VideoWhisper Site Manager for ChatGPT, Claude, Codex, Grok

Review AIOSEO titles and descriptions with your assistant. Select AIOSEO in Images and SEO, read the current overrides, and save a private single-item proposal. Compare it in WordPress before applying. AIOSEO owns defaults, smart tags, caches and frontend output; canonical, indexing, social and schema settings remain in its editor. Existing tools, personal restrictions and connection permissions remain in force.

Review one page section with your assistant. Read a compact Gutenberg block list, select a supported plain-text paragraph or heading, and prepare a private before/after proposal. Review it in WordPress before applying. Other blocks keep their exact source bytes; formatting, nested, bound, locked and builder content stays with its native editor. No whole-document echo, automatic application or publication is added. Enable item reviews in Images and SEO and review the new section tools in Tool access and any restricted connection. Existing grants and personal restrictions are retained.

Manage WordPress with ChatGPT, Claude, Codex or Grok using your own account. Site Manager provides MCP, REST/OpenAPI, local OAuth and optional reviewed WordPress Abilities. Your AI subscription remains separate; the plugin does not call model providers directly.

Included workflows:

• Read, draft and update permitted Posts and Pages, inspect revisions and recover supported own actions.
• Compare exact content, image metadata and SEO proposals in WordPress before a human applies them.
• Use enabled media-library reads, reviewed image intake and metadata tools.
• Read/edit supported SEO through the selected output owner; optional Site Kit Search Console evidence helps choose one page to review.
• With the compatible Agentic Multilingual Translator, translate your own public Posts/Pages in available languages, save private drafts and publish only when all configured permissions allow. Supported WPBakery text and labels preserve builder structure and links.
• Resume own-content translation plans across small, private batches. Retrieve progress/notes, retry without duplicating work and assemble a complete draft before separately permitted publication. New tools still require the applicable native tool and connection reviews.
• Connect several separately managed sites through the optional hosted relay, retaining each site’s own permissions.

Popular uses

Prepare a blog draft, improve image descriptions, compare one SEO change, or review a multilingual page with your assistant. The optional relay lets the same agent session move between separately authorized sites.

Quick activation guides allowed roles and separate Admin/Other Roles presets through exact native review. Site Read Only, publication controls, WordPress capabilities, connection grants and personal tool exclusions remain authoritative. Draft mode keeps writes unpublished. Existing restricted/revoked policies are retained on upgrade. Optional integrations and native Abilities require their own approvals.

Start in Onboarding, review activation, then open AI/SI Agents to connect your app and try the first workflow with a read and disposable draft. Translation access and publication have separate opt-ins in Multilingual Translator > Settings. Refresh discovery after reviewing new tools.

Requires WordPress 6.9+ and PHP 8.2+. Prefer a maintained newer PHP branch. Direct local OAuth works without the hosted service. See the product page for setup and available integrations.

Extension Hooks

Developers can extend this plugin without editing core files. Common hooks include:

1. Settings and admin UI: vwsm_settings_defaults, vwsm_settings_normalized, vwsm_admin_settings_save, vwsm_rest_settings_payload, vwsm_settings_tab_label, vwsm_settings_form_publishing_rows, vwsm_settings_form_security_rows, vwsm_settings_form_rate_limits_rows, vwsm_settings_form_logs_revisions_rows, vwsm_settings_form_turnkey_oauth_rows, vwsm_settings_form_authentication_rows, vwsm_settings_form_application_passwords_rows, vwsm_settings_form_content_rows, vwsm_settings_form_admin_rows, vwsm_settings_form_attachments_rows, vwsm_settings_form_fomantic_rows, vwsm_settings_form_after_core_rows, vwsm_auth_methods_section.
2. Authentication and OAuth metadata: vwsm_oauth_server_url, vwsm_authorization_server_url, vwsm_rest_401_headers, vwsm_external_oauth_onboarding_urls, vwsm_onboarding_oauth_tab_content, vwsm_handle_external_register_gpt.
3. OpenAPI, MCP, and tools: vwsm_ai_actions, vwsm_ai_plugin_integrations, vwsm_ai_plugin_option_integrations, vwsm_ai_plugin_action_dispatch, vwsm_ai_action_native_openapi_tools, vwsm_mcp_server_name, vwsm_mcp_extra_tools, vwsm_mcp_dispatch_tool, vwsm_mcp_site_context, vwsm_openapi_components, vwsm_openapi_document, vwsm_write_rate_limit_mcp_tools.
4. Content and sanitization: vwsm_allowed_content_types, vwsm_revision_limit, vwsm_revision_gradient, vwsm_supported_extra_allowed_html_tags, vwsm_allow_extra_allowed_html_tags.
5. User connection workflows: vwsm_user_connect_handle_post, vwsm_user_connect_after_sections, vwsm_user_connect_tools_data, vwsm_user_connect_gpt_url.
6. Reviewed role availability: vwsm_tool_access_feature_map maps fixed boolean API settings to selected tool names; semantic map changes invalidate earlier role reviews. Credentials, source hosts, role eligibility and package approvals remain separate.
7. Operator and environment behavior: vwsm_default_operator_username, vwsm_use_current_user_mode.

