wptaskify

Security

How we handle your credentials, permissions and approvals.

Last updated: July 2026

wptaskify connects to your live WordPress site, so security is not a feature, it is the foundation. This page explains exactly how we handle your credentials, what the connection can and cannot do, and how the approval workflow keeps you in control. If you are an agency evaluating us for client sites, this is written for you.

Credentials encrypted at rest

Your WordPress Application Password is encrypted with AES-256-GCM before it ever touches our database. Each record uses its own unique nonce. The master encryption key lives only in the server environment, never in the database, so a database snapshot alone cannot reveal a single credential.

Application Passwords, not your login

You never give us your WordPress admin password. You connect using a WordPress Application Password, a dedicated credential you generate for this purpose and can revoke inside WordPress at any time. Revoke it and our access stops instantly.

Every account is isolated

Each customer's site and credentials are strictly scoped to their own account. The system is fail-closed: if a request cannot be tied to the correct owner, it is refused rather than falling back to any default. One account can never read or touch another account's site.

Nothing risky happens without approval

Risky actions are queued to an approval inbox. The AI proposes the change, and it only runs after you approve it. Routine drafting can flow freely while destructive or high-impact actions wait for your explicit sign-off.

We do not store your card details

Payments are processed by Razorpay. We never see or store your full card number. For Indian customers we store a GSTIN only if you choose to provide one for a tax invoice.

Automatic backups before edits

Before the AI makes file-level edits, an automatic backup is taken so a change can be undone. This is a safety net on top of, not a replacement for, your own full-site backup routine.

How we handle your credentials

When you connect a site, three pieces of information are used: your site URL, your WordPress username, and an Application Password. Here is the full lifecycle of that data:

  • Validation first. We verify the credentials against your site over HTTPS before storing anything, so a wrong username or a revoked password is caught immediately.
  • Encrypted immediately. The Application Password is encrypted with AES-256-GCM and stored as ciphertext with a per-record nonce. The plaintext is only ever held in memory for the moment a request runs, and it is never written to logs.
  • Used only for your instructions. The credential is used solely to carry out the actions you ask the AI to perform on your own site.
  • Revocable and deletable. You can disconnect a site at any time, which removes its stored credentials, and you can revoke the Application Password inside WordPress to cut access instantly.

What permissions the connection needs

The AI acts through the standard WordPress REST API using the Application Password you provide, so it can do what that user is allowed to do, and nothing more. In practice, connecting with an Administrator account lets the AI manage content, media, SEO fields, menus, redirects, and, when you ask, themes and plugins.

  • Scoped to your user's role. The connection inherits the capabilities of the WordPress user you connect. It cannot exceed them.
  • No hidden backdoor. There is no separate secret access. If you revoke the Application Password, the connection is dead.
  • You choose the role. If you prefer to limit what the AI can touch, connect a lower-privilege user. Some tools will simply be unavailable to that role.

The approval workflow

Automation should never mean losing control. wptaskify is built around a simple principle: the AI proposes, you decide.

  • Drafts by default. A sensible workflow has the AI create drafts you review, so nothing is published until you say so.
  • Approval inbox for risky actions. High-impact or destructive actions are queued for your explicit approval rather than executed automatically.
  • Full audit of activity. Your dashboard shows what the AI has done, so you always have a record of changes made on your site.
  • Backups before file edits. Edits that touch files are preceded by an automatic backup, so a mistake can be rolled back.

Account and platform security

  • Passwords hashed. Your wptaskify account password is stored using Argon2id hashing, never in plain text.
  • Sessions are signed and expiring. Session cookies are signed, time-limited, and revocable. Changing your password signs out other sessions.
  • HTTPS everywhere. All connections use HTTPS. The connector refuses to work over plain HTTP.
  • Least data collected. We collect only what is needed to run the service. See our Privacy Policy for the full detail.

Responsible disclosure

If you believe you have found a security issue, we want to hear from you. Please email us via the contact page with the details and steps to reproduce, and give us a reasonable window to investigate and fix it before any public disclosure. We appreciate reports made in good faith.

Evaluating wptaskify for client sites?

Connect a test site free, review the approval workflow, and see exactly what the AI does before you roll it out.

Try it on a test site