YLabs AI Assistant Connector

Let your AI assistant manage your WordPress site. WP Agent connects ChatGPT, Claude, Cursor, and other AI systems to your site so they can create and edit content, manage media, menus, and settings — keyless, using a standard WordPress Application Password.

Most of WP Agent works through the WordPress core REST API with no plugin at all. This companion plugin adds the pieces core REST cannot do:

• Reliable authentication on any host — many hosts (LiteSpeed, Apache without CGIPassAuth) strip the Authorization header before WordPress sees it, which silently breaks Application Password logins. The plugin accepts the same Application Password in a custom X-WPAgent-Authorization header that survives, and validates it with WordPress’s own native check. No new secret, no weaker check.
• Re-enables Application Passwords — some security plugins and hosts turn WordPress Application Passwords off globally, which makes any connection impossible. Because Application Passwords are the only credential WP Agent uses, this plugin turns the feature back on while it is active. WordPress core still requires HTTPS for them, and every Application Password remains individually revocable under Users → Profile → Application Passwords. Deactivating this plugin restores your security plugin’s setting.
• SEO meta read/write — Yoast SEO, Rank Math, and All in One SEO store their fields as protected meta (or, for AIOSEO v4, in a custom table) that core REST cannot write. The plugin adds safe, permission-checked endpoints so your assistant can set SEO titles, descriptions, and focus keywords.
• Site overview — one endpoint that tells the assistant what it’s working with: WordPress/PHP version, active theme, detected SEO plugin, WooCommerce presence, and (for admins) the plugin inventory.
• Media help — your assistant can search a free stock-photo library, upload a photo into your media library, set featured images, and fix alt text. WP Agent does not generate AI images and never sells image credits.

All endpoints live under one wp-agent/v1 REST namespace and every one of them requires an authenticated WordPress user with the appropriate capability. Nothing is exposed to anonymous visitors.

Security

• No new credentials — authentication uses WordPress’s built-in Application Passwords, validated by WordPress core
• Your WordPress account password is never stored or transmitted
• Every REST endpoint checks WordPress capabilities
• Revoking the Application Password (Users → Profile) instantly disconnects WP Agent

External Service Disclosure

This plugin communicates with exactly one external service:

WP Agent (mcp.getwpagent.com / getwpagent.com) — the “Connect WP Agent” button on the admin page is a link that opens the WP Agent website with your site URL and site name pre-filled, so you can pair the site to your WP Agent account. The plugin itself sends nothing to WP Agent in the background; pairing happens on the WP Agent website after you sign in there. Once you connect, your AI assistant manages the site through WP Agent, which sends authenticated requests to your site’s REST API.
WP Agent Terms of Service · WP Agent Privacy Policy

The plugin sends nothing to any AI provider: WP Agent does not generate AI images, and the optional image-key validation that previously contacted OpenAI and Google was removed in 0.9.10.

If you never click Connect, the plugin makes no external requests at all.