Nothing happens on your site that you haven’t seen first.

SiteHelm gives an AI agent 80 named WordPress operations and nothing else. No PHP. No shell. No SQL.

Free, open source, and no account to create. Pro is a separate add-on, and only for site-wide SEO and WooCommerce.

One write, end to end Reversible

 Preview Every changed field, before and after. nothing written 
 Permission Checked against your own WordPress account. edit_post 
 Apply Only with the single-use token that preview issued. plan 8f21 
 Verify Re-read from the database once it has run. confirmed 
 Rollback The prior state is kept so you can put it back. one screen 

Cue 2 — first light

A change is legible before it goes.

Ask the agent to change something and nothing changes yet. The preview comes back with the exact field-level before and after, plus a single-use plan token.

Applying means re-sending the same arguments with that token. If the arguments moved even slightly, you get a StalePlan refusal — not a surprise write.

Agents discover the surface at runtime by calling a dispatcher with no operation argument, so they never work from a memorised list.

Preview · plan token issued Armed

content.update #4128 post_title

Before Spring Sale — 20% off

After Summer Sale — 30% off

Illustrative. Nothing is written until this exact plan is re-sent with its token.

Cue 3 — dawn

Then it checks what actually landed.

Most tools report what they sent. SiteHelm reports what persisted.

Snapshot

The old state is kept first

Before the write, not after it. This is what rollback restores from.

Write

The operation runs

Through a typed handler whose schema rejects unknown properties.

Read back

The site is read again

Not the return value of the write — the site itself, freshly queried.

Compare

Persisted against promised

If a filter, a plugin or the theme quietly altered the value, the report says so instead of claiming success.

Cue 4 — blackout

Four cues that will never go.

These are not features held back for a paid tier, and not items on a backlog. They are recorded as permanently excluded, so nobody on this project can propose them again.

The open-shell approach advertises the opposite of this list — PHP execution, WP-CLI, database queries and file edits on a live site — as the reason to buy. That is the whole disagreement.

Activity · a cue that did not go Refused

users.delete #7 Capability

A refusal is a first-class outcome with a reason and a remedy, logged in the same register as a success. Never a stack trace, a file path, or a SQL string.

Never

Arbitrary PHP

No eval, no snippet store, no theme-file editor. There is no path from an agent to executing code.

Never

Unrestricted SQL

No query passthrough. Every read and write goes through a typed operation with a schema.

Never

Unrestricted filesystem

No arbitrary file writes, and no WP-CLI passthrough.

Never

Irreversible deletion

Nothing is destroyed without a snapshot that can put it back.

And

No god-mode key

Permission comes from the authenticating WordPress user’s real capabilities, and every handler re-checks them itself.

Cue 5 — day

And you can put it back.

Rollback restores from the snapshot taken before the write. Not a re-edit, and not an undo stack the agent controls — the state that existed a moment earlier, returned by you from the console.

Six tabs in wp-admin do the human half of the job: Home, Connect an app, History, Health, Permissions and Tools, with rollback, a write pause, and credential revoke reachable in one click.

Per-operation and per-module switches mean you can hand over exactly as much as you meant to, and no more.

Activity Illustrative

content.update #4128 Applied

media.upload summer-hero.jpg Applied

users.delete #7 Refused

menus.reorder primary Rolled back

Synthetic rows, shown to illustrate the log’s shape.

Cue 6 — the plot 80 operations

10 modules, 11 dispatchers, one closed set.

The surface is small on purpose. Everything on it is named, typed, and refuses arguments it does not recognise.

Requires PHP 8.1 or newer and WordPress 6.6 or newer. Elementor, ACF, Meta Box, an SEO plugin and WooCommerce are all optional — SiteHelm reports which of them it found rather than requiring any.

Every area, and what it does

17 ops

Content

Posts, pages, custom post types, blocks, terms and redirects — the operations an editor would otherwise perform by hand.

8 ops

Media

The library: attachment details, uploads, alt text and captions, and import from a URL behind a guarded fetch.

6 ops

Menus

Navigation menus, their items, their order, and which theme location each one is assigned to.

19 ops

Elementor

Documents and elements, widget settings, global colour and typography tokens, and theme-builder display conditions.

8 ops

Custom fields

ACF and Meta Box field groups, their fields, and their values — read and written through each plugin’s own API.

6 ops

SEO

Titles, descriptions and robots directives, read and written through whichever SEO plugin the site already runs.

3 ops

Comments

The moderation queue: list by status, approve, hold, spam or trash, and reply beneath a comment.

3 ops

Forms

Read only: which forms the site holds, each form’s fields and embed shortcode, and its most recent entries.

2 ops

Users

The roster, and one write: replacing a user’s roles with a single role the site has actually registered.

2 ops

Site settings

Thirteen fields, allowlisted: title, tagline, timezone, date and time formats, posts per page, front-page geometry, permalinks, default discussion settings, and search-engine visibility.

Cue 7 — the board

The free plugin is the whole safety model.

Everything above this line — the two-phase write, read-back verification, the capability model, the activity log, rollback, the write pause, the exclusions — is in the free plugin. Nothing about safety sits behind the paywall.

Pro adds reach, not safety: 16 further operations for site-wide SEO settings, schema, bulk metadata fixes and WooCommerce products. Every one of them inherits the same preview, snapshot, verification and rollback.

Nothing free moves into Pro later, and a lapsed licence stops the Pro operations without stopping anything else.

Start with the free plugin Free against Pro, by name

Single site

1 site. Your own site, or one you look after.

$39/year

Get Pro — single site

3 sites

Up to 3 sites. A small book of client work.

$69/year

Get Pro — 3 sites

Unlimited

Every site you run. An agency, or a freelancer with a full roster.

$149/year

Get Pro — unlimited

Launch pricing, new customers only, applied at checkout to the first payment and to every renewal — your price does not jump next year. Monthly and lifetime licences are available at the same checkout.

Install 3 steps

Connect once, from the Connect screen.

Step 1

Install and activate SiteHelm

An ordinary WordPress plugin. Nothing to configure first.

Step 2

Open Connect and follow it

It carries you through the whole handshake. You do not need to know what MCP, JSON-RPC, or an application password is.

Step 3

Point your AI client at the site

Claude, Claude Code, Cursor, VS Code, or any other MCP client. The agent discovers what it is allowed to do at runtime.

Download the free plugin The install guide in full

Nothing happens on your site that you haven’t seen first.

A change is legible before it goes.

Then it checks what actually landed.

The old state is kept first

The operation runs

The site is read again

Persisted against promised

Four cues that will never go.

Arbitrary PHP

Unrestricted SQL

Unrestricted filesystem

Irreversible deletion

No god-mode key

And you can put it back.

10 modules, 11 dispatchers, one closed set.

Content

Media

Menus

Elementor

Custom fields

SEO

Comments

Forms

Users

Site settings

The free plugin is the whole safety model.

Single site

3 sites

Unlimited

Connect once, from the Connect screen.

Install and activate SiteHelm

Open Connect and follow it

Point your AI client at the site

Already looking at another one?

The questions people ask before installing

What Pro costs