AI agents and existing websites
AI-assisted WordPress changes: preserving users, permissions and integrations
An AI agent can produce a new page without understanding how the existing site works. On a live WordPress site, a requested change also has to preserve user access, connected content and the processes that depend on them.
Beyond the visible page
What needs to survive a site change?
The term “agentic web” describes a web where AI agents perform tasks as well as read information. For an agency maintaining an existing site, the practical question is what those agents may change and what must remain intact. The site’s state includes user accounts, roles, content relationships, submitted forms, plugin settings, media, URLs, analytics configuration and connections to external services.
WordPress uses roles and capabilities to control user actions. Its revision system records supported content changes. These are different mechanisms: content revisions are not a backup of every plugin setting or connected service. The WordPress documentation explains roles and capabilities and content revisions.
- Identify the user accounts and access rules that the change must preserve.
- Map content relationships, form destinations and external service connections.
- Keep the relevant change history and define how affected data can be restored.
A redesigned contact page may look correct while sending enquiries to the wrong destination. Checking the result therefore means testing the process as well as reading the page.
After client handover
Who may change what after launch?
An agency has to support later edits, new campaigns and new editors. A client may need to update copy and images without changing access rules or disconnecting a form. Those permissions should be explicit before either a person or an AI agent starts editing.
This matters for customer portals, internal tools and restricted content as much as for public pages. WordPress can manage content and its presentation while authentication and other application functions run in separate services. A page edit should not silently reconfigure those services.
- Give each editor or agent only the operations required for the task.
- Base changes on the current site, including its existing relationships and settings.
- Apply the same checks when the model, instructions or person using the agent changes.
The handover should document who edits, who approves publication and who maintains the connected services. The generated pages alone do not answer those questions.
Preparing a change
Three checks before applying an AI-generated change
Preserve existing data
Start from the current content and configuration. Identify dependencies before replacing a page or changing its structure.
Limit permitted operations
Expose specific operations with permission and input checks. A model’s interpretation of instructions should not determine its access rights.
Review the proposed result
Prepare published-content changes separately and have an authorized person review them before application. Test affected forms and integrations as well.
Instructions and permissions
Written instructions do not enforce access rights
Instructions can explain the intended result. The application must still enforce which operations are permitted and which content structures are accepted. Human approval controls when a prepared change is applied; it does not replace those technical checks.
Applying this in WordPress
What Agent Composer controls—and what still needs separate checks
Agent Composer provides a defined set of WordPress operations under the site’s configured rules. For supported published content, it can prepare a separate update proposal. The live source stays unchanged until a human reviewer approves its application.
This controls the content-editing path. It does not by itself preserve every user account, plugin setting or external system during a wider rebuild. The agency still needs to identify those dependencies, test affected functions and plan recovery for the components being changed.
- Keep WordPress available for ordinary content editing.
- Assign responsibility for connected services, including any running in the customer’s own infrastructure.
- Treat the content proposal, integration tests and recovery plan as separate parts of the change process.
For a concrete test, ask the agent to revise one published article while leaving its URL and related content intact. Review the proposal, check the links and confirm that the published source has not changed before approval.
Permissions and page structure
Permission to edit is not permission to reshape the page
WordPress roles, capabilities and MCP-exposed operations can decide whether an editor or an AI agent may edit a page at all. That is only the first boundary. A user who is allowed to edit content may still need to be prevented from deleting a required section, moving a call to action above the introduction, or replacing a controlled block with an arbitrary one.
Agent Composer can apply a separate set of structural rules to managed page types. Those rules can keep named content areas in place while still allowing permitted fields to change. The same boundary can apply to an external agent and to a client editor working in WordPress.
- Text in an allowed field can be changed without making its surrounding section removable.
- An approved image can be replaced while the image’s place in the page remains fixed.
- Additional blocks can be limited to declared insertion points, where user-added blocks can be moved or removed without exposing the protected structure.
This separates two questions that are often treated as one: what operation may this user or agent call? and what is that operation allowed to change inside this page type? Both checks are useful, and neither replaces review before a change reaches published content.
Try the editing process
Test a content change with Agent Composer
The test environment lets you examine how an external AI agent creates WordPress content through the operations available to it. Check the proposed content and the limits of its access before using the same approach on a client site.