Title: WingPilot – Your AI Site Consultant & Security Expert
Author: ilyag
Published: miz Here 25, 2026
Last modified: miz Here 26, 2026
---
Search plugins
# WingPilot – Your AI Site Consultant & Security Expert
By [ilyag](https://profiles.wordpress.org/ilyag/)
[Download](https://downloads.wordpress.org/plugin/wingpilot.1.6.0.zip)
* [Details](https://bre.wordpress.org/plugins/wingpilot/#description)
* [Reviews](https://bre.wordpress.org/plugins/wingpilot/#reviews)
* [Installation](https://bre.wordpress.org/plugins/wingpilot/#installation)
* [Development](https://bre.wordpress.org/plugins/wingpilot/#developers)
[Support](https://wordpress.org/support/plugin/wingpilot/)
## Description
**[Your WordPress site. Now with an AI team behind it.](https://getwppilot.com/)**
**Turn the WordPress site you already own into an intelligent, AI-powered website
that keeps getting better.**
Imagine having a developer, a designer, a security specialist, a marketing consultant
and a website manager who already know your business, understand your entire website
and are always looking for ways to improve it.
Now imagine you could talk to that team whenever you wanted, and they could actually
do the work.
That’s **[WPPilot](https://getwppilot.com/)**.
Install WingPilot on your existing WordPress site and give it a whole new way to
operate. WPPilot understands your content, design, plugins, files, database and
business, so you can build, improve and manage your website through conversation
instead of dashboards, tutorials and code.
But that’s only half the story.
**WPPilot doesn’t just wait for instructions. It keeps looking after your website,
finding opportunities, spotting problems and preparing the next improvements, even
when you’re away.**
No migration. No rebuilding. No coding skills. No AI API keys.
#### An entire AI team. One conversation.
What would you do with a team of WordPress experts at your fingertips?
**“Build a landing page for our next campaign, matching our existing design.”**
Your AI developer and designer get to work, creating a new page within your existing
website.
**“Our checkout is losing customers. Find out why and make it better.”**
WPPilot investigates the shopping experience, looks for friction and works on improvements.
**“Our website feels outdated. Give it a refresh.”**
Your AI consultant studies your site and helps turn a vague idea into a plan and
actual changes.
**“Check our plugins, strengthen security and take care of maintenance.”**
WPPilot examines your WordPress setup, identifies vulnerabilities and helps keep
the technical side under control.
You don’t need to know which settings to change, which plugins to open or which
code to write.
**Just describe what you want to achieve. WPPilot figures out how to get there.**
#### Your AI consultants don’t clock out.
Most AI tools wait for you to ask a question.
**WPPilot can bring the next question, problem or opportunity to you.**
Behind the scenes, your AI team keeps an eye on the things that matter to your website
and business.
* **Your security specialist** watches for vulnerable plugins, suspicious changes
and issues that need attention.
* **Your website consultant** looks for weak pages, missing information and opportunities
to make your site more effective.
* **Your performance specialist** helps uncover the things slowing your website
down.
* **Your marketing consultant** connects what it knows about your business and
visitors to ideas for better pages and customer journeys.
* **Your AI developer** can investigate technical problems and prepare improvements,
from small fixes to ambitious new functionality.
Instead of opening WordPress and wondering what needs doing, open WPPilot and discover
what your team has already found.
With [WPPilot Pro](https://getwppilot.com/pricing), your consultants can go further:
proactively investigating opportunities, preparing work and bringing improvements
to you for approval.
**The goal isn’t another dashboard demanding your attention. It’s a website that
has a team paying attention for you.**
#### It gets to know your website. Really know it.
Generic AI gives generic answers.
WPPilot starts by exploring the website you’ve already built.
In about 90 seconds, your first **Site Briefing** introduces you to what WPPilot
has learned: your business, your products, your audience, what’s working, what’s
holding you back and where your biggest opportunities might be.
Then that knowledge stays with your AI team.
Your conversations, goals, decisions and site changes become part of an ongoing
relationship. WPPilot learns what matters to you and uses that context to help with
whatever comes next.
**You don’t have to explain your website from scratch every time you need something
done.**
#### From an idea to a finished improvement.
WPPilot isn’t another chatbot that explains which buttons to click.
It’s built to do the work.
Build new pages. Improve your existing design. Solve WordPress problems. Work on
your store. Tackle SEO, content, forms, plugins, security and site functionality.
Start with a simple request or a completely unfinished idea. WPPilot investigates,
plans, builds and prepares the result for you.
Review the changes. Ask for revisions. Approve when you’re happy.
