Nothing happens on your site that you haven’t seen first.

SiteHelm gives an AI agent 79 named WordPress operations and nothing else. No PHP. No shell. No SQL.

One write, end to end Reversible

            Preview
            Every changed field, before and after.
            nothing written
          

            Permission
            Checked against your own WordPress account.
            edit_post
          

            Apply
            Only with the single-use token that preview issued.
            plan 8f21
          

            Verify
            Re-read from the database once it has run.
            confirmed
          

            Rollback
            The prior state is kept so you can put it back.
            one screen
          

Cue 2 — first light

A change is legible before it goes.

Ask the agent to change something and nothing changes yet. The preview comes back with the exact field-level before and after, plus a single-use plan token.

Applying means re-sending the same arguments with that token. If the arguments moved even slightly, you get a StalePlan refusal — not a surprise write.

Agents discover the surface at runtime by calling a dispatcher with no operation argument, so they never work from a memorised list.

Preview · plan token issued Armed

content.update #4128 post_title

Before Spring Sale — 20% off

After Summer Sale — 30% off

Illustrative. Nothing is written until this exact plan is re-sent with its token.

Cue 3 — dawn

Then it checks what actually landed.

Most tools report what they sent. SiteHelm reports what persisted.

Snapshot

The old state is kept first

Before the write, not after it. This is what rollback restores from.

Write

The operation runs

Through a typed handler whose schema rejects unknown properties.

Read back

The site is read again

Not the return value of the write — the site itself, freshly queried.

Compare

Persisted against promised

If a filter, a plugin or the theme quietly altered the value, the report says so instead of claiming success.

Cue 4 — blackout

Four cues that will never go.

These are not features held back for a paid tier, and not items on a backlog. They are recorded as permanently excluded, so nobody on this project can propose them again.

The open-shell approach advertises the opposite of this list — PHP execution, WP-CLI, database queries and file edits on a live site — as the reason to buy. That is the whole disagreement.

Activity · a cue that did not go Refused

users.delete #7 Capability

A refusal is a first-class outcome with a reason and a remedy, logged in the same register as a success. Never a stack trace, a file path, or a SQL string.

Never

Arbitrary PHP

No eval, no snippet store, no theme-file editor. There is no path from an agent to executing code.

Never

Unrestricted SQL

No query passthrough. Every read and write goes through a typed operation with a schema.

Never

Unrestricted filesystem

No arbitrary file writes, and no WP-CLI passthrough.

Never

Irreversible deletion

Nothing is destroyed without a snapshot that can put it back.

And

No god-mode key

Permission comes from the authenticating WordPress user’s real capabilities, and every handler re-checks them itself.

Cue 5 — day

And you can put it back.

Rollback restores from the snapshot taken before the write. Not a re-edit, and not an undo stack the agent controls — the state that existed a moment earlier, returned by you from the console.

Six tabs in wp-admin do the human half of the job: Home, Connect an app, History, Health, Permissions and Tools, with rollback, a write pause, and credential revoke reachable in one click.

Per-operation and per-module switches mean you can hand over exactly as much as you meant to, and no more.

Activity Illustrative

content.update #4128 Applied

media.upload summer-hero.jpg Applied

users.delete #7 Refused

menus.reorder primary Rolled back

Synthetic rows, shown to illustrate the log’s shape.

Cue 6 — the plot 79 operations

Nine modules, eleven dispatchers, one closed set.

The surface is small on purpose. Everything on it is named, typed, and refuses arguments it does not recognise.

Requires PHP 8.1 or newer and WordPress 6.6 or newer.

Module

Content

Posts, pages, taxonomies and terms — read and write.

Module

Media

Library reads, uploads, and import from a URL behind a guarded fetch.

Module

Menus

Navigation structure, items, and ordering.

Module

Elementor

Page data, global colour and typography tokens, theme-builder display conditions.

Module

Custom fields

ACF and Meta Box field groups and their values.

Module

SEO

Titles, descriptions and robots directives across seven providers.

Module

Comments

The moderation queue: approve, unapprove, spam, trash.

Module

Users

Roles and accounts, without ever declaring a meta capability.

Module

Site settings

The options a site owner would otherwise change by hand.

Cue 7 — the board

The free plugin is the whole safety model.

Everything above this line — the two-phase write, read-back verification, the capability model, the activity log, rollback, the write pause, the exclusions — is in the free plugin. Nothing about safety sits behind the paywall.

Pro adds reach: WooCommerce products, deep SEO for Yoast and Rank Math, bulk metadata, per-post schema, audit-driven fixes, and forms across seven more plugins. Every Pro operation inherits the same safety model.

Start with the free plugin

Single site

One site. Everything in Pro.

$39/year

Get Pro

3 sites

For a small book of client work.

$69/year

Get Pro

Unlimited

Every site you look after.

$149/year

Get Pro

Launch pricing, new customers only, applied at checkout to the first payment and to every renewal — your price does not jump next year. Monthly and lifetime licences are available at the same checkout.

Install 3 steps

Connect once, from the Connect screen.

Step 1

Install and activate SiteHelm

An ordinary WordPress plugin. Nothing to configure first.

Step 2

Open Connect and follow it

It carries you through the whole handshake. You do not need to know what MCP, JSON-RPC, or an application password is.

Step 3

Point your AI client at the site

Claude, Claude Code, Cursor, VS Code, or any other MCP client. The agent discovers what it is allowed to do at runtime.

Download link pending — the plugin listing URL goes here.