v1.4.4

Highlights

• Media orphan scanner — daily-cached wp-admin scan (JOOservices → Media) for attachments whose file is missing on disk and files with no attachment record; exposed read-only via wordpress_get_media_orphans
• Broken inline media reference finder — wordpress_find_broken_media_references scans post/page content for dead wp-image-{ID} references and matches them against the orphan-file scan by exact path
• Orphan media adoption (no re-upload) — wordpress_adopt_orphan_media registers an orphan file as a real attachment without copying bytes, so fixing a broken reference no longer creates a duplicate file

Fixed

• Media upload failure visibility: wordpress_upload_media failures and wordpress_get_mcp_activity logs now surface the WordPress plugin's verification_step / verification detail instead of a bare error code.

Assets

• wordpress-chatgpt-1.4.4.zip — WordPress plugin (PHP 8.3+)
• MCP server: deploy from packages/mcp-server (Node 24+) or Docker (make prod-up)

Deploy

Install wordpress-chatgpt-1.4.4.zip on each WordPress site (jooservices, soulevil, …), replacing the existing plugin files. Deploy the updated MCP server alongside it — the new tools are server-side.

Full changelog: CHANGELOG.md

v1.4.3

WordPress plugin 1.4.3

Fixed

• Yoast SEO metadata: Updating SEO title and meta description in a single MCP/REST call no longer drops the description. Yoast can clear metadesc when the SEO title meta is saved; the plugin re-applies description (and Open Graph description) after the first write pass.

Deploy

Install wordpress-chatgpt-1.4.3.zip on each WordPress site (jooservices, soulevil, …). MCP server redeploy is not required for this release.

v1.4.2

MCP server patch release. WordPress plugin unchanged at v1.4.0.

Fixed

• Active site persistence: wordpress_set_active_site now persists across tool calls for the same OAuth bearer token, fixing stateless MCP clients (e.g. ChatGPT) that open a new HTTP session per tool call.

Changed

• Tool descriptions and server instructions clarify multi-site workflow and that wordpress_get_site includes PHP upload limits (replaces removed wordpress_get_site_limits).

Deploy the updated MCP server image/code only; rebuild Docker with --force-recreate.

v1.4.1

MCP server patch release. WordPress plugin unchanged at v1.4.0.

Fixed

• Multi-site routing: wordpress_list_sites works without a site parameter when multiple WordPress sites are configured.
• Active site session: wordpress_set_active_site correctly applies to subsequent tool calls in the same MCP session.

Deploy the updated MCP server image/code only; no WordPress plugin update required.

v1.4.0

Highlights

• Post templates — admin-defined templates with auto-match rules; wordpress_list_post_templates and template options on create
• Verified media — decode/hash before write, post-upload verification with rollback on failure
• Consolidated tools — MCP surface reduced from 50 to 42 purpose-built tools

Tool migration

See UPGRADING.md for the full v1.3.0 → v1.4.0 tool migration table.

Assets

• wordpress-chatgpt-1.4.0.zip — WordPress plugin (PHP 8.3+)
• MCP server: deploy from packages/mcp-server (Node 24+) or Docker (make prod-up)

Full changelog: CHANGELOG.md

v1.3.0

v1.3.0

Added

• featured_media support on wordpress_create_content, wordpress_update_content, and wordpress_preview_content_update: attach an uploaded image by media ID or pass 0 on update to remove it. Content responses now return the selected media ID for verification.
• Full media lifecycle tools: update attachment metadata and permanently delete media.
• WordPress.org-only plugin and theme management; granular user management and curated site settings.
• Navigation menu REST management, Site Health, update status, maintenance mode, content revisions, redirects, and a capped 404 monitor.
• MCP tools for plugins, themes, users, media, settings, health, update status, maintenance mode, core update, revisions, and redirects.

Security

• Connector scopes are a second allowlist on top of WordPress capabilities and object-level permissions.
• Featured images and WordPress media markup/galleries require media.embed, attachment edit permission, and a valid image attachment; uploading a new file remains media.upload.
• Plugin/theme installs accept only official WordPress.org slugs. Code changes, user changes, settings, redirects, maintenance, restores, and core updates require MCP confirmation.