**You remain in control of what goes live, with previews, approvals and Undo.**
And when the task is complete, your AI team is still there for the next one.
#### Security and maintenance, without the constant worry.
WordPress needs attention, even when your business doesn’t have time for it.
WPPilot’s **Watchtower** keeps monitoring your website, checking plugins against
vulnerability intelligence, watching file changes and bringing important findings
to your attention.
Instead of cryptic alerts and endless technical notifications, you get meaningful
explanations and clear next steps.
With the free **WPPilot Advanced** add-on, your AI team gains deeper technical capabilities
for plugin management, maintenance and site improvements.
It’s like having someone keeping an eye on the technical health of your website
while you focus on running your business.
#### Your business never stops. Neither should your website.
Your website isn’t a project you finish once.
New campaigns. New products. Changing customers. Security updates. Better designs.
New opportunities.
There’s always something worth improving.
WPPilot gives your website an ongoing team of AI specialists who can help it evolve
alongside your business.
Connect Google Analytics to bring visitor behaviour into the conversation. Discover
opportunities in your content, store and customer journey. Give WPPilot a goal,
and work towards it over time.
**Your website doesn’t have to sit still between the moments you find time to manage
it.**
#### Every website. One AI cockpit.
Manage one WordPress site or a portfolio of them from a single place.
See what your AI consultants have discovered, follow site activity, continue conversations,
review prepared improvements and keep track of what matters.
Your sites, your goals, your AI team, all together.
#### Bring your WordPress site into the AI era. Free.
You already have the website. You already have the business.
Now give them an AI team.
Install WingPilot, connect your site and meet WPPilot through your first personalized
Site Briefing. Ask questions, explore opportunities and start making real improvements.
No credit card. No AI API keys. No starting over.
The optional **WPPilot Advanced** add-on is free, too. [Paid plans](https://getwppilot.com/pricing)
give your AI team more capacity, more sites and proactive work.
**Stop spending your time managing WordPress. Start having conversations with the
team that manages it with you.**
**[Get started free](https://getwppilot.com/)** · [See how WPPilot works](https://getwppilot.com/how-it-works)
### External services
WingPilot needs a free WPPilot account and a connection to the WPPilot service at
api.getwppilot.com, which provides the Briefing, the conversation, approved changes
and Watchtower monitoring. Without a connection the plugin does nothing except keep
WPPilot lead forms on your pages working (form messages stay on your site).
Once you connect, your site shares with the service what it needs to do that work:
your site address, WordPress, PHP, plugin and theme versions; the content WPPilot
reads to answer you or prepare a change (pages, posts, products, menus, comments
awaiting moderation, and a public page’s HTML when your host blocks WPPilot’s own
request); site activity events such as logins and plugin changes; and security-scan
file fingerprints and the contents of changed core, plugin and theme code files.
Configuration files such as wp-config.php, uploads and data files are checked on
your server and never sent. Your admin email is sent when you click Connect, to
propose your account address. Approved changes are written back through the plugin’s
own REST API.
Data is sent when you connect or open WPPilot, as activity happens on a connected
site, during daily heartbeats and scans, when WPPilot reads content to answer you,
and when you approve a change. When you approve a page illustrated with a stock
photo, your site downloads that image (https only) from Pexels or the original Openverse
host.
Terms of Use: [getwppilot.com/terms](https://getwppilot.com/terms) · Privacy Policy:
[getwppilot.com/privacy](https://getwppilot.com/privacy) · Pexels: [terms](https://www.pexels.com/terms-of-service/),
[privacy](https://www.pexels.com/privacy-policy/) · Openverse: [terms](https://docs.openverse.org/terms_of_service.html),
[privacy](https://wordpress.org/about/privacy/)
## Screenshots
[⌊Your Site Briefing: in about 90 seconds WPPilot explains your business, what's
working and where the opportunities are.⌉⌊Your Site Briefing: in about 90 seconds
WPPilot explains your business, what's working and where the opportunities are.⌉[
Your Site Briefing: in about 90 seconds WPPilot explains your business, what’s working
and where the opportunities are.
[⌊Ask for a landing page and get one, built in your own design as a draft that goes
live only when you approve it.⌉⌊Ask for a landing page and get one, built in your
own design as a draft that goes live only when you approve it.⌉[
Ask for a landing page and get one, built in your own design as a draft that goes
live only when you approve it.
[⌊"Our checkout is losing customers." WPPilot walks the store like a shopper and
finds exactly what's blocking the sale.⌉⌊"Our checkout is losing customers." WPPilot
walks the store like a shopper and finds exactly what's blocking the sale.⌉[
“Our checkout is losing customers.” WPPilot walks the store like a shopper and finds
exactly what’s blocking the sale.
