The four ways to give AI access to your WordPress site
Application passwords, SFTP, SSH with WP-CLI, and Git. What each one unlocks, and how to revoke any of them.
Not filmed yet
The lesson is written out below. The video comes after.
There is not one “connect your site” switch, there are four doors, and they open onto very different rooms.
An application password gets you content and the REST API — writing posts and pages, reading what is there. It is the narrowest and the easiest to revoke, and it is where most people should start. SFTP gets you theme and template files, which is what you need the moment you want design changed rather than words. SSH with WP-CLI is the big one: the database, bulk operations, plugin and option management, the things that used to be a weekend. Git is not access to the site at all — it is version history, which is what makes the other three safe.
The habit worth building is matching the door to the job. Most tasks do not need the database, and the ones that do should be the ones you supervise.
The one thing to keep
Give the narrowest access that does the job, and know how to take it back.
More in WordPress + Claude Code
Next to this one
The wp_options bomb
The table WordPress loads in full on every page view, quietly stuffed with megabytes of junk from plugins you deleted years ago.
WordPress + Claude CodeBuild your own theme instead of buying one
A purchased theme or a page builder is now the expensive option.