Fixed

• Media uploads now accept WordPress's documented successful wp_upload_bits() result (error: false) instead of incorrectly returning WORDPRESS_ERROR.

Deploy

• MCP server: rebuild and restart (make prod-up or docker compose ... up -d --build mcp)
• WordPress plugin: upload wordpress-chatgpt-1.3.0.zip or sync packages/wordpress-plugin

See CHANGELOG.md for full details.

v1.2.1

v1.2.1

Added

• Configurable OAuth rate limits on the MCP server via .env (enable/disable + per-endpoint max/window)
• Configurable REST rate limits on the WordPress plugin via wp-admin → WordPress - MCP → Settings
• Optional wp-config.php overrides: MCP_RATE_LIMIT_ENABLED, MCP_RATE_LIMIT_MAX, MCP_RATE_LIMIT_WINDOW_SECONDS

Fixed

• OAuth client registration shared rate-limit bucket behind reverse proxies (MCP_TRUST_PROXY, default on)
• WordPress Settings save returning a blank admin-post.php page

Deploy

• MCP server: rebuild and restart (make prod-up or docker compose ... up -d --build mcp)
• WordPress plugin: upload wordpress-chatgpt-1.2.1.zip or sync packages/wordpress-plugin

See CHANGELOG.md for full details.

v1.2.0

Highlights

• MCP request observability — an X-Request-Id header correlates a tool call across the MCP server's own event log and the WordPress site's audit log; every REST endpoint now logs with duration (not just mutations); new wordpress_get_mcp_stats / wordpress_get_mcp_request_log tools; log retention (MCP_LOG_RETENTION_DAYS); admin Audit Log page gained filters, a summary, and CSV export
• On-site SEO tools (no external API calls) — wordpress_get_robots / wordpress_update_robots, wordpress_seo_audit, wordpress_get_seo_metadata / wordpress_update_seo_metadata / wordpress_seo_fix; auto-detects Yoast/Rank Math, falls back to the plugin's own fields
• wordpress_get_site_limits reports the site's real PHP upload/content limits; MCP's own body limit is now a configurable backstop (MCP_JSON_BODY_LIMIT), not a hard ceiling
• Node 24 upgrade for the MCP server (current Active LTS)
• Also includes everything from the in-flight tool-policy/DTO/resources/session-manager work: safety gates, resource discovery, content diff preview, semantic search, session-aware site selection, and tool allowlisting — plus a security/quality audit's worth of fixes (denial handling, resource-list resilience, nested DTO projection, session-eviction observability, tag-diff case sensitivity, media MIME-sniff hardening, protected-postmeta query guard)

Full changelog: https://github.com/jooservices/wordpress-mcp/blob/v1.2.0/CHANGELOG.md#120---2026-08-30

v1.1.0

Highlights

• OAuth refresh tokens with rotation and persistent storage (OAUTH_DATA_DIR volume) — ChatGPT connectors survive token expiry and MCP restarts
• Plugin scope hardening — terms.read, correct page capabilities, post/page-only content, revoked connection permanent delete
• Production deploy — make prod-up no longer requires MCP_DOMAIN / ACME_EMAIL unless using built-in Caddy HTTPS

Full changelog: https://github.com/jooservices/wordpress-mcp/blob/v1.1.0/CHANGELOG.md#110---2026-08-30

v1.0.0

JOOservices ChatGPT Connector v1.0.0

First public release.

Highlights

• WordPress plugin with scoped REST API, connections, audit log, rate limiting
• MCP server with 14 tools and Streamable HTTP transport
• Multi-site: one MCP server → many WordPress sites via WORDPRESS_SITES
• OAuth 2.1 Mixed auth (anonymous read, OAuth-gated write)
• PHP 8.3+, Docker dev/prod stacks

Install

• Plugin: download wordpress-chatgpt-1.0.0.zip below, or see WORDPRESS-SETUP.md
• MCP server: see DEPLOYMENT.md

Full changelog: CHANGELOG.md