[⌊Ask anything: every plugin checked against published vulnerability advisories,
with what to update first.⌉⌊Ask anything: every plugin checked against published
vulnerability advisories, with what to update first.⌉[
Ask anything: every plugin checked against published vulnerability advisories, with
what to update first.
[⌊Watchtower and missions: your AI team keeps working and keeps watch, even when
you're away.⌉⌊Watchtower and missions: your AI team keeps working and keeps watch,
even when you're away.⌉[
Watchtower and missions: your AI team keeps working and keeps watch, even when you’re
away.
[⌊Every website, one AI cockpit: all your sites and what WPPilot is working on,
in one place.⌉⌊Every website, one AI cockpit: all your sites and what WPPilot is
working on, in one place.⌉[
Every website, one AI cockpit: all your sites and what WPPilot is working on, in
one place.
## Installation
1. Install directly from the WordPress plugin directory, or upload the `wingpilot`
folder to `/wp-content/plugins/`.
2. Activate the plugin through the **Plugins** menu in WordPress.
3. Open **WPPilot** from the main wp-admin menu and click **Connect to WPPilot**.
WPPilot opens in a new tab.
4. Click **Authorize** in the new tab. An account is created automatically with your
WordPress admin email — confirm or change it. That completes the connection.
(Prefer to connect manually? The WPPilot admin page also shows your **Site Secret**
with a Copy button under “Connection details”, so you can paste your site URL +
secret at [app.getwppilot.com](https://app.getwppilot.com) instead.)
Your Briefing will be ready in about 90 seconds.
## FAQ
### Do I need an account?
Yes. A free account at [app.getwppilot.com](https://app.getwppilot.com) is required.
The account is created automatically the first time you connect a site — you’ll
confirm your email address as part of the connect flow. The plugin connects your
WordPress site to the WPPilot service; without the connection, the only thing it
does on its own is keep any WPPilot forms on your pages working.
### What data does the plugin send?
Only what WPPilot needs to understand and improve your site, and only after you
connect: site and version details, the content it reads to answer you, activity
events and security-scan data. Configuration files such as wp-config.php are checked
on your own server and never sent. See External services above and the [Privacy Policy](https://getwppilot.com/privacy).
### Can WPPilot change things on my site?
Only with your explicit approval, and only your content. The changes the plugin
can make are: post and page titles, excerpts, body content and status; SEO titles
and meta descriptions; new draft pages and posts (including Elementor pages); text
in Elementor, Beaver Builder and Bricks layouts; image alt text and approved stock
images added to your media library; menu item labels and links; comment moderation
and a post’s discussion settings; custom field values; WPPilot lead forms; and clearing
Elementor’s generated CSS after a change. Each change is checked against the permissions
of the WordPress user who connected the site, never adds scripts or PHP, shows you
a preview first, and can be rolled back from the activity feed in the cockpit.
### Does WingPilot install plugins or run code?
No. It never downloads, installs, activates or updates plugins, themes or code,
and never runs code it receives. If you want more than this plugin does, you can
optionally install the separate WPPilot Advanced add-on yourself from the WPPilot
app; nothing is installed or pushed to your site automatically.
### Can I manage multiple sites from one account?
Yes. Install and connect WingPilot on each WordPress site you want WPPilot to manage.
All sites connected with the same account email appear in your cockpit at app.getwppilot.
com.
### Can I disconnect at any time?
Yes. Open **WPPilot** from the main wp-admin menu and click **Emergency Disconnect**(
you’ll be asked to confirm). This immediately revokes all tokens and stops all backend
communication. The plugin becomes inert. You can also disconnect individual sites
from the cockpit at app.getwppilot.com.
### How do I try WPPilot on a test site?
Install and activate the plugin on a site that is reachable from the internet, open**
WPPilot** in wp-admin and click **Connect to WPPilot**, then **Authorize** in the
tab that opens. Your Briefing follows in about 90 seconds; ask WPPilot to rewrite
a post title to see a change previewed, approved and then undone from the activity
feed.
### Does the plugin work on localhost?
For the full experience, your site needs to be accessible from the internet so the
WPPilot backend can reach the plugin’s REST API. For local development, you can
use a tunnel service like ngrok to expose your local site.
### Where do form messages go, and what happens to them if I delete the plugin?
Each message sent through a WPPilot form is emailed to the address set for that
form and saved under **WPPilot Leads** in wp-admin. Saved leads stay on your site—
they are not sent to the WPPilot service. Forms work whether or not your site is
connected. If you delete the plugin, the form settings are removed but your saved
leads are kept.
