GoBuildWP 1.18.6 — WPPilot is now GoBuildWP, plus two security fixes

WPPilot is now GoBuildWP. Same plugin, same wppilot folder, settings, connections, change log and Pro licences. Existing installs update in place and keep working.

Download gobuildwp.zip below and install it with Plugins → Add New → Upload Plugin. It installs as wp-content/plugins/wppilot. Do not use GitHub's "Source code" archive. (wppilot.zip is the same file under its old name, kept for older links.)

Changed

• Rebrand to GoBuildWP. Update checks (and telemetry, when switched on) use gobuildwp.com; new GoBuildWP Cloud connections use app.gobuildwp.com. Sites already connected to Cloud keep their connection.
• New client setups suggest the server name gobuildwp-<your-site>; existing client configurations keep working.
• Ability descriptions an AI client reads now state what the code does, including which changes can be undone and the limits of safe-update rollback.

Security

• The MCP endpoints on the bundled MCP Adapter (/wp-json/mcp/wppilot, the OAuth endpoint and the legacy alias) admitted any signed-in user for the legacy protocol: a subscriber with an Application Password could list tools and read skill resources (running abilities was already refused). They now require AI abilities switched on and GoBuildWP's manage capability, as the modern protocol, OAuth and REST already did.
• The PHP sandbox treated only .php as PHP; .phtml, .phar, .php7, .pht, .phps and similar could be written outside wp-content/wppilot-sandbox/. Every extension a server may run as PHP now has to stay in the sandbox.

Fixed

• OAuth clients speaking MCP 2026-07-28 on /wp-json/mcp/wppilot-oauth got "Missing Mcp-Session-Id"; the modern protocol is now served there.
• WordPress 7.1 core public abilities are now published on both protocols.
• A missing bundled vendor directory now stops OAuth with a clear notice instead of a fatal error.

Requires WordPress 6.9+ and PHP 8.0+, tested up to 7.1. GoBuildWP Pro 1.12.4 requires Free 1.18.1 or newer.

WPPilot 1.18.5 — Safe updates that survive cache purges, and a site issues log

• New: wppilot/site-issues, a read-only log of what went wrong on the site. WordPress's fatal error handler now records the error behind "There has been a critical error on this website" - type, the message's first line, the file relative to the WordPress root and the line, the plugin or theme it belongs to, the request path without its query string, a count and first/last seen - in a capped, non-autoloaded log of 50 entries. Out-of-memory and timeout fatals are not blamed on the file PHP happened to stop in. The ability reads that log with the plugins and themes WordPress paused in recovery mode, failed backups and the updates WPPilot Pro's safe update rolled back. Query strings, cookies, stack traces and server paths are never stored.
• New: WPPilot Cloud hears about changes within seconds instead of at the next hourly check-in: a finished or failed backup (UpdraftPlus, BackWPup, Duplicator), a core, plugin or theme update (safe updates included), a plugin or theme installed, activated, deactivated, deleted or switched, and a Site Kit connection change each send the same signed check-in from WordPress cron, at most once every 30 seconds and never during a visitor's page load.
• Changed: cloud/status sends a compact issues summary - counts, when the newest fatal was, and the newest ten issues with relative file paths only - so WPPilot Cloud can show an Issues log per site.
• Fixed: wppilot/pagespeed-check offered Site Kit dashboard sharing to a module owner whose Google sign-in was gone, which Site Kit refuses. It now skips Site Kit with site_kit_owner_signed_out and returns a sign-in fix that links to Site Kit > Dashboard.

