Safety layer
The safety layer is the set of checks around normal WPAgently tasks. It is not a guarantee against every mistake. It is a set of concrete boundaries.
- Bot-not-admin: Before a task, WPAgently checks that the agent user is only an Editor. If it has Administrator permissions, the workflow deliberately stops.
- Draft first: CLI pipelines create new content as drafts by default. Even a requested publish command does not currently publish it automatically.
- Safe image sources: WPAgently accepts only public image addresses and blocks local and private network addresses.
- No silent duplicates: An already used or ambiguous slug stops creation before anything changes.
- Limited tools: An ability that is turned off is not shown to your assistant at all.
BYO principle
BYO means “bring your own.” You choose your own AI provider and WordPress site. Your WordPress content and credentials are not routed through a WPAgently text service.
For an external connection, the credential stays with you, either in your local configuration file or in the browser sign-in you approved. With the optional WordPress chat, WordPress sends the request directly to the AI provider you configured under Settings > Connectors.
Licence checks and updates need technical connections. They do not send WordPress content or WordPress credentials.
Production note
Even with these boundaries, review every visible change yourself before publishing it. For normal content, use Companion and the Editor from the setup.
Power is deliberately not part of this path. It is a separate plugin for technical access to files, the database, and PHP. As a regular WordPress user, leave it turned off. If you need it for a test copy, read Power mode first.
Step 1: install the Companion plugin (about 5 minutes)
Install and activate the wp-agent-companion plugin on your site, exactly the way you install any other WordPress plugin. "Activate" simply means switching the plugin on in the WordPress backend so it starts working.
This Companion plugin is the part of WPAgently that runs on your website. It gives your assistant clearly limited tools. An *Ability* is simply one allowed action, for example creating a new draft or checking a post.
With Free, you can start after activation. You need no account or license key. If you bought Paid, open Tools > WPAgently license, paste the license key from Polar, and select “Activate license”.
Power is not included in Companion and is not needed for this guide. Do not install it “just in case”. The normal Companion covers blog posts, pages, and landing pages.
After activation, open WPAgently. The control center shows the system status and leads you to Connect agent. Still check Settings > Permalinks for "Plain". With "Plain", the /wp-json/ route used here does not work. On a new site that is not yet public, you can select “Post name” and save. If your website is already public, do not change its permalink structure without a redirect plan. Ask the person responsible for your website or your hosting provider for help.
On WordPress 7.0 or newer, you can also use WPAgently > Chat and Preview. First configure your own AI provider under Settings > Connectors. Write suggestions always appear as a plan first. You approve them one by one.
You do not need the complete list of abilities at the beginning. Find it in the Abilities reference later, when you need a specific advanced feature.
This step is complete when the plugin shows as “Active” and Tools > WPAgently license reports “Free active” or “Paid.” With Free, verify the connection next through the read task and test draft in the quickstart. With the Paid CLI, check the connection and a test draft under First workflows.