GoBuildWP changelog. Every release, and what actually shipped in it.

Current Pro 1.12.4 is owner-confirmed released and requires Free 1.18.1 or newer. Historical entries describe the named release, not every current dependency or recovery path. Preview coverage, retained snapshots, available purge callbacks and backup reporting have their own limits; a reported backup does not prove archive completeness or restoration. Source-review labels record a source check, not an installed-site test.

1. GoBuildWP Free

   1.18.6

   13 October 2026Latest dated Free note

   WPPilot is now GoBuildWP. Same plugin, folder, settings, connections and Pro licences; existing installs update in place. This release also closes two security gaps: the legacy MCP protocol now requires the same capability as the modern one, and the PHP sandbox covers every extension a server may run as PHP.

   Requires WordPress 6.9+, PHP 8.0+

   • ChangedWPPilot is now GoBuildWP. Update checks use gobuildwp.com and new GoBuildWP Cloud connections use app.gobuildwp.com. Sites already connected to Cloud keep their connection, and existing client configurations keep working.
   • SecurityGoBuildWP's MCP endpoints on the bundled MCP Adapter admitted any signed-in user for the legacy protocol, so a subscriber with an Application Password could list tools and read skill resources (running abilities was already refused). They now require AI abilities switched on and GoBuildWP's manage capability, as the modern protocol, OAuth and the REST API already did.
   • SecurityThe PHP sandbox treated only .php as PHP, so .phtml, .phar, .php7, .pht, .phps and similar files could be written outside wp-content/wppilot-sandbox/. Every extension a server may run as PHP now has to stay in the sandbox.
   • FixedOAuth clients speaking MCP 2026-07-28 on /wp-json/mcp/wppilot-oauth are served, WordPress 7.1 core public abilities are published on both protocols, and a missing vendor directory shows a clear notice instead of a fatal error.

   Source review recorded80136c1View release files

2. GoBuildWP Pro

   1.12.4

   13 October 2026Latest dated Pro note

   WPPilot Pro is now GoBuildWP Pro. Same product, licence and settings; existing licensed sites update through Freemius as before.

   Requires GoBuildWP Free 1.18.1+, WordPress 6.9+, PHP 8.0+, active Pro licence

   • ChangedWPPilot Pro is now GoBuildWP Pro. Licences, settings and connected sites are kept, and the plugin keeps its wppilot-pro folder so updates install in place.

   Source review recordedsha256:79d45db36271

3. GoBuildWP Free

   1.18.5

   10 October 2026Records the PHP error behind "There has been a critical error on this website" and reads it with a new site issues log, together with paused plugins, rolled-back updates and failed backups. GoBuildWP Cloud now hears about backups, updates and plugin changes on the site's next WordPress cron run instead of at the hourly check-in, and gets a short issues summary for each site.

   Requires WordPress 6.9+, PHP 8.0+

   • Newwppilot/site-issues is a read-only log of what went wrong on the site. WordPress's fatal error handler records each fatal error: its type, the message's first line, the file relative to the WordPress root and the line, the plugin or theme it belongs to, the request path without its query string, a count and first and last seen, in a capped log of 50 entries. A fatal from running out of memory or time is not blamed on the file PHP happened to stop in. Query strings, cookies, stack traces and server paths are never stored.
   • NewThe same ability lists the plugins and themes WordPress paused in recovery mode, the updates GoBuildWP Pro's safe update rolled back, and backup runs that failed. Limit: a fatal raised while a plugin that loads before GoBuildWP is being loaded ends the request before anything can record it.
   • NewGoBuildWP Cloud hears about a finished or failed backup (UpdraftPlus, BackWPup, Duplicator), a core, plugin or theme update, a plugin or theme installed, activated, deactivated, deleted or switched, and a Site Kit connection change on the site's next WordPress cron run instead of at the hourly check-in, through the same signed check-in the site already sends. It goes from WordPress cron, at most once every 30 seconds, never during a visitor's page load.
   • Changedcloud/status adds a short issues summary: counts, when the newest fatal was, and the newest ten issues with file paths relative to the WordPress root, so GoBuildWP Cloud shows an Issues log for each site.
   • Fixedpagespeed-check offered Site Kit dashboard sharing to a Site Kit owner whose Google sign-in was gone, which Site Kit refuses. It now skips Site Kit and returns a sign-in fix that links to Site Kit, Dashboard.

   Source review recordedc54cee0View release files

4. GoBuildWP Pro

   1.12.3

   10 October 2026Safe updates no longer roll back on LiteSpeed servers for a site-wide critical error they caused themselves. Pages that fail right after an update are checked again before anything is rolled back, a rollback names the PHP error behind it, and a Site Kit owner who lost their Google sign-in is told to sign in again.

   Requires GoBuildWP Free 1.18.1+ (1.18.5 to name the PHP error in a rollback), WordPress 6.9+, PHP 8.0+, active Pro licence

   • FixedOn LiteSpeed and OpenLiteSpeed servers with LiteSpeed Cache and Elementor, every safe update was rolled back, even of an inactive theme, and visitors saw the critical-error page while it ran. Elementor clears its CSS cache on any update, LiteSpeed Cache answers with a full purge, and the purge resets OPcache, which then stays off for the whole site until the safe update's own request ends. On a 128 MB memory limit every page ran out of memory. LiteSpeed Cache's purge now runs once when the safe update is finished, so caches are still purged and OPcache restarts as soon as the answer is sent.
   • NewA page or health check that fails right after an update with an error, a PHP fatal or no answer is checked again 8 seconds later, and only what still fails counts. An update whose checks all recover is kept, with the reason "recovered on recheck" saying what failed first. Breakage that persists is still rolled back.
   • NewWith GoBuildWP 1.18.5 the rollback reason names the PHP fatal the site recorded, its file, line and plugin, and rolled-back updates appear in the site issues log and GoBuildWP Cloud's Issues page. Any other OPcache reset during an update, such as an updated cache plugin's own first run, is detected and stated in the reason.
   • FixedWhen the Site Kit owner of Search Console or Analytics had lost their Google sign-in, Site Kit reads told them to grant every requested permission, which a signed-out account cannot do. They now name the owner and the module and link to Site Kit, Dashboard to sign in again; the permissions message is kept for users who are signed in.

   Source review recorded60f6a17

5. GoBuildWP Free

   1.18.4

   9 October 2026Runs Google PageSpeed Insights on any page of the site with no Google key needed from anyone, turns on Site Kit's read-only dashboard sharing for Administrators, and tells GoBuildWP Cloud why a backup is stuck. Whether an All-in-One WP Migration backup can be started is now decided by what the install has, never by its version.

   Requires WordPress 6.9+, PHP 8.0+

   • Newwppilot/pagespeed-check returns a page's Lighthouse scores, lab metrics, Core Web Vitals field data when Google has it, the opportunities ordered by the time they save, and failing diagnostics. Site Kit by Google answers when its PageSpeed module is connected and readable; otherwise GoBuildWP Cloud runs the check with GoBuildWP's own Google key, and Google's keyless API is the last resort; Site Kit is skipped while its setup is unfinished. A key of your own under Settings, PageSpeed is optional. refresh: true measures again instead of reusing a recent result.
   • Newwppilot/site-kit-enable-sharing turns on Site Kit's read-only dashboard sharing for Administrators for Search Console, Analytics and PageSpeed Insights, through Site Kit's own sharing route so its owner rules apply, and can be undone. PageSpeed checks say when this sharing is all that keeps Site Kit from answering.
   • ChangedWhether an All-in-One WP Migration backup can be started is decided by what the install has, the same check GoBuildWP Pro 1.12.2's export runner makes, and never by its version. backup-status's trigger.reason names what is missing when it can't.
   • Changedcloud/status reports, per backup plugin, whether it is running, the site's own reason it can't be started, and the export GoBuildWP Pro started (running, stalled, failed or finished, with a plain reason), so GoBuildWP Cloud's run page shows why a backup is stuck and stops waiting for an export that failed. File names, folders, job ids and keys are never sent.

   Source review recorded85f876aView release files

6. GoBuildWP Pro

   1.12.2

   9 October 2026All-in-One WP Migration backups started from GoBuildWP Cloud or an agent now finish on hosts that drop a site's requests to itself, because Pro runs the plugin's export steps itself; a start is refused, with the reason, when the installed release lacks what Pro needs. Adds a PageSpeed fix loop for cache plugins that keeps a setting only when the score holds, and says when Site Kit data is unreadable only because it is not shared.

   Requires GoBuildWP Free 1.18.1+ (1.18.4 for the PageSpeed fix loop and Cloud's backup reasons), WordPress 6.9+, PHP 8.0+, active Pro licence

   • FixedOn hosts that drop a site's requests to itself, such as OpenLiteSpeed behind Cloudflare, an All-in-One WP Migration export stopped after its first step while backup-trigger reported it started. Pro now runs the plugin's own export steps itself, in its order and with its parameters, in short slices on WP-Cron and on every backup-status read, so GoBuildWP Cloud's once-a-minute check also moves it on. It can now be started from WP-CLI and WP-Cron as well as MCP.
   • Newbackup-status reports the export Pro started under providers[].export: running, stalled, failed with the reason, or finished. An export fails, and its half-built archive is deleted, when a step reports an error, the same step starts three times without moving on, or no step runs for 15 minutes. A failed export does not count toward the hour between starts.
   • ChangedNo All-in-One WP Migration version is checked any more: Pro runs whatever export steps the installed release registers. A start is refused, with a plain reason, only when the install lacks something Pro needs to run it; GoBuildWP 1.18.4 makes the same check when Pro is not active.
   • NewWith GoBuildWP 1.18.4, GoBuildWP Cloud's run page shows a stalled or failed export as it happens and ends the backup step as soon as the site reports it failed, instead of waiting 30 minutes. With an older GoBuildWP, Cloud still sees only whether a backup is running.
   • NewPageSpeed fix loop: wppilot/pagespeed-fix-plan names the one cache setting that addresses the largest PageSpeed opportunity it can, and wppilot/pagespeed-fix-step applies it with confirm, checks the page from the server, measures again and keeps the change only when the score held and nothing new broke, otherwise rolling it back. The re-measure asks GoBuildWP Cloud for a fresh run first, with no Google key needed from you. The checks are server-side; open the page in a browser after each kept step.
   • NewSite Kit reads say when a module is unreadable only because this administrator is not signed in to Google and the module is not shared with Administrators (wppilot_site_kit_not_shared), and name the fix: GoBuildWP 1.18.4's wppilot/site-kit-enable-sharing. site-kit-status carries the same hint per module.

   Source review recordedb617d04

7. GoBuildWP Free

   1.18.3

   9 October 2026Prompts is back in the WordPress admin menu under GoBuildWP, next to Dashboard, so the industry briefs are one click away. No ability or permission changed.

   Requires WordPress 6.9+, PHP 8.0+

   • ChangedGoBuildWP collapses its screens into the tab bar on its own pages, which had left Prompts two clicks deep under Studio. The admin sidebar now keeps Dashboard and Prompts listed; the wppilot_sidebar_visible_pages filter changes the set.

   Source review recordede722993View release files

8. GoBuildWP Free

   1.18.2

   8 October 2026Abilities that work through WordPress's own REST API run again over GoBuildWP Cloud and OAuth connectors such as Claude and ChatGPT: block themes, the block theme site header, Cloud's Back up now with All-in-One WP Migration, and Pro abilities that use WordPress REST. A token sent straight to any other REST route is still refused. Check again under Dashboard, Updates now shows a new GoBuildWP release at once.

   Requires WordPress 6.9+, PHP 8.0+

   • FixedWith GoBuildWP Cloud or an OAuth connector, abilities that call WordPress's own REST API failed with "This OAuth credential is not accepted on the requested REST route." That broke the block themes kit, the block theme path of the site header builder, Cloud's Back up now with All-in-One WP Migration, and Pro abilities such as WooCommerce reports, Etch, GeneratePress, Meta Box relationships and Site Kit. A REST call an ability makes for itself while serving an MCP request that already passed the token check is now let through, and still runs the route's own permission check as the token's user.
   • FixedDashboard, Updates, Check again now fetches GoBuildWP's release data instead of answering from a 12-hour cache, so a new release shows at once.

   Source review recorded6b3aee0View release files

9. GoBuildWP Free

   1.18.1

   8 October 2026Reads All-in-One WP Migration backups, so sites that back up with it can use GoBuildWP Cloud's Backups page and GoBuildWP Pro 1.12.1's safe updates. No other ability or permission changed.

   Requires WordPress 6.9+, PHP 8.0+

   • NewAll-in-One WP Migration backups are read alongside UpdraftPlus, BackWPup and Duplicator: backup-status and backup-list report its newest finished backup (time and size), how many there are and whether an export or import is running, and GoBuildWP Cloud's Backups page shows it. Only a complete archive of at least 1 MB in its backups folder counts, so a file dropped there cannot pass for a backup. File names, folders and links are never returned: where .htaccess is ignored, a .wpress file name is enough to download the whole site.

   Source review recorded2b7c9f1View release files

10. GoBuildWP Pro

    1.12.1

    8 October 2026Counts All-in-One WP Migration backups for safe updates and the fresh-backup hold, and starts an All-in-One WP Migration export with backup-trigger, from an AI client or GoBuildWP Cloud. Also makes two backup starts at once start only one backup.

