On March 20, WordPress.com opened write access to its Model Context Protocol (MCP) server, allowing AI agents like Claude, ChatGPT, and Cursor to create posts, build pages, manage comments, and organize content on any WordPress.com site with a paid plan. No dashboard required. Just a conversation.

The update adds 19 new write operations across six content types – posts, pages, comments, categories, tags, and media – on top of the read-only access that launched in October 2025. In practice, this means a site owner can tell Claude “draft a blog post about our spring sale, categorize it under Promotions, and add a 160-character meta description” and the agent will do it.

For the hosting industry, this is not just a WordPress.com product announcement. It is an early signal of how site management is about to change – and what that shift means for support workflows, control panel relevance, and the role hosting providers play in their customers’ daily operations.

What the Agents Can Actually Do

The 19 new operations cover the core content management tasks that site owners spend most of their dashboard time on:

  • Posts and pages – draft, create, edit, and publish. Agents can build landing pages using the site’s existing block patterns and theme design tokens (colors, fonts, spacing), so the output matches the site’s look without manual styling.
  • Comments – approve, reply to, or trash. An agent can moderate a comment queue in seconds that would take a human ten minutes of clicking through the dashboard.
  • Categories and tags – create, rename, restructure. An agent can build an entire category hierarchy (“Recipes” with Breakfast, Lunch, Dinner, Desserts subcategories) from a single instruction.
  • Media – audit and fix alt text, captions, and titles. An agent can scan a site’s image library, identify images missing alt text, and suggest descriptions based on filenames and context.

The agents are not working blind. Before generating any content, they read the site’s theme data – colors, fonts, spacing, block patterns – and produce output that fits the existing design. If the site owner changes their theme, the agent’s output adapts automatically.

Safety Mechanisms

WordPress.com built several layers of control around write access:

Every action requires explicit user confirmation before execution. The agent describes what it plans to do and waits for a yes. New posts and pages are saved as drafts by default, not published immediately. Deleted content goes to trash with a 30-day recovery window. Categories and tags are the exception – deleting them is permanent, and the agent must warn the user before proceeding.

All changes are logged in the site’s Activity Log with full attribution. Standard WordPress user roles apply – if the connected account has Editor permissions, the agent can edit posts but not change site settings. Each of the 19 operations can be toggled individually in the MCP settings dashboard at wordpress.com/me/mcp.

“Before creating, updating, or deleting anything, your AI agent describes exactly what it plans to do and asks for your explicit confirmation,” the company wrote in its announcement.

WordPress.com vs WordPress.org: Two Different Stories

The March 20 announcement applies to WordPress.com – Automattic’s hosted platform. For the millions of self-hosted WordPress.org installations that run on independent hosting providers, the situation is different but moving in the same direction.

WordPress 6.9 introduced the Abilities API – a standardized way for plugins, themes, and core to register executable functions with typed inputs, outputs, and permission checks. The official WordPress MCP Adapter, available on GitHub, translates these Abilities into MCP tools that AI agents can discover and execute.

Three core abilities ship by default: get-site-info, get-user-info, and get-environment-info. Plugin developers can register additional abilities and explicitly opt them into MCP exposure via a meta.mcp.public flag. The adapter supports both local connections (via WP-CLI) and remote access (via application passwords or OAuth over the REST API).

Self-hosted sites can already use MCP through the adapter, but the experience is rougher than WordPress.com’s turnkey setup. There is no OAuth solution for self-hosted yet – authentication relies on JWT tokens or application passwords, which are functional but less polished. Third-party plugins like AI Engine also offer MCP server functionality for self-hosted installations.

The gap between WordPress.com’s one-click MCP and the self-hosted experience is exactly the kind of gap hosting providers could fill.

What This Means for Hosting Providers

WordPress.com publishes 70 million new posts per month across its platform. If even a fraction of that volume starts flowing through AI agents instead of the dashboard, the downstream effects on hosting are significant.

Support patterns will shift. If customers manage their sites through Claude or ChatGPT instead of logging into cPanel and then wp-admin, the questions they ask hosting support will change. Fewer “how do I add a page in WordPress” tickets, more “why can’t my AI agent connect to my site” tickets. Hosting providers that understand MCP and can troubleshoot agent-to-site connectivity will have an advantage over those that don’t.