WPPilot 1.18.4 — PageSpeed checks and Site Kit sharing

• New: wppilot/pagespeed-check runs Google PageSpeed Insights on any page of the site and returns the Lighthouse scores, lab metrics, Core Web Vitals field data when Google has it, the opportunities ordered by the time they save, and failing diagnostics. No Google key is needed from anyone: Site Kit by Google answers when its PageSpeed module is connected and readable, otherwise WPPilot Cloud runs the check with WPPilot's own key (signed by a paired site, plain otherwise), and Google's keyless API is the last resort. A key of your own on Settings > PageSpeed is optional and not needed. refresh: true measures again instead of reusing a recent result, on the site and, for a paired site, at WPPilot Cloud too.
• New: wppilot/site-kit-enable-sharing turns on Site Kit's read-only dashboard sharing for Administrators for Search Console, Analytics and PageSpeed Insights, through Site Kit's own sharing route so its owner rules apply, and can be undone. PageSpeed checks say when this sharing is all that keeps Site Kit from answering.
• Changed: whether an All-in-One WP Migration backup can be started is now decided by what the install has - the same check WPPilot Pro 1.12.2's export runner makes - and never by its version. backup-status's trigger.reason names what is missing when it can't.
• Changed: WPPilot Cloud is told why a backup is stuck. cloud/status now reports, per backup plugin, whether it is running, the site's own reason it can't be started, and the export WPPilot Pro started (running, stalled, failed or finished, with a plain reason), so Cloud shows it on the run page and stops waiting for an export that failed. File names, folders, job ids and keys are never sent.

WPPilot 1.18.3 — Prompts back in the admin menu

• Changed: Prompts is listed in the WordPress admin menu under WPPilot, next to Dashboard. WPPilot collapses its other screens into the tab bar on its pages, which had left the industry briefs two clicks deep under Studio. No ability or permission changed.

WPPilot 1.18.2 — Cloud and OAuth connectors can run every ability again

• Fixed: with WPPilot Cloud or an OAuth connector (Claude, ChatGPT), abilities that work through WordPress's own REST API failed with "This OAuth credential is not accepted on the requested REST route." That broke the block themes kit (Global Styles, templates, patterns, navigation), the block theme path of wppilot/build-site-header, Cloud's "Back up now" with All-in-One WP Migration, and WPPilot Pro abilities that use WordPress REST (WooCommerce reports, Etch, GeneratePress, Meta Box relationships, Site Kit). The access-token route limit now lets through a REST call an ability makes for itself while serving an MCP request that already passed it; that call still runs the route's own permission check as the token's user. A token sent straight to any other REST route, including inside a REST batch request, is still refused with 403. Application Password connections were not affected.
• Fixed: Dashboard > Updates > Check again now fetches WPPilot's release data instead of answering from a 12-hour cache, so a new release shows at once.

WPPilot 1.18.1 — All-in-One WP Migration backups

• New: All-in-One WP Migration backups are read alongside UpdraftPlus, BackWPup and Duplicator. backup-status and backup-list report its newest finished backup (time and size), how many there are and whether an export or import is running (only a complete archive of at least 1 MB in its backups folder counts, so a file dropped there cannot pass for a backup); WPPilot Cloud's Backups page shows it, and WPPilot Pro 1.12.1 counts it as the recent backup a safe update needs. Backup file names, folders and links are never returned, because on hosts that ignore .htaccess a .wpress file name is enough to download the whole site.

WPPilot Pro 1.12.1 requires this release; update WPPilot first.

WPPilot 1.18.0 — Cloud updates, backups and safety policies, AI-designed headers, block themes

