README

WordPress Site Manager using the Abilities API - A native, AI-ready alternative to MainWP.

Part of LW Plugins - Lightweight plugins for WordPress.

Requirements

PHP 8.1+
WordPress 6.9+
WordPress Abilities API

Installation

Via Composer

composer require lwplugins/lw-site-manager

Manual

Download the latest release from GitHub
Upload to wp-content/plugins/lw-site-manager
Activate the plugin in WordPress admin

Available Abilities

The plugin currently registers 167 abilities. All slugs use the site-manager/ namespace and are grouped below by their ability category.

Core abilities

Updates (5)

check-updates, update-core, update-plugin, update-theme, update-all (with PHP error detection)

Plugins (5)

list-plugins, install-plugin, activate-plugin, deactivate-plugin, delete-plugin

Themes (4)

list-themes, install-theme, activate-theme, delete-theme

Posts (8)

list-posts, get-post, create-post, update-post, delete-post, restore-post, duplicate-post, bulk-posts

Plus get-post-types, get-post-terms, set-post-terms (3) for taxonomy/post-type metadata.

Pages (10)

list-pages, get-page, create-page, update-page, delete-page, restore-page, duplicate-page, page-hierarchy, page-templates, set-page-template, reorder-pages

Taxonomy (10)

Categories: list-categories, get-category, create-category, update-category, delete-category Tags: list-tags, get-tag, create-tag, update-tag, delete-tag

Both groups accept a taxonomy parameter so they also work on any custom taxonomy.

Users (7)

list-users, get-user, create-user, update-user, delete-user, get-roles, reset-password

Comments (9)

list-comments, get-comment, create-comment, update-comment, delete-comment, approve-comment, spam-comment, bulk-comments, comment-counts

Media (5)

list-media, get-media, upload-media, update-media, delete-media

Settings (10)

get-general-settings, update-general-settings, get-reading-settings, update-reading-settings, get-discussion-settings, update-discussion-settings, get-permalink-settings, update-permalink-settings, front-page-settings, set-homepage, set-posts-page

Meta (12)

Entity	Get	Set	Delete
Posts	`get-post-meta`	`set-post-meta`	`delete-post-meta`
Users	`get-user-meta`	`set-user-meta`	`delete-user-meta`
Terms	`get-term-meta`	`set-term-meta`	`delete-term-meta`
Comments	`get-comment-meta`	`set-comment-meta`	`delete-comment-meta`

Inline meta fields are also accepted by all create-* / update-* abilities for posts, pages, users, terms, comments, and the WooCommerce equivalents below.

Backup (6)

create-backup, list-backups, backup-status, cancel-backup, restore-backup, delete-backup

Backups are processed in chunks via WP-Cron — create-backup returns immediately and backup-status polls progress.

Database (2)

optimize-database, cleanup-database

Cache (1)

flush-cache — covers WP object cache, OPcache, and the major page-cache plugins (WP Rocket, W3TC, WP Super Cache, LiteSpeed, WP Fastest Cache, Cache Enabler, Autoptimize, Kinsta, SG Optimizer, Cloudflare WP plugin, Redis, Varnish).

Health & diagnostics (2)

health-check, error-log

Plugin database updates (4)

check-plugin-db-updates, get-supported-db-plugins, update-plugin-db, update-all-plugin-dbs

WooCommerce abilities (requires WooCommerce 7.0+)

Products (10)

wc-list-products, wc-get-product, wc-create-product, wc-update-product, wc-delete-product, wc-duplicate-product, wc-update-stock, wc-list-product-categories, wc-list-variations, wc-bulk-products

Orders — CRUD (6)

wc-list-orders, wc-get-order, wc-create-order, wc-update-order, wc-delete-order, wc-update-order-status

Orders — extras (5)

wc-list-order-statuses, wc-create-refund, wc-list-order-notes, wc-add-order-note, wc-bulk-orders

Order line items (3)

wc-add-order-item, wc-update-order-item, wc-remove-order-item

Order coupons & fees (4)

wc-apply-order-coupon, wc-remove-order-coupon, wc-add-order-fee, wc-remove-order-fee

Order shipping & recalc (3)

wc-set-order-shipping, wc-remove-order-shipping, wc-recalculate-order

Order payment workflow (3)

wc-mark-order-paid (with silent flag), wc-send-order-email (6-template whitelist), wc-get-payment-url

Reports (6)

wc-sales-report, wc-top-sellers, wc-orders-totals, wc-revenue-stats, wc-low-stock-products, wc-products-totals

Global attributes (5)

wc-list-attributes, wc-get-attribute, wc-create-attribute, wc-update-attribute, wc-delete-attribute

Attribute terms (4)

wc-list-attribute-terms, wc-create-attribute-term, wc-update-attribute-term, wc-delete-attribute-term

Product-attribute bindings (3)

wc-set-product-attributes (full replace), wc-add-product-attribute, wc-remove-product-attribute

Supports both global (pa_*) and custom per-product attributes.