    Requires GoBuildWP Free 1.18.1+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • NewAll-in-One WP Migration counts as a backup plugin: its newest finished backup is the recent backup that safe updates (require_backup) and the fresh-backup hold look for. Before, a site that backed up only with it was told no backup could be confirmed, so every safe update from GoBuildWP Cloud was refused.
    • Newwppilot/backup-trigger starts an All-in-One WP Migration export (version 7.112 or later) through the plugin's own REST export route, over MCP or GoBuildWP Cloud, and the export finishes in the background. Each export is a full copy the free plugin never deletes, so starts are an hour apart and refused when the disk has less free space than twice the newest export (1 GB when there is none).
    • FixedTwo backup-trigger calls at once, such as a retry, Cloud and an agent together, could both pass the running and cooldown checks and start two backups. The checks and the start now run under one lock per backup plugin. On a host that blocks the site's requests to itself the export may not finish; the answer then says the export was requested rather than started.
    • ChangedPro 1.12.1 requires GoBuildWP 1.18.1, which reads All-in-One WP Migration backups: update GoBuildWP first.

    Source review recorded057d550

11. GoBuildWP Free

    1.18.0

    8 October 2026Connects a site to the new GoBuildWP Cloud screens: it reports its pending updates, newest backup and safety settings, and applies a Cloud safety policy only as far as its owner allows. Adds AI-designed site headers built per language, Free abilities for block themes' Global Styles, templates, patterns and menus, an Elementor editability audit, undo for Elementor's, WooCommerce's and EDD's own MCP writes, a Chat token meter, and draft-aware rendered checks.

    Requires WordPress 6.9+, PHP 8.0+

    • NewSite header builder: the AI designs the site header for the brand, as an Elementor Pro Theme Builder header or a block theme header part, and GoBuildWP builds one per Polylang language with a styled language switcher, the menu and the cart. It checks the design before saving (mobile menu button, contrast, empty images and links) and the served page after (wrapping, overlap, broken links), reports each problem against its element, and needs confirmation; the change can be undone.
    • NewBlock themes: read and change Global Styles, list, read, change and revert templates and template parts such as the header and footer, list, create and change the site's own patterns, and list and change block navigation menus. Every call runs through WordPress's own REST controllers, and every write can be undone from the change log. Needs WordPress 6.9.
    • NewGoBuildWP Cloud: the site reports its pending core, plugin and theme updates, read from WordPress's own update check, and its newest successful backup from UpdraftPlus, BackWPup or Duplicator. Under Connect, GoBuildWP Cloud, the owner can let a Cloud safety policy make this site's settings stricter, or also looser up to Production Safe. Both are off by default and a policy applies whole or not at all.
    • NewBuilder quality: an audit scores how editable an Elementor page is, from 0 to 100, with a fix for each finding: layout in HTML widgets, scripts, shortcodes, widgets from inactive plugins, inline styles, custom CSS, fixed colours, deep nesting and empty containers. A page that is one HTML widget no longer grades as good.
    • NewSettings, Other MCP servers: on WordPress 7.1, writes made through Elementor's or WooCommerce's own MCP servers can follow the site's safety profile, wait for a person's approval in wp-admin when destructive, and meet Pro's approval queue. Off by default; reads are never held. Their writes, and those of EDD's and TranslatePress's own abilities, are now snapshotted for undo where they can be put back, and recorded with the reason where they cannot.
    • NewChat counts each person's tokens per day, prompt and answer totals only, and shows today's and this month's use above Chat, turning amber at 80% of any limit GoBuildWP Pro sets. A request over a limit is refused before the AI provider is asked.
    • Improvedverify-rendered-page and audit-accessibility check drafts through a one-minute signed-in preview on the same site. Rendered checks read only the page's own content for empty elements and skipped headings, tag every finding as content or theme, and skip script templates, icons and mini-cart images. The ability list returns each ability's parameter names and types.
    • FixedElementor: classic sections and columns validate against their own controls, so a pre-container page can be written back; the form widget's Reply-To accepts a field ID; rich-text fields accept paragraphs and lists; rewriting a Theme Builder template keeps its type. Polylang sites are no longer reported as WPML. Undo of a WooCommerce product edit no longer refuses over its sales counters.
    • SecurityElementor writes that bypass Elementor's document save, atomic v4 trees and the fallback path, now run every string through wp_kses_post when the user cannot post unfiltered HTML, as Elementor's own editor does, instead of relying on Elementor's REST-only meta sanitizer.

    Source review recorded87d0067View release files

12. GoBuildWP Pro

    1.12.0

    8 October 2026Turns HTML widgets on an Elementor page back into native Elementor widgets, translates TranslatePress page strings with undo, and sets daily and monthly Chat token limits per person. Also fixes Elementor form submissions for one form returning rows from every form.

    Requires GoBuildWP Free 1.18.0+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • NewElementor: converts simple markup inside an HTML widget into the widgets a person would have used, such as Heading, Text Editor, Button and Image, and opens up plain wrapper divs. Scripts, styles, iframes, forms, SVG, video and tables are left alone with the reason. Dry run by default; an applied repair can be undone from the change log.
    • NewTranslatePress: lists the strings TranslatePress collected for a language with their status, and saves up to 100 translations at a time through TranslatePress's own editor call, marked as reviewed by a person so automatic translation leaves them alone. Undo restores each string's previous translation and status.
    • NewChat limits under Settings: tokens per person per day and per month, from 10,000 to 50 million or no limit, with administrators exempt by default. At the limit Chat stops before the AI provider is asked. The limits keep applying if the licence lapses.
    • FixedElementor form submissions filtered by one form returned rows from every form on the site, and the forms list included revisions. Chat limit values such as -5 or 1e3 are no longer stored as numbers they were not.
    • ChangedThe Elementor page-building skill and the Theme Builder abilities now send header work to GoBuildWP 1.18.0's site header builder. Pro 1.12.0 requires GoBuildWP 1.18.0: update GoBuildWP first.

    Source review recorded15b40c0

13. GoBuildWP Free

    1.17.4

    8 October 2026GoBuildWP Cloud and AI connectors that sign in with OAuth work again on sites running Yoast SEO. Every token-signed request on those sites failed with an HTTP 500 error; Application Password connections were not affected. No ability or permission changed.

    Requires WordPress 6.9+, PHP 8.0+

    • FixedOn a site running Yoast SEO, checking a GoBuildWP access token asked Yoast for the user's permissions, Yoast asked WordPress who the current user was, and that started the token check again until PHP ran out of memory. The token check now ignores that inner lookup, so the request signs in as the token's user.

    Source review recorded8bd7d9fView release files

14. GoBuildWP Free

    1.17.3

    7 October 2026AI clients can run abilities again on sites where another plugin reads the WordPress Abilities registry early: they were offered only discovery and could list abilities but never run one. Reconnect the client after updating. No ability permissions changed.

    Requires WordPress 6.9+, PHP 8.0+

    • FixedWhen another plugin read the Abilities registry early in the request, the bundled MCP Adapter missed the moment to register get-ability-info and execute-ability, so every GoBuildWP MCP endpoint served discovery alone. GoBuildWP now registers both itself when the adapter did not.

    Source review recorded9307df5View release files

15. GoBuildWP Pro

    1.11.1

    7 October 2026The Upgrade screen inside WordPress now shows the same plan names and prices as gobuildwp.com and the Freemius checkout: Single Site, 10 Sites, 100 Sites and Unlimited Sites, yearly or once. It had still listed the old launch prices under Solo, Crew, Fleet and Command.

    Requires GoBuildWP Free 1.16.0+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • FixedThe in-plugin Upgrade screen quoted $79 a year for 10 sites and $99 to $399 for lifetime plans, prices the checkout no longer charged. It now lists $39, $59.99, $79.99 and $99.99 a year or $59.99, $79.99, $119.99 and $199.99 once, with 10 Sites marked Most popular and Unlimited Sites Best for agencies. Checkout links, licence quantities and abilities are unchanged.

    Source review recordedc0c00f6

16. GoBuildWP Free

    1.17.2

    7 October 2026GoBuildWP's admin screens now use the gobuildwp.com brand purple, so the plugin, the website and the GoBuildWP Cloud dashboard look like one product. Visual only: no ability, permission or behaviour changed.

    Requires WordPress 6.9+, PHP 8.0+

    • ChangedThe Connect, Abilities and Skills screens and the masthead Upgrade link use #675CF4 instead of #3D2BFF for primary buttons, focus rings and active tabs.

    Source review recorded09a7b67View release files

17. GoBuildWP Free

    1.17.1

    6 October 2026When GoBuildWP Cloud cannot finish connecting a site because its test request is refused or answered by something else, the Connect screen now says why and what to change, instead of only verification_failed.

    Requires WordPress 6.9+, PHP 8.0+; a free GoBuildWP Cloud account to use Cloud

    • FixedA failed GoBuildWP Cloud connection check names its reason on the Connect screen, such as a firewall or security plugin refusing the request (unauthorized_403) or a challenge page or redirect answering it (protocol_200), with what to change. Connection Doctor does not test the token Cloud uses, so it could pass while this check failed.

    Source review recordede594849View release files

18. GoBuildWP Free

    1.17.0

    3 October 2026Adds GoBuildWP Cloud: an optional hosted account at app.gobuildwp.com that puts every connected site behind one MCP link for ChatGPT, Claude, Cursor and other MCP clients. The site mints its own Cloud-managed token and hands it over server to server; disconnecting from either side revokes it. Nothing changes until a site is connected.

    Requires WordPress 6.9+, PHP 8.0+; a free GoBuildWP Cloud account to use Cloud

    • NewGoBuildWP Cloud card on the Connect screen: sign in at app.gobuildwp.com, choose Read Only or Production Safe and which abilities, then confirm on the site. The access token is listed as Managed by GoBuildWP Cloud and never passes through a browser. Cloud reads status and can unlink only through two routes that accept just that token, and the site sends a signed hourly heartbeat.
    • ChangedThe wppilot_tool_call_rate_limit filter receives the credential being budgeted as a second argument; the GoBuildWP Cloud credential is allowed at least 600 write calls a minute unless the limit is switched off.
    • FixedA database error during the Cloud heartbeat no longer disconnects the site, single and automatic updates report the new version to Cloud straight away, and the Cloud-managed token's limits can't be edited by hand.

    Source review recorded816c26cView release files

19. GoBuildWP Pro

    1.11.0

    1 October 2026Closes an approval-queue bypass through undo, keeps cache plugin credentials away from the agent, and withholds submitters' email addresses and phone numbers from form exports and single-entry reads by default. The WooCommerce store reads, backup and security status, four form lists and scheduled routines now come from GoBuildWP 1.16.0 under the same names, and a long list of builder, theme, form and cache fixes lands.

    Requires GoBuildWP Free 1.16.0+, WordPress 6.9+, PHP 8.0+, active Pro licence; each integration loads only while its plugin is active

    • SecurityAn agent held by the approval queue could release itself by undoing the change that added its hold rule. Undo and redo now refuse that, as changing the policy directly already did; an administrator can still undo from the Changes screen.
    • SecurityCache plugin credentials (Cloudflare keys and tokens, NitroPack secrets, Redis, Memcached and CDN passwords) no longer reach the agent from cache settings reads or writes. Writing a withheld value back keeps the stored secret.
    • SecurityForm exports and single-entry reads for Contact Form 7, Fluent Forms, Formidable, Ninja Forms, WPForms and Gravity Forms withhold submitters' email addresses and phone numbers by default, like the entry lists. An export meant for a CRM or mailing list includes them only after you explicitly approve it.
    • ChangedMoved to GoBuildWP 1.16.0 with the same names and results: WooCommerce store reads (products, variations, categories, tags, store settings, orders and customers), backup and security status, form lists for WPForms, Contact Form 7, Gravity Forms and Forminator, and scheduled routines, which keep running with their history. Pro keeps its WooCommerce writes and reports, backup triggers, security hardening, and every form export and entry read.
    • FixedWooCommerce keeps backslashes in product, variation, coupon, gateway and order text, and an edit to a product that manages stock can be undone without touching the live stock level. Session undo and redo in GoBuildWP 1.16.0 cover Pro's product edits.
    • FixedElementor 4.2 global class undo, Spectra block switches, Spectra One typography, Astra header layouts and palettes, OceanWP library templates, Code Snippets 3.10, The Events Calendar dates and trash, Tutor LMS course trash, Beaver Builder Lite templates, ACF options pages on ACF free, several form editors, FlyingPress purges and Powered Cache preload.
    • FixedUndoing the first change to a setting removes it again; the builder converter is listed to MCP clients again; Site Kit reports say when Google is not connected. Cancelling a Paid Memberships Pro level now says billing can continue if the gateway does not confirm the cancellation.

    Source review recorded2565b7e

20. GoBuildWP Free

    1.16.0

    30 September 2026Brings five former Pro features into Free - WooCommerce reads and a basic product editor, one post's SEO title, description and robots for seven SEO plugins, read-only forms with contact details withheld, backup and security status, and scheduled audits - adds undo and redo for a whole agent session, and a local stdio connection through wp wppilot mcp serve. Reading server files now needs Developer Full Access. 48 new abilities, 216 in all.

