistant to disconnect the site. Deactivating the plugin also disables all of its endpoints immediately.
-
What happens if I delete the plugin?
-
All plugin data is removed from your database.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“YLabs AI Assistant Connector” is open source software. The following people have contributed to this plugin.
Contributors
Translate “YLabs AI Assistant Connector” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
0.9.7
- Tightened REST permission checks: the site overview endpoint now requires an administrator (manage_options) and SEO-plugin detection requires content-editing permission (edit_posts)
- WordPress.org build: the Additional CSS endpoints and the optional image API key storage/import are not included in this distribution
0.9.6
- Fix long callback URLs overflowing the card on WordPress’s own authorize-application screen (cosmetic CSS, that screen only)
0.9.5
- Connection status on the WP Agent page — detected locally from the WP Agent Application Password (no external call), with a Reconnect button and a one-click disconnect path
0.9.4
- One-click Buy buttons for the Image Packs — sign in to WP Agent, check out, credits land on your account
- Friendlier, benefit-driven wording across the whole admin page
0.9.3
- Menu icon rendered at the proper size (matches surrounding admin icons)
- Image Packs listed with prices on the admin page, with balance/purchase guidance via the AI assistant
- “Advanced: use your own API key” now always starts collapsed
- Google Gemini listed before OpenAI (recommended image provider)
- Saved keys now show as bullets + last 4 in the key field (WordPress 7 Connectors style)
- Keys detected in Settings Connectors link there for manage/remove
0.9.2
- New lightning menu icon matching the WP Agent logo
- AI images presented as working out of the box (free trial / Image Packs); bring-your-own-key moved to a collapsed “Advanced” section
- Fixed: header-based Application Password authentication now also works on sites with Plain permalinks (?rest_route=)
- Fixed: the SEO write endpoint’s readback now reflects the plugin that was actually written when targeting a non-primary SEO plugin
- Uninstall now removes all stored data, including image API keys
- Internationalization for all admin-facing text; admin assets moved to the enqueue API
0.9.1
- Clearer key-source badges (saved in plugin vs. detected in WP Connectors)
- Validate & Save disabled until a key is entered; added Cancel
0.9.0
- Initial release: header-strip-proof Application Password auth, SEO meta read/write (Yoast, Rank Math, AIOSEO), site overview, Additional CSS endpoints, image key storage with live provider validation, WordPress 7.0 Connectors key detection