=== WingPilot – Your AI Site Consultant & Security Expert ===
Contributors: ilyag
Tags: ai, site management, security, seo, content
Requires at least: 6.0
Tested up to: 7.1
Requires PHP: 8.0
Stable tag: 1.6.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Your WordPress site, now with an AI team behind it. Build, improve and manage it through conversation, with every change previewed and approved.

== Description ==

**[Your WordPress site. Now with an AI team behind it.](https://getwppilot.com/)**

**Turn the WordPress site you already own into an intelligent, AI-powered website that keeps getting better.**

Imagine having a developer, a designer, a security specialist, a marketing consultant and a website manager who already know your business, understand your entire website and are always looking for ways to improve it.

Now imagine you could talk to that team whenever you wanted, and they could actually do the work.

That's **[WPPilot](https://getwppilot.com/)**.

Install WingPilot on your existing WordPress site and give it a whole new way to operate. WPPilot understands your content, design, plugins, files, database and business, so you can build, improve and manage your website through conversation instead of dashboards, tutorials and code.

But that's only half the story.

**WPPilot doesn't just wait for instructions. It keeps looking after your website, finding opportunities, spotting problems and preparing the next improvements, even when you're away.**

No migration. No rebuilding. No coding skills. No AI API keys.

= An entire AI team. One conversation. =

What would you do with a team of WordPress experts at your fingertips?

**"Build a landing page for our next campaign, matching our existing design."**

Your AI developer and designer get to work, creating a new page within your existing website.

**"Our checkout is losing customers. Find out why and make it better."**

WPPilot investigates the shopping experience, looks for friction and works on improvements.

**"Our website feels outdated. Give it a refresh."**

Your AI consultant studies your site and helps turn a vague idea into a plan and actual changes.

**"Check our plugins, strengthen security and take care of maintenance."**

WPPilot examines your WordPress setup, identifies vulnerabilities and helps keep the technical side under control.

You don't need to know which settings to change, which plugins to open or which code to write.

**Just describe what you want to achieve. WPPilot figures out how to get there.**

= Your AI consultants don't clock out. =

Most AI tools wait for you to ask a question.

**WPPilot can bring the next question, problem or opportunity to you.**

Behind the scenes, your AI team keeps an eye on the things that matter to your website and business.

* **Your security specialist** watches for vulnerable plugins, suspicious changes and issues that need attention.
* **Your website consultant** looks for weak pages, missing information and opportunities to make your site more effective.
* **Your performance specialist** helps uncover the things slowing your website down.
* **Your marketing consultant** connects what it knows about your business and visitors to ideas for better pages and customer journeys.
* **Your AI developer** can investigate technical problems and prepare improvements, from small fixes to ambitious new functionality.

Instead of opening WordPress and wondering what needs doing, open WPPilot and discover what your team has already found.

With [WPPilot Pro](https://getwppilot.com/pricing), your consultants can go further: proactively investigating opportunities, preparing work and bringing improvements to you for approval.

**The goal isn't another dashboard demanding your attention. It's a website that has a team paying attention for you.**

= It gets to know your website. Really know it. =

Generic AI gives generic answers.

WPPilot starts by exploring the website you've already built.

In about 90 seconds, your first **Site Briefing** introduces you to what WPPilot has learned: your business, your products, your audience, what's working, what's holding you back and where your biggest opportunities might be.

Then that knowledge stays with your AI team.

Your conversations, goals, decisions and site changes become part of an ongoing relationship. WPPilot learns what matters to you and uses that context to help with whatever comes next.

**You don't have to explain your website from scratch every time you need something done.**

= From an idea to a finished improvement. =

WPPilot isn't another chatbot that explains which buttons to click.

It's built to do the work.

Build new pages. Improve your existing design. Solve WordPress problems. Work on your store. Tackle SEO, content, forms, plugins, security and site functionality.

Start with a simple request or a completely unfinished idea. WPPilot investigates, plans, builds and prepares the result for you.

Review the changes. Ask for revisions. Approve when you're happy.

**You remain in control of what goes live, with previews, approvals and Undo.**

And when the task is complete, your AI team is still there for the next one.

= Security and maintenance, without the constant worry. =

WordPress needs attention, even when your business doesn't have time for it.

