Changelog

September 28, 2026

• New – "Require preview before high-risk actions" now works. Actions that can't be undone – permanently deleting media, recompressing an image, deleting a category or tag, removing a menu item, navigation item or widget – first return a preview and only run when the AI calls again with confirm=true.
• New – "Email me on high-risk actions" now emails the site admin address whenever a high-risk action runs (including confirmed bulk changes), limited to 10 emails an hour.
• New – "Weekly activity summary" now emails a weekly digest of tool calls, changes and high-risk actions. Weeks with no activity are skipped.
• Improvement – Clearer descriptions for these settings and for "Show activity feed".
• New – Help menu in the WindCodex Ops settings header, with quick links to the documentation, the support forum, and leaving a review.
• New – "Settings" and "Docs" links on the Plugins screen.

September 24, 2026

• Add – "Who can connect" setting under Settings > WindCodex Ops > General – Administrators only by default, or Editors and above. Only those users can approve an AI connection on the consent screen.
• Security – A connection now stops working as soon as the user who approved it loses that role or is deleted, and every tool call requires it.
• Improvement – Removed the "Acting user" setting. Every connection runs as the person who approved it – there is no shared or fallback account.
• Improvement – Removed the custom delete confirmation on the Plugins screen (WordPress's standard one is shown instead), the relabelling of this plugin's row on the Enable Abilities for MCP settings screen, and the script that moved other plugins' notices on the WindCodex Ops settings page. Notices now appear above the settings header.

September 23, 2026

• New – Initial release of Windcodex Ops as its own standalone, entirely free plugin.
• New – 100+ tools across 5 groups: content, media, SEO, site structure, and site health.
• New – OAuth connector with automatic client registration, a static Client ID/Secret fallback, and per-app revoke.
• New – Per-user requests-per-minute limit (10-600, default 120).
• New – 72-hour undo for posts, pages, categories, and tags.
• New – WordPress Abilities API support.