Disclaimer

This plugin provides infrastructure for operating a WordPress site with external AI chatbots and agents. The site owner is solely responsible for the actions enabled through this functionality, including content created or changed by AI tools, credentials and access tokens, backups, privacy compliance, and any publishing or policy consequences.

AI-generated content can be inaccurate, defamatory, plagiarized, non-compliant, or otherwise unsuitable for publication. Review AI output and tool activity before publishing. Keep publishing disabled unless you fully understand and accept the risk.

Use HTTPS, protect Application Passwords and OAuth credentials, restrict access where possible, monitor logs, and maintain independent backups. Use at your own risk.

Authenticated MCP and REST context includes a bounded catalog snapshot with name/contract revisions for the current account and destination. It cannot inspect an AI app’s cached tool list. Complete every tools/list nextCursor, including empty refresh pages; keep the previous catalog on errors. A metadata refresh never grants access or retries a write. The versioned vwsm_action_catalog_diagnostics_v1 action exposes metadata stages for read-only observations, never execution or grant authority.

Frontend connection help

The [vwsm_user_connect] page provides section links, expandable app setup,
MCP URL copy buttons and a permission-aware tool list. Grok.com uses its custom
connector setup. Grok Bot has a separate Connect apps interface; custom MCP
availability depends on the product/account. Follow the linked provider guides.
Native WordPress abilities and optional MCP Adapter exposure have separate
administrator reviews. A connection can permit fewer tools than the account.
Personalized shortcode pages send no-cache headers; exclude them from any
reverse-proxy or full-page cache that ignores WordPress cache controls.

Privacy

Single-item proposals store the submitting user, selected item/operation, exact before/after fields, source permission identifiers, hash, creation/update/expiry and review result in a private review table. Bodies are escaped in native review and redacted from proposal request summaries. Native onboarding reviews use a session-bound, ten-minute transient and an expiring one-use marker; they contain selected tool metadata, never an authentication password. Disabling an optional bridge retains its existing reviewed user policies.

Native Abilities availability is stored in site options. Reviewed policies are private user metadata scoped to the site; they contain selected tool fingerprints, mode, native version, audience, user and epoch, plus the optional Adapter exposure choice. No Application Password is copied into these policies.

Local OAuth stores client names, registered callbacks, registration IP addresses, user/client IDs, granted scopes, versioned tool selections and permission mode, token expiry and last-use timestamps in this site database. Access/refresh tokens use keyed hashes and confidential client secrets use password hashes. Credentials are returned only during issuance and are not included in tool/audit payloads. Administrators can revoke tokens and remove clients from Local OAuth. Deactivating extensions does not remove the included local connection.

This plugin stores the following data on your WordPress site:

• Plugin settings in WordPress options (for example: publish, rate limit, HTTPS, IP allowlist, authentication, and provider URL settings)
• Audit log entries in a custom database table (*_vwsm_audit_logs)
• Optional dedicated operator user ID reference in WordPress options (when using onboarding helper)
• Short-lived transient for one-time Application Password display after creation (plaintext is not stored long-term)
• Short-lived transient cache for external bearer-token validation, when Turnkey OAuth is used
• Optional connected service account tokens, site keys, server URLs, and provider policy links used for remote account and Turnkey OAuth workflows
• A private vwsm_user_context user-meta value (up to 2,000 characters) when a user saves My Agent Context from [vwsm_user_connect]

Audit logs may include (depending on settings):

• Authenticated WordPress user ID
• Request route and method
• Sanitized request/response summaries
• Timestamp and IP address

This plugin does not send data to third-party AI services by itself.
This plugin does not include telemetry/analytics tracking by default.

