Let an AI assistant propose finding fixes
A connected assistant can look up a finding's fix options, apply safe fixes with an undo, and propose the rest as plans you approve.
What it does
With Let AI assistants fix things on, a connected assistant can work on the fixes behind your findings. It first reads what a finding’s fix would act on, such as scheduled events, REST routes, folders, plugin updates, unused plugins and themes, downloadable files, accounts and application passwords. Accounts are named by display name, never by login, and a list stops at fifty rows.
A few fixes only add protection, so they apply right away. Each one is saved to the undo record before it runs:
- Remove scheduled events that nothing on the site answers.
- Start watching a REST route that answers anyone, and after a week of watching, require sign-in for it.
- Take world-write permission off content folders.
- Apply a protection again that is on but not working. A protection that changes how people sign in is applied again on the site, not by the assistant.
- Take a source off the script and content policy.
Everything else is a plan you approve in the conversation or under Agents › Requests:
- Update one plugin to the newer version from WordPress.org. The current version is kept.
- Move an unused plugin or theme into quarantine.
- Move a leftover tool, backup or log that visitors can download into quarantine.
- Rename the account named
admin. It is never the account the assistant acts as. - Revoke an application password nobody has used for a long time.
- Suspend an unused privileged account. It is never the last administrator or an account that recovery or alerts go to.
- Ask an account with a weak password for a new one. It cannot sign in with its current password and is emailed a reset link.
- Start enforcing the script and content policy, or allow one more source in it.
The assistant can also ask for a finding to be checked again, one plugin’s changed files to be compared again, a vulnerability check, or overdue scheduled work to run once. These change no code and no protection.
Agents still never create accounts or credentials, change recovery options, weaken two-factor or alerting, lift a lockout or remove log rows.
Set it up
- Turn on Let AI assistants see security info and Let AI assistants fix things under Agents › Permissions. Both are off by default.
- Connect an assistant. Leave Allow this key to make fixes unticked on a key that should only look.
- Ask the assistant about a finding.
- For a plan, open Agents › Requests, press Show Details and then Approve, or approve it when the assistant shows you the plan in the conversation.
Renaming the admin account also needs your recovery link checked in the last 24 hours under Protection › Recovery. The limits in Let an AI assistant apply approved changes apply to these fixes too. Each connection’s tool selection still decides what an app is offered.
Recommended settings
Our advice: start with the checks, then one fix at a time. Read the plan before you approve it. Update plugins only with a backup you can restore, because new code can break a site in ways putting the old version back does not fully reverse. Tell the person whose username is renamed.
What it can break and how to undo
- Scheduled events, REST routes, folder permissions, a plugin update, a quarantined plugin or theme, a renamed account, a suspended account and a password hold can each be taken back. The way back is a plan too, because it takes protection away or restores older code. Ask the assistant to undo it and approve the plan.
- A quarantined download is put back from the quarantine list on the site. See File quarantine.
- A revoked application password cannot be restored. Make a new one.
- Enforcing the script and content policy can stop a page loading something it needs, checkout included. Take enforcement back on the site.
- Turning off Let AI assistants fix things stops new fixes. It does not undo the ones already made.
Check it is working
After a fix, the finding updates on its own and the score changes. The activity log records each change, and a fix applied without a plan is recorded as a high-severity row. Activity › Agent activity shows everything each assistant asked for, even what was refused.