Variations (4)

wc-generate-variations (cartesian auto-fill of variation-flagged attributes), wc-create-variation, wc-update-variation, wc-delete-variation

WooCommerce meta (6)

Entity	Get	Set	Delete
Products / variations	`wc-get-product-meta`	`wc-set-product-meta`	`wc-delete-product-meta`
Orders	`wc-get-order-meta`	`wc-set-order-meta`	`wc-delete-order-meta`

All HPOS-aware via WC_Data API. Inline meta is also accepted by wc-create-product / wc-update-product, wc-create-order / wc-update-order, wc-create-variation / wc-update-variation, wc-add-order-item / wc-update-order-item.

Behavioral notes

Order locking — every order modification ability rejects cancelled / refunded / failed orders with HTTP 409 (order_locked).
Deferred recalculation — order item/coupon/fee/shipping mutations support recalculate=false; chain several mutations and finish with a single wc-recalculate-order call.
Email opt-out — wc-mark-order-paid accepts silent: true to suppress the customer notification.

Documentation

Full API documentation is available in the docs/abilities directory.

Usage Examples

REST API

# Check for updates
curl -X GET "https://yoursite.com/wp-json/wp-abilities/v1/abilities/site-manager/check-updates/run" \
  -H "Authorization: Basic BASE64_ENCODED_APP_PASSWORD"

# Create a post with custom taxonomy
curl -X POST "https://yoursite.com/wp-json/wp-abilities/v1/abilities/site-manager/create-post/run" \
  -H "Authorization: Basic BASE64_ENCODED_APP_PASSWORD" \
  -H "Content-Type: application/json" \
  -d '{"input":{"title":"My Post","content":"Content here","status":"publish","taxonomies":{"my_custom_tax":[1,2,3]}}}'

# Set terms for a custom post type
curl -X POST "https://yoursite.com/wp-json/wp-abilities/v1/abilities/site-manager/set-post-terms/run" \
  -H "Authorization: Basic BASE64_ENCODED_APP_PASSWORD" \
  -H "Content-Type: application/json" \
  -d '{"input":{"id":123,"taxonomy":"product_cat","terms":[5,10]}}'

PHP

// Check updates
$ability = wp_get_ability( 'site-manager/check-updates' );
$updates = $ability->execute( [ 'type' => 'all' ] );

// Create a post with custom taxonomies
$ability = wp_get_ability( 'site-manager/create-post' );
$result = $ability->execute([
    'title' => 'My New Post',
    'content' => 'Post content here',
    'status' => 'publish',
    'taxonomies' => [
        'category' => [1, 2],
        'post_tag' => [5, 6, 7],
        'my_custom_tax' => [10, 11],
    ],
]);

Authentication

Use WordPress Application Passwords for REST API authentication:

Go to Users → Your Profile
Scroll to "Application Passwords"
Create new application password
Use Basic Auth: Authorization: Basic base64(username:app_password)

AI Integration

This plugin is designed for AI agent integration via:

REST API - Any AI can call abilities via HTTP
MCP Adapter - Claude, GPT can use abilities as tools
Agentic Loops - AI decides which abilities to call

Built-in MCP server

Since v1.2.0, the plugin ships its own MCP (Model Context Protocol) server so a client — Claude Code, Claude Desktop, ChatGPT, or any other — can connect directly and use the abilities as tools. It is on by default (since v1.3.0) and still requires an administrator Application Password to connect. Toggle it in the admin (LW Plugins → AI / MCP → "Enable the built-in MCP server" → Save), where the settings page also shows a ready-to-paste snippet pre-filled with your endpoint.

Add the server to your MCP client. For Claude Code, in the project .mcp.json:

{
  "mcpServers": {
    "lw-site-manager": {
      "type": "http",
      "url": "https://YOUR-SITE/wp-json/mcp/lw-site-manager",
      "headers": {
        "Authorization": "Basic BASE64(username:application_password)"
      }
    }
  }
}

The Authorization value is the literal word Basic, a space, then the base64 encoding of username:application_password (use an administrator account's Application Password). See docs/mcp-server.md for the full setup, auth layers, and domain-lock behavior.

Example AI workflow:

User: "Check my site and update everything safely"

AI Agent:
1. Calls site-manager/health-check
2. Calls site-manager/check-updates
3. Calls site-manager/create-backup
4. Calls site-manager/update-all with stop_on_error=true
5. If errors: reports issues, suggests rollback
6. If success: calls site-manager/health-check again
7. Returns summary to user

Changelog

See CHANGELOG.md for the full version history.

Most recent: 1.1.26 — split WooCommerceAbilities.php into focused classes and added 38 new abilities: order management (line items, coupons, fees, shipping, payment workflow), full attribute / variation CRUD, HPOS-aware meta on every entity, plus inline meta on every create/update.

License

GPL-2.0-or-later

Sponsor

Supported by Sinann

lwplugins / lw-site-manager

Maintainers

Package info

Fund package maintenance!

Statistics

Security