    Requires WordPress 6.9+, PHP 8.0+; WooCommerce, SEO, form, backup and security abilities register only while that plugin is active

    • NewWooCommerce basics, formerly Pro: the setup check, products and variations, categories and tags, store settings, and reading orders and customers (those two also need manage_woocommerce). wppilot/woocommerce-edit-product changes one product's name, description, prices and stock through WooCommerce and can be undone. Bulk prices and stock, order and customer writes, refunds, coupons, reports, shipping, tax, gateways and full product editing stay in Pro.
    • NewOne post's SEO title, meta description and robots in Yoast SEO, Rank Math, All in One SEO, SEOPress, The SEO Framework, Slim SEO and SmartCrawl, a get and an edit per plugin, written the way each plugin's own editor writes them and undone from a before-image. Slim SEO cannot force index, and SEOPress has no per-post force-index. Focus keywords, canonicals, social previews, schema, redirects and bulk SEO stay in Pro.
    • NewRead-only forms, formerly Pro: list the forms of WPForms, Contact Form 7, Gravity Forms and Forminator and read their entries (Contact Form 7's through Flamingo; WPForms entries need WPForms Pro). Email and phone answers, passwords, card data, uploads, signatures and the IP are withheld, and email addresses and phone numbers are cut out of free text. Full values, exports and form editing stay in Pro.
    • NewBackup and security status, formerly Pro: wppilot/backup-status and wppilot/backup-list read UpdraftPlus, Duplicator 5 and BackWPup; the security status, scan findings and lockouts read Wordfence and Solid Security, with IP addresses shown as /24 or /48 networks and logins masked. Starting a backup, the fresh-backup hold, safe updates, hardening, IP blocks and scans stay in Pro.
    • NewScheduled audits, formerly Pro: a routine runs the read-only accessibility, content and alt-text audits on WP-Cron, daily or weekly in the site's timezone, compares each run with the one before and emails the administrators it names. A Routines screen under Activity has a Run now button. Routines made with Pro keep running unchanged.
    • NewUndo a whole agent session. Every write is filed under its session, and wppilot/undo-session takes back everything a session did, newest first, each change verified against its before-image. If something else changed a target after the session did, nothing is changed and the conflict is named. wppilot/redo-session puts it back, wppilot/list-sessions shows what either would do, and the Changes screen has Undo session and Redo session buttons.
    • NewA local connection over WP-CLI: wp wppilot mcp serve --user=<login> serves the same MCP server over stdio for Claude Code, Cursor or a CI job on the machine that runs the site, with the same abilities, safety profile, confirmations and permission checks and no credential to create. The Connect screen shows the claude mcp add command and a Cursor mcp.json with the site's path filled in.
    • ImprovedClient setup re-checked against each vendor's documentation: Zed, Cline, Kilo Code, OpenCode, Amazon Q / Kiro and OpenClaw sign in with OAuth natively; Kimi Code CLI, Qwen Code, ZCode, Factory Droid and OpenClaw gain OAuth tabs; Kimi targets Kimi Code CLI; GitHub Copilot snippets are for Copilot CLI; Devin Desktop lists its new config path; and Manus can take an access token.
    • Securitywppilot/read-file and wppilot/list-directory ran under Production Safe and even Read Only, because a read-only ability passed every profile, so an agent on those profiles could read wp-config.php with its database password and salts. Both now need Developer Full Access like the other server-file abilities, and each call is recorded in the change log. A fresh install on the default profile now registers 154 abilities.
    • Fixedwppilot/delete-comment is recorded as irreversible instead of offering an undo that could only fail; wppilot/delete-theme works over MCP; wppilot/adopt-design-from-site no longer fails on themes with numeric spacing slugs such as Twenty Twenty-Five; alt text keeps its backslashes; and five admin screens no longer log a deprecation for a missing title.
    • SecurityThe change history now withholds more credentials: option names such as LiteSpeed's object-pswd and cdn-cloudflare_key, NitroPack's siteId, Autoptimize's ccss_key and any *_pass, *_pwd or *_auth key were shown in plain text and are now hidden like passwords and tokens.
    • ChangedWorks beside GoBuildWP Pro 1.10.0, which still carries its own copies of the five moved features: Pro registers first and each free copy stands aside for a name already registered, so nothing changes on a site running Pro 1.10.0. The change log gains two columns, session_id and redo_data; existing rows are kept. wppilot/read-file and wppilot/list-directory now need Developer Full Access; no other existing ability changed its permissions, and existing connections keep working.
    • ChangedKits: runtime 1.2 adds Runtime\unclaimed(), kit.json requires.any (a kit serving whichever of several plugins is active) and a SessionLedger host interface, through which a kit lets session undo check and redo its own changes.
    • FixedEvery call through the legacy MCP transport recorded a second change row for the adapter's execute tool, reads included, each saying No supported before-image, which also made every legacy session look irreversible. The Dashboard's recent changes no longer log a notice for a change made by an ability that is no longer registered.

    Source review recordedf4ac3a2View release files

21. GoBuildWP Pro

    1.10.0

    29 September 2026Adds safe plugin and theme updates with automatic rollback, backup status and Backup Now for UpdraftPlus, Duplicator and BackWPup with an optional fresh-backup requirement, Wordfence and Solid Security hardening and IP blocks with undo, scheduled audit routines, content fixes, per-post SEO for The SEO Framework, Slim SEO and SmartCrawl, Forminator, WS Form and FunnelKit modules, Kadence Design Library patterns, and four MCP Apps cards with approvals decided from the card.

    Requires GoBuildWP Free 1.15.1+, WordPress 6.9+, PHP 8.0+, active Pro licence; each integration loads only while its plugin is active

    • NewSafe updates. wppilot/safe-update updates one plugin or theme per call: it requires a successful backup from the last 24 hours, zips the current version, checks the home page and up to four recent pages, REST and admin-ajax logged out before and after, and tries to put the old version back automatically when a page that worked now errors, fatals or does not answer; that restore can itself fail, and it covers files only. A kept update can be undone for 7 days. Core, GoBuildWP itself and single-file plugins are refused, and no screenshots are taken.
    • NewBackups. wppilot/backup-status and wppilot/backup-list read UpdraftPlus, Duplicator and BackWPup: the last backup and its result, contents, size and storage names, never paths, links or credentials. wppilot/backup-trigger queues an UpdraftPlus or BackWPup WP-Cron backup with the plugin's own action; Duplicator is read-only. Nothing restores, downloads or deletes. A BackWPup run whose local archive was deleted no longer counts.
    • SecurityRequire a fresh backup, under Settings > Backups, off by default. While on, any call rated destructive or critical is refused unless a supported backup plugin reports a successful backup newer than the chosen age (24 hours by default). It fails closed with no readable backup plugin, holds nothing else, runs before the approval queue on every transport, and stays enforced if the licence lapses.
    • NewSecurity plugins, Wordfence and Solid Security: status, open scan findings and lockouts; a hardening plan you confirm, applied through the vendor, read back, checked over loopback and rolled back if the site or MCP stops answering; IP block and unblock; and starting a scan. Every change is undoable, Application Passwords are never switched off, and IPs leave only as /24 or /48 networks. Wordfence extended protection and Solid two-factor are only reported.
    • NewScheduled routines run the free accessibility, content and alt-text audits daily or weekly on WP-Cron with no agent connected, as a named administrator and through every gate. Each run is compared with the last, new, resolved and changed issues, and emailed to administrators chosen by user id. Routines can only run those read-only audits. A Routines screen under Activity shows schedules and results.
    • NewContent fixes. wppilot/content-fix-plan turns a finished content audit into exact changes with a preview and a confidence: broken internal links retargeted in post content and Elementor data byte for byte, one 301 when three or more posts share a dead link, related links for orphans on block-editor posts only, and drafted meta descriptions. wppilot/content-fix-apply writes only the items picked, each undoable.
    • NewPer-post SEO for The SEO Framework, Slim SEO and SmartCrawl: setup, stored and rendered values, and writes through each vendor's own storage, undone from a before-image of that plugin's meta only. Bulk SEO works on all three through a provider registry, and a field the active plugin does not store now fails that post instead of reporting it written.
    • NewForminator and WS Form: list and read forms, read entries with email, phone and IP always withheld, and change a form's title, submit text or a field's label, placeholder or required flag. A Forminator edit is undone from the change log; a WS Form edit cannot be, because WS Form's only restore recreates every field under a new id, so it returns the previous values instead.
    • NewFunnelKit funnels with their steps, optins, orders and revenue per step for a date range, counts and sums only, and step renames, re-slugs, publishing and drafting with undo; a new title no longer moves the step's URL. Kadence Design Library: list and insert free sections into block-editor posts with uniqueIDs renamed and the page checked; licensed patterns are never inserted.
    • NewMCP Apps cards for hosts that render them: a diff card for previews and ledger rows, a before and after screenshot slider, a filterable search-and-replace grid and an approval card. wppilot/approval-list-requests and wppilot/approval-decide sit behind its buttons, and a decision counts only when a person confirmed it; an agent's own confirm=true is refused.
    • FixedRank Math redirects created before its setup wizard was finished or skipped were stored and reported as working, but Rank Math serves none until then. Creating one now refuses with the reason and what to do, and redirect status and automatic redirects fall through to the next provider.
    • FixedThe approval queue held calls whose input was invalid, so a person approved them and only then saw them fail. Input is validated first on every transport, and an invalid call is refused at once with nothing queued.

    Source review recordedc9cb74dView release files

22. GoBuildWP Free

    1.15.1

    29 September 2026A fixes release. The Connection Doctor, Diagnostics and Connect screen name Wordfence when it has switched Application Passwords off, change records mask email addresses when they are read, and the content audit and wppilot/read-content recognise The SEO Framework, Slim SEO and SmartCrawl. No abilities were added or changed, and existing connections keep working.

    Requires WordPress 6.9+, PHP 8.0+

    • FixedWith Wordfence active, every MCP call made with an Application Password returned 401 and nothing said why: Wordfence switches Application Passwords off by default. The Connection Doctor, Diagnostics and the Connect screen now name Wordfence and the setting to uncheck, name any other plugin that switches them off by the file its filter lives in, and point to OAuth or an access token, which do not need Application Passwords.
    • SecurityChange records showed email addresses in full: wppilot/get-change, wppilot/export-changes, the Changes screen and its download redacted secrets by key name only, and get-change returned before-images unredacted. Email addresses in the input, result, before-image and undo verification are now masked when a record is read, keeping only the first letter of each part, and before-images get the key-name redaction too. What is stored is unchanged, so undo still restores the exact original.
    • FixedThe content audit and wppilot/read-content only knew Yoast, Rank Math, SEOPress and AIOSEO, so a site on The SEO Framework, Slim SEO or SmartCrawl was reported as having no SEO plugin and no SEO title or description. Their meta is read now. With GoBuildWP Pro active the audit reads SEO plugins through Pro's own readers and suggests each plugin's update ability only when it is registered.
    • ChangedFor developers: kit.json can declare another plugin's storage (vendor_storage) and the kits a kit needs exported with it (requires.kits); the coexistence check honours the first and the exporter the second.

    Source review recorded4f51404View release files

23. GoBuildWP Free

    1.15.0

    28 September 2026Adds 26 abilities - search and replace with undo, image editing, WCAG and content audits, Block Notes, site and database tools, multisite and Connection Doctor - lets a person rather than the model confirm destructive calls, scopes access tokens, and moves the change log into its own table.

    Requires WordPress 6.9+ (7.1 to anchor a new Block Note), PHP 8.0+

    • NewSearch and replace across posts. wppilot/search-replace-preview builds a reviewed plan of every match, per field, over titles, content, excerpts and chosen meta keys, serialized values and builder JSON included. wppilot/search-replace-apply writes only posts in the plan and unchanged since the preview, 100 per call or as a background job, and records one undoable change per post under one batch. Serialized objects, guids and options are never touched; regular expressions are off unless asked for.
    • NewImage editing: wppilot/edit-image resizes, crops, rotates and flips an image as a new attachment or in place, the way WordPress's own editor names files and keeps backup sizes. Either can be undone, and the original file is never deleted.
    • NewAccessibility and content audits. wppilot/audit-accessibility checks a page as visitors receive it against WCAG 2.2, citing the criterion and level on every finding and naming what it could not check, such as contrast and focus. Alt-text abilities find missing or filename alt text, show the image to the model and set alt text in bulk with undo. wppilot/audit-content finds broken internal links, orphan pages, thin content and missing descriptions as a background job.
    • NewBlock Notes: an agent can leave a note on a block for a person, reply, resolve, and read the notes a person resolved, using WordPress 7.1's Notes. Reading works from 6.9; anchoring a new note to a block needs 7.1. Every note it writes can be undone.
    • NewSite tools: WP-Cron list, run and delete (a deleted event can be put back), Site Health tests and transient flush. Only on Developer Full Access, and recorded without their results: an options explorer and wppilot/database-query, one read-only SELECT with sensitive columns redacted and the users, options and key tables refused. On a multisite network, wppilot/network-run-ability runs an ability on another site through that site's own profile, confirmation and log.
    • NewConnection Doctor, on the Diagnostics screen and as wppilot/connection-doctor, finds what stops an MCP client connecting - a firewall, Cloudflare, ModSecurity, a stripped Authorization header, disabled Application Passwords, OAuth clock skew or a URL mismatch - and gives the fix for the server it runs on.
    • SecurityA person, not the model, can confirm destructive calls. With Settings > Confirmation mode set to "A person approves", confirm=true from the model is not enough: a person approves the exact call in their MCP client or on a one-time wp-admin link. Each change records how it was confirmed. Off by default. Any ability, including other plugins', can also be set to always need confirmation or a minimum profile.
    • SecurityAccess tokens are agent identities: a token can have an expiry chosen at creation, be limited to chosen abilities or categories, and carry a safety-profile ceiling below the site's. Everything outside its scope is refused and hidden, and its changes are attributed to it by name. An invalid or expired token now gets a proper invalid_token answer on sites where another plugin reads the current user early.
    • ChangedThe change log is stored in its own database table instead of one option capped at 500 rows, and existing history is moved across on update. It keeps 10,000 changes or 90 days, and large before-images of changes older than 30 days are dropped. If the table cannot be created, the option keeps working and Diagnostics says why.
    • ChangedA redesigned admin. GoBuildWP opens on a Dashboard showing whether agents can act, connected clients, the last day's changes with an Undo on each, and writes waiting for approval. Sixteen screens sit in six sections under one white header, and every screen fits a phone.
    • NewMCP: a server card at /.well-known/mcp/server-card.json, skills and industry briefs as skill:// resources, MCP Tasks on the modern transport, with background execution for job-backed abilities, polling, results, listing and cancellation (other abilities complete synchronously), and an MCP Apps preview card that supporting hosts show beside a preview with an Apply button. 26 new abilities, 168 in all; no existing ability changed its permissions, and existing connections keep working.

