=== 500Toolbox Connector ===
Contributors: 500toolbox
Tags: ai, mcp, claude, chatgpt, activity log
Requires at least: 5.6
Tested up to: 6.8
Requires PHP: 7.4
Stable tag: 1.1.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Connect WordPress to Claude, ChatGPT or Cursor in one click - no application password, works with security plugins, with a full AI activity dashboard.

== Description ==

500Toolbox Connector links your site to the 500Toolbox WordPress MCP connector, so your AI assistant can write drafts, fix SEO, manage WooCommerce products and orders, build courses, moderate comments and answer questions about your site.

**One-click connection.** Go to wp-admin → 500Toolbox and click Connect. You approve the site on 500toolbox.com and you are done. You don't need to copy an application password or edit .htaccess.

**Works with security plugins.** Wordfence, Solid Security (iThemes), All-In-One Security, WP Cerber, Shield, Defender, Sucuri and "disable REST API" plugins often switch off application passwords or public REST access. This plugin needs neither:

* Each AI call is a single signed POST (HMAC-SHA256, with a timestamp and a one-time nonce) sent to admin-ajax.php.
* The plugin checks the signature, signs the call in as the administrator who connected, and runs it through WordPress' own REST API internally.
* WordPress permission checks still apply to every call.

**A dashboard of everything the AI did.** It's stored in your own database:

* KPIs for AI actions, changes (created / updated / deleted), reads, errors, blocked attempts and response time, compared with the previous period.
* Daily activity chart, a breakdown by area (posts, pages, media, users, WooCommerce, courses...), a weekday × hour heatmap and a response-time trend.
* Recent changes with direct edit links, the most-changed items and the most-used endpoints.
* A full activity log with filters, search, paging and CSV export.
* A site snapshot: content counts, plugin updates, versions, and the security plugins it detected along with their compatibility.
* A widget on the WordPress dashboard.

**You stay in control:**

* Read-only mode, and "block changes" switches for each area (users, plugins, themes, settings, WooCommerce...).
* Each connection can be disconnected separately at any time.
* The AI can't read or edit its own activity log, or the plugin's keys and settings.

**Plugin data without an API.** Many plugins keep data the REST API can't see: their own tables, hidden post types, meta, internal comment types and settings. Under toolbox/v1 (Administrators only) the plugin exposes a generic bridge for that data. WordPress core tables are never touched through it, and values that look like secrets are returned as [redacted].

== Installation ==

1. Download the zip from https://www.500toolbox.com/downloads/500toolbox-connector.zip
2. In wp-admin, go to Plugins → Add New → Upload Plugin. Choose the zip, click Install Now, then Activate.
3. Open wp-admin → 500Toolbox and click **Connect to 500Toolbox**. Sign in on 500toolbox.com, then click Connect site.
4. Add the 500Toolbox WordPress connector to your AI app (https://www.500toolbox.com/api/wordpress) and start asking.

Keep the plugin active while you use the AI connector, because the connection runs through it. If you deactivate the plugin, the AI can no longer reach the site. If you delete it, its keys, settings and activity log are removed too.

== Frequently Asked Questions ==

= Does it need an application password? =

No. Each connection has its own random key, and your passwords are never used or shared.

= My security plugin disables the REST API. Will it work? =

Yes. The AI calls don't use the public /wp-json/ endpoint or the Authorization header. A firewall that runs in front of WordPress (Cloudflare, Sucuri, your host) can still block requests before they reach the site. If that happens, allow the user agent "500Toolbox-WordPress-Connector".

= Does the site need HTTPS? =

Yes. 500Toolbox only connects to HTTPS sites, so the connection key always travels encrypted.

= Where is the activity stored? =

In a table called {prefix}toolbox_activity in your own database. Entries are kept for 30 to 365 days (your choice) and are removed when you delete the plugin.

== Changelog ==

= 1.1.0 =
* One-click Connect: no application password, works with security plugins (signed requests through admin-ajax.php).
* New wp-admin → 500Toolbox dashboard: KPIs, charts, heatmap, recent changes, most-changed items and a site snapshot.
* Activity log with filters, search and CSV export, plus a WordPress dashboard widget.
* Read-only mode, per-area change blocking and per-connection disconnect.

= 1.0.0 =
* First release: plugin tables, posts of any type with meta, user meta, comments of any type, plugin settings.
