WordPress for Cowork — Changelog

Newest first. Everything from v7.0.0 onwards runs on your own WordPress site — the plugin installs its own connection endpoint and builds your Claude connector for you. Releases below v7.0.0 describe the earlier setup, which used a separate “Cowork Bridge” download, a domain allowlist and a /wp-setup command. Those steps no longer exist; the older entries are kept as a record, not as instructions.

v8.0.2 — 2026-08-11 (cache clear no longer runs on failed changes)

• Fixed: the automatic cache clear ran even when a change had failed. Harmless, but it meant the site was being purged for no reason.

v8.0.1 — 2026-08-11 (SEO now explains what it can still do)

• When no SEO plugin is installed, Claude now tells you what it can do instead of just declining. Without one, WordPress builds the page title tag from the post title — so the post title is what search engines show, and Claude can edit that, along with slugs, headings and excerpts. That covers most of on-page SEO.

v8.0.0 — 2026-08-11 (works with the SEO plugin you already have; automatic cache clearing)

• SEO now works with the SEO plugin you already have. Yoast, Rank Math, SEOPress and Slim SEO are all supported, including their free versions. Previously the SEO tools only worked with Slim SEO — on any other site they reported success and changed nothing. Nothing to install and nothing to switch.
• If no supported SEO plugin is active, Claude now says so plainly instead of claiming to have saved something. WordPress has no field of its own for a meta title, so there is genuinely nowhere to put one.
• If two SEO plugins are active, Claude warns you — they compete over the title tag and the result is duplicate tags.
• Your page cache is cleared automatically after any change. WP Rocket, LiteSpeed, W3 Total Cache, WP Super Cache, WP Fastest Cache, Cache Enabler, Autoptimize, SiteGround Optimizer and Kinsta. Before this, a change could be saved correctly and you would still see the old page and assume it had failed.
• Fixed: the SEO summary counted the wrong field, so it under-reported how much of your site was optimised — even on Slim SEO.

v7.9.0 — 2026-08-11 (groundwork for SEO plugin support)

• Groundwork for the SEO plugin support released in 8.0.0.

v7.8.0 — 2026-08-11 (30 new tools — 74 to 104)

• 30 new tools — 74 to 104. Menu locations, revisions, block templates, widgets, permalinks, site icon and logo, diagnostics, and theme installation.
• Menus now actually appear on your site. Previously Claude could build a menu and fill it with links, but nothing attached it to a position in your theme — so the menu existed and was invisible. It can now list the positions your theme offers and assign a menu to one.
• Revisions. See every saved version of a post, read any of them, and roll back to one. The version that was live is kept, so a rollback is itself undoable.
• Block templates. List, read, create, edit and remove the templates a block theme uses for your homepage, single posts, archives and 404 page.
• Widgets and sidebars for classic themes: see what your theme offers and place or remove widgets.
• Permalinks. Change the URL structure of your posts. Safe mode refuses a structure that would give every post the same address.
• Site icon and logo can be set from anything in your media library.
• Editing without resending everything. Append or prepend to a post, or find and replace a phrase inside one, without Claude rewriting the whole page. Faster, and it cannot accidentally lose the parts it was not asked to change.
• Diagnostics. WordPress and PHP versions, pending updates, scheduled jobs, media missing alt text, SEO coverage, scheduled posts, and a broken-link scan.
• Content statistics — published counts by author and by month. This is not visitor traffic; WordPress core does not record any.
• Themes can be installed by name from the WordPress.org directory.
• Fixed: block templates created by earlier tooling were not linked to your active theme, so they were created successfully and then never used.
• Fixed: the installer looked for the bundled endpoint under the wrong filename in 7.7.0. On some sites WordPress also offered to activate the wrong file after upload, reporting “the plugin does not have a valid header” on a perfectly good install.

v7.7.0 — 2026-08-10 (menus become editable; categories and tags)

• Menus can be edited, not just viewed. Create menus, add pages or custom links, reorder them, nest them into dropdowns, and remove items. Previously the menu tool took no parameters at all and could only list what was there.
• Categories and tags can be renamed. Rename or re-slug a category, change its parent, and create, rename or delete tags. Only category creation existed before.
• 74 tools in total.

