PressBot is now on WordPress.org. Get it free →

Security

How PressBot keeps your site and your AI keys safe

PressBot connects an AI to your WordPress site, so it has to earn trust. This page lists what we do, what is free and what is Pro, what is still coming, and what no plugin can protect. If a claim is not on this page, we are not making it.

Your AI keys

PressBot is bring-your-own-key. The key is the most sensitive thing it holds, so it gets the most care.

  • You pay your provider directly

    Bring your own key: you pay your AI provider directly. Today PressBot never resells or proxies your usage.

  • Encrypted, one key per secret

    Keys are stored with modern authenticated encryption (XChaCha20-Poly1305 via libsodium), each with its own derived key, locked with your site’s wp-config.php security keys. A copy of the database alone doesn’t reveal them. (since 1.20.11)

  • Never shown again

    After saving, a key is never shown again, only its start and end. PressBot hides its own keys from everything it sends: admin screens, AI apps connected over MCP, Telegram messages, error messages and logs.

  • Tested on every release

    Every release runs an automated test that plants a fake key and blocks the release if it appears anywhere in PressBot’s output.

  • Keep keys out of the database

    You can keep keys out of the database entirely with wp-config.php constants, for example PRESSBOT_ANTHROPIC_API_KEY.

Key Relay New in 1.21

Keep your Claude key out of WordPress entirely. The key lives in a small relay in your own Cloudflare account (the free plan is enough), and your site only holds a limited, revocable token: locked to your server, limited to the models you allow, and rate-limited. If your site is ever compromised, an attacker gets that token, not your key. We run pressbot.io this way. Set it up in Connections; the relay is open source on GitHub.

Our advice, whatever you use

Set a monthly spend cap with your AI provider, and use one key per site. If a key ever leaks, the damage is then limited and you know which site it came from.

An agent that asks before it actsPro

The admin agent can change your site, so it is built to show you the change first.

  • Review before changes run

    The admin agent shows a review card before changes run, and most changes can be undone.

  • Only what the user could do

    Agent actions respect WordPress capabilities. An agent can only do what the logged-in user could.

  • Approvals from your phone

    Telegram approvals for actions requested from your phone.

  • AI apps over MCP

    AI apps (Claude, ChatGPT, Cursor and others) connect over MCP with OAuth or WordPress application passwords. OAuth tokens are stored only as hashes. The free version’s MCP tools are read-only.

A visitor chatbot that can’t touch your site

The chatbot your visitors talk to has no write access to anything.

  • Read-only

    The visitor chatbot is read-only: it answers from your published pages and knowledge notes and cannot create, edit or delete anything.

  • Stays on topic

    Focus Mode (on by default) keeps it on topic so visitors can’t use it as a free general AI on your key. Rate limits and an optional monthly budget cap add more limits.

  • Safe with page caching

    It works on cached pages without exposing admin sessions.

Your WordPress site

Free unless marked.

  • Site Check

    Site Check looks for the traces a hacked site usually leaves: unexplained admins, modified core and plugin files, PHP files in uploads, odd scheduled tasks. It checks whether your PHP version still gets security fixes and whether the server is behind on a security release, and it shows where admin usernames are public.

  • Close common doors

    Hide usernames, turn off XML-RPC, and change your admin username safely.

  • PressBot Shield Pro

    AI-assisted login protection with lockouts and smart Telegram alerts. See Shield.

How we build and ship

Process claims you can check.

What no plugin can protect

If an attacker can run code on your server, they can read anything your site can. That is true of every WordPress plugin, including this one. It is why we recommend provider spend caps and built Key Relay, so the Claude key doesn't have to be on your server at all. Keep WordPress, plugins and PHP updated.

Report a vulnerability

Use the contact form and say it is a security report. We will reply, and we will credit you if you would like. Our security.txt is at /.well-known/security.txt.