What we lock down, and what we don't.
PressConduit can change a client's WordPress site. You should know exactly how it is controlled. This page says what is true today, in plain words.
- Site keys encrypted at rest
- Most AI changes have an undo
- Crash protection built in
What we lock down.
Your site’s connection key is locked.
Each site has a secret key that lets PressConduit talk to it. We store it encrypted, so a copy of our database is not enough to use it.
The AI only gets in if you let it.
You sign in and approve before your AI can see your sites. The approval screen names the app and lists the sites. You can remove the PressConduit connector from your AI app, or remove a site from your dashboard, at any time.
Teammates only see what you give them.
The owner picks all sites or a list. The AI follows that list on every request, and the activity list shows who did what.
Most AI changes can be undone.
Before most changes, PressConduit saves a restore point for what it is about to change. Anything that cannot be undone asks you to confirm first.
A crash does not take your site down.
If a plugin crashes your site while it starts, PressConduit switches that plugin off. If PressConduit itself is the problem, it rolls back to the last good copy.
Scans say what they really did.
The malware and file checks say “incomplete” when they could not finish, instead of saying “all clear.”
How the AI connection is controlled.
- Your AIClaude, ChatGPT or Cursor
- You sign in and approve
- PressConduit's serverChecks the site list and saves a restore point
- Locked site key
- Your siteMakes the change
The AI is yours. PressConduit does not run one. Sign-in uses a standard method called OAuth, with a one-time proof code. The keys the AI holds expire. One kind lasts 24 hours. The other lasts up to 90 days and is replaced each time it is used. A removed teammate loses access on their next request. New accounts confirm their email.
If something goes wrong.
A crash
The rescue file switches off the plugin that crashed, or rolls PressConduit back to the last good copy. Every event goes in the Recovery log.
A bad AI change
Open the site, pick the restore point from before the change, and put it back.
A lost key
Remove the PressConduit connector in your AI app. To cut a site off right away, remove it from your dashboard. You can connect it again when you are ready. The keys the AI holds also expire on their own.
A lost laptop
Change your password in Settings. That signs you out everywhere else. The AI keys on the laptop keep working until they expire, so also remove the connector in your AI app, or remove your sites from your dashboard and connect them again.
What we do not do.
- We do not run your AI or read your AI conversations.
- We do not keep your WordPress admin passwords.
- We are not certified (no SOC 2 or similar).
- We do not promise a site can never be harmed. We promise a way back.
What is coming next.
- Optional two-step sign-in for accounts.Planned
- Every plugin update signed, so a fake one is refused.Planned
- Proof that a site really belongs to the person connecting it.Planned
- Backups stored in the cloud, never on your server.Planned
No dates, on purpose.
Report a problem.
Found something? Write to security@pressconduit.com. Please include what you found, the page or site, the steps to repeat it, and no real customer data.
We read every report and answer within 3 business days.
Try it on one site, free.
Connect one site. You can disconnect any time.