v7.6.0 — 2026-08-10 (18 new tools — 46 to 64)

• 18 new tools — 46 to 64. This release closes the gap between what the website promised and what the plugin could actually do.
• Media is no longer read-only. Upload files from a URL or directly, set alt text, captions and titles, and attach an image as a post’s featured image in the same step.
• Site-wide theming has a real tool at last. Set colours, typography and custom CSS across every page. Works on block themes via theme.json and on classic themes via Additional CSS, so “make my whole site look like this” works either way.
• Users. Create accounts, change roles, send password resets, and remove people with their posts reassigned rather than deleted. No password is ever set or shown in the conversation — WordPress emails them a link to choose their own.
• Scheduling actually schedules. Posts now take a date, and a future date sets the post to publish then. Slugs can be set on posts as well as pages.
• WooCommerce. Stock levels, SKUs, weight, dimensions, shipping class, product images and categories. Order status can be updated. And coupons exist — create, list, update and delete, with expiry dates, usage limits and product restrictions.
• Plugins can be installed by name from the WordPress.org directory, and removed.
• Site settings widened from just title and tagline to timezone, date and time format, posts per page, and which page is your homepage. Setting a homepage now switches the site to use it, rather than silently doing nothing.
• Fixed: settings could not be cleared, only changed — an empty value was indistinguishable from one you hadn’t sent. The tagline can now be blanked.
• Safe mode revised: deactivating a plugin is allowed again (it’s reversible in one command), while deleting one is now blocked, which is the thing you can’t undo. Deleting a user without saying where their posts should go is also refused.

v7.5.2 — 2026-08-10 (safety skill: what a theme is, and honesty rules)

• The safety skill in your connector now explains what a theme actually is: one shared set of design decisions applied to every page, defined once as CSS variables — not a styled landing page with the rest of the site left behind, and not a separate block of CSS per page. Per-page styles drift apart and produce a site that looks different depending on where you land.
• Claude now asks you to inspect an element and paste the tag when it needs a class name, rather than guessing selectors and changing your live site repeatedly hoping one of them matches.
• Added honesty rules: don’t claim something is done without checking, don’t describe a page that hasn’t been read, don’t state figures without a source, and don’t guess an ID. If a request could mean two things — “tidy up the blog” — ask which, rather than picking one and acting on it.
• A multi-step change now either finishes or gets put back. If it can’t finish, Claude tells you exactly which pages changed and which didn’t, rather than leaving you to work it out. A theme applied to three pages out of twelve looks broken in a way the original never did.

v7.5.0 — 2026-08-10 (safe mode, on by default)

• New: Safe mode, on by default. Claude can reach 46 tools on your site. Safe mode holds back the handful that could make your site unreachable or destroy something you cannot get back — changing your site address, the unrestricted API passthrough, deactivating plugins, switching theme, and restoring backups.
• Deleting posts, pages and comments now sends them to the trash rather than removing them permanently, so a mistake is recoverable.
• Everything else is unchanged. Writing and editing content, comments, products, categories and SEO all work exactly as before.
• You can turn safe mode off at Cowork → Safety if you specifically need those tools, or pin it with the WFC_SAFE_MODE constant in wp-config.php.
• The connector you download now carries a safety skill, so Claude asks before publishing, deleting, or changing prices on a live site, and reads changes back to confirm they actually landed rather than assuming.

v7.4.0 — 2026-08-10 (the plugin updates itself)

• New: the plugin now updates itself. Until this release there was no update mechanism at all, so the only way to move from one version to the next was to be sent a zip and re-upload it by hand. New versions now appear on the Plugins screen and install with one click, like any other plugin.
• Update checks are cached and fail open. If wordpressforcowork.com is slow or unreachable you simply see no update — your admin screens never hang and nothing on your site breaks.
• Corrected the documentation: there is no site limit on any plan. Earlier readmes referred to a “site allowance”, which was wrong.

v7.3.0 — 2026-08-08 (the full tool set arrives in the bundled endpoint)