WPPilot's **Watchtower** keeps monitoring your website, checking plugins against vulnerability intelligence, watching file changes and bringing important findings to your attention.

Instead of cryptic alerts and endless technical notifications, you get meaningful explanations and clear next steps.

With the free **WPPilot Advanced** add-on, your AI team gains deeper technical capabilities for plugin management, maintenance and site improvements.

It's like having someone keeping an eye on the technical health of your website while you focus on running your business.

= Your business never stops. Neither should your website. =

Your website isn't a project you finish once.

New campaigns. New products. Changing customers. Security updates. Better designs. New opportunities.

There's always something worth improving.

WPPilot gives your website an ongoing team of AI specialists who can help it evolve alongside your business.

Connect Google Analytics to bring visitor behaviour into the conversation. Discover opportunities in your content, store and customer journey. Give WPPilot a goal, and work towards it over time.

**Your website doesn't have to sit still between the moments you find time to manage it.**

= Every website. One AI cockpit. =

Manage one WordPress site or a portfolio of them from a single place.

See what your AI consultants have discovered, follow site activity, continue conversations, review prepared improvements and keep track of what matters.

Your sites, your goals, your AI team, all together.

= Bring your WordPress site into the AI era. Free. =

You already have the website. You already have the business.

Now give them an AI team.

Install WingPilot, connect your site and meet WPPilot through your first personalized Site Briefing. Ask questions, explore opportunities and start making real improvements.

No credit card. No AI API keys. No starting over.

The optional **WPPilot Advanced** add-on is free, too. [Paid plans](https://getwppilot.com/pricing) give your AI team more capacity, more sites and proactive work.

**Stop spending your time managing WordPress. Start having conversations with the team that manages it with you.**

**[Get started free](https://getwppilot.com/)** · [See how WPPilot works](https://getwppilot.com/how-it-works)

== External services ==

WingPilot needs a free WPPilot account and a connection to the WPPilot service at api.getwppilot.com, which provides the Briefing, the conversation, approved changes and Watchtower monitoring. Without a connection the plugin does nothing except keep WPPilot lead forms on your pages working (form messages stay on your site).

Once you connect, your site shares with the service what it needs to do that work: your site address, WordPress, PHP, plugin and theme versions; the content WPPilot reads to answer you or prepare a change (pages, posts, products, menus, comments awaiting moderation, and a public page's HTML when your host blocks WPPilot's own request); site activity events such as logins and plugin changes; and security-scan file fingerprints and the contents of changed core, plugin and theme code files. Configuration files such as wp-config.php, uploads and data files are checked on your server and never sent. Your admin email is sent when you click Connect, to propose your account address. Approved changes are written back through the plugin's own REST API.

Data is sent when you connect or open WPPilot, as activity happens on a connected site, during daily heartbeats and scans, when WPPilot reads content to answer you, and when you approve a change. When you approve a page illustrated with a stock photo, your site downloads that image (https only) from Pexels or the original Openverse host.

Terms of Use: [getwppilot.com/terms](https://getwppilot.com/terms) · Privacy Policy: [getwppilot.com/privacy](https://getwppilot.com/privacy) · Pexels: [terms](https://www.pexels.com/terms-of-service/), [privacy](https://www.pexels.com/privacy-policy/) · Openverse: [terms](https://docs.openverse.org/terms_of_service.html), [privacy](https://wordpress.org/about/privacy/)

== Installation ==

1. Install directly from the WordPress plugin directory, or upload the `wingpilot` folder to `/wp-content/plugins/`.
2. Activate the plugin through the **Plugins** menu in WordPress.
3. Open **WPPilot** from the main wp-admin menu and click **Connect to WPPilot**. WPPilot opens in a new tab.
4. Click **Authorize** in the new tab. An account is created automatically with your WordPress admin email — confirm or change it. That completes the connection.

(Prefer to connect manually? The WPPilot admin page also shows your **Site Secret** with a Copy button under "Connection details", so you can paste your site URL + secret at [app.getwppilot.com](https://app.getwppilot.com) instead.)

Your Briefing will be ready in about 90 seconds.

== Frequently Asked Questions ==

= Do I need an account? =

Yes. A free account at [app.getwppilot.com](https://app.getwppilot.com) is required. The account is created automatically the first time you connect a site — you'll confirm your email address as part of the connect flow. The plugin connects your WordPress site to the WPPilot service; without the connection, the only thing it does on its own is keep any WPPilot forms on your pages working.

