Access and safety
Every guard Saddle puts between an AI app and your site, and how to use each one.
Access levels
The access level on Saddle → Permissions is the ceiling for every connected app.
| Level | What the AI can do |
|---|---|
| Read | Read posts, pages, media, your theme’s design and recent changes. Nothing on the site can change. New sites start here. |
| Read & write | Create and edit posts and pages, build pages, and upload and edit media. |
| Managing the site | Also change settings and permalinks, activate plugins, switch themes and clear the cache. |
You can also turn off any single tool on the same screen.
Three more limits sit under the access level:
- A connection cannot outrank its account. It acts as a specific WordPress user and has that user’s permissions. An Editor’s connection cannot do what an Editor could not do by hand.
- A sign-in grant can only lower the level. If the site allows Read & write but you approved an app for Read, that app gets Read.
- A connection cannot change Saddle itself. A Saddle key only works at the MCP address. It cannot reach Saddle’s settings, so an app can never raise its own level or give itself a new key.
Deleting always asks twice
Anything that deletes or overwrites returns a preview first, with a single-use code. The change runs only when the app sends that code back, which a good app does only after you agree.
- The code works once, for that exact change, and expires after 15 minutes.
- Deleted posts and pages go to the trash by default.
Drafts-only
Turn on Drafts-only under Saddle → Permissions. New posts and pages then always save as drafts, whatever the AI asks for. Publishing an existing draft shows a preview and needs a confirmation.
Edits to content that is already published still go live, because that content is already public. Drafts-only is off by default.
Pause
Saddle → Settings has one switch that refuses every request from every app, immediately. Saddle forgets nothing while paused. Resuming puts everything back as it was.
Protected settings
Even at Managing the site, the site URL, security keys, user roles and admin email cannot be changed through Saddle.
The activity log
Saddle → Activity lists every change a connected app made, and every request it was refused. Every edit is also a normal WordPress revision, so you can restore an earlier version from the editor.
No code, no files
Saddle never runs code sent by an AI. It has no PHP execution, no shell and no WP-CLI passthrough, and it does not write files. Every action is a standard WordPress function, and changes go to the database only.
The plugin’s source is public, so you can check this yourself.
Privacy
Your AI app connects to your own WordPress. Saddle has no servers in between, needs no account and sends no tracking or usage data.
The version on WordPress.org never contacts another site on its own. It connects out only when you ask it to:
- Upload from URL. WordPress downloads the one file you asked for.
- Connection check. Saddle sends a test request to your own site.
- Unsplash, if you add your own key. Your search words or a photo ID go to Unsplash, and the photo is downloaded from Unsplash.
- Sign-in for ChatGPT, if you turn it on. Saddle reads a public address the app provides, to confirm who the app is. It sends nothing about your site.
Sign-in tokens are stored only as a one-way fingerprint, so a database backup holds nothing anyone could sign in with.
Saddle Pro adds one outbound request: a license and update check to Freemius. It carries licensing details only, never your content.