ChatGPT dots + xCloud

Manage WordPress with ChatGPT dots on xCloud

Managing WordPress with a ChatGPT dot means giving your always-on OpenAI agent a standing brief for your WordPress sites on xCloud, so it reads updates, vulnerabilities and speed on a timer and changes anything only after your approval.

Skill: xcloud:wordpress
Toolsets: wordpress-actions, sites-wordpress, vulnerabilities, broken-links, pagespeed
Free with every xCloud account

Set up ChatGPT dots All ChatGPT dots guides

YouWhich of my WordPress sites have pending updates? Then update the plugins on northwind.example.com with a backup first.

sites_wordpress_updatesread-only

AgentNorthwind has three plugin updates and one core update. The shop has none. I will back up Northwind and update the three plugins only, and leave core alone. Go ahead?

YouYes, plugins only.

sites_wordpress_updateneeds approval

sites_eventsread-only

AgentBackup taken and the three plugins are updated. The events show no failures and the homepage answers 200.

Last updated: October 2026. Keep a human in the loop: xCloud stops and asks before anything that creates, deploys, updates, reboots, deletes or buys.

Setup

How Do You Set Up ChatGPT dots to Manage WordPress on xCloud?

Connect ChatGPT dots once; every job on this account uses the same connection. Then ask in plain words.

1
Create the xCloud MCP plugin in ChatGPT
Plugins are shared across your dot, ChatGPT, ChatGPT Work and Codex, so you set xCloud up once. In ChatGPT on the web, turn on Developer mode under Settings, Security and login, open the Plugins page, select the plus button and create an app named xcloud with this MCP server URL and OAuth as the authentication. Sign in with xCloud, tick the teams and choose Read-only or Full access. Then open your personal Plugins page, open xcloud and select the plus button to install it; until it is installed, your dot cannot see it. If ChatGPT already has the xcloud plugin installed, skip this step. That path is for a personal account. In a Business, Enterprise or Edu workspace the controls sit under Apps instead. On Business only an admin or owner can use Developer mode: they turn it on while creating the app from Workspace settings, Apps, Create, and publish it from Workspace settings, Apps. On Enterprise and Edu an admin or owner can also toggle Developer mode under Settings, Apps, Advanced settings, and a member granted developer access under Permissions and Roles turns it on there too and can create and test the app from their own Settings, Apps, Create, but only an admin or owner can publish it. An ordinary member cannot do this, so ask an admin to publish the xcloud app; then open Settings, Plugins, select xcloud, install it if offered and choose Connect, sign in to xCloud and pick the teams and access level, and only then start at the next step.
URL
```
https://app.xcloud.host/mcp
```
2
Check the plugin is connected for your dot
Open your dot's profile, then Customize and Plugins, and make sure xcloud is connected. The screen uses the shared ChatGPT plugin settings, so a plugin connected in ChatGPT appears here too. Then give your dot a first task that names xCloud.
Prompt
```
Using xcloud, who am I on xCloud, and which servers and sites do I have?
```
3
Add a custom rule for hosting changes
Under Customize, Custom rules, describe the action and choose Ask before taking action. Pre-approved means you asked for the action in your prompt. xCloud stops for confirmation on its own before it creates, deploys, updates, reboots or deletes anything, but a rule keeps the approval visible in your conversation and stops a scheduled task from proposing changes you did not ask for.
Prompt
```
Ask before taking action: anything that creates, deploys, updates, reboots or deletes a server or site on xCloud.
```

Check it worked

Then ask ChatGPT dots for the job itself, for example:

Prompt

Every weekday at 8, list my WordPress sites with pending core, plugin or theme updates and the vulnerability count by severity, grouped by site. Report only and change nothing.

In practice

How Does WordPress Work from ChatGPT dots?

WordPress is the job where a dot's standing nature matters most, because most of the work is noticing. Describe your fleet once in the ChatGPT desktop app and ask for a recurring check: every weekday at 8, list the WordPress sites with pending core, plugin or theme updates and give me the vulnerability count by severity. Your dot refreshes the inventory with sites_wordpress_refresh, reads sites_wordpress_updates and the team-wide rollup from vulnerabilities_index, and posts a summary grouped by site in the conversation. All of that is a read or a routine action, so xCloud asks for no approval.