= What data does the plugin send? =

Only what WPPilot needs to understand and improve your site, and only after you connect: site and version details, the content it reads to answer you, activity events and security-scan data. Configuration files such as wp-config.php are checked on your own server and never sent. See External services above and the [Privacy Policy](https://getwppilot.com/privacy).

= Can WPPilot change things on my site? =

Only with your explicit approval, and only your content. The changes the plugin can make are: post and page titles, excerpts, body content and status; SEO titles and meta descriptions; new draft pages and posts (including Elementor pages); text in Elementor, Beaver Builder and Bricks layouts; image alt text and approved stock images added to your media library; menu item labels and links; comment moderation and a post's discussion settings; custom field values; WPPilot lead forms; and clearing Elementor's generated CSS after a change. Each change is checked against the permissions of the WordPress user who connected the site, never adds scripts or PHP, shows you a preview first, and can be rolled back from the activity feed in the cockpit.

= Does WingPilot install plugins or run code? =

No. It never downloads, installs, activates or updates plugins, themes or code, and never runs code it receives. If you want more than this plugin does, you can optionally install the separate WPPilot Advanced add-on yourself from the WPPilot app; nothing is installed or pushed to your site automatically.

= Can I manage multiple sites from one account? =

Yes. Install and connect WingPilot on each WordPress site you want WPPilot to manage. All sites connected with the same account email appear in your cockpit at app.getwppilot.com.

= Can I disconnect at any time? =

Yes. Open **WPPilot** from the main wp-admin menu and click **Emergency Disconnect** (you'll be asked to confirm). This immediately revokes all tokens and stops all backend communication. The plugin becomes inert. You can also disconnect individual sites from the cockpit at app.getwppilot.com.

= How do I try WPPilot on a test site? =

Install and activate the plugin on a site that is reachable from the internet, open **WPPilot** in wp-admin and click **Connect to WPPilot**, then **Authorize** in the tab that opens. Your Briefing follows in about 90 seconds; ask WPPilot to rewrite a post title to see a change previewed, approved and then undone from the activity feed.

= Does the plugin work on localhost? =

For the full experience, your site needs to be accessible from the internet so the WPPilot backend can reach the plugin's REST API. For local development, you can use a tunnel service like ngrok to expose your local site.

= Where do form messages go, and what happens to them if I delete the plugin? =

Each message sent through a WPPilot form is emailed to the address set for that form and saved under **WPPilot → Leads** in wp-admin. Saved leads stay on your site — they are not sent to the WPPilot service. Forms work whether or not your site is connected. If you delete the plugin, the form settings are removed but your saved leads are kept.

= What WordPress versions are supported? =

WordPress 6.0 and above, tested through 7.1, with PHP 8.0 or higher.

= Is WPPilot free? =

Yes, there's a free tier — install, connect, get your Briefing, and try the conversational actions without a credit card. Paid tiers (Starter, Pro, Agency) unlock higher usage limits and additional capabilities; see [getwppilot.com](https://getwppilot.com) for current pricing.

== Screenshots ==

1. Your Site Briefing: in about 90 seconds WPPilot explains your business, what's working and where the opportunities are.
2. Ask for a landing page and get one, built in your own design as a draft that goes live only when you approve it.
3. "Our checkout is losing customers." WPPilot walks the store like a shopper and finds exactly what's blocking the sale.
4. Ask anything: every plugin checked against published vulnerability advisories, with what to update first.
5. Watchtower and missions: your AI team keeps working and keeps watch, even when you're away.
6. Every website, one AI cockpit: all your sites and what WPPilot is working on, in one place.

== Changelog ==

= 1.6.0 =
* First release in the WordPress.org directory. Copies installed from getwppilot.com keep their connection and settings, and take their updates from WordPress.org from this version on.
* Fixed: after WPPilot was updated, the next step of the update (or a background request in the admin) could be redirected to WPPilot's page instead of finishing. Only a first install now opens WPPilot's page, and only on an ordinary admin page.
* The plans summary on the WPPilot page now lists what paid plans actually add.
* Security: a new Elementor page, and any change to page text or a page-builder layout, can no longer add a script or event handler, including in place of one that was already there. WPPilot no longer changes the body or status of anything that is not site content, such as Additional CSS or another plugin's code, and publishing a new page needs the permission to publish.

