Letting Claude maintain WordPress sites without giving it SSH access

<p>I look after WordPress sites for a living, and lately I've wanted Claude to take over the boring parts: find where a piece of text lives in a theme, fix it, check which plugins need updates, write the monthly care report for the client.</p> <p>The two obvious ways to do that both felt wrong:</p> <ul> <li> <strong>Give the AI an SSH key.</strong> It sees everything, including <code>wp-config.php</code> and the database password, and one bad instruction can wipe a client's site.</li> <li> <strong>Copy and paste files into a chat.</strong> Safe, but slow, and the AI never sees the whole theme.</li> </ul> <p>So I built something in between: <strong>PressBridge</strong>, a self-hosted MCP server that sits between Claude and the WordPress site. Claude gets useful tools; the server decides what those tools are allowed to do.</p> <h2>

The server enforces the rules, not the prompt

</h2> <p>A prompt like "never read wp-config.php" is a suggestion. A file that is invisible to the tool is a guarantee. That was the main design rule: every limit is checked by PressBridge before anything runs, so text hidden in a plugin readme or a web page can't talk Claude past it.</p> <p>In the free edition, Claude can:</p> <ul> <li>read, list and search theme and plugin files</li> <li>run read-only WP-CLI commands: versions, plugin and theme lists, core checksums, cron, users</li> <li>call <code>site_overview</code> to get the WordPress version and pending updates in one call</li> </ul> <p>And it can't:</p> <ul> <li>see <code>wp-config.php</code>, <code>.env</code>, SQL dumps, keys or <code>.git</code>, at any folder depth</li> <li>reach anything outside the site folder, symlink tricks included</li> <li>open a shell or run arbitrary commands</li> </ul> <p>It connects over SSH, so nothing is exposed to the internet.</p> <h2>

A real session

</h2> <p>Here's a 70-second recording of a real session on a test site: health overview, creating and editing a file with an automatic backup, a one-call undo, a safe delete and the audit log.</p> <p> <iframe src="https://www.youtube.com/embed/3Am6OlLmZ6s" width="710" height="399"> </iframe> </p> <h2>

Try it

</h2> <p>The free edition is MIT-licensed on GitHub, for one site, read-only: <a href="https://github.com/pressbridgesupport/pressbridge" rel="noopener noreferrer">https://github.com/pressbridgesupport/pressbridge</a></p> <p>Install takes about five minutes on any Linux server where you have SSH: a Python venv, WP-CLI, and a small YAML file listing your site. Then add it to Claude Code or Claude Desktop and ask: <em>"Give me a health overview of mysite."</em></p> <h2>

If you want Claude to fix things too

</h2> <p>I also sell a paid edition, which is how I'm hoping to keep working on this. It adds edits with automatic backups and one-call undo, a PHP syntax check before saving, allow-listed plugin, theme and core updates, unlimited sites, a Docker HTTPS server and a full audit log. There's also a monthly plan with a nightly security check that alerts you to new admin accounts, PHP files in uploads and changed core files. Details: <a href="https://pressbridgesupport.github.io/pressbridge" rel="noopener noreferrer">https://pressbridgesupport.github.io/pressbridge</a></p> <p>One honest limit: file backups don't cover database changes such as plugin updates, so keep your normal database backups running.</p> <h2>

Feedback welcome

</h2> <p>I'd really like to hear from people who manage WordPress sites: what would you want blocked, or allowed, before you'd let an AI assistant anywhere near a client site?</p>

Original source

Read the original article on dev.to