AI and WordPress

How to connect ChatGPT or Claude to WordPress

Pasting content between a chat window and wp-admin is not integration. This is what it takes to give an AI assistant real access to a WordPress site, what it can safely do once connected, and what you should never let it near.

Copy and paste is not a connection

Most people already use AI with WordPress. They describe a page in ChatGPT, get some HTML back, and paste it in. It helps, but the assistant has no idea what your site contains. It cannot see your existing posts, your menu structure, your SEO fields or your settings, so everything it produces is a guess about a site it has never seen.

A real connection changes what you can ask for. Instead of “write me a paragraph about X”, it becomes “find every internal link that points at a page I deleted and fix them”, which is a job nobody wants to do by hand and no amount of pasting will accomplish.

What actually makes a connection possible

Both ChatGPT and Claude can call external tools. The assistant does not run your site; it asks a server for something, that server does the work, and the result comes back. The protocol for this is MCP, the Model Context Protocol, and it is becoming the standard way AI clients talk to outside systems.

For WordPress that means a plugin which exposes a defined set of tools. Not raw database access, and not arbitrary code execution. A specific list: read a post, update SEO fields, add a menu item, list plugins. The assistant can only do what the list allows.

Why this matters more than it sounds: a tool list is a permission boundary. If there is no tool for deleting posts, no amount of clever prompting will delete a post. Safety comes from what was built, not from the assistant choosing to behave.

What a connected assistant can genuinely do

With a properly scoped set of tools, the useful work is the repetitive kind:

  • Content at scale. Publish a post, update twenty pages, find and replace a phrase across the whole site, fix internal links that broke when a slug changed.
  • SEO housekeeping. Set titles, meta descriptions and focus keyphrases. Find two pages competing for the same keyword. Spot pages with no SEO fields at all.
  • Structure. Build menus, change per-page layout settings, control what search engines index.
  • Settings and plugins. Read plugin configuration, compare two sites, install something from the WordPress.org directory, switch a theme.

The pattern is the same throughout: things that are simple individually and miserable in bulk.

What you should not connect

This is the part usually skipped, and it matters more than the feature list.

Credentials

API keys, SMTP passwords and licence keys all live in the WordPress options table. Any tool that can read arbitrary options can read those. A safe implementation refuses credential-shaped values outright, including ones nested inside otherwise innocuous settings.

Arbitrary code

Writing PHP to a server is not editing content, and it should never be bundled with content permissions. Agreeing that an assistant may fix your typos is not agreeing that it may run code on your server.

Anything without an undo

Deleting has no inverse. Neither does activating a plugin, since the code has already run by the time you regret it. Those belong behind separate, explicit switches, off by default, with confirmation required.

Connecting it

The practical steps are short:

  1. Install an MCP plugin on the WordPress site.
  2. Generate an access token in its settings.
  3. Choose which capabilities to enable. Start read-only.
  4. Add the connector in ChatGPT or Claude using the site’s endpoint and that token.
  5. Ask it something harmless first, like listing your published pages, and confirm the answer matches reality.

Read-only first is worth the extra few minutes. It tells you the connection works before anything can change.

One detail people miss: the assistant should act as a specific WordPress user, and WordPress capability checks should still apply. If it runs as an Editor, it cannot do administrator things – not because the plugin decided so, but because WordPress itself refuses. That is a much stronger guarantee than a plugin promising to be careful.

Is it worth it?

If you have one small site you rarely touch, probably not. The value scales with how often you are in wp-admin doing the same small job again.

Related reading: how this differs from an AI website builder, and if you are on shared hosting, the resource limits worth understanding first.

If you manage several sites, publish regularly, or maintain a membership site where settings live across half a dozen plugins, a connected assistant removes a category of work rather than speeding it up.

Marketur MCP

A WordPress MCP server built around exactly these boundaries: separate switches for content, files, plugins and settings, all off by default, credential values refused at read time, and every action running as a WordPress user you choose.

See how it works

Scroll to Top

More

🌙 Dark Mode
📰 Latest Posts
Loading...
📊 Community Stats
Loading...
🟢 Online Now
Loading...
👋 New Members
Loading...
👥 Popular Groups
Loading...