AI for a WordPress site: theme, plugin and edits with an AI agent

A neural network for building a WordPress site is useful not where ad headlines promise. It will not assemble an entire site "with one button", but it helps edit theme templates, write small plugins, migrate markup and make sense of someone else's code. Work through an agent that sees the project files and runs checks, and never on the live site. Below is a process you can repeat in one evening.

What to give the agent and what to keep for yourself

Good WordPress tasks for an agent:

• extend theme files: single.php, archive.php, template parts, functions.php;
• write a small plugin: a shortcode, widget, metabox, REST route;
• enqueue styles and scripts correctly with wp_enqueue_style and wp_enqueue_script;
• work out why you get a white screen or a fatal error, if you have the log;
• bring code up to WordPress standards and add escaping.

Keep for yourself: choosing a theme and plugins for the job, content, backups and hosting access, core updates on the live site. The agent is a developer's tool, not a hosting administrator.

Step 1. A local copy of the site

Rule one: the agent gets no access to the production server. Set up a local copy of the site with Docker, a local WordPress environment you like, or a password-protected staging subdomain. Export the theme and plugin files, and the database only if needed and without customers' personal data.

Then put the theme or plugin in git. Without a repository you will not see what exactly the agent changed and cannot roll back quickly.

cd wp-content/themes/my-theme
git init && git add . && git commit -m "baseline"

Step 2. Connect the agent

Claude Code fits code work: it reads files, edits them and runs commands in the project terminal. Detailed setup is in the Claude Code documentation↗. In short, three environment variables:

export ANTHROPIC_BASE_URL=https://api.zukko.pro
export ANTHROPIC_AUTH_TOKEN=fetch_your_key
export ANTHROPIC_MODEL=claude-sonnet-5-5
cd wp-content/themes/my-theme
claude

Note that the address has no /v1 here, because Claude Code appends the path itself. Create the key in the dashboard↗. It is better to make a separate key for this project with a daily dollar limit and a list of allowed models: if the agent loops, you lose no more than the limit.

Step 3. Give the agent WordPress rules

It is easier for an agent to follow rules when they are written in a project file. In Claude Code that is CLAUDE.md at the root of the theme or plugin; how to write it is explained in the article on CLAUDE.md↗. An example for WordPress:

Project rules:
- This is a WordPress child theme. Do not touch the parent theme.
- Function and hook prefix: mytheme_
- Escape all output: esc_html, esc_attr, esc_url, wp_kses_post.
- Data from $_POST and $_GET goes through sanitize_* and a nonce check.
- Scripts and styles are enqueued only via wp_enqueue_*.
- Do not edit wp-config.php and do not put keys into project files.
- Before finishing, run php -l on changed files.

These rules target common problems of generated code: unescaped output, raw <script> in templates and function name clashes.

Step 4. A sample task: a shortcode in a plugin

A typical request: "make a plugin with a [price_table] shortcode that prints a table from an array in settings". The agent creates a plugin file roughly like this:

<?php
/**
 * Plugin Name: Price Table
 * Description: Shortcode [price_table].
 * Version: 0.1.0
 */

defined( 'ABSPATH' ) || exit;

function pt_render_table( $atts ) {
    $atts = shortcode_atts( array( 'limit' => 5 ), $atts, 'price_table' );
    $rows = get_option( 'pt_rows', array() );
    $rows = array_slice( (array) $rows, 0, (int) $atts['limit'] );

What to check by eye in such code: is there an ABSPATH guard, is every printed value escaped, are there database queries inside a loop. If the plugin needs to call a neural network API, the key must not be written into the plugin file. The usual approach is to define a constant in wp-config.php on the server and read it with defined(). A detailed plugin example with a generation button in the editor is in the article on text generation in WordPress via API↗.

Step 5. Checking the changes

Do not trust the agent's "done". A minimal set of checks:

1. php -l file.php for each changed file: syntax.
2. git diff: review all edits line by line. Look for files you did not ask it to touch.
3. A check on the local site: enable WP_DEBUG and watch the log for warnings.
4. If you use PHP_CodeSniffer with the WordPress standard, run it: it finds missing escaping. Check exact commands and the ruleset name in the tool's documentation.
5. A manual run of scenarios: the form, the shortcode on a page, mobile behaviour.

Only then move the changes to the live site, after taking a backup.

What it costs

Calculated for 18 October 2026, claude-sonnet-5-5 prices: input $0.4, output $2, cache read $0.05, cache write $0.5 per 1M tokens. Assumptions for the example: a theme-editing session of about ten steps, fresh input 120,000 tokens, cache read 480,000, cache write 60,000, output 30,000.

Formula: fresh input × input price + cache read × read price + cache write × write price + output × output price.

0.12 × $0.4 + 0.48 × $0.05 + 0.06 × $0.5 + 0.03 × $2 = $0.048 + $0.024 + $0.03 + $0.06 = $0.162 per session.

The cache discount works in the Anthropic format, which Claude Code uses; in the OpenAI format all Claude input is billed at the input price. More on caching is in the limits and cache documentation↗. For the hardest steps you can switch to claude-opus-5-5, but it costs twice as much as Sonnet: check whether your tasks really need it.

Starting is simple: create a key in the dashboard, bring up a local copy of the site and give the agent one small task.

FAQ

Can I build a WordPress site with AI alone?

Fully without a human, no. A neural network writes theme and plugin code, but nobody will choose the structure, produce content, set up hosting and handle security for you. A realistic goal is to speed up development, not replace it.

Where should I put the API key for a plugin?

Not in plugin files and not in the repository. Define a constant in wp-config.php on the server or use an environment variable and read it in code. Make a separate API key for it with a spending limit.

Can I give the agent access to the live site?

It is better not to. Work on a local copy or staging subdomain, read git diff, and only then move the edits. That avoids accidental changes on the live site.

Which model suits WordPress?

In Claude Code use Claude models: start with claude-sonnet-5-5, and on a hard task compare it with claude-opus-5-5. Choose by price, context and strength index from the table and by results on your own code, not by promises.