Can AI Manage Your Website? A Developer's Honest Answer

In short: yes, ChatGPT and Claude can now edit a WordPress site directly. Keeping that site in good shape over time takes a proper system around the AI: structured review, testing, ongoing cleanup and a record of every change. That’s where most AI setups fall down.

If you’re trying to work out whether AI can manage your website, you’ve probably noticed the answers are all over the place. Some say yes, plug it in and stop paying for help. Others say no way, it’ll wreck your site. A lot of it depends on who’s writing and what they’re selling.

So I’ll tell you where I sit, and why. I’ve spent years working AI deep into how I build and look after websites. I use it every day, and it’s a core part of how I work. I’ve seen what it does brilliantly, and I’ve cleaned up plenty of what it gets wrong. I’ve also had to think hard about a fair question: if AI can do all this, why would anyone still pay someone like me?

My honest answer is that AI can edit your website now, directly, no question. Whether it can look after it in a way that still holds together a year from now is a different matter, and that’s what this article is about: what I’ve learned, what I see go wrong, and what it takes to use AI on a website without inheriting a mess.

The short version:

• Can AI edit your site? Yes, directly, through connector plugins.
• Is one pass enough? No. Of 142 AI code reviews on my projects since April 2026, 138 led to fixes.
• What goes wrong over time? Small errors compound into design drift, code drift and SEO drift.
• The safe way in: give AI a lane (a scoped tool or a sandbox), not the keys to the live site.

Everyone thinks everyone else’s job is replaceable

An SEO consultant I work with asked recently whether he could point an AI tool at one of his client’s sites over FTP and make changes with it directly. I host and maintain that site.

I joked that by that logic I could start selling AI SEO. He said using AI for SEO is about as viable as loan sharking. I said vibe coding is building yourself a hand grenade. Both blow up eventually.

He could see straight away why AI-driven SEO is a bad bet, because SEO is his field. He knows how many judgement calls sit behind a title tag, how a strategy hangs together, and what happens when someone starts changing things without one. I see the same in mine. Everyone thinks everyone else’s job is replaceable except their own, because nobody understands the depth of a field like the person who has spent a career in it.

AI can teach you the pieces of any field, and teach them well. What it struggles with is joining years of experience together and applying it to your situation: knowing which of the ten technically correct options is right for this particular site.

Yes, AI can edit your website now

Plenty of articles still talk about AI as something that writes code for you to paste in. That’s out of date.

Through connector plugins built on the Model Context Protocol (MCP), ChatGPT and Claude can connect to a WordPress site and make changes themselves. You type what you want in the chat window, and the assistant reads your content and edits it in place.

This is mainstream now. WordPress 6.9 added an Abilities API that lets plugins describe what AI tools can do, and the official MCP Adapter plugin arrived on WordPress.org in October 2026, which the WordPress AI team still describes as experimental. AI Engine, a plugin with more than 90,000 active installs, can turn a site into an MCP server that agents use to edit posts and, in its Pro version, install plugins, customise themes and run database queries. WPBeginner, one of the biggest WordPress tutorial sites, published a guide in September 2026 to managing your site with ChatGPT or Claude.

What the AI can change depends on the plugin. Between them, the popular ones can:

• Write, edit and publish posts and pages
• Update SEO titles, meta descriptions and canonical URLs
• Find broken links and add missing alt text in bulk
• Update plugins, themes and WordPress itself with a single prompt
• Install plugins, edit theme files and run database queries

The better plugins add safeguards: a preview before the change is applied, an approval step, an undo. Those are good, but look at what they protect against. They answer “can I reverse this edit?” They don’t answer whether the edit is right, or whether it undoes a decision someone made for a reason. Knowing what to change, and checking that the change didn’t break something you weren’t looking at, is the job.

AI-written work is full of problems you can’t see

Anything substantial AI builds for me goes through review before it goes anywhere, and the reviews almost always find problems. Wrong assumptions about how the existing code works. A check that only happens in the interface, not on the server. A confident statement about a setting that turns out to be wrong. A fix for one problem that creates another. These are problems the AI introduced itself, minutes earlier, with complete confidence.

Independent testing points the same way. When Veracode tested more than 100 AI models on 80 coding tasks, the code they wrote introduced a known class of security flaw in 45% of cases, and the bigger models did no better than the smaller ones.

If you connect an AI to your website and let it make changes in a single pass, all of those mistakes ship, and you won’t see most of them because they aren’t in the part you were looking at.