Control panels may lose relevance. The traditional flow is: customer logs into hosting control panel, clicks through to WordPress, manages content. If AI agents handle content management directly, the WordPress dashboard becomes less central. And if the dashboard matters less, the hosting control panel – which exists largely as a gateway to the dashboard and server settings – matters less too. The customer’s primary interface becomes whatever AI tool they’re talking to.

Managed WordPress hosting gets a new job. If self-hosted WordPress sites need MCP configured, secured, and maintained, that becomes a managed hosting feature. Setting up the MCP adapter, configuring authentication, managing permissions, monitoring agent activity – these are services that hosting providers can offer. The ones that do will differentiate from commodity shared hosting. The ones that don’t will watch WordPress.com pull customers who want the easier path.

API traffic patterns change. AI agents hitting the REST API generate different load patterns than humans clicking through a dashboard. An agent that audits 500 images for missing alt text in one session produces a burst of API calls that a human never would. Hosting providers may need to think about rate limiting, caching, and resource allocation differently for sites with active MCP connections.

The 3 Waves of WordPress AI: Why “Vibe Coding” Will Destroy Your Support Team

The Bigger Race: Platforms Opening Up to Agents

WordPress.com is not the only platform moving in this direction, but it is the furthest along in giving agents write access through a standardized protocol.

Shopify has taken a different but parallel path. On March 3, Shopify and Google jointly announced the Universal Commerce Protocol (UCP) – an open standard built on MCP that lets AI agents browse product catalogs, add items to carts, and complete purchases inside Google Search, Gemini, and Microsoft Copilot. Partners include Etsy, Wayfair, Target, Walmart, Visa, Mastercard, and Stripe. In March, Google added three new UCP capabilities: Cart, Catalog, and Identity Linking.

Wix and Squarespace have built AI content generation features into their editors, but neither has opened a standardized agent protocol. Their AI tools work inside the platform, not as external agents connecting in. That’s a meaningful difference – WordPress.com and Shopify are building open infrastructure that any AI client can connect to. Wix and Squarespace are building proprietary features that work only within their own walls.

For hosting providers, the open approach matters more. If the industry standardizes on MCP as the way AI agents interact with websites, hosting providers that support it become part of the agent workflow. Those that don’t become invisible to it.

The Timeline

  • July 2025 – WordPress.org begins work on the MCP Adapter and Abilities API
  • October 2025 – WordPress.com launches MCP server with read-only access
  • February 2026 – WordPress.org publishes the MCP Adapter for self-hosted sites, introducing the Abilities API
  • March 20, 2026 – WordPress.com adds 19 write operations, agents can now create and manage content
  • April 9, 2026 (scheduled) – WordPress 7.0 ships with AI Connectors built into core, centralizing API key management for OpenAI, Gemini, and Claude under Settings > Connectors. The Abilities API and MCP Adapter become part of the standard WordPress installation, not optional add-ons

Five months from read-only to full write access. And less than three weeks from now, WordPress 7.0 bakes the entire AI infrastructure – Connectors, Abilities API, MCP Adapter – directly into core. That means every self-hosted WordPress site, on every hosting provider, will ship with the plumbing that lets AI agents connect to it. The agents won’t be enabled by default – site owners still have to enter API keys and toggle permissions – but the infrastructure will be there, waiting.

For hosting providers, that April 9 release date is the more important one. WordPress.com’s MCP is a product decision by Automattic. WordPress 7.0’s AI Connectors in core are a platform decision that affects every host running WordPress – which is virtually all of them.

WordPress 7.0 Ships AI Connectors: Infrastructure, Not Features

What Happens Next

Ronnie Burt, AI Product Lead at WordPress.com, framed the update in practical terms: “Now those tools can actually take action – draft a post, build a page, manage comments – directly on your site, through conversation.”

The immediate impact is limited. Most WordPress.com users don’t know what MCP is yet, and most AI agent users haven’t connected them to their websites. But the infrastructure is now in place. The protocol is open. The permissions model is built. And the largest CMS in the world – powering 43% of all websites – has decided that AI agents should be first-class citizens of the publishing workflow.

For hosting providers, the question is not whether this changes the business. It is whether you are building for it or waiting for it to happen to you.