WordPress MCP for Beginners: 9 Real Jobs You Can Hand to Claude, Cursor or ChatGPT (Safely)

WPPilot — Sun, 27 Sep 2026 21:56:43 +0000

Read the WordPress and WooCommerce forums for a week and the same requests keep coming up. People want to rewrite thousands of stale product descriptions. They want every missing meta description written. They want an Elementor edit that doesn't wreck the layout, and a weekly check-up on the site. Alongside those requests you see the same fear: "One of my clients asked me to install Claude MCP onto their WordPress site and I'm terrified." The usual advice in those threads is sensible: start read-only, use staging, keep credentials easy to revoke, and make sure you can undo things.

This guide is built around those requests. We'll connect an AI client to WordPress through the Model Context Protocol (MCP), set up the safety controls first, and then go through nine common jobs. For each job you get the exact tools the AI calls, a prompt to paste, what happens to your site, whether you can undo it, and whether it needs the free or the paid edition.

The server we'll use is WPPilot, a GPL WordPress plugin (Free 1.13.0 and Pro 1.7.0 at the time of writing). Everything below was checked against its live docs and GitHub repository. Jobs are labelled Free or Pro.

MCP in 60 seconds

MCP is a standard way for an AI app (the client) to find and call tools that a server exposes. Once they're connected, you write normal sentences and the client picks the tools itself.

For WordPress this means two things:

The AI works on real WordPress data. Drafts, menus and Elementor elements show up in wp-admin. You don't paste HTML around.
The rules live on the server. Telling the model "don't delete anything" is just a request. A server-side permission is enforced whatever the model decides.

WPPilot runs on your own site, with no relay service in between and no per-request fees. It doesn't bundle a model, because your client brings its own. It's built on the WordPress Abilities API and the official MCP Adapter. The client sees three tools (discover-abilities, get-ability-info, execute-ability), and behind them sit typed "abilities" such as wppilot/update-post. Free ships 141 of them. Pro adds plugin-specific ones for WooCommerce, SEO suites, page builders, forms and more.

Install and connect (Free)

Requirements: self-hosted WordPress 6.9+, PHP 8.0+, HTTPS for anything outside your own machine, and a staging copy or backup.

Download wppilot.zip from the latest GitHub release. The plugin isn't on WordPress.org, and GitHub's "Source code (zip)" won't install because it has no vendor/ folder.
Go to Plugins → Add New → Upload Plugin, then activate it.
Create a dedicated WordPress user for the AI with the smallest role that works, for example Editor for content work. Every call inherits that user's capabilities.
Open WPPilot → Connect, turn on AI abilities, pick your client, and copy the config it generates. It already contains your real URL.

WPPilot serves two routes:

https://your-site.com/wp-json/mcp/wppilot-oauth   # OAuth 2.1 (preferred)
https://your-site.com/wp-json/mcp/wppilot         # Application Password or wpp_ access token

OAuth uses PKCE, one-hour access tokens and 14-day refresh tokens. Every app shows up under Connected Apps and can be revoked there, which makes it the easy-to-revoke credential the forums ask for. Application Passwords never expire, so revoke them yourself when you're done.

Claude Code

claude mcp add --transport http wppilot https://your-site.com/wp-json/mcp/wppilot-oauth
# then run /mcp inside Claude Code to finish the browser sign-in

Claude Desktop / claude.ai: go to Settings → Connectors → Add custom connector and paste the wppilot-oauth URL.

Cursor (~/.cursor/mcp.json):

{ "mcpServers": { "wppilot": { "url": "https://your-site.com/wp-json/mcp/wppilot-oauth" } } }

VS Code 1.101+ (.vscode/mcp.json):

{ "servers": { "wppilot": { "type": "http", "url": "https://your-site.com/wp-json/mcp/wppilot-oauth" } } }

Codex CLI (~/.codex/config.toml, then codex mcp login wppilot):

[mcp_servers.wppilot]
url = "https://your-site.com/wp-json/mcp/wppilot-oauth"

ChatGPT: enable Developer mode on ChatGPT web, create an app with the OAuth URL, and switch it on in each chat. It connects from OpenAI's cloud, so your site needs public HTTPS.

