Everybody wants to point an AI at their WordPress site and say "go fix it." Almost nobody wants to find out what it did while they were at lunch.
MCP (Model Context Protocol) is how AI assistants get real hands inside WordPress. They can read content, edit pages, change settings, and run tools. It is powerful, it is new, and the default setup is a lot like handing a stranger your admin login and hoping they have good manners.
Let the bots in. Install the locks first.
I have spent two decades cleaning up what happens when the wrong thing gets access to a WordPress site. This workshop is the fun version: we let the bots in, with the doors, locks and cameras already installed.
What you'll learn
Connect it, fence it in, keep receipts
Three jobs, in that order. You don't need to be a security person. That part is mine.
Connect it
- A plain-English picture of what MCP is
- What actually happens when an AI connects to your site
- How to connect an assistant to WordPress, step by step
Fence it in
- How to give the bot only the access it needs
- Why "admin, just to make it easy" is the wrong answer
- Why a staging site is your best friend
Keep receipts
- What to log and what to review
- How to undo things when the bot gets creative
- The short list of things you never hand to an AI
The one rule
Safe is a setup, not a hope
Give the bot a key to the room it needs. Not the master key.
Spoiler: the answer is rarely "full admin." Every safe setup comes down to the same three layers, and we build all three in the session.
Scope
The narrowest access that still gets the job done. A bot that writes posts does not need to install plugins.
Sandbox
Try it on staging first. If the bot has a creative idea, it has it on a copy.
Receipts
Log what it does, review it, and know how to roll it back before you need to.
Who this is for
Come for the bots, stay for the guardrails
This is for you if
- You build or look after WordPress sites, your own or for clients
- You're curious about AI working inside WordPress
- You'd like to still own your site afterward
You don't need
- A security background
- To already be an MCP expert
- A perfect setup. A staging or throwaway WordPress site is handy to have if you want to follow along
What people say about my workshops
A quick note: this review is from a different workshop, my Agentic Agency Workshop, not this one. It gives you a good idea of what people get from my workshops.
Blown away by what I was able to build in a few hours.
I did not even get up from my desk afterwards. Within a couple of hours I had a full set of agents running for our agency: a research analyst that had already produced two in-depth reports I needed, another scheduled to deliver a daily report, and a chief of staff agent up and running.
What I loved most was that Kathy showed us her actual setup.
Tina CookAgentic Agency Workshop participant, review left on the workshop page
- 2in-depth research reports delivered
- 1daily report running on a schedule
- 1chief of staff agent up and running
All within a couple of hours of the workshop.
Your presenter
Kathy Zant
WordPress security expert, author, keynote speaker
Over two decades in information security, including time at Wordfence and SolidWP, and approximately 5,000 hacked WordPress sites cleaned. These days she works in marketing for GeneratePress and runs her own consulting and content business. She teaches AI in WordPress the way she tests everything else: assuming something will go wrong, then showing you where.
Good to know
A test site helps
If you have a staging or throwaway WordPress site, have it ready. Nobody wants to learn about permissions on a client's live site.
It's live
Bring questions, because I will take them.
$49, or free with Amplified
Members of Zantastic Amplified attend free. Everyone else is $49 a seat.
Let the bots in. Keep the keys.
Tuesday, November 17, at noon Central. One session that could save you a very bad Monday.
$49 per seat. Free for Zantastic Amplified members.
Save my seat