    Source review recordedda46f7bView release files

24. GoBuildWP Pro

    1.9.0

    28 September 2026Adds WooCommerce sales and best-seller reports for calendar dates in the store's timezone, rechecks the design direction when a held request is approved, and records bulk SEO and field writes so the new Changes screen in GoBuildWP 1.14 can undo a batch in one step.

    Requires GoBuildWP Free 1.14.0+, WordPress 6.9+, PHP 8.0+, WooCommerce 9.0+ for the reports, active Pro licence

    • NewNew ability: wppilot/woocommerce-sales-report, read-only. Sales for calendar dates in the store's timezone, inclusive, overall and per day, week or month: orders, items sold, gross and net sales, discounts, refunds counted on their refund date, and total sales. product_ids (products or variations) and category_ids narrow it to those line items. Verified on WordPress 7.1 with WooCommerce 11.1.2 against hand-reconciled totals. It is not an accounting, tax or payout report.
    • NewNew ability: wppilot/woocommerce-product-sales, read-only. Ranks products by net sales or units for a date range, with refunded units and amounts netted and variations counted under their parent.
    • NewBoth reports read stored orders through wc_get_orders(), which is HPOS-safe, up to 5,000 per call, then say truncated. WooCommerce Analytics answers only when asked or when a range holds more orders than one call reads, and every result names its source. On the test store Analytics reported zero orders while five existed because its import had not run, which is why it is not the default. wppilot/woocommerce-sales-summary stays registered for existing callers.
    • ChangedApproving a held request replays it through the free plugin's gate pipeline as a human-approved call, so the safety profile, the preview requirement and now the design direction are rechecked as they stand when the approver clicks, not as they stood when the agent asked. The design gate was never rechecked on approval before.
    • ImprovedBulk SEO meta and custom-field value writes record one ledger row per post through the free plugin's per-item recorder, under one group per call, so the Changes screen in GoBuildWP 1.14 can undo a whole batch at once. The rows are written under a lock, so a concurrent write can no longer erase one.
    • NewKits: a Pro feature can be built as a kit on the free plugin's kit runtime, so it can be exported into another plugin. WooCommerce reports is the first. A kit loads through the module manifest behind its plugin's gate, and one that cannot load is reported with its reason in integration health rather than registering nothing.
    • FixedThe skill checker could not see the twenty WooCommerce abilities registered in a loop, so a skill naming one looked broken and a typo in one looked fine.
    • ChangedFor developers: the approval, lapsed-licence and draft-first holds are registered once, on the free plugin's shared wppilot_pre_ability_execute filter, which the modern MCP transport fires since free 1.14. The modern-only filter they were also on is retired.

    Source review recorded8ffcf74View release files

25. GoBuildWP Free

    1.14.0

    28 September 2026Adds a Changes screen in wp-admin where a person can filter, undo and export what agents changed, puts Chat through the same checks as MCP and REST, and lets a feature ship as a kit that can be exported into another plugin.

    Requires WordPress 6.9+, PHP 8.0+

    • NewNew screen: GoBuildWP > Changes. Code and skills have long said to undo a mistake from the Changes screen, but there was no such screen; the only way back was rollback-change, run by the same agent that made the mistake. It lists every recorded change newest first, filters by ability, agent, date range, status and kind, shows one change's redacted input, result and undo verification, and undoes one change, one bulk batch, or every undoable change a filter shows, up to 200 at once, reporting any that did not come back.
    • NewNew ability: wppilot/export-changes, read-only. The change record as flat rows for a client report or an audit, filtered like the Changes screen and paged 500 rows or 256 KB at a time. The screen downloads the same filters as CSV or JSON. Before-images never leave the site, and CSV cells a spreadsheet would run as a formula are defused.
    • SecurityChat runs every ability through the same controls as MCP and the REST API. It called abilities directly, so a Chat write skipped the write rate limit, the design gate and anything a companion plugin adds, such as Pro's approval queue. Every path - both MCP transports, the REST route, WordPress core's ability runner, Chat and Pro's approval replay - now runs one pipeline: safety profile, confirmation, then the shared filter. Chat's approve button is the confirmation; the preview requirement still stands aside for Chat, as its setting always said.
    • FixedUndoing a change to a draft failed. WordPress moves an unscheduled draft's floating date to now whenever the post is updated, so the undo restored the content and then failed its own date check with "Rollback ran but the observed state did not match the before-image". It keeps the draft's date now.
    • ImprovedBulk writes record one undoable change per item under one group, so a batch can be undone whole or item by item. One call cannot fill the change record: before-images stop after 1 MB per call, and later items say plainly that none was kept. The record is written under a database lock, so two writes recorded at the same moment no longer erase each other.
    • NewAn ability can keep a sensitive read off Production Safe and have every call recorded: meta.safety.min_profile names the least permissive profile it runs under, and meta.safety.audit_reads records who ran it and with what input, never what it returned. A read-only ability used to pass every profile, because its read-only flag was checked first. No ability shipped in this release uses either yet.
    • NewKits: a feature can be built as one self-contained folder - kit.json, abilities, skill - on a small runtime that supplies the safety profile, confirmation, change record, undo and background jobs, so scripts/export-kit.php can copy it into another plugin under that plugin's own prefix. wppilot/export-changes is the first. A kit that cannot load on a site says why instead of registering nothing. Modules can also register how their own changes are undone, through wppilot_register_rollback_strategy.
    • ChangedFor developers: the modern-transport-only wppilot_modern_mcp_pre_ability_execute filter is no longer fired. Hook wppilot_pre_ability_execute, which now runs on that transport too. One new ability, read-only; no permission changes, and existing connections keep working without re-authorising.

    Source review recorded0fe4424View release files

26. GoBuildWP Pro

    1.8.0

    27 September 2026Turns the approval queue into a per-client, per-ability policy, extends rollback to every builder, adds WooCommerce bulk, order, customer and store-settings writes, bulk SEO and custom-field values, working copies and form entry export, and closes three paths that let agent writes skip review or reach code.

    Requires GoBuildWP Free 1.10.0+ (1.13.0 recommended), WordPress 6.9+, PHP 8.0+, active Pro licence

    • SecurityWordPress core's own ability runner (/wp-abilities/v1/abilities/{name}/run) executed writes without passing the approval queue or the lapsed-licence hold, so any agent with an application password could skip review. That route is held like every other transport now. "Hold destructive writes only" also holds critical writes: creating or deleting users, admin access links, and deleting files, plugins, themes and database rows.
    • SecurityThe Elementor atomic widget generator wrote agent text into a PHP file loaded on every request without escaping it. Every value is escaped, and the ability is treated as code execution: it needs confirmation and Production Safe refuses it. Bricks code, query-editor PHP and page scripts sit behind an explicit opt-in that only the Developer profile allows.
    • NewThe approval queue is a policy rather than a switch. The default mode holds every write, only destructive and critical ones, or nothing; each agent credential can have its own mode, including a trusted mode that holds only destructive writes and code execution; and rules can always or never hold one ability or a family. wppilot/approval-get-policy and wppilot/approval-set-policy manage it, and an agent can never relax its own review. A site with no saved policy behaves as the old switch did.
    • ImprovedRollback reaches every builder: 361 of 617 Pro writes can now be undone, up from 45 of 570, covering Bricks, Divi, Etch, Oxygen, Breakdance, Beaver Builder, WPBakery and Flatsome pages, WPForms and CF7 forms, Yoast, Rank Math and SEOPress post SEO, custom-field values and products. The other 256 name the table, file or service that keeps them out of reach. Undo is no longer offered where it would corrupt data on a free plugin older than 1.13.0.
    • NewWooCommerce: bulk price and stock changes on up to a hundred items per call, with a dry run of every before and after and one ledger entry per product; order and customer create and edit through WooCommerce's own CRUD, never touching payment, passwords or staff accounts; shipping zones, tax rates and gateway settings, with keys and secrets never written or returned. Status changes that email customers or move stock need confirmation.
    • NewBulk SEO titles, descriptions, focus keywords, canonicals, robots and Open Graph text across Yoast, Rank Math, AIOSEO and SEOPress, and bulk custom-field values across ACF, Meta Box, Pods, JetEngine, ACPT and ASE, each with a dry run and per-post results. A changed permalink gets a 301 in whichever redirect plugin is installed, touching only redirects GoBuildWP created. Rank Math redirects and a Redirection integration are new.
    • NewWorking copies: edit a draft copy of a live builder page, preview what would change, and publish it back onto the original so its ID, URL and SEO history stay, with a rollback point. An optional draft-first setting makes builder writes refuse published pages. Also new: read-only Site Kit by Google data, WPML and Polylang string translation, Tutor LMS course and quiz authoring, and PMPro levels, discount codes and order reads.
    • SecurityForm entries from Ninja Forms, Fluent Forms, Gravity Forms, Formidable, WPForms and Flamingo return IP addresses, passwords, card numbers, uploads and signatures as [REDACTED] unless the call asks for them with confirmation, and searches no longer match those values. New entry export for WPForms, Gravity Forms, Formidable, Ninja Forms and Contact Form 7 (through Flamingo) writes CSV or JSON under the same rule.
    • FixedBuilder, theme, field, form and WooCommerce writes no longer strip backslashes, which broke JSON and code in Bricks, WPBakery, Flatsome, Avada, Astra, GeneratePress, Spectra, Pods, WPForms and others. WooCommerce order edits refuse another order's line items, and refunding exactly the remainder of a line works.

    Source review recordeda3ba243View release files

27. GoBuildWP Free

    1.13.0

    26 September 2026Coexists with Elementor's own MCP, answers whether a site is ready for it, and lets an agent see the page it built rather than only read it.

    Requires WordPress 6.9+, PHP 8.0+

    • FixedGoBuildWP no longer fatals beside another plugin that bundles the same dependencies. Composer derives the Jetpack autoloader's namespace from the dependency set, so two plugins with similar composer.json files generate the identical namespace and the second to activate dies naming a hashed class nobody can search for. The suffix is pinned now, so GoBuildWP's namespace is its own and cannot collide with one another project happened to generate.
    • NewGoBuildWP shares a site with Elementor's MCP, and with any other plugin that ships the WordPress MCP Adapter. Only one copy of the adapter can load and version arbitration decides which, so GoBuildWP can find itself running somebody else's copy - and class_exists() answers true either way. GoBuildWP resolves the actual origin and, on a foreign copy, stops renaming the adapter's default server and registers its own endpoint beside it instead of taking a route another plugin owns. wppilot/system-status reports which copy is loaded and who owns it.
    • NewNew ability: wppilot/elementor-audit-atomic-readiness. An atomic-only tool connects to a classic site, reports success, and then cannot edit the page anyone asked about, with nothing on the site to say why. This answers it across every Elementor document at once: what is already atomic, what GoBuildWP can convert, and which widgets block the rest, with counts. A widget whose plugin is inactive is reported as unregistered rather than counted as classic, because those elements are lost rather than converted.
    • NewNew ability: wppilot/get-page-view-link. Every other check reads the page; none could see it, and the failures that matter most are visual - a headline illegible over the photograph behind it, a card that wrapped onto its own row at 1024px. This hands an agent's own browser a URL and the widths worth checking, and handles a draft honestly: an unpublished page returns its preview URL with requires_sign_in set, and points to the critical create-admin-access-link rather than signing a browser in itself.
    • NewNew abilities: wppilot/capture-page, wppilot/register-capture, wppilot/list-captures, wppilot/compare-captures and wppilot/attach-captures-to-change. For a caller with no browser, a logged-in wp-admin tab takes the screenshot instead. Two captures compare into a score and the regions that moved, sampled on a grid rather than pixel-exact, because a pixel-exact diff reports every page as changed and gets switched off within a day. The pair can be attached to a change-ledger entry, so the history carries what a write did to the page rather than only what it did to the data.
    • Changedwppilot/verify-rendered-page checks a page that is not published yet. It used to refuse - a draft has no public URL and fetching one anonymously returns the 404 - which sent the check away at the moment it was most wanted. The preview is fetched carrying the caller's own minute-long session, destroyed as soon as it returns; nothing is escalated, and a caller who cannot read the draft in wp-admin cannot read it here.
    • FixedA queued block-editor change whose target page was deleted stranded its whole batch. The item was handed to a browser tab that cannot open a post which is not there, so it sat running until its lease expired and the batch never finished. The target is checked when the item is claimed now, so it fails once, names the reason, and the rest of the batch carries on.
    • FixedRuns on PHP 8.0 again, as the header promises. Call sites that used first-class callables or unpacked string-keyed arrays, both refused by PHP 8.0, use the forms 8.0 accepts.
    • SecurityThe modern MCP transport answered tools/list and server/discover before WordPress checked who was asking, so an anonymous request could read every ability schema and the safety profile. It now answers only callers who pass the same checks as the legacy route. The same release accepts access tokens and OAuth bearer credentials on REST requests only.
    • Securitywppilot/verify-rendered-page no longer follows redirects while carrying the caller's session, and get-page-view-link no longer mints a sign-in link itself; it names the critical create-admin-access-link instead.
    • FixedRollback no longer strips backslashes from builder data such as Elementor JSON, term, comment and menu rollbacks report verification, and capture pruning deletes only files GoBuildWP created.

