GoBuildWP Cloud Safety Policies for Many WordPress Sites

What a policy sets

A policy has a name and four parts, and any part can be left alone. Safety profile: leave each site's own, Production Safe or Read Only. Approvals: leave each site's own, the AI confirms risky calls itself, or a person approves risky calls in wp-admin.

Switch these abilities off: tick from a list that covers running PHP code, WP-CLI commands, database queries, editing and deleting files, installing and deleting plugins and themes, switching the theme, creating users, creating admin login links, and search and replace across the database, or add any other ability name, one per line. Always ask for confirmation: updating a plugin or theme, activating or deactivating a plugin, deleting posts and pages, deleting media, plus any names you add.

Developer Full Access is not on the list. Cloud can never set it on a site; only the site's own wp-admin can.

Let Cloud manage a site's safety settings

This part happens on each site, in wp-admin, by an administrator who can manage GoBuildWP. Open GoBuildWP, then Connect, then the GoBuildWP Cloud panel, and find Safety settings from GoBuildWP Cloud. There are two boxes: GoBuildWP Cloud may make these settings stricter, and below it, and may also loosen them (never above Production Safe). Tick what you agree to and select Save.

Both boxes are off by default. Loosening can only be allowed together with tightening. Both are cleared when the site disconnects from Cloud, and no Cloud call or token can tick them. Once a policy has been applied, the panel names it and the time it was last applied.

• Signed in as an administrator who manages GoBuildWP
• Stricter ticked
• Loosen ticked only if you mean it
• Saved

Tighten only, or also loosen

Tightening means Read Only instead of a more permissive profile, a person approving instead of the AI confirming, switching an ability off, or adding a confirmation. Loosening is the reverse, and also includes lifting a block that the previous Cloud policy set and the new version no longer lists.

A site applies a policy whole or not at all. If a push would loosen anything and the owner only allowed tightening, the site refuses the entire policy, changes nothing and names each setting that would have loosened. The push's run page shows that refusal against the site.

Create, assign and push a policy (Pro)

Safety policies needs a GoBuildWP Pro licence linked to the Cloud account; without one the screen shows New policy locked. With Pro, fill in New policy and select Create policy. On the policy's page, tick the sites it is for and select Save sites; a site can have one policy. Then select Push to apply it on every assigned site. Cloud opens the run with each site's result.

Each assigned site carries a status: In sync, Differs, push to apply, Owner hasn't allowed Cloud to manage it, or Needs GoBuildWP 1.18.0+. Editing a policy saves it in Cloud only; sites get the change at the next push. Deleting a policy leaves sites with the settings it applied; they stop being managed by it.

When the owner changes something in wp-admin

Ability rules belong to whoever changed them last on the site. If the owner switches an ability off, or changes a block or confirmation the policy set, that rule becomes the owner's, and Cloud never lifts a block it did not set itself. GoBuildWP's own discovery tools, which every connection needs to list abilities, are never switched off by a policy.

The safety profile and approval mode work differently: the next push sets them to the policy's values again, and the panel in wp-admin warns that changes made there may be replaced. To keep a different profile on one site, take that site off the policy in Cloud, or untick the opt-in on the site.