WordPress MCP write access: approvals, limits and undo
WordPress MCP write access in BetterShield means an AI assistant can fix things on your site, but only within limits you set: fixes that only add protection apply at once with an undo, heavier changes wait for your approval, and a short list of actions is never open to an assistant at all. It is one switch, Let AI assistants fix things, and it is off until you turn it on.
This post is about the change side of the connection. How to connect an assistant and read from your site first is in WordPress MCP: connecting an AI assistant to your site safely, and the six rules for the whole arrangement are in MCP security best practices for a WordPress site. Here we look at what changing adds: what applies directly, what waits, what stays out of reach, and how to take a change back.
Quick summary
- Reading and changing are separate. Let AI assistants see security info comes first, and Let AI assistants fix things depends on it. Both are off by default.
- Fixes that only add protection apply right away, and each is saved to the undo record before it runs.
- Sign-in changes and anything else risky become a plan. You approve one plan, once, in the conversation or under Agents › Requests.
- Agents never create accounts or credentials, change recovery options, weaken two-factor or alerting, lift a lockout, remove log rows, or write
wp-config.phpor.htaccess. - Limits are 5 changes of one kind per hour for each connection, and 15 for the site as a whole. Excess calls are refused, not queued.
Why change access is a separate decision
An assistant that can only read cannot hurt your site. It can tell you what the score is and what a finding means, and then you do the work. Letting it act saves that step, which is the point, and it is also why BetterShield treats it as a different level of trust. The assistant connects as an account on your site, so it can never do more than that account can, and the switches then narrow it further.
The same idea runs through the principle of least privilege: give a tool the smallest set of powers that gets the job done. BetterShield’s design follows from it. Small, reversible things are allowed to happen quickly. Everything else needs a person.
What an assistant can do without asking again
Release 1.1.4 adds fixes on your findings. An assistant can look up the fix options for a finding, then act. A few fixes only add protection, so they apply right away. Each is written to the undo record before it runs:
- Remove scheduled events that nothing on the site answers.
- Start watching a REST route that answers anyone, and later close it.
- Narrow folder permissions.
- Apply a protection again that stopped working.
- Take a source off the script and content policy.
Current versions also let an assistant propose ending sessions, revoking another connected app or putting the site into lockdown. An assistant you allowed to change the site applies each of these once you agree in the conversation. Other callers wait under Agents › Requests. Only the site itself can lift lockdown.
An assistant allowed to fix things can also ask for work that changes no protection: audits, file checks, recovery checks, vulnerability checks, a check of a single finding, an early run of overdue scheduled work and refreshed incident evidence. It can start or stop observation too, where that is supported, and starting observation does not enforce the protection.
What waits for your approval
Everything else becomes a plan. The plan says what will change and whether it can be put back. These are the changes that wait:
| Change | What the plan covers |
|---|---|
| Update a plugin | The newer version from WordPress.org; the current version is kept |
| Quarantine an unused plugin, theme or downloadable file | Moved aside, not deleted |
| Rename the account named admin | Never the account the assistant acts as |
| Revoke an unused application password | Cannot be restored; make a new one |
| Suspend an unused privileged account | Never the last administrator |
| Ask an account for a new password | The person is emailed a reset link |
| Change the script and content policy | Start enforcing it, or allow one more source |
| Take a fix off, or put a changed file back | A plan too, because it removes protection or restores older code |
Sign-in changes have extra conditions. They need a recovery link you verified within the last day, which you can do under Protection › Recovery, and the approving person’s password. If you have not set recovery up, start with Set up recovery before you let an assistant near anything that can lock people out.
What stays out of reach
Some actions are not offered to an assistant at any setting. Agents never create accounts or credentials, change recovery options, weaken two-factor or alerting, lift a lockout, remove log rows, or write wp-config.php or .htaccess. Agents › Permissions lists them under What stays yours. A caller also cannot enforce a protection: starting observation is not the same as switching one on.
Set it up
- Open BetterShield › Agents › Permissions and turn on Let AI assistants see security info, then Let AI assistants fix things. The account that connects must be allowed to approve AI fixes.