    Source review recorded42e578eView release files

28. GoBuildWP Pro

    1.7.0

    21 September 2026Converts a page built in one page builder into a new draft built in another, through one builder-neutral document model, and ships 300 industry briefs.

    Requires GoBuildWP Free 1.13.0+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • NewBuilder-to-builder conversion. Four abilities - wppilot/list-convertible-documents, wppilot/convert-preview, wppilot/convert-document and wppilot/get-conversion-report - built on one neutral document model rather than a translator per pair. Converting N builders into N others pairwise is N squared translators, each with its own idea of what a column is; one model in the middle makes it one reader and one writer per builder, and puts every loss in one place.
    • NewTen readers and eleven writers: Elementor classic and atomic, WPBakery, Divi 5, Divi 4, Bricks, Beaver Builder, Oxygen, Breakdance, Etch, Flatsome UX Builder and the block editor. Divi 4 is readable and deliberately not writable - most Divi sites are still on its shortcodes, so reading them lets those sites leave, while writing them would convert somebody into a format on the way out.
    • NewNothing is lost quietly. Every element carries how it survived - carried exactly, approximated, reduced to markup, or not carried at all - and the model refuses to validate when an element is marked imperfect with no recorded reason. The report groups losses by the widget that caused them, so thirty-one vc_gmaps is one line rather than thirty-one. A conversion that would drop anything, or reduce more than a quarter of the page to markup, refuses until the call says it accepts that.
    • NewThe source page is never modified. A conversion is a judgement call with losses in it, and overwriting the page a business runs on - to discover afterwards which widgets did not survive - is not a trade anybody would take if asked. The result is a new draft, recorded in the change ledger, and rollback removes it.
    • New300 industry briefs across 18 sectors, on top of the ten the free plugin ships. Not three hundred landing pages: 152 build a whole multi-page site, 71 a booking site, 37 a store, 20 a course and 17 a membership site, which is the part free structurally cannot do. Every brief must carry a palette, a type pairing and a design signature no other brief uses, and the importer refuses the batch if any two collide.
    • ChangedMosaic is not supported and says so, with the reason, rather than looking forgotten. Its documents are templates, masters and components in its own tables addressed by a UUID, while the converter reads a post, writes a new draft and rolls that draft back through the ledger. wppilot/list-convertible-documents reports that under not_supported on a site where Mosaic is active.

    Source review recordedb35c8f1View release files

29. GoBuildWP Pro

    1.6.2

    12 September 2026WordPress 7.1 support: Pro identifies its own abilities from the registry, so a filtered registry stops attributing a Pro ability to somebody else.

    Requires GoBuildWP Free 1.10.0+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • FixedPro names its own abilities as the difference between the ability list before and after its integrations load. Since WordPress 7.1 that list runs the discovery filters on every call, so an ability another plugin hides is missing from both halves of the difference and is never recognised as Pro's - which is how a Pro ability ends up labelled as somebody else's on the Abilities screen. The comparison reads the registry now, through the free plugin where that read exists and falling back where it does not, so Pro still loads against an older free.
    • ChangedTested against WordPress 7.1. Everything else 7.1 changed for GoBuildWP is in the free plugin, which serves Pro's abilities: the safety profile is enforced on every caller rather than only on GoBuildWP's own transports, tool schemas are prepared for clients before they are advertised, and an ability registered with 7.1's channel-independent `public` flag is reachable over MCP. Pro 1.6.2 with free 1.12.0 is the pairing that has all of it.
    • ChangedRequires GoBuildWP (free) 1.10.0 or newer, unchanged. No ability was added, removed or renamed.

    Source review recorded97f3730View release files

30. GoBuildWP Free

    1.12.0

    12 September 2026WordPress 7.1 support: enforcement reads the registry rather than the filtered list, and the safety profile now binds every caller instead of only GoBuildWP's own transports.

    Requires WordPress 6.9+, PHP 8.0+

    • ChangedWordPress 7.1 changed what `wp_get_abilities()` answers: every call now runs the discovery filters, so it reports what a site publishes rather than what is registered. GoBuildWP read it in both senses. Discovery still calls it, because a site that filters its registry means the filtered list. The ability policy and the Abilities screen read `WP_Abilities_Registry` now, because an ability another plugin hid from discovery would otherwise keep its registration and stay executable through every path that does not go through discovery, while the screen reported it as switched off.
    • NewThe safety profile is enforced for every caller. `wp_ability_permission_result` runs inside `WP_Ability::execute()` and in the standalone permission checks the REST API and WP-CLI perform, so core REST, WP-CLI, the AI Client, another MCP adapter and GoBuildWP Chat all get the refusal MCP already gave. Until now the profile was enforced by unregistering what it refuses, which has to stand down on the Abilities screen so that screen can list disabled abilities. The filter only ever denies: a call something upstream already refused keeps that refusal.
    • NewAn ability registered with WordPress 7.1's channel-independent `public` flag is reachable over MCP. GoBuildWP's own `mcp.public` stays authoritative and an ability setting it to false stays hidden, but the fallback follows core's precedence - the channel's flag, then `public`, then false - so an ability written by someone who never heard of this plugin is served rather than ignored.
    • ChangedAdvertised tool schemas go through `wp_prepare_json_schema_for_client()` where it exists. Every ability on the site is exposed, not only GoBuildWP's, and a schema authored for WordPress carries a property-level `required: true` and the PHP-only `sanitize_callback`, `validate_callback` and `arg_options` keys, so a client validating arguments against the advertised schema dropped the field or refused the tool. Input validation is unchanged: the ability's own schema still decides what a call may send.
    • FixedThe change ledger records the risk of the ability that actually ran. Both execution hooks hand the `WP_Ability` to their callbacks now, so the ledger stops looking the name up after the write - a lookup that came back empty, and recorded a plain "write", when the ability being recorded had switched the safety profile or disabled something and the policy had unregistered rows mid-request.
    • ChangedThe compatibility block published to clients carries `tested_wordpress_version` and a `wordpress_capabilities` map, probed by asking for the function or class that implements each capability rather than by comparing version strings. Everything in this release is inert on WordPress 6.9 and 7.0; the minimum is still 6.9 and no ability was added, removed or renamed.

    Source review recorded359fcd0View release files

31. GoBuildWP Pro

    1.6.1

    5 September 2026The cache module loads on PHP 8.0 and 8.1 again, and the Pro prompt packs are retired ahead of industry briefs.

    Requires GoBuildWP Free 1.10.0+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • FixedThe Cache & Performance module did not load on PHP 8.0 or 8.1. Fourteen files declared a `true|WP_Error` return type, which PHP accepts only from 8.2, while the plugin header promises 8.0. The parse error was caught and recorded as an integration failure, so on those hosts every cache ability silently disappeared and nothing said why. The types are `bool|WP_Error` now and every file parses under 8.1.
    • ChangedThe Pro prompt packs are removed. The free plugin's library is now one complete landing-page brief per industry rather than packs of ability chains, and the old packs did not fit that shape. Pro's own industry briefs will arrive through the new filter.

    Source review recordedb541b76View release files

32. GoBuildWP Free

    1.11.0

    5 September 2026The prompt library becomes one complete landing-page brief per industry, and Dynamic Client Registration clients with a localhost callback can sign in again.

    Requires WordPress 6.9+, PHP 8.0+

    • NewTen landing-page briefs, one per industry: a bakery, a yoga studio, a dental clinic, a landscaper, a bookshop, a wedding photographer, a plumber, a family law firm, a pet groomer and a brewery taproom. Each fixes a flat palette, a type pairing, a design signature that makes its page unlike the other nine, the sections it must communicate and the facts to use verbatim, then closes with one shared standards block covering WCAG 2.1 AA, real photography, one icon set, builder-native construction and completeness.
    • ChangedThe earlier packs, organised by editor and by task and naming ability chains, are retired. They taught the agent which calls to make and nothing about what to build, so every business came back as the same centred hero with three cards under it. The Prompts screen gains a builder picker that writes Elementor or the block editor into the first line of every brief.
    • FixedAn OAuth client that registered through Dynamic Client Registration with a `localhost` callback, MCP Inspector among them, was refused with "redirect_uri not registered for this client" from 1.10.1 onward. That release normalises the callback the client sends onto the IPv4 literal, but a registered row keeps the spelling it was posted with, and the loopback comparison ignores the port while still comparing the host. The stored list is now normalised the same way when it is read, which also repairs rows registered before this fix.

    Source review recordedc1a21efView release files

33. GoBuildWP Pro

    1.6.0

    1 September 2026Cache and page speed as a specialization: twenty-six layers detected by name, cross-layer purging, purge-after-write, and a verification step that reads the page a browser would render.

    Requires GoBuildWP Free 1.10.0+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • NewPurge-after-write. GoBuildWP could rewrite a page and had no idea whether anyone would ever see the result: an agent edited a post, the row changed, the ability reported success, and the front end kept serving HTML built before the edit. Any write that names a post now purges that post across every cache layer present; anything site-shaped purges everything, and targets flush once on shutdown so a batch of twenty writes costs one purge.
    • NewTwenty-six caching layers detected by name, with one canonical settings vocabulary across the twelve that share meaning, so `js.defer` means the same thing on LiteSpeed as on WP Rocket. A canonical key a plugin has no equivalent for is reported as unsupported rather than silently dropped.
    • New`cache-verify-in-browser` names what an optimisation is most likely to have broken and hands back the exact browser checks that would prove it either way. It does not run a browser: a settings write reporting `applied: true` proves the option row changed, but it cannot see that the header logo is now a transparent placeholder, and neither can any server-side audit.
    • New`blocked_by_environment` reports what no WordPress setting can fix - an `.htaccess`-less LiteSpeed host that makes browser-cache headers and WebP delivery inert while both still read back as enabled, an edge not caching HTML, a missing object cache - with the ordered steps for whoever owns that panel. A limit reported without a next step only moves the dead end.
    • NewPageSpeed scores read from the report page in a browser rather than the API, because the keyless quota is shared globally and answers 429 for most of the day. Both form factors, with the capture timestamp, so a stored analysis is never mistaken for a fresh one.
    • ChangedIt never emits a Lighthouse-style score of its own, and says so: LCP, CLS and INP do not exist until a browser renders.

    Source review recordedeed2a41View release files

34. GoBuildWP Pro

    1.5.0

    31 August 2026The Elementor machine is read from the free plugin instead of copied, and generated content drops the property rather than the page.

    Requires GoBuildWP Free 1.10.0+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • ChangedThirty-five files removed and no behaviour with them. The Elementor runtime, schema extractor, tree and style helpers and atomic value layer ship in GoBuildWP 1.10.0, so Pro imports those symbols rather than keeping a second copy that would drift on any site running both. What stays is the authoring layer, which is what Pro was always for: fifty-one abilities, every name unchanged.
    • ChangedThe minimum free-plugin version rises to 1.10.0. An older free plugin beside this one is not a degraded install, it is a fatal on the first Elementor call, so refusing to load and saying why is the honest answer.
    • FixedGenerated content drops the property rather than the page. The validator already returns a usable tree, so refusing the whole document on top of that is a policy - right for hand-written content, wrong and expensive for generated content. One `alt` on an image took down a seventy-four element page. `build-from-spec` asks for the coerced tree and reports what was lost, naming the widget and the key; `strict: true` restores the old behaviour where it is wanted.
    • FixedThe prompt-pack gate walked only Pro's tree, so it reported every Elementor chain prompt as naming abilities nobody registers. It reads the sibling free checkout now.

    Source review recordedce107a8View release files

35. GoBuildWP Free

    1.10.2

    31 August 2026The third and last OAuth loopback gate: the token exchange now normalises the callback the same way the authorization endpoint does.

    Requires WordPress 6.9+, PHP 8.0+

    • FixedA native client that got through the authorization screen in 1.10.1 could still fail at the token exchange as a malformed request. The authorization endpoint normalises a `localhost` callback onto the IPv4 literal, so the issued code carries the normalised spelling while the client sends the token request with the spelling it started with, and the two are compared as exact strings. The token endpoint normalises the incoming `redirect_uri` the same way now, so both sides are in one form. A client that never used a loopback callback is unaffected.

