Signed changes, human approval, nothing hidden
An Application Password alone cannot change your site. Every change WPTerminal sends is approved where it needs to be, signed for that exact request, and checked again by the plugin on your server.
Signature
Ed25519
Only the public key ships in the plugin.
Proof window
5min
Each signed change runs once, then expires.
At rest
AES-256GCM
Site credentials, bound to organization and site.
Audit
12months
Every tool call, on every plan.
End-to-end
The life of one change
From the moment your AI asks to the moment WordPress saves, five steps, and each one can stop it.
- 01 / Request
Your AI asks
A tool call arrives over remote MCP with your OAuth sign-in or API key. Viewers can only read.
tools/call update_post
- 02 / Policy
Rules decide
Reads run. Changes that publish, delete or touch plugins, settings or code need a person. Some are refused.
effect: REQUIRE_APPROVAL
- 03 / Approval
A person says yes
In the chat for routine actions, in the dashboard for critical ones. Destructive actions are approved one exact action at a time.
approved once · by owner
- 04 / Signature
The change is signed
Ed25519, bound to your site, the credential, the route, the body hash and one operation ID. Valid for five minutes.
X-Cmdlane-Proof: v1…
- 05 / Verify
Your site checks it
The plugin verifies the signature, refuses replays and hard-limited actions, then runs the change and keeps a receipt.
200 · receipt op_…
Inside a signed change
What the plugin checks before anything runs
The signature covers a small set of claims. Change any of them, or reuse them, and the site refuses the request.
{
"kid": "3bc7376b34dae651", // which public key
"aud": "shop.example.com", // this site only
"cred": "sha256(app password)", // this connection only
"op": "op_7Qk2mX9vLs0aTb4e", // single use
"method": "POST",
"route": "/wp-abilities/v1/abilities/cmdlane-agent-link/update-post/run",
"body": "sha256(request body)", // exact content
"iat": 1792478400,
"exp": 1792478700, // five minutes
"appr": "approval id" // when a person approved
}Plugin checks
all must pass- The key is one the plugin ships with
- The Ed25519 signature is valid
- The audience is this site
- The credential is this connection's password
- Method, route and body hash match the request
- Issued less than five minutes ago (60 s clock skew)
- The operation ID has never been used (replay)
- WP-CLI changes carry a person's approval
Any failure → 403, nothing runs, the attempt is logged.
Defense in depth
Nine layers between an AI and your site
A separate agent account
The AI signs in as its own WordPress user with its own Application Password. Your account and password are never shared.
Content-only by default
Administrator tools (WP-CLI, plugins, themes, users) stay off until an administrator turns them on, and turning them off removes them again.
Only through the plugin
The agent account can change the site only through Cmdlane Agent Link's own routes. WordPress core and other plugins' REST routes are read-only for it.
Hard limits
No new administrators, no administrator changes, no passwords, no site URL or active-code options, no deleting the active theme or the plugin itself.
Guarded SQL
One statement at a time, no comments or schema changes, and the users, usermeta and options tables are off limits, so password hashes and keys never leave the site.
Safe outbound requests
The gateway refuses private, loopback and cloud-metadata addresses, checked on the address it actually connects to, so DNS tricks cannot reach internal systems.
Encrypted at rest
Site Application Passwords are encrypted with AES-256-GCM and bound to your organization and site. Access tokens and API keys are stored only as hashes.
Audit trail and receipts
Every tool call is recorded with who ran it, where and the result, for 12 months. Each signed change leaves a receipt on the site.
Revocable at any time
Disconnect a site from WordPress or the dashboard and its password is revoked on the spot. Disconnect an AI client or an API key the same way.
Found a security issue?
Please tell us privately at [email protected] before sharing it anywhere else. The plugin is open source, so you can read every check above in its code.
Details for administrators are in the docs.