• The bundled MCP endpoint is now the full 45-tool version, replacing the 5-tool core. Adds themes, menus, plugins, media, comments, categories, tags, users, SEO, backups, WooCommerce, and a wp_raw_api escape hatch. This brings v7 to feature parity with v6 — until now v7 could only read and write posts and pages.
• Its authentication was rewritten for the v7 model. The original authenticated against License Manager for WooCommerce and a device-cap heartbeat, both of which exist only on wordpressforcowork.com; on a customer’s own site every request would have failed. It now uses the Application Password the plugin generates for itself.

v7.2.2 — 2026-08-07 (connector filenames carry version and site)

• The downloaded connector is now named with its version and a short site tag, e.g. wordpress-for-cowork-7.2.2-u9-xrms.plugin. Previously every download was called wordpress-for-cowork.plugin, so a second download collided in the Downloads folder and nobody could tell which build they had.

v7.2.0 — 2026-08-07 (Download my Claude connector)

• New: “Download my Claude connector” button. The site now builds a connector file already personalised to itself, so there is nothing to copy, configure or install. One click in wp-admin, drag the file into Claude Desktop, done.
• The connector carries a literal endpoint URL rather than a placeholder. Cowork validates that URL before substituting variables, which is why every earlier version failed to install with “MCP server has invalid URL”.
• The manual connect code remains, demoted to a fallback.

v7.0.3 — 2026-05-29 (connect codes could never be generated)

• Fixed: the Application Passwords availability check tested a function that does not exist in WordPress core, so connect codes could never be generated. Affected every installation.
• Fixed: the bundled MCP endpoint reported a hardcoded version that could drift from the plugin’s. It now resolves the live version at request time.

v7.0.0 — 2026-05-29 (complete overhaul — the plugin runs on your own site)

• Complete overhaul. Self-install activation, Application Password self-generation, mu-plugin installer, a real working MCP endpoint (site info + posts/pages), one-time AES-256-GCM connect code with random reference codename, wp-admin page, and a multi-domain license client with weekly fail-open re-validation.

Earlier releases (v5.x)

Kept for reference. These entries describe the superseded setup flow — the slash commands and allowlist steps mentioned below are no longer part of the product.

v5.0.5 — 2026-04-30 (customer-facing — license-model rewrite + machine ID + update notices)

Changed

• Removed all subscription / trial / “seats used” language across README.md, plugin.json, commands/wp-setup.md, and CONNECTORS.md. The plugin now correctly reflects the live one-time-purchase + 1-year-updates-included + optional yearly maintenance renewal model. Plans table replaced with current Solo $99 / Agency $399 / Enterprise from $414 pricing, “licenses included” framing, unlimited domains, 2 devices per user license. Stripe entry reframed from “subscription billing” to “checkout + optional yearly renewal.”
• Dropped legacy CW-SOLO-* / WPCv3-* license-key format references from wp-setup.md step 1.
• SKILL.md “How This Plugin Works” corrected from “shared-secret Bearer token” (v4.x stale wording) to “license-key Bearer token from WORDPRESS_COWORK_KEY.”
• SKILL.md slash-commands table entry for /wp-setup updated from “Configure the shared secret” to “Activate your license key.”
• Skill version bumped to 5.0.5.

Added

• Machine ID generation in /wp-setup step 2. A stable UUIDv4 is generated on first setup and reused on every subsequent run. Stored in ~/.claude/plugin-config/wordpress-for-cowork.json alongside the license key. The license server uses this to recognize the device when checking the 2-device-per-user-license cap. Existing machine_id values are preserved on re-runs.
• Persistent state expanded. Config file now also tracks last_setup_at, plugin_version, and a connected_sites array that grows as additional sites are connected via /wp-setup. Re-running /wp-setup preserves machine_id and connected_sites (only re-writes license_key, last_setup_at, plugin_version).
• Update notice in /wp-setup step 3. Calls the public /wp-json/wpfc-release/v1/latest feed, compares to the bundled plugin version, and surfaces a one-line notice if a newer version exists. Severity-aware wording (critical → install before continuing, high → install soon, otherwise → install when convenient). Fails silently if the feed is unreachable.
• maintenance_expired (403) error case in wp-setup.md — the plugin keeps working, but updates pause until renewal. Replaces the removed “trial expired” / “subscription lapsed” cases.
• config file at ~/.claude/plugin-config/wordpress-for-cowork.json explicitly documented in the Notes section: license key + machine ID (UUIDv4) + last setup timestamp + plugin version + connected sites, mode 600.