    Source review recorded6859fbfView release files

36. GoBuildWP Free

    1.10.1

    31 August 2026OAuth sign-in works again for desktop MCP clients registering with loopback callbacks.

    Requires WordPress 6.9+, PHP 8.0+

    • FixedSign-in failed with "Unknown client_id" for any client whose Client ID Metadata Document declares loopback callbacks without an `application_type`. OpenID Connect defaults that field to `web`, a web client may never redirect to loopback, and so the whole document was refused - which is every desktop MCP client registering this way, Claude Code among them. A document whose redirect URIs are all loopback or private-use is now read as `native`; one declaring `web`, or mixing a remote HTTPS callback into the list, is refused exactly as before.
    • FixedAuthorization then stopped at "redirect_uri not registered for this client" when the callback was spelled `localhost`. RFC 8252 treats `localhost` and the IPv4 literal as the same loopback host; the comparison did not.

    Source review recorded9da4e2eView release files

37. GoBuildWP Free

    1.10.0

    31 August 2026Elementor editing is free. Sixteen abilities move out of Pro and into this plugin.

    Requires WordPress 6.9+, PHP 8.0+, Elementor 3.6+ for the Elementor abilities

    • NewSixteen Elementor abilities ship here now: read a document, discover the widgets and the seventy-three atomic style properties the install offers, inspect one widget's parameters, find elements, replace a document's tree, add, edit, move, duplicate, reorder and delete elements, and read and write page settings. They register when Elementor 3.6 or newer is active and stay absent otherwise.
    • ChangedWhy this and not more: the design system already shipped free - a direction, a type scale, the compositions a page may be built from, and the checks that grade the result - while the builder that could apply any of it did not. Pro keeps the authoring layer: composing a whole page from a description or a reproduction spec, templates and theme parts, display conditions, popups, forms, dynamic tags, interactions and global classes.

    Source review recordedd769706View release files

38. GoBuildWP Pro

    1.4.0

    30 August 2026Six craft rules join the design check, and a new memory type keeps what a composition on this site is actually made of.

    Requires GoBuildWP Free 1.0.0+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • NewSix craft rules join `wppilot/check-design`. The free pre-flight asks whether a page is wrong; a page can pass all of it and still look like nobody made a decision. These ask whether it is well made: `space-off-scale` and `radius-off-scale` for measurements that drifted off the declared ladder, `restraint-sizes`, `restraint-weights` and `restraint-colors` for what loud looks like when you count it, and `hierarchy-hue-dependent` for a palette whose reading order disappears when you strip the colour. They warn, never block: an off-ladder value is usually a mistake and sometimes the point.
    • NewA `composition` memory type: a block subtree in the design spec's own vocabulary - what a pricing tier, a hero or a testimonial set on this site is actually made of - kept per site rather than shipped as a library, so a second page starts from what the first one settled.
    • FixedAny image carrying alt text failed the entire build. `e-image` has four controls and the spec builder passed `alt` as a fifth, so tree validation rejected the whole document rather than the one element, and a seventy-four element page produced nothing but an error string.
    • FixedThe v3 style bridge invented controls a widget does not have, failing whole documents: typography sub-keys were derived from the group name, so `animated-headline` was sent a key it has never declared and a three-hundred-and-fifty element page was refused over one of them.
    • FixedA nested widget was built empty and replaced real content. `nested-tabs` keeps its panels in child elements, which a spec cannot supply, so it rendered as a tab strip with three empty panels and nothing reported a problem. Any widget declaring a `nested-elements-repeater` is left out with a note saying why.

    Source review recorded6c69c01View release files

39. GoBuildWP Free

    1.9.0

    30 August 2026A spec can describe a composition, not only a stack of full-width bands.

    Requires WordPress 6.9+, PHP 8.0+

    • NewFour layout grammars a spec can actually ask for: `bleed`, `layer`, `index-detail` and `overlap`. The vocabulary named these shapes from the start and `wppilot/list-layout-grammars` returned them, but nothing could request one, so every page this pipeline built came out as a stack of full-width bands - the one thing the module itself describes as what a stack of bands can never do.
    • ImprovedA design is derived from the site rather than chosen by a model, so a build starts from what the install already settled instead of inventing a third answer.

    Source review recorded3dc3363View release files

40. GoBuildWP Pro

    1.3.1

    28 August 2026A defect-only release. Two fixes, both to features that could not run at all: uninstall cleanup never executed, and three theme build-page skills were unreachable on exactly the sites they were written for.

    Requires GoBuildWP Free 1.1.0+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • FixedUninstalling Pro now runs its cleanup. The uninstall branch built its Freemius instance from namespaced constants defined in two files loaded further down the same file, so the lookups threw, the catch swallowed it, and the cleanup handler was never attached. Deleting the plugin left every wppilot_pro_* option, every memory and approval post - encrypted approval payloads included - and the approval cleanup cron event behind on the site.
    • FixedThe Blocksy, Neve and WoodMart build-page skills are reachable again. Each tested for an ability category named after its own theme, and no such category exists - all three are served by the theme bridge - so they were missing from the discover-abilities catalogue, the Skills screen and skill-get on precisely the sites they target.

    Source review recordedf13ab538cbfccd47197View release files

41. GoBuildWP Free

    1.8.1

    28 August 2026A defect-only release. Fifteen fixes, three of which took a documented feature out of service entirely, and two more that corrupted content silently on the way in. No new abilities, no schema changes, no permission changes.

    Requires WordPress 6.9+, PHP 8.0+

    • Fixedwppilot/reorder-menu-items destroyed the menu it was asked to reorder. WordPress merges its own defaults over whatever a menu-item write does not carry and rewrites the item, so a call carrying only a position blanked the label, cleared the link, reset the type to custom and flattened the nesting of every item it touched - and reported success.
    • FixedThe Chat screen rendered nothing. Its script was enqueued from a build manifest looked for one directory too deep, so the fallback declared no dependencies at all and the bundle threw on execution, leaving an empty page with no error anybody could see.
    • FixedA site-wide fatal was reachable through update-site-settings: any string was accepted as a timezone, and one PHP cannot resolve throws from inside current_time() and wp_date() - every request that formats a date, for everyone, until the option is repaired by hand.
    • FixedSkill and design bodies were corrupted on save. Escape processing meant for AI clients that JSON-encode their tool arguments twice ran on every submission, turning a Windows path into a tab and a regex into plain letters, including for content typed into wp-admin or read from an uploaded file. The rescue now runs only on a body carrying the signature it exists for.
    • FixedBackslashes were stripped from comments, skill bodies and design titles: WordPress unslashes what these functions are given, so unslashed data arrived one round of stripping short.
    • FixedA Block Editor batch that failed at commit became permanently stuck, because the retry staged byte-identical content and WordPress reports no-change as a failure.
    • Fixedset-featured-image and update-post reported a failure when the requested image was already the featured image - the one thing a retry could not do, on abilities that are idempotent by declaration.
    • FixedAlso: an uncaught fatal in edit-file on an empty old_string, a 500 on a Chat update with an empty body, a preview expiry rendered as already past, a new skill created as Disabled going live anyway, a missing post-type check on skill deletion, the absent Get Pro link on the Plugins page, and an OAuth walkthrough shown on sites where those routes are deliberately not served.

    Source review recorded5f36d89e751cbc7d678View release files

42. GoBuildWP Pro

    1.3.0

    27 August 2026Brand Kit: a design direction stops being a document and becomes tokens the site's own builders hold. Export and import W3C design tokens, write the palette, type scale, spacing and radii into seven design systems, and verify the result against the page a visitor gets.

    Requires GoBuildWP Free 1.8.0+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • NewBrand Kit exports the active design as a Design Tokens Community Group document - the W3C-backed format Figma, Tokens Studio, Style Dictionary and Penpot all read - and imports one back. Group-level types are inherited and aliases resolved, so a real Figma export arrives as colours rather than unresolved references. Types with no equivalent are reported as skipped rather than flattened into something plausible.
    • NewApplying writes the palette, the type stack, the type scale, the spacing tokens and the corner radii into the design systems installed on the site: block-theme global styles, Elementor, Bricks, Divi, Breakdance, Beaver Builder and Astra. Every builder write goes through that builder's own ability, so each keeps its validation and lands in the change ledger.
    • NewApplying is an upsert: a second apply updates what the first wrote rather than stacking a set beside it. Targets that cannot are labelled - Divi's global colours carry no name a token can match on, and the screen says so rather than leaving it to be discovered.
    • Newwppilot/brand-kit-from-palette turns a flat list of colours into a working design. A swatch list carries no roles and no contrast guarantee, so four colours pasted into a builder produce a page that uses all four equally or a button nobody can read. Lightness decides the ground and the ink, chroma decides the accent, and anything that cannot carry text is moved along its own hue until it can, with the original reported because it is still the brand in print.
    • Newwppilot/brand-kit-generate-from-brief derives a palette from a business description and a seed colour that clears WCAG by construction rather than by hope, reporting every ratio it achieved.
    • Newwppilot/brand-kit-verify-applied fetches a rendered page and compares the colours and faces in it against the active design. The finding worth the feature is the negative one: a design saved, activated, shown as active on every screen, and whose accent appears nowhere in the served page.
    • ChangedBrand Kit is no longer a separate menu item. Every section on it was about the active design, so it renders inside the Design screen under Apply to site and Tokens, and that screen now says whether the active design has been written to this site and when.
    • FixedEvery brand-kit target is checked against the schema of the ability it calls, without needing that builder installed - the class of bug that previously surfaced only on a customer's site. Also fixed: font stacks reaching builders unsplit, design tokens losing their line height on a round trip, and named arguments into Astra's and ACF's own functions.

    Source review recordeda36cd725b573ec241c0View release files

43. GoBuildWP Free

    1.8.0

    27 August 2026The design system stops being a document the agent reads and becomes something the site enforces, applies and can be checked against: read the direction a site already has, start from one of seven worked directions, and verify the page a visitor actually gets.

    Requires WordPress 6.9+, PHP 8.0+

    • Newwppilot/adopt-design-from-site reads the design a site already has - a block theme's global styles, the customizer, and whatever a builder module can contribute - and returns a DESIGN.md draft. On any site that is not brand new the brand already exists, and a fresh direction invented alongside it produces work that clashes with every page already there. The draft carries the adopted palette's contrast, because an inherited palette was never chosen by anyone and finding out it cannot carry body text is worth knowing before anybody builds on it.
    • Newwppilot/list-design-examples ships seven complete directions as real DESIGN.md files, spanning light and dark, serif and sans, dense and airy. They are reference rather than a menu: nothing applies one. The Design screen offers them as starter kits, shown as colour rather than as a list of hex values and each with a live specimen of its own headline, body text and button; choosing one copies it into your designs for editing and never activates it.
    • Newwppilot/verify-rendered-page fetches a published page and reports what the server really sent: heading order, images without alt text, empty elements, PHP notices that reached the markup, page weight, and the colours and faces present. It follows the page's own same-origin stylesheets, ranked so builder-generated CSS is read first - without that, a correctly styled Elementor page reported its design as absent.
    • Newwppilot/check-contrast computes WCAG ratios across the active palette, reports which surfaces can carry body text, and answers what to put on a given background using the design's own colours rather than defaulting to black or white.
    • NewA design can declare its type scale. Typography roles always accepted fontSize, lineHeight, letterSpacing and measure and nothing downstream looked, so a design could declare its sizes and every page still invented its own. The scale now reaches the preview and the CSS variables, and readiness warns when it is missing and separately when sizes are set without leading.
    • NewDesign direction is enforceable on the write path, under Off, Warn and record, or Refuse the write. A refusal names the offending value and the palette entry to use instead, chosen by the role the colour was playing rather than by raw numeric distance. Builder-agnostic: colours and fonts are read out of the write itself.
    • FixedUninstalling no longer deletes your designs and skills. Both are documents somebody wrote and neither can be regenerated from anything left behind, so removing them silently was the same decision as deleting a site's posts. They now go only when the site has explicitly opted in.
    • FixedThe design's own Don't rules no longer match inside longer words. A rule naming Inter flagged words such as interrogate, interest and internal, which an accounting or engineering site uses on nearly every page, each reported as a possible violation of a rule about a typeface.

    Source review recorded7c67c759a023e73c924View release files

44. GoBuildWP Free

    1.7.0

    25 August 2026Stock-image search over Openverse, WordPress.org's openly-licensed media search. No API key, no account, and every result carries the licence and a ready-made attribution string the agent is told to keep.

    Requires WordPress 6.9+, PHP 8.0+

    • Newwppilot/search-images searches Openverse with licence, licence-type, orientation, extension and source filters. Results carry the licence, the creator, and a ready-made attribution string, and the ability's own description tells the agent to carry it into the caption on import; attribution is a licence obligation for every CC licence except CC0 and the public domain mark, not a courtesy.
    • NewSearch and import stay separate abilities on purpose. Search is read-only and costs nothing; importing a chosen result is wppilot/import-media-url's job, so a failed import cannot be mistaken for a failed search.
    • NewThe per-page cap is 20 because that is what Openverse grants an anonymous caller: it silently clamps larger requests rather than reporting an error, so the schema caps where the API actually caps. Rate limiting is reported as exactly that, with an instruction to wait rather than retry.
    • NewWhat leaves the site: the search terms and filters, to api.openverse.org, only when the ability is called. Nothing about the site, its users, or its content. Disclosed in readme.txt under External services.

