USE SITE
AGENT.
WITH CONTROL.
From first login to a verified change: here is the plain-English way to ask questions, review exact plans, act safely, and understand what Site Agent can—and cannot—do.
GUIDE FOR SITE AGENT 0.2.4 / DEVELOPER TEST BUILDREADY IN
FIVE STEPS.
Use a backed-up test site first. You need an active Site Agent installation, the right WordPress permissions, and an OpenAI API key with API billing for AI chat and planning.
GO TO SITE AGENT.
Sign in to WordPress and select Site Agent in the admin menu. There is no public chat box.
CONNECT OPENAI.
Go to Settings, paste an API key, and select Validate and save. The full key is encrypted and never shown again.
BUILD KNOWLEDGE.
Open Knowledge and select Rebuild knowledge index. Wait for completion before relying on answers.
CHECK ROLES.
Confirm who may inspect, propose, execute by risk level, roll back, and manage the app.
START A CHAT.
Choose an agent role, ask one focused question, and use a new conversation when the task changes.
SIX SECTIONS.
ONE WORKFLOW.
The tabs you see depend on your permissions. Agent roles change emphasis; WordPress capabilities decide what you may actually do.
CHAT
Ask questions, choose a role, use starter prompts, and request controlled changes in plain language. Enter sends; Shift+Enter adds a line.
HISTORY
See when a supported change happened, its target, risk, source, and whether conflict-aware rollback is currently available.
KNOWLEDGE
Rebuild and search the local index. Analyze plugin-removal evidence without sending raw plugin source or builder payloads to AI.
ROLES
Control who may inspect, propose, execute low-, medium-, or high-risk work, roll back, and manage Site Agent.
SETTINGS
Manage the OpenAI connection, model, audit/chat/ledger retention, local redacted chat history, and uninstall behavior.
ADVANCED
Run diagnostics for WordPress, database, cron, memory, storage, and available error-log evidence. Gray means unknown—not broken.
THE AI
DOES NOT
GET THE KEYS.
Site Agent interprets your request. WordPress validates the exact target, permissions, and risk. You approve the plan. The executor runs only that plan.
01 / WRITE THE RESULT YOU WANT
Be specific: “Update the About page introduction, keep it published, and show me the exact change first.”
02 / READ THE WHOLE PLAN
Confirm the target, fields, status, risk, and preview. Cancel if anything is unclear. High-risk work receives an extra warning.
03 / APPROVE ONCE
Approved plans use a user-bound, single-use token that expires after ten minutes. Duplicate execution is blocked.
04 / CHECK THE REAL RESULT
Verify the front end and affected workflow. A successful API response is not the same as a successful website change.
05 / CHECK HISTORY
Confirm the Change Ledger entry and rollback status. Supported rollback is targeted and conflict-aware—not a full-site backup.
ASK LIKE
A SITE OWNER.
One focused question produces a clearer answer than a vague request to “fix everything.” These prompts match Site Agent’s current inspection tools.
WHAT CHANGED ON MY SITE THIS WEEK?
IS ANYTHING ON MY SITE UNHEALTHY?
WHICH PAGES NEED ATTENTION?
WHICH PAGES USE THIS BUILDER?
WHAT CRON JOBS ARE RUNNING?
WHAT COULD BREAK IF I REMOVE THIS PLUGIN?
PRIVATE.
BOUNDED.
HONEST.
Site Agent is designed to reduce its own attack surface, not to pretend WordPress can eliminate every operational risk.
SENSITIVE DATA STAYS OUT.
Credentials, submissions, orders, user records, raw builder payloads, and change snapshots are excluded from provider context. Secret-like values are redacted again before requests and logs.
THE MODEL ONLY PLANS.
Unknown tools, malformed arguments, unsupported targets, and unauthorized actions are rejected server-side. Native WordPress permissions still apply.
NO FALSE PROMISES.
Rollback appears only when a supported snapshot exists. A newer-state conflict blocks normal rollback. Keep real backups.
WHAT IT CAN CHANGE TODAY
- Create and update supported posts/pages
- Trash supported content
- Update supported builder and SEO metadata
- Update allowlisted non-secret core settings
- Activate or deactivate installed local plugins
- Delete expired transients
- Roll back supported ledger entries
WHAT IT CANNOT PROMISE
- Complete hosting, DNS, traffic, SaaS, or vendor visibility
- Proof that plugin removal is consequence-free
- A full-site backup or universal rollback
- Network-wide plugin rollback
- Protection from a compromised admin, plugin, theme, server, browser, or database