= 1.5.31 =
* Fixed: on hosts that switch off some PHP functions (such as `disk_free_space`), WPPilot could not read your site's environment or its plugin and theme list, and answered without them. It now reads both on those hosts too.

= 1.5.30 =
* Security: a change WPPilot makes to the words on a Beaver Builder or Bricks page is now refused if it would add a script, an event handler (such as `onclick`) or a script address, exactly as changes to a page body and to Elementor layouts already were. The same check now also covers custom fields and settings that hold page text. Markup the text already held is kept; nothing unsafe is added, by a change or by its undo.
* Fixed: undoing a move to the trash no longer gives a post an address another post took in the meantime. Before, the post came back sharing that address (as a draft) or renamed with "-2" (when published). Now WPPilot says the address is taken and leaves the post in the trash, with nothing changed.
* New: when you ask where your form enquiries go, WPPilot now reads the notification recipients saved by Contact Form 7, WPForms, Formidable Forms and Gravity Forms (read-only), and names the site admin address where a form sends to it by default.

= 1.5.29 =
* Fixed: a change WPPilot makes to a page or post body now stores exactly what you approved. Before, block settings WordPress keeps escaped (an `&`, a quote, `<` or `--` inside a block's settings) lost their backslashes when saved, and a title, excerpt, new draft or meta description lost any backslash it contained.
* Fixed: WPPilot no longer changes a WooCommerce order as if it were a post. On stores that keep orders in their own tables, an order's number also names a placeholder post that is not the order; changing that post's status changed nothing about the order while reporting that it had. Orders, and any item whose type no active plugin registers, are now refused with the reason, and nothing is changed.

= 1.5.28 =
* Improved: when WPPilot changes a menu item's label or link, it now records the item's date along with its place in the menu, so undoing the change can confirm the item is back exactly where and as it was.

= 1.5.27 =
* Improved: when WPPilot answers a question about a whole set of your content — how many products are out of stock, which listings are duplicates, which pages have no meta description or no translation — your site now counts every item itself, so the numbers cover all of them even on a large or slow site where reading every item in time is not possible.

= 1.5.26 =
* Fixed: changing a menu item's label or link now changes only that label or link. Before, saving the item also reset its date and could move an item to the end of its menu, and undoing the change put the label back but not its place.

= 1.5.25 =
* Fixed: changing a menu item's label or link no longer moves it. Before, the renamed item left its submenu for the top level of the menu and could change places with its neighbours, and WPPilot then refused to undo the change because the item was no longer where it had been.
* Before WPPilot moves a post to the trash, it can now tell you how many of its comments are approved, waiting, spam or in the trash, since they are hidden along with the post.

= 1.5.24 =

* Security: the checks that keep scripts out of page content now read markup the way a browser does. An encoded address such as `&#106;avascript:`, a tab inside one, or an event handler separated by a slash (`<img/src=x/onerror=…>`) is refused like its plain spelling, for page and post bodies and for Elementor layouts. An Elementor layout can no longer gain a script, an event handler or a scripting address it did not already have.
* WPPilot's changes to an Elementor layout, and their undo, are now written only while the layout still holds what WPPilot read, so they never overwrite an edit made in the meantime.

= 1.5.23 =

* WPPilot can now go through every item of one kind at once — every tour, product, page or post — instead of a sample, so "how many products are out of stock?" or "which tours have no meta description?" gets an answer about all of them. It reads titles, statuses, whether an excerpt, meta description (in your SEO plugin's own field) and featured image are set, WooCommerce stock, price and SKU, and Polylang or WPML language versions. Never page text. Read-only: nothing is changed. Only an administrator's connection can run it.

= 1.5.22 =

* Fixed: undoing a change that moved a post or page to the trash now brings back its comments too, each in the status it had (waiting, approved or spam). Before, the post came back and its comments stayed hidden with the trashed post.
* WPPilot no longer moves a post to the trash on a site whose trash is switched off, where WordPress would delete it permanently instead.