• New: WPPilot Cloud reporting. A site connected to WPPilot Cloud now reports its pending core, plugin and theme updates and its newest backup (UpdraftPlus, BackWPup or Duplicator), so Cloud's Updates and Backups screens can show every site at once. Cloud never receives backup files, links or storage credentials.
• New: safety settings pushed from WPPilot Cloud. Under WPPilot > Connect > WPPilot Cloud the site owner can let Cloud tighten this site's safety profile, approval mode and switched-off abilities, or also loosen them. Both are off by default, loosening needs tightening, Developer Full Access can never be set from Cloud, and a rule the owner changes afterwards stays the owner's.
• New: block themes kit. AI clients can edit Global Styles, templates and template parts (header, footer), patterns and navigation menus on block themes through WordPress's own REST endpoints, and every change can be undone.
• New: wppilot/build-site-header. The AI designs the site header for the brand (an Elementor Pro Theme Builder header or a block theme header part) and WPPilot does the rest: one header per Polylang language, a styled language switcher, the menu and the cart, confirmation and undo. WPPilot checks the design before saving (mobile menu button, contrast, empty images and links) and the served page after (wrapping, overlap, broken links), and reports each problem against the element so the AI can fix its own design.
• New: safety and undo for other MCP servers. Writes made through Elementor's and WooCommerce's own MCP abilities, and TranslatePress's and Easy Digital Downloads' settings and product abilities, are recorded in WPPilot's change log and can be undone. An optional setting (Settings > Other MCP servers) also asks for approval before they run.
• New: builder quality audit. wppilot/elementor-audit-output scores how editable an Elementor page is in the panel (native widgets versus HTML widgets and raw markup) and lists what to fix. WPPilot Pro 1.12.0 adds the fixer.
• New: Chat usage meter. WordPress Chat shows how many tokens each person has used today and this month. Only token counts are kept, for 62 days, and they never leave the site. WPPilot Pro 1.12.0 adds daily and monthly limits that stop Chat before the AI provider is asked.
• Fixed (reported by a client): elementor-set-content rejected classic sections and columns, so a page built with them could not be written back; Elementor Pro form fields such as Reply-To did not accept the form's own field IDs; rich-text fields documented inline tags only although paragraphs and lists are allowed; and Polylang sites were reported as WPML.
• Fixed: verify-rendered-page and the accessibility audit can check drafts, through a one-minute signed-in preview that only reaches this site, and every finding and heading says whether it comes from the page or the theme. Theme, sidebar and footer output no longer fails a page.
• Fixed: elementor-set-content kept a Theme Builder template's type (header, footer) instead of resetting it to a page; the Gutenberg finalizer keeps blocks whose attributes arrive empty; undoing a WooCommerce product edit no longer refuses over its live sales counters; parallel Chat steps are all counted.
• Changed: discover-abilities lists each ability's parameters, for example post_types?: array, so clients stop guessing names.
• Security: Elementor writes that bypass Elementor's document save (atomic v4 trees and the fallback path) now run every string through wp_kses_post when the user lacks unfiltered_html, as Elementor's own editor does, instead of relying on Elementor's REST-only meta sanitizer.

WPPilot Pro 1.12.0 requires this release; update WPPilot first.

WPPilot 1.17.4 — Cloud and OAuth sign-in work again with Yoast SEO

• Fixed: on a site running Yoast SEO, every request signed in with a WPPilot access token (WPPilot Cloud, and AI connectors that use OAuth) failed with an HTTP 500 error. Checking the token asked Yoast for the user's permissions, Yoast asked WordPress who the current user was, and that started the token check again until PHP ran out of memory. The token check now ignores that inner lookup, so the request signs in as the token's user. Application Password connections were not affected. No ability permissions changed.

WPPilot 1.17.3 — AI clients can run abilities again

• Fixed: an AI client could list WPPilot's abilities but never run one, because it was offered only mcp-adapter-discover-abilities. When another plugin read the WordPress Abilities registry early in the request, the bundled MCP Adapter missed the moment to register mcp-adapter/get-ability-info and mcp-adapter/execute-ability, so every WPPilot MCP endpoint (OAuth and Application Password alike) served discovery alone. WPPilot now registers both itself when the adapter did not. Clients that connected before updating should disconnect and reconnect, or start a new chat, so they read the tool list again. No ability permissions changed.

WPPilot 1.17.2 — brand purple in wp-admin

• Changed: WPPilot's admin screens (Connect, Abilities, Skills and the masthead Upgrade link) use the wppilot.co brand purple, #675CF4, instead of #3D2BFF, so the plugin, the website and the WPPilot Cloud dashboard look like one product. The README names the Pro plans by site count (Single Site, 10 Sites, 100 Sites, Unlimited Sites), as wppilot.co does. No behaviour, ability or permission changed.