That’s why AI work needs a system around it, not another prompt. Review at each stage, ongoing cleanup of what builds up over time, and someone who understands the site judging every finding. A review on its own just produces a list, and that list is a mix of real problems, false alarms and suggestions that would make things worse. Knowing which is which, and what to do about each one, is where the experience comes in.

What my own reviews turn up

I wanted a real number rather than an impression, so I counted. Between April and October 2026 I have written records of 142 AI code reviews across 16 projects, mostly my own tools and products, plus client websites and apps. The code was largely AI-written, separate AI reviewers checked it, and I went through what they found before the work was signed off.

• 140 of the 142 reviews found something. Two came back clean, and 138 led to at least one fix.
• 1,272 individual findings, about nine per review.
• 1,000 were fixed as part of the same piece of work. Another 242 were looked at and deliberately left alone: a problem that pre-dated the change, a suggestion that wasn’t worth it, or a reviewer that turned out to be wrong. 30 were deferred to later work. Acting on every finding blindly would have meant changes nobody needed, and a few based on the reviewer’s own mistakes.
• 52 were rated must-fix, the highest severity, and about one review in five (29 of 142) turned up at least one.

Reviews of the plan, before any code is written, tell the same story. Of 232 plan reviews, not one came back without something to change.

Plenty of the findings weren’t cosmetic. A few of the kinds that matter on a website or web app:

• An upload feature checked that someone was logged in, but not that the record was theirs, so any signed-in user could overwrite someone else’s file.
• Saving a settings screen reset a setting the screen didn’t show.
• Password-protected pages were being treated as public by the site’s own search index.
• A throwaway demo page was left on a public, unprotected address.

Findings vary in size, and not every one is a bug: some are a wrong comment or a missing test. The reviewers are AI too, and a handful of bugs still got past an approved review and turned up later. Skip the review entirely, though, and the problems behind those 1,000 fixes would have gone out with the work, unless something later happened to catch them.

The plaque problem: why AI mess compounds

The best way I can describe unmanaged AI changes is dental plaque. One meal doesn’t hurt your teeth. Skip brushing for a few months and keep eating, though, and before you know it you’re in the dentist’s chair having surgery to fix problems a toothbrush would have handled at the start.

AI edits work the same way, with one extra twist. AI takes its cues from what’s already on your site. When it adds something new, it copies the patterns it finds in the existing pages, templates and code. If those patterns are messy, the new work is messy in the same way.

On a website, that buildup shows up as three kinds of drift:

• Design drift. Each change looks fine on its own. Six months later there are four slightly different button styles, three heading sizes and spacing that doesn’t match anywhere.
• Code drift. Duplicated snippets, a second way of doing something the site already did one way, styles that override styles. Every change gets slower and riskier.
• SEO drift. Titles rewritten without the keyword they were targeting, structured data that no longer matches the page, internal links pointing at pages that moved. Nobody decided to abandon the strategy. It just eroded.

There’s research pointing the same way. GitClear analysed 211 million changed lines of code written between 2020 and 2024, across the years AI coding tools took off. 2024 was the first year it measured more copy/pasted code than code moved during refactoring (the tidying up). GitClear doesn’t measure which lines AI wrote, so this is a correlation, not proof, but it’s the pattern you’d expect when code gets added faster than anyone tidies it.

Cleanup is the expensive part, and the longer it waits, the more there is to clean, with the AI copying the mess in the meantime. That’s why cleanup has to be part of the system, done as you go, not a job saved for the day something breaks.

Too many hands on one website

Most small business websites have more than one person with access: the owner, someone doing marketing, an SEO consultant, the developer who built it, and whoever hosts and maintains it. Now each of them can bring an AI tool along.

When several people change one site with no shared record of what changed and why, three things happen.

Nobody can say which change broke what. A form stops sending. Was it the plugin update, the AI edit to the contact page, or the new tracking script? Without history, every fault becomes an investigation.

Changes collide. One person’s AI tidies the header. Another person’s AI, working from an older picture of the site, puts back what was removed. Neither knows the other was there.

Accountability lands on the wrong person. Whoever hosts and maintains the site is the one the client calls when it breaks, even for a change they didn’t make and can’t see the history of.

A website needs one owner. Handing AI the keys, several times over, takes that away.

The 80/20 trap

With AI, the first 80% of a website change takes 20% of the time. The last 20% is where people get stuck. It feels powerful, a bit like magic: you describe what you want and it appears, and most of a redesign can come together in an afternoon.