= 1.5.21 =

* WPPilot can now tell you where a piece of text is stored across your whole site — an old domain, a phone number, a name — with how many times it appears in each place: page and post content (drafts and scheduled posts included), Elementor layouts (where button and link addresses are stored with their slashes escaped), custom fields, menus, widgets, Customizer settings and other settings. It also says what it did not search. Read-only: nothing is changed. Only an administrator's connection can run it; passwords, keys and anything stored under a credential-like name are counted but never quoted.

= 1.5.20 =

* WPPilot can now change a custom field on a post or page — for example one day of a tour's itinerary kept in an ACF, Pods, Meta Box or JetEngine field — after you approve it, with undo. Only the one value you asked about changes: the other rows and sub-fields of the field are written back exactly as they were, the field is checked again just before it changes (anything you changed yourself in the meantime is left alone), ACF fields are saved through ACF itself, and undo puts back exactly what was there. Fields WordPress or a plugin keeps for itself, passwords and keys, fields that link to other content or media, and anything stored as a PHP object are never changed this way.

= 1.5.19 =

* When WPPilot reads a post or page, it now also reads the post's custom fields — the itinerary, price lists, specifications and other details that sites built with Pods, ACF, Meta Box, JetEngine or Toolset keep outside the main content and show through their templates. Before, a page whose words all live in custom fields looked empty to WPPilot even though visitors saw it in full. Fields are read with their labels where the field plugin provides them; passwords and anything shaped like a key or credential are never sent, and only users who can edit the post have its fields read.
* When your homepage's search title comes from your site title and tagline, WPPilot now reads what changing them would reach on your site — each language version of the homepage, with the tagline as that language shows it under Polylang or WPML, and the title of another page — instead of assuming it, so it can prepare the homepage title you asked for and tell you exactly what else it changes.

Earlier versions are listed in changelog.txt, included with the plugin.

== Upgrade Notice ==

= 1.6.0 =
First WordPress.org release. Your connection and settings are kept; updates now come from WordPress.org.

= 1.5.31 =
WPPilot reads your site's environment and plugin list on hosts that switch off some PHP functions.

= 1.5.30 =
Builder page text, custom fields and settings can no longer gain a script or event handler; undoing a trash never reuses an address another post took.

= 1.5.29 =
Page and post changes keep escaped block settings and backslashes exactly; WooCommerce orders are no longer changed as if they were posts.

= 1.5.28 =
Undoing a menu item change now confirms the item's date as well as its place.

= 1.5.27 =
Counts over a whole content type (stock, duplicates, descriptions, translations) now cover every item, however large the site.

= 1.5.26 =
Menu label and link changes, and their undo, leave everything else about the item as it was.

= 1.5.25 =
Fixes menu label changes moving the item out of its submenu.

= 1.5.24 =
Security hardening: encoded or unusually spelled scripts are refused in page content and Elementor layouts, and Elementor changes never overwrite an edit made in the meantime.

= 1.5.23 =
Lets WPPilot answer questions about all of your tours, products or pages at once (counts, missing descriptions, stock, translations) instead of a sample.

= 1.5.22 =
Undoing a move to the trash now restores the post's comments as well as the post.

= 1.5.21 =
Lets WPPilot find where a piece of text (such as an old domain) is stored across your whole site, with counts by place, before anything is changed.

= 1.5.20 =
Lets WPPilot change a custom field value (such as one day of an itinerary) on the posts you choose, with your approval and undo.

= 1.5.19 =
Lets WPPilot read the custom fields (Pods, ACF, Meta Box, JetEngine, Toolset) your pages are built from, so it no longer mistakes a page filled from custom fields for an empty one, and lets it see what a tagline change would reach on your site before it tells you.

= 1.5.17 =
Lets WPPilot read what each of your plugins says it does, change the title search engines show in Yoast SEO or Rank Math, and tell you honestly where that title comes from on sites without an SEO plugin.

= 1.5.16 =
Lets WPPilot see whether your Elementor forms keep their enquiries and whether your site can reliably send their emails.

= 1.5.15 =
Lets WPPilot open or close comments on the posts and pages you choose, with undo.

= 1.5.14 =
Reports update status honestly for plugins outside WordPress.org, names Hello Dolly correctly, and lets WPPilot see must-use plugins, drop-ins and who made each plugin.

