Safety, Limits, and FAQ

Permissions come from WordPress

WPVibe uses the WordPress account you authorize. If that user cannot do something in WordPress, WPVibe should not be able to do it either.

Risky actions wait for your approval

Hard-to-undo operations wait for you: permanently deleting posts, pages, comments, users or plugins, raw SQL writes, site-wide search and replace, giving or removing administrator access, changing a user’s email or password, and changing the site address, admin email, default role for new users or whether anyone can register. WPVibe shows the change on an approval page, and nothing runs until you click Approve. Approved operations are recorded in WPVibe > Approval Log in wp-admin.

Some deletes do not ask. Deleting a post, page or comment moves it to the trash on sites that keep one, so you can restore it. Things WordPress keeps no trash for, such as categories, tags, menu items, and media on most sites, are deleted for good when your AI removes them through the REST API, with no approval page. Before a cleanup that matters, ask your AI to list what it will delete and wait for your go-ahead.

Everyday edits do not ask. Creating and editing posts, pages, products, most settings and most page-builder layouts runs right away. Plugin abilities follow the same line: an ability waits for approval only when its plugin marks it destructive and it deletes something or runs code. An ability that updates a product or builds a page runs right away even if its plugin marks it destructive, and an ability its plugin does not mark destructive runs right away whatever it does.

New code snippets usually do not ask either (plugin 1.19.2 and later). WPVibe saves them switched off, and turning one on is a click you make in wp-admin after reviewing the code, so that click is your approval. Other snippet changes ask: editing a snippet that is on (or was on before WPVibe turned it off), editing one you wrote or one changed since WPVibe wrote it, or changing a snippet’s code type. Approving an edit to an HTML, CSS or JavaScript snippet that is already on makes the new code live right away.

With plugin 1.20.4 and later, WPVibe can also turn off a snippet it created without asking, because turning it off loses nothing and you can turn it back on in WPCode. Deleting one of its own snippets asks, and the snippet goes to the trash in WPCode, where you can restore it. WPVibe never turns off or deletes a snippet you created, and it won’t delete one of its own after you changed its code.

Some things are refused outright, approval or not. Raw SQL can’t write to the users, user meta or options tables (your AI uses the matching WP-CLI command or REST route instead), security keys and WPVibe’s own security settings can’t be changed through WPVibe, and your AI can’t create application passwords. The only one WPVibe makes is its own connection password, when you approve the connect link in your browser.

Why does WPVibe keep asking me to approve?

Every risky operation gets its own approval by default. Three things cut the clicks:

• Approve for the session. Approval pages offer a box to approve operations of the same kind on this site for the next 30 minutes, up to 25 operations: for example post deletes, user and role changes, changes to the site address or admin email, runs of one plugin ability, or SQL row changes (UPDATE, INSERT, DELETE, REPLACE; plugin 1.20.0 and later, and not on multisite or on databases with triggers, views or custom drop-ins). Each kind gets its own 30 minutes and 25 operations. A few things always ask, with no box: SQL schema changes like CREATE, ALTER and DROP, SQL writes to code snippet tables, WPVibe’s own tables or WooCommerce API keys, search and replace, plugin abilities that run code, turning on white label, and a batch of requests that contains any of these. If you decline something, a session approval never runs it.
• Reads never ask. Database read queries run without a prompt. With plugin 1.20.0 and later they run inside a read-only transaction where the database supports it, so a read can’t change anything.
• Turn approvals off for a site. On sites you trust, an administrator can turn on Dangerously bypass approvals in wp-admin. One thing still asks even then: turning on white label mode. Everything else, including deletes, SQL and user changes, runs without a prompt. Read the risks first.

Your AI app may also ask before each tool call. That is the app’s own permission setting, separate from WPVibe. See AI Client Setup.

Free, Pro, Power, Agency, and Scale

The free plan is designed for useful everyday work and has a daily AI request limit. Pro gives more daily headroom for heavier usage. Power is for builders who need more room for repeated workflows. Agency adds the client toolkit for teams managing client sites, and Scale is the top of the ladder for the heaviest workloads. See Agency Plans: Invite Clients and Manage Sub-Accounts for how client invitations work.

How do I check my usage?

Ask your AI right in the conversation (“How much WPVibe usage do I have left?”) or open your Account page for the full breakdown. See How to Check Your WPVibe Usage for details, including how the rolling 24-hour window works.

Does WPVibe work with WordPress.com?

WPVibe is built for self-hosted WordPress sites. For WordPress.com-hosted sites, use the connector options available through WordPress.com and your AI client.

Do I need the WPVibe plugin?

Some WordPress REST work can run without the plugin. Install the WPVibe plugin when you want WPVibe-specific features like draft theme editing, file operations, WP-CLI-style commands, editable fields, and richer diagnostics.

Where should I go for help?

Email [email protected] with your WPVibe account email, the connected site URL, and the AI client you are using.