AIWP Designer 0.12.1

Ten faults found by building a three-page site cold from a written specification, and then actually using it.

The last one: a url field on a form asked whether the server could reach the site rather than whether the address was well formed, so an ordinary customer website was rejected and nobody could submit the form.

Install: download aiwp-designer-0.12.1.zip below, then in WordPress go to Plugins → Add New → Upload Plugin.

Needs Advanced Custom Fields (the free one), WordPress 6.6+ and PHP 8.1+.

See CHANGELOG.md for the full list.

AIWP Designer 0.12.0

Nine faults found by building a three-page site cold from a written specification. Three were invisible — nothing looked broken.

The ones that mattered most: every page scrolled sideways on a phone, a modal claimed to trap focus and let Tab walk straight out, a skip link had nothing to land on, and a fixed behaviour never reached a browser that had already cached the old one.

Install: download aiwp-designer-0.12.0.zip below, then in WordPress go to Plugins → Add New → Upload Plugin.

Needs Advanced Custom Fields (the free one), WordPress 6.6+ and PHP 8.1+.

See CHANGELOG.md for the full list.

AIWP Designer 0.11.0

A page with a repeater could not be saved from wp-admin on any site this plugin had built. That is fixed, along with sixteen other things.

Install: download aiwp-designer-0.11.0.zip below, then in WordPress go to Plugins → Add New → Upload Plugin.

Needs Advanced Custom Fields (the free one), WordPress 6.6+ and PHP 8.1+.

See CHANGELOG.md for the full list.

AIWP Designer 0.10.0

Download aiwp-designer-0.10.0.zip below, then in WordPress go to
Plugins → Add New → Upload Plugin and choose it.

You also need Advanced Custom Fields (the free one).
WordPress 6.6+ and PHP 8.1+.

What is in this release

• An MCP server your AI connects to. Every tool is gated on a WordPress capability.
• A safe template language, parsed to an AST and never evaluated. The AI writes a field schema, markup, page CSS and the starting content — never PHP or JavaScript, and anything that tries is refused.
• A design system the site writes for itself: colours, type scale, spacing, motion and a component library of its own, so every page reads the same without any page repeating the decision.
• Content in ACF fields, still editable in wp-admin as usual.
• Articles as WordPress posts under one AI-written template, with archives to match.
• Forms, shared header and footer, menus, SEO meta and schema.
• Every change is an immutable version. Rollback is one call.
• The AI has to read the finished page back before it can publish it.
• A whole site exports to one file and imports onto another WordPress.

Security

Two validator bypasses were found and fixed before this release. Both needed
an MCP token that can edit pages, and both could have let an editor reach an
administrator's session:

• A URL could hide javascript: from the check by splitting the scheme with a tab or a null byte. Browsers strip those before resolving the scheme; the check did not. URLs are now read the way a browser reads them, and the scheme must be http, https, mailto or tel.
• A null byte made the validator and the browser read different markup: DOMDocument truncates an attribute at the first null, so the check saw a harmless value while the renderer printed the real one. Control characters are now refused outright in templates and CSS.

Tested

312 unit tests and 178 end-to-end checks against a real WordPress.