Clients such as Zed, Cline or Windsurf use the mcp-remote bridge (npx -y mcp-remote <oauth url>), which needs Node.js. Setup guides for all 27 supported clients are on wppilot.co/wordpress-mcp.

If the connection fails: most failures are network problems, not WordPress bugs. Your CDN, WAF or security plugin has to let /wp-json/mcp/* and /.well-known/oauth-* through without caching them, and the site must answer on a single canonical URL. If sign-in succeeds but calls are still unauthenticated, something is stripping the Authorization header. WPPilot → Diagnostics tests the connection the way a client would.

Safety setup (before any job)

This part answers the "I'm terrified" thread. Everything in this section is Free.

1. Pick a safety profile. The server enforces it, not the prompt.

Profile	What it allows
Read Only	Inspection only. Every write is blocked. Use it for your first connection and for audits.
Production Safe (installation default)	Normal content, design and store work. Plugin activate, deactivate and update need confirmation. PHP, WP-CLI, filesystem, database access and plugin/theme install or delete are blocked.
Developer Full Access	Everything that's enabled, including PHP and WP-CLI. Staging only.

2. Layers on top of the profile:

WordPress capability checks on every call
per-ability switches under WPPilot → Abilities
per-credential write rate limits
draft-first creation
destructive calls that refuse to run without "confirm": true

3. Preview before write. For post, page and media edits, settings changes and deletions, the agent can call preview-ability. You get a field-by-field diff and nothing is written. Then apply-preview runs it, but only after checking that nobody changed the same fields in the meantime. You can make previews mandatory for the whole site; that setting is off by default.

4. The change ledger and rollback. Every write is logged with the credential, the ability and redacted inputs. You read the log with list-changes and get-change. rollback-change reverses supported operations. The docs are clear that "rollback is never universal", and it isn't a backup. Each job below says whether its changes can be undone.

Prove it with one read (Read Only):

Use the wppilot MCP server. Change nothing.
1. Report the active safety profile and the abilities you can see.
2. Call get-site-settings, then list-content for the five newest pages,
   then get-content on one of them.
3. Name every ability you called and every WordPress ID you read.

Job 1: Read-only site and security audit (Free)

Abilities: security-audit, list-extensions, get-extension, list-users, get-site-settings, list-changes, agent-context, system-status, performance-audit.

Do a read-only security review. Change nothing.
1. Run security-audit and explain each finding, most serious first.
2. List plugins and themes with updates; flag inactive ones that could go.
3. List administrator accounts and point out any that look unexpected.
4. Summarise list-changes for the last 30 days.
5. Finish with a numbered fix list and say which items need a developer.

What happens: Only reads run, and Read Only stays on the whole time, so there's nothing to undo. Keep in mind that security-audit reviews configuration. It is not a malware scan.

Job 2: Refresh old posts and draft new ones (Free)

Abilities: search-content, list-content, get-content, get-page-snapshot, create-post, update-post, list-revisions, restore-revision, create-term, assign-terms.

Find posts mentioning "2024 pricing". For each, show the paragraph that
needs updating and propose new wording. Preview each update-post change
and wait for my OK. Then draft a new post from these bullet points: [...]

What happens: The agent searches, then previews each edit. You approve, and apply-preview writes it. New posts are created as drafts. A post edit can be rolled back from the ledger, and WordPress revisions give you a second safety net.

Job 3: Bulk image alt text (Free)

Abilities: list-media, update-media, verify-rendered-page.

List images with empty alt text. For each, read its title, caption, filename
and parent post, and write alt text of 125 characters or fewer. If you can't
tell what it shows, add it to a "needs review" list instead of guessing.
Save with update-media, 25 per batch, and pause after each batch.

What happens: Each update-media call gets its own ledger entry, so one bad description can be rolled back without touching the rest of the batch. One catch: posts that already embed an image keep the old alt text in their HTML. Fixing those means editing each post.

Job 4: Comment triage (Free)

Abilities: list-comments, get-comment, moderate-comment, create-comment, update-comment, delete-comment (needs confirmation).

Sort held comments into spam, approve and needs-me, with reasons for needs-me.
Mark spam, approve the rest, never delete permanently. Draft replies to
questions and show me before posting any.

