Launch offer
20% off every Pro tier — and every renewal — for a limited time. Use the code at checkout:
About
Most tools in this category hand an agent the same power a developer has over SSH. That is the right answer on a machine you can restore in ten minutes, and the wrong one on a client's live business.
SiteHelm is an independent project. It is not affiliated with, endorsed by, or connected to the WordPress project or Automattic.
An agent that can edit theme files and run SQL will eventually do both, at speed, on the wrong site. The failure is never dramatic while it is happening: it looks like a successful response and a confident summary. You find out afterwards.
SiteHelm was built by refusing that shape. In the free plugin there is still no path from an agent to executing code. The Pro Code module is the one guarded exception, and it earns it: it ships switched off, a snippet is never live on arrival, the site is health-checked the moment one is switched on, a snippet that breaks the site is reverted and quarantined automatically — and nothing SiteHelm stores ever runs during its own request, so the way back in survives anything a snippet does.
What is left is 115 free and 51 Pro named operations, each one declared in code with a schema, a required capability, and its own preview, snapshot and rollback policy. An agent can do a great deal with them. It cannot do anything else.
The free plugin has no path from an agent to running code. Code exists only in the Pro Code module — off by default, always stored switched off, health-checked the moment it is switched on, auto-reverted when the site stops rendering, and self-deactivating unless confirmed.
Snippets load only on the hook they declare, never on the gateway request, WP-CLI or cron — a snippet that white-screens the site cannot break the channel you would use to remove it.
No query passthrough. Every read and write goes through a typed operation with a schema.
No arbitrary file writes, and no WP-CLI passthrough.
Nothing is destroyed without a snapshot that can put it back.
These are not roadmap gaps. They are the product.
Every operation is written, reviewed and tested individually. That is slower than exposing an API surface wholesale, and it is the reason the answer to “what can it do to my site” is a list rather than a shrug.
There is no permanent delete anywhere in the surface. A trash operation moves an item to the bin and declares that rollback is required.
Preview, capability checks, snapshots, verification, rollback, the activity log and every switch are free on every site. Selling a safety control is selling you the risk and then charging to remove it.
Including its tests and its full operation reference. Every claim on this site about what SiteHelm will not do is checkable in the code rather than taken on trust.
SiteHelm is built and maintained by one developer, working on it directly. There is no support team behind a form and no queue: the person who wrote the operation is the person who answers when it misbehaves.
That is a real limit and it is worth knowing before you buy. It also means a reproducible bug report is read by someone who can fix it the same day, and that the roadmap is not filtered through anyone.
The plugin, its tests and its operation reference are public. The repository is here.
What gets built next is decided in the open. The roadmap and the request board are the same list everyone else sees.
Contributions are rewarded with free Pro access, for verified work a maintainer has read. The programme is here.
Everything above is a claim. The free plugin is how you check it: point an agent at a site that does not matter and read what a preview actually returns before it writes anything.
Get the free plugin How the five gates work Compared with the alternatives
SiteHelm