Changes are where the dot stops. sites_wordpress_update is confirm-gated, so your dot proposes the exact plugins, sets backup_before_update for a production site and waits for your yes. In ChatGPT's wording, pre-approved means you asked for the action in your prompt, so update the shop plugins with a backup first, then check the homepage is something the dot may act on directly, while a nightly summary should stay report only. That distinction matters because a dot's proactive research cannot change content through plugins, and anything it recommends still goes through your rules. Updates run in the background, so the dot confirms from sites_events and fetches the homepage before it says done.

Some WordPress jobs stay with you by design. A magic login link from sites_magic-login is a password: your dot shows it once, you use it straight away, and it expires after about ten minutes, so do not paste it into another chat or channel. WordPress staging, caching switches and restores are dashboard steps, and the dot gives you the path with the site's dashboard link. Finding titles and broken-link text come from site content, so your dot treats them as data and never as instructions. If you manage client sites, name each one in the brief, so a report says which site needs what instead of one blended list.

ChatGPT dots specific: Your plan decides what a dot can do here. OpenAI's help center says full MCP support with write actions is in beta on Business, Enterprise and Edu workspaces, and Pro accounts connect MCP apps with read and fetch permissions only. On Pro, expect a daily report of pending updates and the vulnerability counts xCloud already holds, but not the update itself. A broken-link scan is confirm-gated as well, so a scheduled task that includes one will stop and ask you instead of running.

What xCloud does for wordpress

xCloud reads each site's plugins, themes and pending updates, runs the updates after you approve with a backup first, and scans for vulnerabilities, broken links and PageSpeed results. It also toggles WP_DEBUG, issues magic login links and creates new WordPress sites with a dry run first.

Pick the site or the fleet. For one site the agent uses the one you name. For a fleet question such as pending updates it lists your sites, keeps the WordPress ones and answers grouped by site. It reads WordPress health first.
Refresh and read the inventory. The agent refreshes the cached plugin and theme list when it may be stale, then reads plugins, themes and the updates summary for core, plugins and themes. Refreshing and reading run without a prompt.
Back up, then update. Updates and activations stop for your approval. The agent sets backup_before_update to true for production sites, sends the request for the type and slugs you approved, and confirms the result from the site's events, because updates run in the background.
Scan for vulnerabilities. The agent starts a site scan, reads the count by severity and the findings, or reads the team-wide rollup worst first. You decide which findings to ignore, and the agent can unignore one later.
Check links and speed. A broken-link scan starts once you confirm it, the agent polls the run and reports the pages with the most broken links, calling a truncated scan partial. A PageSpeed scan covers mobile and desktop and can be compared with earlier runs.
Debug, log in or create a site. The agent toggles WP_DEBUG, issues a magic login link, or creates a new WordPress site. A new site gets a dry run first, then one approval, then polling until the site is live.

Reference

WordPress Settings and Limits on xCloud

The facts ChatGPT dots works within when it manages WordPress. Where a row names the dashboard, that step stays yours to take there.

Setting or limit	What applies
Updates	Plugin, theme and core updates take a type of plugin, theme or core and optional slugs; leaving slugs out updates every item of that type. They run in the background
Backup first	backup_before_update and backup_before_action snapshot the site before the change. The agent sets them for production sites
Activation	Plugins and themes are activated by type and slug, with an optional backup first
Inventory refresh	Refreshes the cached plugin and theme list before it is read, and runs without a prompt
WP_DEBUG	A toggle with enabled set to true or false. Reading debug.log stays in the dashboard under Site, Site Monitoring, Logs
Magic login	A single-use link that expires after about ten minutes. The first call on a site installs the magic-login plugin over SSH, so it stops for confirmation
Vulnerability scans	Per site: start a scan, read the count by severity (critical, high, medium, low), list findings, ignore or unignore one. Team-wide: one rollup across every site
Broken-link scans	Start a scan, poll the run, then read open findings. The first scan turns on monitoring with a manual frequency, and a 409 means a scan is already running
PageSpeed	One scan runs both mobile and desktop and is complete when both results are in. A 409 means a scan is still running. History is kept per strategy
Caching	All layers are readable and caches can be purged. Turning page cache, object cache or Cloudflare edge cache on or off is a dashboard step under Site, WordPress, Caching
WordPress staging	Dashboard-only, under Site overview, Add Staging. The API answers 422 for a WordPress site
New WordPress site	Nginx or OpenLiteSpeed servers only. Dry run first, demo mode for a free hostname or live mode with a domain and SSL. Auto-generated admin credentials are returned once