What happens: The WordPress user needs moderate_comments, which Editor has, so no admin rights are required. Moderation can be reversed with rollback-change. A reply you've posted can be trashed, but anyone notified has already seen it.

Job 5: Plugin updates and weekly maintenance (Free)

Abilities: list-extensions, update-plugin, activate-plugin, deactivate-plugin (all writes need confirmation), plus security-audit and system-status.

List plugins with updates available, with current and new versions.
Recommend an order, lowest risk first. Update only the one I choose,
then re-check system-status and the home page with verify-rendered-page.

What happens: Under Production Safe, each update asks for confirmation. Updates are recorded but can't be rolled back, so take a backup or test on staging first. Installing or deleting plugins is only possible under Developer Full Access, because it writes code to your server.

Job 6: Edit Elementor pages and build landing pages (Free edits, Pro composes)

Forum threads say generic AI edits "produce broken layouts on Elementor" and that Elementor "will silently drop malformed widgets". Typed, element-level abilities are the fix.

Free abilities (Elementor 3.6.0+, Elementor Pro not required): elementor-check-setup, elementor-get-content (a compact skeleton by default), elementor-find-elements, elementor-get-widget-params, elementor-edit-element, elementor-duplicate-element, elementor-delete-element (needs confirmation), elementor-set-content (needs confirmation), plus get-active-design, check-design, verify-rendered-page, get-page-view-link and capture-page.

On the Pricing page (draft): read it as a compact skeleton first.
Change every "Get started" button to "Book a demo", keep the links.
Make "Plans for every team" an H2. Change nothing else.
Give me a preview link and the element ids you changed.

What happens: Only the targeted elements change. Unknown controls abort the write instead of corrupting it, and capture-page can attach a screenshot to the ledger entry. Rollback: "On Free alone these edits are recorded without a way back". With Pro active, the ledger keeps a copy of the document so the edit can be rolled back. On Free, work on a draft or a duplicate.

For a landing page, the agent can read your design, create a draft with create-post, write the layout with elementor-set-content (or a Gutenberg batch, see below), then check it with check-design and verify-rendered-page. Pro adds elementor-build-page (whole-page composition), templates, popups, global classes and variables.

On the block editor side, Gutenberg edits are staged with gutenberg-create-pending-batch and finished by the editor itself from a Block Editor Queue tab, so live content isn't touched until then. That's Free too.

Job 7: Bulk SEO titles and meta descriptions (Pro)

Abilities: yoast-get-post-seo / yoast-edit-post-seo, rank-math-get-post-seo / rank-math-edit-post-seo, plus the AIOSEO and SEOPress equivalents, term-archive SEO, and the Free list-content and verify-rendered-page.

Check which SEO plugin is active. List published pages with their SEO
title, description, canonical and robots. Report duplicates, empty
descriptions and titles over 60 characters. Change nothing yet.
For the ten worst, propose a title and description from the page content.
After I approve, write only those two fields, then verify-rendered-page.

What happens: Steps 1–3 run fine in Read Only. Switch to Production Safe for the writes. SEO edits are recorded but have no rollback, which is why the prompt reads the old values first. Save that table. Redirect abilities depend on the SEO plugin's own paid tier (Yoast Premium, AIOSEO Pro, SEOPress Pro).

Job 8: WooCommerce catalogue edits (Pro)

The "4k product descriptions" and "throttled after 50 products" threads keep ending with the same advice: small batches, logging, a human check.

Abilities (WooCommerce 9.0+): woocommerce-check-setup, woocommerce-list-products, woocommerce-get-product, woocommerce-edit-product (partial updates), woocommerce-list-product-variations, woocommerce-edit-product-variation, woocommerce-sales-summary, and woocommerce-delete-product (needs confirmation).

Run woocommerce-check-setup. List published products in Jackets with SKU,
regular price, sale price and stock. Propose a sale price 20% below regular
for items with more than 5 in stock; show the table and wait. After I approve,
set only sale_price, on each variation for variable products.

The same pattern works for descriptions: 25 products per batch, rewrite only description, and pause between batches.

What happens: Store settings, gateways, tax and shipping zones stay read-only under every profile. Product and variation edits have no rollback, so export or note the old values first. For store-wide changes, Pro's approval queue holds every write until a person signs off, and it emails the admin.