= 1.5.13 =
Fixes abilities notices on WordPress 6.9+, keeps your admin email out of web addresses, and makes the WPPilot page fast and its connect errors clear when WPPilot is unreachable.

= 1.5.12 =
Lets WPPilot add buttons and forms to your Elementor pages and templates in your site's own style, and see the other language versions of a translated page or template.

= 1.5.11 =
The "Connect this site" step comes first after activation, with a dismissible reminder on the Plugins screen and Dashboard until the site is connected.

= 1.5.10 =
Lets WPPilot read your public pages from your own site when a CDN or firewall bot check turns its request away.

= 1.5.9 =
WPPilot says where a shared Elementor template or form appears before it proposes a change to it.

= 1.5.8 =
Lets WPPilot fix your own Elementor forms and shared templates, with your approval and an Undo.

= 1.5.7 =
WPPilot reports a plugin's update status as unknown, rather than current, when WordPress's own check did not complete.

= 1.5.6 =
A clear connection status, a one-click Reconnect that reports its result, and no endless retries when WPPilot refuses this site.

= 1.5.5 =
Lets WPPilot clear spam from your comment moderation queue, with your approval and an Undo.

= 1.5.4 =
Elementor's fonts follow your site when WPPilot moves it off a staging address.

= 1.5.3 =
Lets WPPilot safely remove a form that is on no page; its messages are kept.

= 1.5.2 =
One meta description per page on Hello Elementor sites.

= 1.5.1 =
Fixes site activity not reaching WPPilot after the plugin's sign-in lapsed.

= 1.5.0 =
Working contact and quote forms with spam protection, and new pages created as Elementor pages on Elementor sites.

= 1.4.9 =
Approved meta descriptions now appear on sites without an SEO plugin.

= 1.4.8 =
Security scans now work on hosts with strict firewalls.

= 1.4.7 =
Security scans check every file on your site; previously a few files could be left out.

= 1.4.6 =
WPPilot can see every installed theme, so it can tell you which ones are safe to remove.

= 1.4.5 =
After a menu change WPPilot tells you whether a cache in front of your site is still serving the old menu, instead of leaving you to find out.

= 1.4.4 =
Menu changes made through WPPilot now reach your cached pages straight away instead of waiting for the cache to expire.

= 1.4.3 =
WPPilot now knows which WordPress permissions were checked, so it can rename menu items and make other changes that need a permission the earlier check never asked about. Read-only otherwise.

= 1.4.2 =
A change WPPilot makes to a page-builder page now reaches your host's page cache straight away instead of waiting for the cache to expire.

= 1.4.1 =
WPPilot can now see whether a page cache or object cache is wired into your site, including one your host installed, so it stops recommending a cache you already have. Read-only.

= 1.4.0 =
WPPilot can now read a page as your page builder stores it and see your Site Health facts, so it stops guessing about builders it was never taught and about why a site is slow. Credential-looking values are removed on your site before anything is sent. Read-only; adds no new way to change your site.

= 1.3.0 =
Your site now tells WPPilot which plugins, themes and core have updates waiting, so it stops guessing staleness from a version number. Also sends each post's publish date and author, and can recover a connection your account no longer recognises. Read-only; adds no new way to change your site.

= 1.2.1 =
WPPilot now reads your plugin list in your site's own language, so the names it tells you match the ones on your Plugins screen. Read-only; adds no new way to change your site.

= 1.2.0 =
Lets WPPilot see every page and post on sites with more than fifty of them, instead of treating the first fifty as the whole site. Read-only; adds no new way to change your site.

= 1.1.2 =
Your site now tells WPPilot which endpoints it actually serves, so WPPilot stops inferring that from a version number. No additional site content or personal data is collected; this release reports which WPPilot endpoints the plugin itself has registered, and adds no new way to change your site.

= 1.1.1 =
Lets WPPilot tell you honestly what it can and cannot do on this site. This release only reports whether an Advanced Actions module is present — it installs nothing, downloads nothing, and adds no new way to change your site.

= 1.1.0 =
Security and privacy release. Your configuration files — including wp-config.php — are now inspected on your own server and no longer sent to the service, while still being checked for injected code. Opening WPPilot from wp-admin now signs you in and lands on the right page.

= 1.0.0 =
First public release. Install, connect, and get your first Briefing.