    Source review recorded1b61b5aef3076dec3faView release files

45. GoBuildWP Pro

    1.2.1

    24 August 2026WPML reads work on MCP and REST requests, translation-group linking is atomic, and Flatsome round trips are byte-exact. These are fixes found by exercising 1.2.0 against a real WPML install rather than the emulated hooks it was written against.

    Requires GoBuildWP Free 1.0.0+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • FixedWPML language reads over MCP. wpml_element_language_details wants the bare post type; the prefixed form the write hooks use fails quietly there and made every post read as having no language at all. And wpml_active_languages is documented for calls after the `wp` action, which REST and MCP requests never reach, so language discovery now reads SitePress's own catalogue on early requests.
    • FixedLinking a WPML translation group is atomic: every member write and its verification run inside one database transaction, begun only after the table's engine confirms support, and a failed member rolls the whole set back instead of leaving earlier posts linked to a half-built group. An occupied language slot is refused before anything is written.
    • FixedFlatsome round trips are byte-exact: whitespace between shortcodes is carried as content rather than normalized away, duplicate element ids are refused because the editor drops one of two elements sharing an id, and editing an option to an empty string removes it.
    • FixedPolylang translation sets normalize language keys before the uniqueness check, so two spellings of one language can no longer slip through as two entries.
    • SecurityThe approval queue re-checks the active safety profile at approval time, because policy can change while a request waits, and approving a held write is not permission to bypass the profile the site switched to since. Approval hooks also moved behind the free plugin's preview gate.

    Source review recordedsha256:ad0a8714c003View release files

46. GoBuildWP Free

    1.6.4

    24 August 2026Preview confidentiality and lifecycle races, menu partial updates and ownership, deep queue discovery, front-page settings validation, and Pro approval enforcement are fixed without widening permissions.

    Requires WordPress 6.9+, PHP 8.0+

    • SecurityPreview inputs are encrypted at rest, malformed or tampered payloads fail closed, stale applies can recover safely, and discard refuses to race a preview another request is applying.
    • FixedMenu item partial updates preserve omitted fields, and cross-menu moves or parents are refused.
    • FixedThe Block Editor Queue can claim an eligible batch beyond the first fifty records.
    • FixedFront-page settings reject invalid page combinations before writing and preview the settings that will change.
    • SecurityApproval hooks cover abilities added through the modern MCP transport, so Pro extensions receive the same preview and live safety checks as built-in abilities.
    • ChangedNo new abilities and no permission changes. Existing connections keep working and do not need re-authorising.

    Source review recordede70d031View release files

47. GoBuildWP Pro

    1.2.0

    24 August 2026Flatsome and WPML become supported integrations, five Mosaic abilities that were written but never registered are now reachable, and a new build gate catches skills that name abilities which do not exist - including a whole Spectra workflow written against a surface that never shipped.

    Requires GoBuildWP Free 1.0.0+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • NewFlatsome and UX Builder: 11 abilities for the shortcode tree, targeted element edits by path, the element catalogue and option schemas, the theme's own section presets, and reusable UX Blocks. Nesting aliases, responsive breakpoint attributes and the editor's element ids are handled for you, and a tree that nests one tag past the tenth level is refused rather than silently flattened.
    • NewWPML: 8 abilities for languages, translatable types, per-post language assignment, translation-group linking and cross-language id resolution. WPML keeps language in its own table, so content created by anything that does not know about WPML has no language at all and is invisible to the language switcher - these abilities report that state and fix it.
    • FixedMosaic's design-variable abilities are registered. Create, read, edit, delete and set-value were implemented, loaded, and named in the change emitter, but no registration call existed for any of them, so five working abilities were unreachable by every client.
    • FixedThe Spectra build-page and integration skills were written against Gutenberg block-CRUD abilities that have never existed, named 22 times including the canonical build sequence. Both are rewritten around the real content and queue abilities, which are not optional for Spectra content because its blocks serialize from their own editor JavaScript.
    • FixedFour live runtime strings named abilities agents cannot call: the JetEngine field-rename error pointed at `wppilot/run-php`, and the Avada FAQ and portfolio listings told the agent to call `wppilot/read-post`. Also corrected in the skills: `acf-edit-field-group`, `wp-run-php`, `wppilot/discover-abilities` and `elementor-list-elements`.
    • NewA build gate that fails when a skill, or an agent-facing string inside an ability, names an ability that does not exist. It checks 785 references across 67 skills and 1,434 more inside the abilities themselves. The prompt library has had this check for a while; skills had none, and three releases in a row shipped defects it would have caught.

    Source review recordedsha256:3b82604ea0ceView release files

48. GoBuildWP Free

    1.6.3

    23 August 2026A Block Editor Queue batch whose tab goes away is picked up and retried automatically, instead of staying marked as running until somebody cancels it.

    Requires WordPress 6.9+, PHP 8.0+

    • FixedA Block Editor Queue batch stayed marked as running when the tab working it was closed, navigated away from, or throttled in the background, and no other tab would take it - so the work had to be cancelled and queued again. It is retried automatically now. A batch another tab is actively working is still left alone.
    • ChangedNo new abilities and no permission changes. Existing connections keep working and do not need re-authorising.

    Source review recorded76df772View release files

49. GoBuildWP Pro

    1.1.3

    23 August 2026Pro refused to activate on a site without the free plugin, and suppressed the notice written to explain why. WordPress was resolving the dependency against a directory the free plugin has never been listed in.

    Requires GoBuildWP Free 1.0.0+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • FixedInstalling Pro without the free plugin was a dead end. The `Requires Plugins: wppilot` header made WordPress look the free plugin up on WordPress.org, where it has never been listed because it ships from GitHub and gobuildwp.com, so activation was blocked outright with no install link, no download link, and no way to satisfy the requirement.
    • FixedThat block also hid the fix: a plugin that never activates never runs, so the admin notice naming the free plugin could not appear on precisely the sites that needed it. The requirement is now enforced inside Pro, ahead of the Freemius SDK and every ability, and the notice carries a direct download button.
    • FixedThe dependency notice never appeared on an unlicensed install, because it was registered below the licence gate. A fresh purchase - Pro installed, no licence, no free plugin - was told only that Pro was unlicensed, never that a second plugin was missing.
    • FixedThe free plugin is detected from the active-plugin list rather than from a constant. WordPress makes no promise about the order two plugin files load in, so a constant defined by free is not a safe test at plugin-load time.

    Source review recorded3a02357ec6f73f8c7d2View release files

50. GoBuildWP Free

    1.6.2

    23 August 2026Four fixes. Agent-built pages keep the settings their blocks assign in the editor, a queue batch no longer stalls on a malformed request, revoking a connection frees its slot at once, and a directory listing survives a folder it cannot read.

    Requires WordPress 6.9+, PHP 8.0+

    • FixedBlocks from libraries that assign part of their own settings in the editor - Spectra among them - were saved without those settings, so an agent-built page could render unstyled while the queue reported success. Blocks now pass through the block editor before they are saved.
    • FixedA Block Editor Queue batch stalled when a request reached it without a readable body, part-way through an item it had already claimed. The request is refused now, and says what to send.
    • FixedRevoking a connection did not free its connection slot. A site allows fifty at once, so an administrator could make room and still be told the site was full.
    • FixedA recursive directory listing came back empty when one folder could not be read. Unreadable entries are skipped and the rest of the listing is returned.
    • ChangedNo new abilities and no permission changes. Existing connections keep working and do not need re-authorising.

    Source review recorded564dbe4View release files

51. GoBuildWP Free

    1.6.1

    22 August 2026Anonymous usage reporting is now off until you switch it on, and the notice 1.6.0 put on your dashboard is gone. A feature that only runs when asked for has nothing to disclose on activation.

    Requires WordPress 6.9+, PHP 8.0+

    • ChangedAnonymous usage reporting is opt-in. Nothing is sent until an administrator turns it on under GoBuildWP → Settings, and the first-run notice is removed - with reporting off by default there is nothing to disclose on activation and nothing to dismiss.
    • ChangedA choice already made is not overruled. Sites that pressed Keep it on keep reporting; sites that turned it off stay off. Every other site, including one that dismissed the notice without answering, stops reporting on update, and its daily scheduled event is cleared rather than left running for a feature that is off.
    • FixedUninstalling now removes the reporting switch, the installation identifier and the daily scheduled event. None of them were listed for cleanup before, so an uninstall left them in the database.
    • ChangedNo new abilities and no permission changes. Existing connections keep working and do not need re-authorising.

    Source review recorded56a689cView release files

52. GoBuildWP Free

    1.6.0

    20 August 2026Optional anonymous usage reporting, so decisions about which WordPress and PHP versions to keep supporting stop being guesswork. A notice explains what is sent the first time you open wp-admin, and one click turns it off.

    Requires WordPress 6.9+, PHP 8.0+

    • NewOptional anonymous usage reporting. It records which GoBuildWP, WordPress and PHP versions are actually in use, so compatibility decisions are made from evidence rather than assumption. It never sends usernames, email addresses, page or post content, or any record of what an agent did.
    • NewA notice explains what is sent the first time an administrator opens wp-admin, and there is a switch under GoBuildWP → Settings. Turning it off also asks us to delete what was already collected.
    • ChangedNo new abilities and no permission changes. Existing connections keep working and do not need re-authorising.

    Source review recordedd3aad94View release files

53. GoBuildWP Free

    1.5.1

    20 August 2026Three defects, one theme: GoBuildWP was unusable from any AI client that checks its calls against the schemas the server hands it - Claude among them. The tool list was rejected outright, abilities that take no input refused every call, and destructive tools asked for a confirmation the client had no way to send. A more forgiving client saw none of it.

    Requires WordPress 6.9+, PHP 8.0+

    • FixedThe tool list was rejected outright. An ability that takes no input reached the client with its properties encoded as a JSON array where a JSON object is required, and the API rejects the whole payload for one such schema - so a single ability broke every tool on the connection rather than its own. Nested schemas are corrected too, and so are responses leaving the bundled MCP adapter.
    • FixedAbilities that take no input refused every call with "input is not of type object". 1.5.0 fixed the client sending an empty object; this is the same argument from the other side, where the server sent nothing at all. Passing null is right only for an ability that declares no schema, so whichever single answer the transport picked, half the no-argument tools broke. It now asks the ability.
    • FixedDestructive tools demanded a confirmation they never advertised. confirm is a control field of the transport rather than ability input, so it appeared in no schema - and abilities forbid undeclared fields, so a validating client dropped it before sending. The refusal then repeated identically however many times the AI retried, with no way to comply. It is now declared, and required, on the 44 tools that are gated.
    • ChangedNo new abilities and no permission changes. Existing connections keep working and do not need re-authorising.

    Source review recorded159a8fcView release files

54. GoBuildWP Free

    1.5.0

    19 August 2026Preview before write. GoBuildWP could already undo a change; this is the first release where it can show you one first - field by field, before anything is written, with a screen in wp-admin where you apply it or throw it away.

    Requires WordPress 6.9+, PHP 8.0+

    • NewPreview before write. wppilot/preview-ability returns a field-by-field diff of what a write would do, plus a link you open in wp-admin; wppilot/apply-preview performs it once you agree. Nothing is written in between. Rollback helps once damage is visible; this stops it.
    • NewThe diff is computed rather than performed, so the site is never touched to produce one - not inside a transaction, not on a copy. Executing and rolling back was rejected for a concrete reason: WordPress re-primes the object cache from the uncommitted row, so a rollback would restore the database and leave the cache serving the previewed content.
    • NewA Preview screen lists what an agent has proposed but not made, naming the AI client and the WordPress user behind each one. Several AI clients usually connect as the same administrator, so the user alone cannot tell you who proposed a change.
    • SecurityApplying re-checks that the target has not moved, scoped to the fields you actually reviewed. A change to those refuses and writes nothing; a change elsewhere is reported as a warning and the write proceeds. Applying also re-runs the safety profile check and the ability's own confirmation requirement, so it is not a route around either.
    • NewA preview never invents a diff. An ability GoBuildWP cannot model is refused by name with a reason, and a call that would be rejected anyway is reported as such rather than shown as a change that was never going to land.
    • NewOptional Settings toggle, off by default and never enabled by an upgrade: require a reviewed preview before agent writes over MCP and REST. Abilities that cannot be previewed are exempt rather than blocked.
    • FixedImporting media from a URL could never run. The ability required three WordPress core files before downloading and one was named for the plugin rather than for core - a rebrand rename of a core path - so every call failed on that line before the download started.
    • FixedAbilities that take no input rejected the call that says so. Sending an empty object, which is what AI clients send rather than omitting the field, returned an error while omitting it succeeded. Six abilities were affected, including the site settings read and all three diagnostics reports.

    Source review recordeda801f44View release files

55. GoBuildWP Free

    1.4.1

    19 August 2026Three defects, two of which let an agent report success for a change nobody could see. Writing page content to an Elementor, Bricks or Beaver Builder page used to succeed and change nothing visible. Recommended for everyone, and required if you also run GoBuildWP Pro.