Site owners are responsible for:

• Securing the site with HTTPS
• Managing WordPress users and Application Passwords
• Configuring GPT sharing safely (recommended: Only Me)
• Reviewing the privacy implications of any external AI service connected to the site’s API

External services

Optional Site Kit Search Console evidence

Off by default. Install Site Kit by Google v1.186+ and complete its Search Console setup separately. Explicitly enabling evidence and requesting a report uses Site Kit’s selected property, Google authorization and permission checks for the current WordPress account; Google may receive the selected dates and an optional local page URL. Site Manager stores no Google credentials and schedules no reports. Bounded query/page metrics returned to an explicitly approved connected assistant can contain non-public search terms; review tool access accordingly. Top rows may omit anonymized or delayed data and are not full site totals. Review candidates are heuristic, not forecasts. Existing reports do not grant SEO writes or publication.

Service: https://sitekit.withgoogle.com/ and https://search.google.com/search-console/
Privacy: https://policies.google.com/privacy
Terms: https://policies.google.com/terms

Optional user-selected image source

Only explicitly executed approved image intake sends a WordPress HTTP GET to the administrator-approved HTTPS source supplied by the agent/user. The source receives the URL (including any query), server network address and WordPress HTTP user-agent. Host validation may resolve DNS, including during a dry run. This feature supplies no WordPress login cookie, Application Password or OAuth token. The administrator chooses the destination and must review its terms/privacy policy. Manual editing, library reads, standalone SEO and disabled intake require no external image service. Source URLs and idempotency keys are redacted from audit summaries. The optional Connection doctor probe contacts only this site’s MCP endpoint without credentials.

This plugin can optionally connect to external services only when an administrator chooses a workflow that uses them, mainly as relay for multi site management. The default external services listed below are provided for free registration-based onboarding and multi site relay functionality. They do not require payment to use with this plugin. Site administrators can also configure another compatible third-party Relay & OAuth Server URL or add custom services through the documented WordPress hooks.

Promptaur Relay & OAuth Server

Default service URL: https://server.promptaur.com

This service is used for optional multi-site relay routing (manage multiple sites from same session), shared Turnkey OAuth, shared GPT/shared MCP onboarding, and bearer-token validation on this type of setup. It makes setup simpler by allowing users to connect through one shared OAuth login and, when enabled by the service, use pre-existing shared GPT or MCP connector configuration instead of creating their own.

Data sent to this service:

• When registering a site: the WordPress site URL, site name, and optional account or server registration token entered/configured by the administrator.
• When registering a GPT/OAuth client: the site key, site secret, client name, and GPT callback URL supplied in onboarding.
• When validating OAuth bearer tokens: the bearer access token plus the site’s registered site key and site secret. The plugin caches validation briefly according to the configured token cache TTL.
• When loading Turnkey configuration, status, disconnect, or user connection data: the site key, site secret, and the specific account/site/user connection values needed for that request.

Terms of Use: https://server.promptaur.com/terms-of-use/
Privacy Policy: https://server.promptaur.com/privacy-policy/

VideoWhisper Remote Connect

Default service URL: https://consult.videowhisper.com

This optional onboarding service is used by the VideoWhisper Remote Connect wizard to register or log in a contact, import connection settings, and simplify account/site setup for multi-site relay server. It is a free registration-based service used to improve onboarding; it is not required for direct Application Password setup.

Data sent to this service from the onboarding page:

• The client plugin identifier, WordPress site URL, and normalized site domain.
• Registration/login details entered by the administrator, such as name, email address, PIN/confirmation code, website/domain, and form fields returned by the service configuration.
• Remote account tokens returned by the service when the administrator chooses to import settings or push the current site URL/account state.

Terms of Use: https://consult.videowhisper.com/terms-of-use/
Privacy Policy: https://consult.videowhisper.com/privacy-policy/

Settings and user-policy extension hooks

Installed integrations may add Settings tabs with vwsm_settings_extension_tabs using a label and callable render function. Site Manager renders an extension tab outside its own settings form. Existing vwsm_ai_plugin_integrations and vwsm_tool_access_feature_map hooks supply integration metadata and feature mappings. Personal restrictions remain an additional ceiling on the resulting catalog.