Can ChatGPT or Claude Edit Your WordPress Site?

Yes, and "WordPress" here means two different products. WordPress.com is a hosted service with its own AI editing built in and an official MCP connection for outside agents. Self-hosted WordPress (wordpress.org software, on your own host) has no AI of its own — access for ChatGPT, Claude, or a coding agent comes through the REST API with application passwords, WP-CLI on the server, or a coding agent editing theme files in a Git repository. Mixing these two up is the most common way people over- or under-estimate what's possible.

What can WordPress.com's own AI do?

WordPress.com's AI Assistant works inside the block editor. Automattic's own announcement says it can "adjust layouts, styles, and patterns" on posts and pages, "rewrite" content, "translate" sections, generate title options, and "generate an image," and it also works in the Media Library to "create and edit images directly" (WordPress.com, "Introducing the WordPress AI Assistant", checked September 2026). It reads your theme, colors, fonts, and structure first, so a request like "add a testimonials section below this one" or "make my colors brighter and bolder" fits your existing design rather than a generic template (same source). Sites on Business or Commerce plans can opt into it at no extra cost, and it's on automatically for sites built with the AI website builder regardless of plan. The catch: it "works best with block themes" — classic-theme sites won't see it in the post editor, though AI image generation in the Media Library still works (same source).

Separately, the Jetpack AI Assistant block (the older, narrower feature) generates and rewrites content inside the block editor, and it also runs on self-hosted sites through the Jetpack plugin (WordPress.com Support, "Improve a page or post with Jetpack AI", checked September 2026).

What can an outside AI agent do on WordPress.com?

Through WordPress.com's own MCP support, quite a lot — with your explicit confirmation on every write. WordPress.com's blog states: "we introduced MCP support on WordPress.com, giving AI agents like Claude, ChatGPT, OpenClaw, and Cursor a window into your site's content," and as of a 2026 update that includes 19 write abilities across posts, pages, comments, categories, tags, and media (WordPress.com, "AI agents can now create and manage content on WordPress.com", checked September 2026). Agents can draft and publish posts, build and update pages, approve or reply to comments, restructure categories and tags, and fix alt text and captions on media (same source).

The safeguards are explicit: "Every change requires your approval" (the agent describes what it plans to do and asks for explicit confirmation), new posts default to drafts, "the write capabilities respect the same user role permissions as the rest of WordPress.com," and "every operation has its own toggle in your MCP settings" (same source). Write access is available on all WordPress.com paid plans; you manage which operations are allowed from your account's MCP settings (same source).

What about self-hosted WordPress?

Self-hosted WordPress has no equivalent built-in assistant. Three separate, real routes exist:

The REST API with Application Passwords. WordPress core has shipped Application Passwords since version 5.6, generated from a user's Edit Profile page, used over HTTPS with HTTP Basic Authentication (WordPress Developer Resources, "Authentication", checked September 2026). WordPress's own documentation calls this the preferred method over the older Basic Authentication plugin, which "requires sending your username and password with every request, and should only be used for development and testing" (same source). An application password is revocable on its own, without changing the account's login password — create one per integration and revoke it when the job is done.

WP-CLI, the command-line interface maintained by the WordPress open-source project, does "administrative and development tasks in a programmatic way" — installing and updating plugins, importing content, running search-replace across a database, managing users — from a terminal on the server (WP-CLI Handbook, checked September 2026). A coding agent with shell access can run wp commands directly, which is a different and more powerful route than the REST API for bulk or database-level work.

A coding agent editing theme or plugin files in a Git repository. If your WordPress install's code lives in version control, Claude Code, Codex, or Cursor can read and edit PHP, template, and CSS files the same way they would on any codebase, then you deploy through your normal process. This is a code change, not a content change, and it needs your usual review and deployment steps before it reaches the live site.

There's also an official MCP Adapter plugin, part of the WordPress "AI Building Blocks" initiative, that self-hosted sites can install as a plugin to expose registered WordPress "Abilities" (specific, scoped actions) to MCP clients (WordPress Developer Blog, "From Abilities to AI Agents", checked September 2026). It authenticates with JWT tokens or Application Passwords rather than WordPress.com's OAuth, and the same post is explicit that MCP clients should be treated as logged-in WordPress users and part of your security surface — it recommends dedicated, limited-capability users for MCP access and warns against permission callbacks that grant blanket access for destructive operations (same source).

What can't any of these routes do?

• The REST API and MCP Adapter only reach what's registered. Application Passwords authenticate a request; they don't grant access beyond what that user's role and the exposed endpoints or Abilities allow.
• A theme file edit is not a live update until deployed. Editing a template in a repository changes source code, not the running site, until your build and deploy process runs.
• AI features are plan- and theme-gated on WordPress.com. The AI Assistant needs a Business/Commerce plan (or an AI-website-builder site) and a block theme; a classic theme or a lower plan won't show it in the editor.
• None of this bypasses WordPress user roles. An Editor-level Application Password can't do what only an Administrator can, on WordPress.com or self-hosted.

How do I keep a way back?

Before a self-hosted change, back up both halves of the site: WordPress's own documentation is direct that "there are two parts to backing up your WordPress site: Database and Files. You need both to be able to fully restore a typical WordPress site," and to do this "regularly, and always before an upgrade or a move to a new location" (WordPress Developer Resources, Backups, checked September 2026). WordPress also keeps post revisions you can restore from the editor (WordPress.org, "Revisions"). On WordPress.com Business or Commerce plans, a staging site lets you "test significant theme and plugin updates, incompatibilities, or any other major changes... before applying them to your main ('production') site," syncing in either direction when you're ready (WordPress.com Support, "Create a Staging Site", checked September 2026) — though the same page warns that syncing back to production can replace the destination's user list, so review before you sync a store or membership site.

For more on giving any AI tool a narrow, reviewable way to change a live site, see How to Have ChatGPT, Claude, Codex or Cursor Edit an Existing Website. If you're weighing whether to leave WordPress entirely rather than manage two different AI access models, the WordPress migration guide covers what a WordPress export does and doesn't carry over.

Bottom line: Know which WordPress you're on before you promise an AI agent anything. WordPress.com now has both an in-editor AI Assistant and an MCP connection with per-operation toggles and mandatory confirmation. Self-hosted WordPress needs Application Passwords, WP-CLI, or a coding agent in a repository — and a backup, made before you start, either way.