Job 9: Page speed and cache tuning (Pro)

Abilities: cache-check-setup, cache-begin-experiment, cache-measure-page, cache-set-settings, cache-purge, cache-warm, cache-verify-in-browser, cache-revert-experiment. They cover LiteSpeed, WP Rocket, W3 Total Cache and about two dozen other cache and optimisation plugins.

Start a cache experiment. Measure / and /shop/ three times as a baseline.
Propose the single lowest-risk change and wait. Apply it, purge, warm,
re-measure. If anything got worse, revert the experiment.

What happens: This is one of the better-covered areas. Each settings change can be rolled back on its own, and cache-revert-experiment restores every layer at once.

Six mistakes that make AI + WordPress go wrong

These come up again and again in forum threads, and each one has a simple fix.

Connecting as an administrator. An Application Password isn't a separately scoped API key. It carries every capability of its user. Give the agent its own Editor-level account and raise it only when a job needs more.
Skipping the read-only pass. Nearly every job above starts with a report. Let the agent show you what it found before it's allowed to change anything, and you'll catch wrong assumptions (the wrong SEO plugin, the wrong category, a variable product priced on its parent) while they still cost nothing.
Treating a successful tool call as a finished job. A tool call that returns without error only means the request went through. Open the page in a browser, check mobile, and let verify-rendered-page catch a cached or theme-overridden title.
Assuming everything can be undone. Alt text, post edits, comment moderation and cache settings can be rolled back. SEO metadata, WooCommerce product edits and plugin updates can't. Neither can Elementor element edits on Free alone. Plan the job around that, not the other way round.
Huge batches. Store owners in the "4k product descriptions" thread hit throttling after about 50 items. Batches of around 25 with a pause and a summary are easier to review, keep the ledger readable, and are less likely to hit your host's rate limits.
Fixing a refused write by switching to Developer Full Access. If a write is refused, a requirement is missing: the capability, the ability switch, the companion plugin or the licence. Fix that one thing. Keep the most permissive profile for staging.

Free vs Pro at a glance

Job / feature	Free	Pro
MCP server, OAuth / App Passwords, 27 client configs	✅	✅
Safety profiles, confirmations, previews, ledger, rollback	✅	✅
Audits: `security-audit`, `system-status`, `performance-audit`	✅	✅
Posts, pages, media / alt text, comments, menus, revisions	✅	✅
Plugin activate / update (with confirmation)	✅	✅
Gutenberg staged edits, design checks, screenshots	✅	✅
Skills and site instructions	✅	✅
Elementor element editing (17 abilities)	✅	✅
Elementor rollback, whole-page composition, templates, global classes	—	✅
Yoast, Rank Math, AIOSEO, SEOPress	—	✅
WooCommerce products, variations, coupons, orders	—	✅
Cache and page-speed experiments	—	✅
Forms, ACF/custom fields, WPML/Polylang/Weglot, other page builders	—	✅
Page builder converter (new draft plus a loss report)	—	✅
Human approval queue with email, persistent memory, integration health	—	✅

Pro is a second plugin that registers extra abilities on the same connection, so nothing you set up on Free is wasted. Each module loads only when its plugin is active.

How to get each version

Free: download wppilot.zip from the GitHub releases. No account is needed and it's GPL.
Pro: choose a plan on the pricing page. Plans differ only by the number of sites, and every tier has the same features. Keep Free installed, upload the Pro zip from the customer portal, and enter your licence key. Without an active licence, Pro modules stop loading and the site falls back to Free. Nothing is deleted.

My advice: prove the workflow on Free (jobs 1–6) before paying for anything. Buy Pro only when the data you need lives in a plugin, such as WooCommerce, an SEO suite, forms or custom fields, or when you want an approval queue for agents that run unattended.

Wrapping up

The pattern that answers the fears in those threads:

staging first
a dedicated user
OAuth so the credential is revocable
Read Only until one read works
Production Safe for drafts
previews for anything that matters
list-changes after every session

Before you rely on rollback for a job, check whether that job supports it.

The WPPilot docs have the full ability reference and troubleshooting. Which job would you hand over first? Tell me in the comments.

DEV Community: WPPilot