### What WordPress versions are supported?
WordPress 6.0 and above, tested through 7.1, with PHP 8.0 or higher.
### Is WPPilot free?
Yes, there’s a free tier — install, connect, get your Briefing, and try the conversational
actions without a credit card. Paid tiers (Starter, Pro, Agency) unlock higher usage
limits and additional capabilities; see [getwppilot.com](https://getwppilot.com)
for current pricing.
## Reviews
There are no reviews for this plugin.
## Contributors & Developers
“WingPilot – Your AI Site Consultant & Security Expert” is open source software.
The following people have contributed to this plugin.
Contributors
* [ ilyag ](https://profiles.wordpress.org/ilyag/)
[Translate “WingPilot – Your AI Site Consultant & Security Expert” into your language.](https://translate.wordpress.org/projects/wp-plugins/wingpilot)
### Interested in development?
[Browse the code](https://plugins.trac.wordpress.org/browser/wingpilot/), check
out the [SVN repository](https://plugins.svn.wordpress.org/wingpilot/), or subscribe
to the [development log](https://plugins.trac.wordpress.org/log/wingpilot/) by [RSS](https://plugins.trac.wordpress.org/log/wingpilot/?limit=100&mode=stop_on_copy&format=rss).
## Changelog
#### 1.6.0
* First release in the WordPress.org directory. Copies installed from getwppilot.
com keep their connection and settings, and take their updates from WordPress.
org from this version on.
* Fixed: after WPPilot was updated, the next step of the update (or a background
request in the admin) could be redirected to WPPilot’s page instead of finishing.
Only a first install now opens WPPilot’s page, and only on an ordinary admin
page.
* The plans summary on the WPPilot page now lists what paid plans actually add.
* Security: a new Elementor page, and any change to page text or a page-builder
layout, can no longer add a script or event handler, including in place of one
that was already there. WPPilot no longer changes the body or status of anything
that is not site content, such as Additional CSS or another plugin’s code, and
publishing a new page needs the permission to publish.
#### 1.5.31
* Fixed: on hosts that switch off some PHP functions (such as `disk_free_space`),
WPPilot could not read your site’s environment or its plugin and theme list,
and answered without them. It now reads both on those hosts too.
#### 1.5.30
* Security: a change WPPilot makes to the words on a Beaver Builder or Bricks page
is now refused if it would add a script, an event handler (such as `onclick`)
or a script address, exactly as changes to a page body and to Elementor layouts
already were. The same check now also covers custom fields and settings that
hold page text. Markup the text already held is kept; nothing unsafe is added,
by a change or by its undo.
* Fixed: undoing a move to the trash no longer gives a post an address another
post took in the meantime. Before, the post came back sharing that address (as
a draft) or renamed with “-2” (when published). Now WPPilot says the address
is taken and leaves the post in the trash, with nothing changed.
* New: when you ask where your form enquiries go, WPPilot now reads the notification
recipients saved by Contact Form 7, WPForms, Formidable Forms and Gravity Forms(
read-only), and names the site admin address where a form sends to it by default.
#### 1.5.29
* Fixed: a change WPPilot makes to a page or post body now stores exactly what
you approved. Before, block settings WordPress keeps escaped (an `&`, a quote,`
<` or `--` inside a block’s settings) lost their backslashes when saved, and
a title, excerpt, new draft or meta description lost any backslash it contained.
* Fixed: WPPilot no longer changes a WooCommerce order as if it were a post. On
stores that keep orders in their own tables, an order’s number also names a placeholder
post that is not the order; changing that post’s status changed nothing about
the order while reporting that it had. Orders, and any item whose type no active
plugin registers, are now refused with the reason, and nothing is changed.
#### 1.5.28
* Improved: when WPPilot changes a menu item’s label or link, it now records the
item’s date along with its place in the menu, so undoing the change can confirm
the item is back exactly where and as it was.
#### 1.5.27
* Improved: when WPPilot answers a question about a whole set of your content —
how many products are out of stock, which listings are duplicates, which pages
have no meta description or no translation — your site now counts every item
itself, so the numbers cover all of them even on a large or slow site where reading
every item in time is not possible.
#### 1.5.26
* Fixed: changing a menu item’s label or link now changes only that label or link.
Before, saving the item also reset its date and could move an item to the end
of its menu, and undoing the change put the label back but not its place.
#### 1.5.25
* Fixed: changing a menu item’s label or link no longer moves it. Before, the renamed
item left its submenu for the top level of the menu and could change places with
its neighbours, and WPPilot then refused to undo the change because the item
was no longer where it had been.