- Connect the assistant. When you create a key, leave Allow this key to make fixes unticked if the key should only look.
- Ask the assistant about a finding and let it show you the fix options.
- For a plan, open Agents › Requests, press Show Details, read what will change, and press Approve.
Approve asks for your password and creates a single-use approval code for that one change. The code works once and expires 15 minutes after the plan was made. Paste it into your assistant; it is shown only then. Decline sets the plan aside so nothing is applied, and the assistant can ask again. Cancel Approval invalidates a code you have not used yet.
Show Details says This can be undone. or This can’t be undone. Read that line before you approve anything.
If you would rather approve without leaving the chat, a supported write-scoped assistant can carry a one-use confirmation from you for the exact action it proposed. Assistants without that confirmation wait in the Requests screen. A confirmation for one action is not ongoing permission for different actions. See Review change requests from agents for the whole screen.
What it can break, and how to undo
Approving a plan gives permission for a change. It does not promise the change is harmless, so each kind has its own way back:
- Scheduled events, REST routes, folder permissions, a plugin update, a quarantined plugin or theme, a renamed account and a suspended account can each be taken back. Taking a fix back is a plan too, so it waits for your approval.
- A quarantined download is put back from the quarantine list. See File quarantine.
- A revoked application password cannot be restored.
- Enforcing the script and content policy can stop a page loading something it needs, checkout included. Take enforcement back on the site.
- Updating a plugin puts new code on the site, and putting the old version back does not fully reverse every kind of breakage. Take a backup you can restore first.
- Turning off Let AI assistants fix things stops new fixes. It does not undo the ones already made, so reverse any completed change that should not stay.
Let an AI assistant propose finding fixes goes through each fix one at a time.
Check it is working
Under Agents › Permissions, Let AI assistants fix things should be on, and Connection diagnostics on Connect should show it. A heavier change should produce a plan under Requests rather than applying immediately. After you approve a plan, its row shows the approval code and expiry. Once it has been used, a second attempt should be refused and the row reads applied.
After a fix, the finding updates on its own and the score changes. For the record of what the assistant asked for, open Activity › Agent activity. Record what agents do on this site is on by default, and it keeps the ability, the route, the outcome and a digest of the input, never the input itself. Refused calls appear too, which is useful evidence. Record what agents do on this site covers the switch, and recording needs WordPress 7.1 or newer.
If you want to know what else on the site offers abilities to assistants, WordPress Abilities API: see what AI agents can reach and do shows how to read the list. The platform’s own Abilities API handbook explains what an ability is.
Recommended settings
We recommend a dedicated connection for any assistant that is allowed to change the site, reviewed before you give it that power. Leave Allow this key to make fixes unticked on any key that only needs to look, and keep activity recording on. Approve only a plan you expected from a known assistant, and compare its target and effect with what you asked for. Start with the checks, then try one fix at a time.
Frequently asked questions
Can an AI assistant change my WordPress site without asking me?
Only for a few fixes that add protection, and each has an undo. Updating a plugin, quarantining something, changing an account and anything that touches sign-in wait for a plan you approve.
Does turning on fix access let an assistant lock me out?
BetterShield works to prevent that. Agents never change recovery options or lift a lockout, and sign-in changes need a recovery link verified in the last day plus your password. Only the site can lift lockdown.
How many changes can an assistant make in an hour?
The limits are 5 changes of one kind per hour for each connection, 15 for the site as a whole, and 30 plans of one kind per hour for each connection. Anything beyond that is refused, not queued.
What happens if I never approve a plan?
Nothing is applied. A plan sits under Agents › Requests, and an approval code expires 15 minutes after the plan was made. You can decline the plan and the assistant can ask again.
How do I see what an assistant did?
Open Activity › Agent activity. Each row shows the ability, the outcome and a digest of the input, and refused calls are included.
Conclusion
Change access is a way to save yourself clicks without giving up the final say. Turn on reading first, add fix access when you have a reason, approve heavier plans one at a time, and keep the log on so you can see what happened.
BetterShield is free on WordPress.org. The doc for this feature is Let an AI assistant apply approved changes.