What it does
WordPress Copilot manages the parts of an existing site that WordPress exposes through its REST API. It can work with pages, posts, media, taxonomies, users, settings, and REST-enabled custom content when the connected role allows it.
It does not assume those surfaces are writable. The first run records the live site, content model, active theme and plugins, current role, endpoints, methods, and blockers. That evidence becomes capabilities.md.
Use it for
Use it for work a site owner or content team would normally perform in wp-admin:
- Edit and publish pages or posts, including categories and tags.
- Update media metadata and alt text.
- Work with supported SEO fields, custom fields, and REST-enabled content types.
- Review exposed users or settings and ask what the current login can safely change.
Use WordPress Copilot Advanced when the request needs code, GitHub, SSH, WP-CLI, the database, server configuration, or deployment.
First run
Connect once with a separate WordPress Application Password. The Copilot captures it outside chat, runs a read-only scan, and writes the local site dossier plus capabilities.md.
After that, ask for the outcome you want. Before a write, the Copilot checks the capability map and current WordPress value; afterward, it reads back the result where possible and records what happened.
What it creates
your-site/
├── README.md
├── capabilities.md
├── project-notes.md
├── changelog.md
└── .wpm/
├── config.json
├── credential
├── .gitignore
└── docs/
├── 00-connection.md
├── 01-site.md
├── 02-content-model.md
├── 03-plugins-theme.md
└── 04-rest-capabilities.mdThe folder can live anywhere appropriate on the laptop, outside the skill package and outside cloud sync. capabilities.md is the visible operating contract; the numbered files hold the read-only evidence behind it.
Inside the skill
The installed package separates the runtime rules from connection, scanning, supporting WordPress knowledge, and generated site-document templates.
norml-wp-manager/SKILL.md- Runtime entry point, capability boundary, safety gates, and request router.
onboarding.md- Chooses terminal or Desktop / Cowork onboarding without mixing their credential paths.
onboarding-console.md- Terminal setup, protected secret capture, connection test, and first read-only scan.
onboarding-desktop.md- Desktop / Cowork setup through a local, short-lived credential handoff.
connect.html- Local no-network credential handoff for Desktop / Cowork.
scripts/- Cross-platform setup, secret capture/import, connection tests, and read-only site scan.
wordpress-guides/- Bundled REST, ACF, WordPress architecture, plugin, and safety guides.
templates/- Generated capabilities, notes, changelog, config, and site README contracts.
This is the installed skill package. The per-site dossier above is generated separately on the user’s computer.
Safety and boundary
Terminal runtimes keep the Application Password in the operating-system secret store where available. Desktop / Cowork uses the bundled local-only connector and deletes its short-lived handoff after import. The credential never belongs in chat, project notes, Git, or a command argument, and it can be revoked without changing the main account password.
Content and administration, not code.
Inside
Verified REST-exposed content, media, taxonomies, users, settings, supported fields, and custom content.
Advanced work
Theme or plugin files, installations, SQL, server configuration, opaque page-builder canvas data, migrations, and deployment.
Broad, destructive, access, and site-wide changes require confirmation.
Ready check
- The first scan is read-only and capabilities.md reflects the current role and live REST surface.
- Before a write, the Copilot reads the current value and shows any gated change.
- Structured content stays in the site’s existing fields and taxonomies.
- The result is verified where possible and recorded in the local changelog.