* Before WPPilot moves a post to the trash, it can now tell you how many of its
comments are approved, waiting, spam or in the trash, since they are hidden along
with the post.
#### 1.5.24
* Security: the checks that keep scripts out of page content now read markup the
way a browser does. An encoded address such as `javascript:`, a tab inside
one, or an event handler separated by a slash (`
`) is refused
like its plain spelling, for page and post bodies and for Elementor layouts.
An Elementor layout can no longer gain a script, an event handler or a scripting
address it did not already have.
* WPPilot’s changes to an Elementor layout, and their undo, are now written only
while the layout still holds what WPPilot read, so they never overwrite an edit
made in the meantime.
#### 1.5.23
* WPPilot can now go through every item of one kind at once — every tour, product,
page or post — instead of a sample, so “how many products are out of stock?”
or “which tours have no meta description?” gets an answer about all of them.
It reads titles, statuses, whether an excerpt, meta description (in your SEO
plugin’s own field) and featured image are set, WooCommerce stock, price and
SKU, and Polylang or WPML language versions. Never page text. Read-only: nothing
is changed. Only an administrator’s connection can run it.
#### 1.5.22
* Fixed: undoing a change that moved a post or page to the trash now brings back
its comments too, each in the status it had (waiting, approved or spam). Before,
the post came back and its comments stayed hidden with the trashed post.
* WPPilot no longer moves a post to the trash on a site whose trash is switched
off, where WordPress would delete it permanently instead.
#### 1.5.21
* WPPilot can now tell you where a piece of text is stored across your whole site—
an old domain, a phone number, a name — with how many times it appears in each
place: page and post content (drafts and scheduled posts included), Elementor
layouts (where button and link addresses are stored with their slashes escaped),
custom fields, menus, widgets, Customizer settings and other settings. It also
says what it did not search. Read-only: nothing is changed. Only an administrator’s
connection can run it; passwords, keys and anything stored under a credential-
like name are counted but never quoted.
#### 1.5.20
* WPPilot can now change a custom field on a post or page — for example one day
of a tour’s itinerary kept in an ACF, Pods, Meta Box or JetEngine field — after
you approve it, with undo. Only the one value you asked about changes: the other
rows and sub-fields of the field are written back exactly as they were, the field
is checked again just before it changes (anything you changed yourself in the
meantime is left alone), ACF fields are saved through ACF itself, and undo puts
back exactly what was there. Fields WordPress or a plugin keeps for itself, passwords
and keys, fields that link to other content or media, and anything stored as
a PHP object are never changed this way.
#### 1.5.19
* When WPPilot reads a post or page, it now also reads the post’s custom fields—
the itinerary, price lists, specifications and other details that sites built
with Pods, ACF, Meta Box, JetEngine or Toolset keep outside the main content
and show through their templates. Before, a page whose words all live in custom
fields looked empty to WPPilot even though visitors saw it in full. Fields are
read with their labels where the field plugin provides them; passwords and anything
shaped like a key or credential are never sent, and only users who can edit the
post have its fields read.
* When your homepage’s search title comes from your site title and tagline, WPPilot
now reads what changing them would reach on your site — each language version
of the homepage, with the tagline as that language shows it under Polylang or
WPML, and the title of another page — instead of assuming it, so it can prepare
the homepage title you asked for and tell you exactly what else it changes.
Earlier versions are listed in changelog.txt, included with the plugin.
## Meta
* Version **1.6.0**
* Last updated **1 sizhun ago**
* Active installations **Fewer than 10**
* WordPress version ** 6.0 or higher **
* Tested up to **7.1.4**
* PHP version ** 8.0 or higher **
* Language
* [English (US)](https://wordpress.org/plugins/wingpilot/)
* Tags
* [AI](https://bre.wordpress.org/plugins/tags/ai/)[content](https://bre.wordpress.org/plugins/tags/content/)
[security](https://bre.wordpress.org/plugins/tags/security/)[seo](https://bre.wordpress.org/plugins/tags/seo/)
[site management](https://bre.wordpress.org/plugins/tags/site-management/)
* [Advanced View](https://bre.wordpress.org/plugins/wingpilot/advanced/)
## Ratings
No reviews have been submitted yet.
[Your review](https://wordpress.org/support/plugin/wingpilot/reviews/#new-post)
[See all reviews](https://wordpress.org/support/plugin/wingpilot/reviews/)
## Contributors
* [ ilyag ](https://profiles.wordpress.org/ilyag/)
## Support
Got something to say? Need help?
[View support forum](https://wordpress.org/support/plugin/wingpilot/)