    Requires WordPress 6.9+, PHP 8.0+

    • FixedWriting page content to a page built with Elementor, Bricks or Beaver Builder is refused instead of silently doing nothing. Those three keep their element tree in postmeta and render that, and they leave post_content looking like ordinary content, so the existing guard - which can only recognise proprietary markup - never saw them. The write was stored, returned as successful with no warnings, and changed nothing a visitor could see; the builder then overwrote it from its own tree at the next save.
    • ImprovedThe refusal names the builder and, when it is installed, the ability that owns that builder's content. post_content is not dead weight - it feeds RSS and search - so allow_raw_content_on_builder_post still performs the write and returns an audit note recording that the rendered page did not change.
    • FixedThe refusal for hand-written builder storage meta no longer points at an ability that is not installed. On a site without Pro it now says to edit in the builder instead, which is what the content refusal has always done.
    • FixedThe plugin version constant read 1.3.0 for the whole of the 1.4.0 release while the plugin header read 1.4.0. That constant is what the update check advertises, what admin assets are cache-busted against, and what Pro compares when deciding which features the free plugin owns.
    • FixedWordPress-core abilities were being served by GoBuildWP Pro's older copies. Registration order follows plugin load order, which follows activation order rather than the alphabet, so on any site where Pro had been activated first its copies won and every fix shipped to those abilities since 1.1.0 was inert there. Update Pro to 1.1.2 alongside this release to complete the fix.
    • ChangedNo new abilities and no permission changes. Existing connections keep working and do not need re-authorising.

    Source review recorded1be92a6View release files

56. GoBuildWP Pro

    1.1.2

    16 August 2026Nine Elementor abilities, one of which had been written, loaded and unreachable since the day it shipped. Agents can now insert, move, duplicate, reorder and search elements, save and apply templates, reach the Theme Builder, and build a whole page in one call.

    Requires GoBuildWP Free 1.0.0+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • FixedThe add-element ability now exists. Its implementation - widgets, containers, v4 atomic containers, whole subtrees, with id generation and style handling - had been complete and loaded since it was written, and was never registered, so no AI client could call any of it. Two shipped tool descriptions told agents to use it by name.
    • NewMove, duplicate and reorder elements. Each was previously a read-modify-write loop the agent had to run itself against the whole document. Duplication regenerates every id in the copy, because two elements sharing an id is not an error Elementor reports - it is a page where styles apply to both and the editor drops one on the next save.
    • NewFind elements by widget type, element type, a settings value or free text. This is how "every button on the page" becomes a short list of ids instead of the whole document.
    • NewTemplate abilities that reach the Theme Builder for the first time. Headers, footers, archives and single templates are library posts rather than pages, so nothing that took a post id could previously find one. Save a page or a section as a template and apply it anywhere; copies get fresh ids, so a template can be applied to the page it was cut from.
    • NewBuild a complete page from one nested description, validated and written in a single call rather than a dozen inserts.
    • FixedElementor Pro's rendered-element cache is now cleared by every write. Elementor checks it before applying render filters, so a change could rebuild the CSS and still serve the old markup - and clearing it was a separate call an agent had to remember after every edit.

    Source review recordedsha256:b4152c13775cView release files

57. GoBuildWP Pro

    1.1.1

    16 August 2026Every admin link Pro built pointed at a file that does not exist, so nine screens answered 404 - and behind them, Sync licence and Deactivate licence answered 403, which meant a customer could neither pick up a renewal nor free a seat.

    Requires GoBuildWP Free 1.0.0+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • FixedEvery admin URL Pro built pointed at wppilot-admin.php, which exists nowhere: the free plugin registers its menu through add_menu_page(), so its screens are served from admin.php. Nine call sites answered 404 - the redirect on activation, the redirect after a licence is accepted, the "not licensed" notice's own link, the Licence and Upgrade screens, the Approvals screen, the links inside approval notification emails, and the Memory screen's paging and filter links.
    • FixedThe activation screen answered 403 once a licence was valid. Freemius redirects there after accepting a key, and the guard meant to catch that ran too late to matter. It now runs on the action WordPress fires immediately before refusing the page.
    • FixedSync licence and Deactivate licence both answered 403, so a customer could neither pick up a renewal nor free a seat. Removing the account screen from the menu had also removed the parent WordPress resolves a plugin page against, which took Freemius' own handler with it.
    • ChangedNo change to abilities, gates, or the licence gate itself. An unlicensed Pro still registers nothing.

    Source review recordedsha256:f0aa756ac07eView release files

58. GoBuildWP Free

    1.4.0

    16 August 2026A large release, all of it about getting connected. Access tokens are a third way in for callers that have no browser, web apps get their own route with real walkthroughs, seven clients are new, and every method now also hands you a prompt for your AI coder.

    Requires WordPress 6.9+, PHP 8.0+

    • NewAccess tokens: a long-lived bearer token for callers that cannot sign in through a browser, such as the Claude Messages API MCP connector, the OpenAI Responses API, cron jobs and automation platforms. Neither existing method reaches those, since OAuth needs a browser sign-in and several of those callers cannot send HTTP Basic at all.
    • SecurityA token is 256 bits from the CSPRNG, shown once, and stored only as a SHA-256 digest, so a database dump yields no working credential. It carries an optional expiry, is revocable on its own, and is deleted with its owner.
    • SecurityA token has exactly the access of the account that created it, re-checked on every request rather than frozen at creation, so demoting or deleting that account closes the token in the same moment.
    • NewWeb apps have their own route on the Connect screen, with walkthroughs for Claude on the web, ChatGPT, Perplexity, Mistral Le Chat and Manus. Three of the five can take an access token instead of a sign-in; the other two say why they cannot.
    • NewSeven new clients: Kimi Code CLI, Qwen Code, Gemini CLI, ZCode (GLM), Mistral Le Chat, Perplexity and ChatGPT. GoBuildWP now generates configuration for 27 clients.
    • NewEvery connection method offers its setup as a copy-paste prompt for an AI coding agent, carrying the server name, the URL, the exact snippet, the file it belongs in, a verification step, and the quirks that would otherwise have an agent "fix" a working connection into a broken one.
    • ImprovedClient instructions were rewritten against current interfaces, several of which had moved: ChatGPT's developer mode is now under Settings, Apps, Advanced settings, and Claude's connectors under Customize rather than Settings. Both now also say to switch the connector on in the chat, which is off by default.
    • ImprovedQwen Code and Gemini CLI name a remote server's URL httpUrl rather than url. A snippet carrying url parses there and then connects to nothing, so both get their own generated shape.
    • ChangedThe Connect screen leads with the setup rather than the status panels, and opens on a method rather than on nothing. Enable AI Abilities stays last.
    • ChangedNo new abilities and no permission changes. OAuth and application passwords are unchanged, and existing connections keep working.

    Source review recordedaef5f49View release files

59. GoBuildWP Free

    1.3.0

    15 August 2026Restoring a revision had been fatal since 1.1.0, and the change ledger could not tell three agents connecting as the same administrator apart. Both are fixed.

    Requires WordPress 6.9+, PHP 8.0+

    • FixedRestoring a revision could not run at all on 1.1.0 through 1.2.1. Every call failed with a fatal error before the post was touched. Nothing else was affected, and no other ability shared the fault.
    • FixedThe same ability reported success when the restore had not written anything. A revision with no restorable fields, or a write WordPress refused, both came back as though the post had been rolled back. Failure is now reported as failure.
    • NewThe change ledger now names the agent behind each write, not only the WordPress user. Claude Code, Cursor and Codex usually connect as the same administrator, so entries could not say which of them made a change. Each entry now carries the OAuth client or application password used, and the client name and version it introduced itself with.
    • ChangedChanges made outside an AI client, in wp-admin, over WP-CLI, or by another plugin, are recorded as direct rather than attributed to the last agent that connected.
    • SecurityOAuth client identifiers are stored hashed in the ledger rather than in the clear.
    • ChangedAbility count is unchanged at 103. No permission changes, and existing connections keep working.

    Source review recorded4e297ddView release files

60. GoBuildWP Free

    1.2.1

    14 August 2026A patch for extension search. The themes directory answers with different types than the plugins directory, which 1.2.0 read as if both were identical.

    Requires WordPress 6.9+, PHP 8.0+

    • FixedExtension search against the themes directory returns the author as a profile record where the plugins directory returns a link, so every theme search raised an "Array to string conversion" warning and reported the author as the literal word "Array".
    • FixedAn extension that declares no minimum WordPress version reports it as false rather than as text, which was rendered as "1" or as an empty string. It now reads as no requirement.
    • FixedTheme results report a download count where plugin results report active installs, so theme popularity came back as zero. Both are read now.

    Source review recordedcab19c9View release files

61. GoBuildWP Pro

    1.1.0

    14 August 2026The prompt library was rebuilt around named ability chains, so a prompt states which abilities to call and in what order rather than describing an outcome and leaving the agent to find its own route.

    Requires GoBuildWP Free 1.0.0+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • NewSixty-nine ability chains across twenty-three builder, theme and block-library packs. Each names the abilities that module actually registers, in call order, starting with the setup check and the design-system inventory.
    • ChangedChain coverage follows what each module can really do. A module that cannot compose a page does not get a build chain, and says so instead.
    • ImprovedIndustry prompts no longer share one long brief with the sector name substituted in. Each is built from that sector's own recommended pages, evidence expectations, permitted structured-data types and claim guardrails.
    • FixedThe pack verifier fails the build when a prompt names an ability that no module registers, or one belonging to a different builder, and when two industries share more than sixty percent of the same prompt.

    Source review recordedsha256:924563e21d9dView release files

62. GoBuildWP Free

    1.2.0

    14 August 2026Agents could see what was installed and change none of it. The plugin and theme lifecycle closes that, with install and delete held behind Developer Full Access.

    Requires WordPress 6.9+, PHP 8.0+

    • NewPlugin and theme lifecycle: search the WordPress.org directory, read a plugin or theme in detail, activate, deactivate, update, switch themes, install and delete. Eleven abilities, taking the free count to 103 from 92.
    • ChangedInstall and delete fetch and write executable code, the same class of operation as running PHP, so they are classified critical: blocked under Production Safe and Read Only, available under Developer Full Access with explicit confirmation.
    • ChangedActivation, deactivation and theme switches write no files, and an update only replaces an installed plugin or theme with its published release, so all four stay available on a live site; each one can still take a site down, so all four require explicit confirmation.
    • FixedThe destructive classifier matches specific lifecycle names rather than bare update- or activate- prefixes, so update-post, update-media, update-term, update-menu, update-site-settings and activate-design are not dragged into the confirmation path.
    • ImprovedDISALLOW_FILE_MODS is honoured before any file operation begins, so a site that has opted out of code changes gets a named refusal instead of a partial install.
    • ImprovedDirect filesystem access is checked up front. GoBuildWP runs headless, where WordPress has no screen to render an FTP credentials form on, so any other method is refused by name rather than stalling half-written.
    • SecurityGoBuildWP and GoBuildWP Pro cannot be deactivated or deleted through these abilities. Doing so mid-call severs the connection carrying the call and, on a remote site, removes the way back in.

    Source review recorded8d408d1View release files

63. GoBuildWP Free

    1.1.0

    12 August 2026The WordPress core surface moved into the free plugin, and MCP 2026-07-28 is served alongside the older revision.

    Requires WordPress 6.9+, PHP 8.0+

    • NewContent, taxonomies, media, comments, revisions, menus, privacy-minimized user reads and an allowlisted settings surface now ship in the free plugin. 92 abilities, up from 42, with no licence or Pro install involved.
    • NewMCP revision 2026-07-28 is served alongside 2025-11-25. Existing clients are unaffected and do not need to reconnect.
    • ChangedNew content is created as a draft unless publication is requested explicitly.
    • ChangedClient ID Metadata Documents are now the preferred OAuth registration mechanism, with Dynamic Client Registration kept as a fallback.
    • ImprovedCapabilities come from each post type's and taxonomy's own capability object, and publishing is checked separately from editing.
    • SecurityContent create, update and delete previously ran on a single administrator check and ignored post-type capabilities and post ownership. Both are now enforced.
    • SecurityMenu item URLs are validated before storage, so a javascript: or data: URL is no longer stored verbatim.
    • SecurityUser reads no longer return email addresses by default.

    Source review recorded50ff044View release files

64. GoBuildWP Pro

    1.0.0

    8 August 2026First source-verified Pro release with isolated plugin integrations, specialist skills, persistent memory, and a human approval workflow.

    Requires GoBuildWP Free 1.0.0+, WordPress 6.9+, PHP 8.0+, active Pro licence

    • NewVerified integration modules for WooCommerce, Elementor and other page builders, forms, SEO plugins, custom fields, themes, multilingual sites, events, memberships, learning, and communities.
    • NewPersistent agent memory, site instructions, plugin-aware skill packs, and integration health reporting.
    • NewA human approval queue that can hold writes for review before execution.
    • NewIsolated integration loading so one incompatible integration cannot stop unrelated abilities from registering.

    Source review recordedsha256:90ddf5287445View release files

65. GoBuildWP Free

    1.0.0

    8 August 2026First source-verified release of the WordPress-native MCP foundation and server-side control layer.

    Requires WordPress 6.9+, PHP 8.0+

    • NewMCP server built on WordPress-native abilities with compact discovery, definition, and execution tools.
    • NewServer-side safety profiles, per-ability controls, confirmation, rate limiting, and redacted change evidence.
    • NewClient-specific connection paths with supported OAuth or Application Password configurations.

    Source review recorded978abfcf9c6dView release files

Releases before 1.0.0 were internal and are not part of the public history.