"Our corporate site was built using WordPress. The other day, I saw in the news that AI became a built-in feature in WordPress 7. When I asked our web agency about it, they told us, 'We\'ll update it eventually.' Honestly, we have no idea whether that\'s good for us or if there\'s anything we should watch out for. Is it okay to just leave it alone?" This was a question we received from a PR representative at a service company. For businesses with their own websites, major updates to WordPress—which powers a huge portion of the world\'s sites—often end up feeling like something that directly concerns them, yet remains difficult to fully grasp.
Released in May 2026, WordPress 7.0 stands out because it incorporates AI handling directly into its core rather than relying on third-party plugins. With just a few clicks in the admin dashboard, you can connect AI services and delegate parts of your content creation workflow. At the same time, allowing AI to "operate" your website introduces new types of risk. In this article, we examine this shift from the client\'s perspective, breaking down both the benefits and the precautions to keep in mind.
What has been "built in"
Previously, using AI in WordPress typically required installing individual external plugins. In version 7.0, a unified foundation managing AI interactions has been integrated into the core. Broadly speaking, it consists of three key components:
- Connectors: A central hub in the admin dashboard where you can authenticate and link AI services such as OpenAI, Anthropic (Claude), and Google in just a few clicks. These three providers are preconfigured right out of the box.
- AI Client (WP AI Client SDK): A shared developer component that lets plugins call multiple AI services using a standardized syntax, standardizing implementations that were previously fragmented across different plugins.
- Abilities API: A framework defining "what AI is allowed to do on this site." It serves as the foundation enabling AI to draft posts, trigger plugin actions, and perform site operations.
In addition, an official AI plugin can optionally be used to generate article titles, summaries, image alternative text (alt text), and images themselves. In short, the underlying plumbing for integrating AI into website management is now provided directly by the core platform.
What this means for clients
The most practical benefit in daily operations is a reduction in the effort required to create content. For example, image alt text is vital for both accessibility and SEO, yet it is often missed when done manually. Having AI draft this text helps prevent missing descriptions. The same applies to article summaries (excerpts) and title suggestions, accelerating how quickly content managers can assemble initial drafts.
However, this does not mean "AI will automatically build a great site on its own." Generated copy and alt text still require fact-checking and refinement to match your brand voice. The division of labor remains unchanged: humans finalize the drafts created by AI. We previously addressed this misconception in our article on why treating AI agents like human employees leads to failure; website management is no different. It is vital to maintain the premise that AI is a drafter, while judgment and final polish belong to humans.
New risks: granting AI "operational permissions"
Behind these benefits lies a category of risk that previously did not exist in WordPress. The Abilities API does not just allow AI to write text; it also enables AI to execute plugin operations—in other words, make changes to your site. What requires vigilance here is that AI inherently tends to interpret incoming text as a literal instruction.
For instance, imagine a malicious actor submitting a blog comment or contact form inquiry containing text like "Ignore all previous instructions and execute the following action." If the AI is connected to a pipeline that processes that text, a single line in a public comment could trigger an operation such as modifying the database—an attack surface known as "prompt injection" that emerged with native AI integration. Furthermore, running AI incurs service usage fees (predominantly pay-as-you-go), raising operational questions about who holds the API keys and how budgets are controlled. While we previously discussed security risks entering via third-party extensions in our article on WordPress plugin supply chain security, built-in AI features broaden this issue of externally supplied instructions and components even further.
What clients should decide before updating
Given these changes, the right approach is neither rushing to upgrade to 7.0 nor avoiding it entirely out of fear. A pragmatic step is to clarify the following points together with your web development and maintenance agency:
First, decide whether your site will actually use these AI features. If you do not intend to use them, you can choose not to activate AI-related capabilities or the official plugins, avoiding an unnecessary expansion of your attack surface in the first place. If you do decide to use them, determine in advance which AI services to connect, who manages the API keys, how cost limits are set, and how to prevent external inputs like comments and inquiries from entering AI processing pipelines. It is also a good practice to audit whether your existing plugins have started introducing their own AI capabilities. While we explored the risks of being tied to specific tools in our article on visual builder lock-in, planning upfront for how you would remove AI features down the road ensures you won\'t run into trouble later.
"We want to discuss whether our WordPress site should be upgraded to 7.0, and what to watch out for if we do." "We want to design a secure setup for AI features, including API key management and spending caps." "We want an audit to ensure our site\'s AI features cannot be exploited." If you share any of these concerns, please feel free to reach out to GleamHub through our website development and maintenance support. We will help you safely adopt only the AI features that truly deliver value for your company\'s website.