One of my clients wanted to rework the look and feel of their site and wanted to drive it themselves with AI. That’s a fair thing to want. It’s their business and their brand. Rather than say no, I set them up with a sandbox: a separate copy of the site where they could work on the design freely without any risk to the live site.

They weren’t left to it on their own, though. My role on that project is the safety net: I provide and look after the sandbox, keep the live site stable, and make sure nothing reaches it until it’s ready. Their SEO consultant watches the SEO side, checking that the redesign doesn’t quietly undo the work that’s gone into their rankings. The client drives the design, and the people around them catch the drift. That support around them is what keeps an AI-driven redesign from becoming a risk to the business.

They got most of the way there quickly, which is the honest strength of these tools. Then they hit the last stretch: the details, the edge cases, making every page consistent, the fiddly parts that don’t come together in a single prompt. As I write this, the redesign isn’t live yet.

It’s how this tends to go, for almost everyone. The last 20% is where experience matters, and it’s where people end up going around in circles: fix one thing, break another, ask the AI to fix that, and find something else has moved. Nothing they tried put the live site at risk, and the work they’ve done isn’t wasted.

How to give AI access to your website safely

If you want to use AI on your own site, I think that’s reasonable, and I’d rather help you do it safely than pretend the tools don’t exist. Ask for a lane, not the keys.

A scoped tool for one job

For one client, I built a small API that lets their AI tools manage one specific type of content on their site and nothing else. The AI can create and update those entries. It can’t touch the theme, the plugins, the settings or any other content. If it gets something wrong, the damage is limited to one place, and that place is easy to check.

This works well when the thing you want AI to help with is repetitive and well defined: listings, products, events, entries in a directory.

A sandbox for bigger changes

For design work or anything that touches templates, work in a sandbox like the one above. Nothing reaches the live site until it has been reviewed and deployed properly.

What should stay off the table

Admin or FTP access to the live site, with an AI making changes and nobody reviewing them. That’s the setup where every mistake ships straight to your customers, and where nobody can reconstruct what happened afterwards.

What a proper system around AI looks like

AI does much of the writing in my work. What makes it safe to use on a client’s site is the system around it, and that’s where most of the effort and most of the experience goes. For any change of substance, that means:

• A clear scope and a plan that fits how the site already works, before anything is built.
• Review at more than one stage, with every finding weighed by someone who knows the site rather than applied blindly.
• Testing in staging before anything touches the live site.
• Cleanup as part of the work, so drift gets dealt with as it appears.
• A written record of what changed, when and why.

None of that is exotic on paper. What makes it work is running it on every change, consistently, and knowing what to do with what the reviews turn up.

That record is what keeps month twelve as clean as month one. When something goes wrong, I can see what changed, when and why, instead of guessing. And when the AI works on the site next time, it works from a site that has been kept consistent, so it copies good patterns instead of bad ones.

Skip the process and you keep the speed for a few months, then pay it back with interest.

A quick decision guide

If a mistake would be visible straight away and easy to undo, AI on its own is fine. If a mistake could sit unnoticed and compound, it needs a proper system and someone accountable for it.

Fine to do yourself with AI:

• Drafting blog posts you read before publishing
• Copy edits on existing pages
• Alt text and meta descriptions
• Content entries in a lane set up for it
• Anything you’d be comfortable changing by hand

Get someone involved:

• Theme, template or code changes
• Installing or removing plugins
• Anything done over FTP or with admin access to the live site
• Forms, payments, bookings or anything customers rely on
• Updates on an online store
• Changes that touch your SEO strategy: titles, structured data, redirects, internal links

When you don’t need a developer at all

Not every site needs someone like me, and I’d rather say so.

If your site is a few pages on a hosted builder like Squarespace or Wix, has no custom code, and nothing commercial depends on it beyond being findable and looking professional, AI plus the builder’s own tools might be all you need. The builder keeps the platform up to date, and there is very little code for drift to accumulate in. I’ve written more about where WordPress and website builders each make sense.

If you’re building an app rather than a website, that’s a different question with different risks. I’ve covered it in Can AI Build Your App?, and if you’ve already built one with AI, my Prototype to Production review is the place to start.

Where I’d push back is the middle ground: a WordPress site with a custom theme, a store, forms, an SEO strategy that’s taken years to build, and several people with access. That’s exactly the kind of site that looks fine for six months of unreviewed AI changes and then doesn’t.

If you want AI on your site without the mess, that’s what my WordPress care plans are for. Get in touch and tell me how your site is looked after now.