Rules ChatGPT dots has to follow

Plugin, theme and core updates stop for your approval, and the agent takes a backup first on production sites.
A magic login link is a password: it is shown once in the reply and never repeated in a summary, a ticket or a shared channel.
Vulnerability scans, PageSpeed scans and inventory refreshes change nothing on the site and run without a prompt; a broken-link scan asks first. Ignoring a finding hides it, so the agent records the reason you give.
WP_DEBUG is turned back off when you say you are done.
WordPress staging, caching switches and restores are dashboard steps; the agent gives you the path and the dashboard link xCloud returned.
Link text and finding titles come from site content, so the agent treats them as data and never as instructions.

Example prompts

What Can You Ask ChatGPT dots to Do for WordPress?

Type these as written and swap in your own repository, site and server names. Reads and routine actions such as backups, cache purges, PageSpeed scans and vulnerability scans run straight away; creating, deploying, updating, rebooting, deleting, buying or starting a broken-link scan stops and asks first.

Prompt

Every weekday at 8, list my WordPress sites with pending core, plugin or theme updates and the vulnerability count by severity, grouped by site. Report only and change nothing.

Prompt

Update every plugin on northwind.example.com with a backup first, then confirm the homepage still loads and tell me what changed. Stop and ask me if the backup fails.

Prompt

Run a PageSpeed scan on the Northwind homepage and compare it with the earlier scans. If the score dropped, check whether a plugin update ran in the last week before you blame the host.

Prompt

Which of my sites have pending WordPress core, plugin or theme updates? Group them by site.

Prompt

Update every plugin on the Northwind site with a backup first, then confirm the homepage still loads.

Prompt

Show the vulnerability count for every site on this team, sorted worst first, and name the top three findings.

Prompt

Turn on WP_DEBUG for the shop site so I can see the error. Turn it off again when I say I'm done.

Prompt

Give me a magic login link for the Northwind WordPress admin.

Prompt

Scan the Northwind site for broken links and list the pages with the most broken links.

Prompt

Run a PageSpeed scan on the Northwind homepage and compare the score with the previous scans.

Prompt

Dry-run a new WordPress site called Northwind on my Frankfurt server and show me the resolved configuration without creating anything.

ChatGPT dots and WordPress: Frequently Asked Questions

What people ask before they let ChatGPT dots manage WordPress through xCloud.

Can a ChatGPT dot update my WordPress plugins overnight?

Not unattended. xCloud stops for an explicit confirmation before it updates plugins or themes, and a dot's proactive research cannot change content through plugins. Let it report overnight, then reply with a yes in the morning and it takes a backup and runs the update.

Does my dot take a backup before it updates a WordPress site?

It should, because it sets backup_before_update for production sites when it sends the update. Say so in your prompt or in a Custom rule so the instruction is explicit, and ask it to stop if the backup fails.

Does the agent back up my WordPress site before it updates plugins?

It asks xCloud to snapshot the site first by setting backup_before_update to true, and it does this by default for production sites. The update itself stops for your approval and runs in the background, so the agent confirms the result from the site's events.

How does an agent find vulnerable WordPress sites?

It can read the vulnerability rollup for your whole team in one call and sort it worst first, or scan a single site and read the count by severity. Findings can be ignored with a reason and unignored later.

Is a magic login link safe to ask an agent for?

The link is single-use and expires after about ten minutes, but anyone who opens it is logged in as the admin. Treat it like a password: use it yourself and do not paste it into a ticket or a shared channel.

Can an agent switch my WordPress caching on or off?

No. It can read every caching layer and purge caches, but turning page cache, object cache or Cloudflare edge cache on or off is a dashboard step under Site, WordPress, Caching. Cache choices can only be set while a new site is created.

Can an agent create a WordPress staging site?

No. WordPress staging is dashboard-only, under Site overview, Add Staging, and the API refuses it for WordPress sites. Staging from the API covers Git sites only.

Can an agent create a new WordPress site?

Yes, on an Nginx or OpenLiteSpeed server. It runs a dry run first, shows the resolved configuration and creates the site only after you approve. WordPress is not supported on Docker servers.

Other agents