How your site stays safe
Giving an AI access to a live site should come with clear limits. This page says exactly how wptaskify connects, what is encrypted, what waits for your approval, how to undo things and how to disconnect.
How your site connects
WordPress and WooCommerce: the free plugin creates a separate WordPress application password. It is not your login, and you can revoke it in WordPress at any time.
Shopify: you install the wptaskify app, and Shopify issues an access token for your store.
Google, Pinterest and Google Business Profile: you sign in with that service and approve access. We never see your password; we receive an OAuth token.
Your AI: Claude, ChatGPT or another MCP client connects to your wptaskify account with one link and signs in to your account.
Encryption
Application passwords, store tokens, OAuth tokens and any AI key you add are encrypted at rest with AES-256-GCM before they are stored.
They are decrypted only when a tool needs them to do the job you asked for.
Connections run over HTTPS.
What waits for your approval
These actions do not run on the AI's say-so. The first request goes to your approval inbox and nothing happens until you approve it, in the chat or in your dashboard:
- Switching the active theme
- Deactivating a plugin
Each approval is for that exact action and is used once. You can choose always allow for a tool if you do not want to be asked again.
Drafts and previews
New posts and pages are saved as drafts by default. Nothing is published unless you ask.
Pinterest pins are saved as drafts.
Bulk tools (meta, alt text, links, product descriptions) show a preview first and work in batches.
Backups and undo
A full site backup (themes, plugins, and optionally media and the database) with a download link, and a restore when you need it.
Roll a post back to an earlier revision, undo a theme switch, and restore theme or plugin files from the automatic backup taken before each file edit.
With server access connected, files are backed up before they are written, and a broken plugin or theme can be switched off even when wp-admin is down.
Logs
Approval requests and decisions are recorded in your dashboard under Approvals.
On paid plans, the wptaskify activity log on your site shows what the AI changed and when.
Your data
Your posts, products and reviews pass between your AI and your site to do what you asked. We do not keep a copy of your content to train AI, and we do not sell or share your data.
We store your account, your connections (encrypted), your approvals and usage records needed for billing.
To delete your account and its stored data, email hello@wptaskify.com from the account address.
Disconnecting
Remove a site from your dashboard, or deactivate the plugin, and access stops at once.
Revoke the application password in WordPress, uninstall the Shopify app, or remove access in your Google or Pinterest account settings at any time.
Disconnecting does not change anything on your site.
What the AI can and cannot do
It can use the tools your plan includes, on the sites you connected, when you ask.
It cannot see your WordPress, Shopify or Google password, run the actions listed above without your approval, delete Google reviews (Google does not allow it), or reach a site you have not connected.
Your AI provider (for example Anthropic or OpenAI) processes your chat under its own terms, because you use your own AI account.