Unchanged

• Tool surface, endpoint URL, slash command set.
• Auth model (license-key Bearer via WORDPRESS_COWORK_KEY).
• Backup safety pre-flight prompt + server-side -32099 gate handling.
• Security-plugin warning in wp-setup.md step 5 (carried over unchanged from 5.0.4).

Notes / not in this release

• Server-side machine_id registration is not yet wired through mcp__wordpress__wp_setup. The hosted MCP at wordpressforcowork.com needs to accept a machine_id parameter and use it when applying the 2-device cap. Until that lands server-side, machine_id is generated and persisted on the client only — the server still falls back to IP-based device tracking. Tracked separately.
• wp-admin JS heartbeat (the original H8 / [16] task) is moot under the current hosted-MCP architecture — the customer’s WordPress site no longer runs any of our plugin code, so there’s no surface to attach a JS heartbeat to. The license server already gets a heartbeat on every tool call (it sees IP + timing per call), which covers the original goal.

v5.0.4 — 2026-04-30 (customer-facing — proactive security-plugin warning)

Added

• commands/wp-setup.md now has a “Before you generate an Application Password” callout listing the most common WordPress security plugins (Wordfence, iThemes/Solid Security, Sucuri WAF, WP Cerber, managed-host firewalls) and the specific toggle to flip in each. Links to the full troubleshooting guide on wordpressforcowork.com/support/. This was the #1 cause of “plugin won’t connect” support tickets — now caught proactively before the user even tries.

Unchanged

• Tool surface, auth model, slash commands, endpoint URL, license-key flow.

v5.0.3 — 2026-04-30 (customer-facing — dead link cleanup)

Fixed

• Replaced two stale /my-account/licenses/ references in commands/wp-setup.md with the new /my-account/devices/ portal URL. License Manager for WooCommerce free version doesn’t expose a /licenses/ endpoint, so those links were dead 404s.
• Reframed “seat limit” 403 guidance as “device limit” 403 to match the new license model: each license can be registered to 2 devices (laptop + desktop). Customer manages registered devices at /my-account/devices/.

Unchanged

• Tool surface, auth model, slash commands, endpoint URL, license-key activation flow.

Known stale (still pending — tracked separately as H7 / [16b])

• README and wp-setup.md still reference subscriptions, “seats used”, trial expiration, and a CW-SOLO-* / WPCv3-* legacy license format. These need a wholesale rewrite to match the current one-time-purchase + maintenance + N-keys-per-tier + unlimited-domains model. Out of scope for this patch.

v5.0.2 — 2026-04-27 (customer-facing — backup-gate handling)

Added

• wordpress-site-builder skill now handles server-side -32099 "Backup confirmation required" errors. New section in SKILL.md (after “Restoring later”) tells the skill to stop, surface the error to the user, and retry either after taking a fresh backup OR with _skip_backup_ack: true once the user opts to skip.

Why

The endpoint mu-plugin wpfc-backup-gate.php (deployed 2026-04-27) blocks destructive tool calls when the most recent on-disk backup is older than 60 minutes. The skill previously didn’t know about this error code and would have surfaced a raw JSON-RPC error to the user. With this update, the skill recognizes the gate, explains it, and routes the user to either take a backup or override.

Unchanged

• Tool surface, auth model, slash commands, Plans table, pricing.
• Endpoint URL.

v5.0.1 — 2026-04-27 (customer-facing — docs)

Fixed

• README pricing table. Removed stale “verify Enterprise pricing” caveat (Enterprise pricing is now stable). Restated Enterprise as per-seat with a 6-seat minimum and added the implied $45/mo / $450/yr floor. Added a one-line note about ~17% annual savings.

Unchanged

• Tool surface, auth model, commands, skill, endpoint URL.
• Live site pricing — README now matches the Plans page.

v5.0.0 — 2026-04-27 (customer-facing)

Customer-facing release alongside v4.x internal build

This is the customer-facing variant of the plugin. The v4