I let an AI agent edit pages on a live WordPress site. It comes down to four safeguards: pages allowed one by one, a backup before every write, a dry run, and a check of the live page afterwards.
The problem
Optimizing a page used to mean: copy the HTML from the admin, paste it into an AI assistant, get the corrected version back, paste it again, check. Ten minutes of copy-paste per page, and just as many chances to paste the wrong version.
The page body isn’t even in WordPress’s standard field: it’s stored in ACF blocks that the REST API doesn’t expose. So an agent couldn’t read anything on its own.
What I built
The official MCP Adapter plugin lets an agent call WordPress “abilities”. I wrote a small mu-plugin that declares a few of them:
- read: list content, read a page with its ACF blocks and Yoast fields;
- write: title, excerpt, Yoast title and meta description, content blocks, featured image;
- backups: list and restore.
The agent connects with a dedicated account, Editor role, and an application password stored in an environment variable, never in a config file.
The safeguards
- Writes are limited to drafts and an explicit list of published IDs. To open a page to the agent, I add its ID to the list, nothing else.
- Automatic backup before every write (the last ten), restorable in one call.
- Dry run (
dry_run): the agent shows me what it’s about to write before touching a published page. - Locked fields: status, date and the form script can’t be changed, except for one specific script validated by a regular expression.
- Read-back: after writing, the agent reads the page through the API, then live.
The fifth point has already paid off: one version of the plugin returned an error even though the write had succeeded. Without the read-back, we would have written twice.
What changed
The agent reads the live page, queries Search Console, proposes the fixes, writes them once I approve and checks the result. I no longer copy-paste HTML, and I’ve never needed to restore a backup because of an agent mistake.
Takeaway
It isn’t the AI that makes this safe, it’s the limits set on the server side. An ID allowlist and an automatic backup beat a “be careful” line in a prompt.
The rules on the agent’s side are in another note.