Building WordPress Websites With AI Coding Agents and What Holds Up

AI coding agents can speed up WordPress development, but the websites that hold up are the ones where an experienced developer directs, reviews and tests every change. Agents are now good at producing plugins, templates and fixes from a plain description, which makes them tempting for small changes and whole builds alike. For organisations investing in bespoke WordPress development for B2B organisations, the question is not whether AI can write the code but how that code is checked before it reaches a live website.

This piece looks at what AI coding agents do well on WordPress, where they struggle and the checks that separate a solid build from one that causes problems later. It draws on guidance from the WordPress project itself and from the UK’s National Cyber Security Centre.

What AI Coding Agents Do Well on WordPress

AI coding agents are good at the repetitive, well documented parts of WordPress development, such as scaffolding a plugin, writing a template or converting a design into markup. WordPress has a huge public body of code and documentation, so agents have plenty of examples to learn from.

The WordPress project has noticed the shift. A post on the official WordPress news blog says AI code agents are getting better at writing WordPress plugins and themes, but testing can still be the slow part. The same post describes a contributor’s tool that lets agents run WordPress and check their own work as they go.

The project’s own AI team is also building ways for AI tools to work with WordPress. The WordPress AI team has announced its MCP Adapter as a canonical plugin, which gives AI tools a standard way to connect to a WordPress website.

Can AI Code a WordPress Website

AI can code a working WordPress website, but it cannot decide what that website should do or judge whether the result is good enough for a business to rely on. Given a clear brief, an agent can produce a block theme, custom post types, contact forms and the templates that hold them together far faster than a person typing every line.

The WordPress project is candid about this. The README for its agent skills repository says AI assistants often generate outdated patterns, miss security issues, skip block deprecations and ignore the tooling already set up in a project. The skills give agents written WordPress procedures to follow rather than leaving them to guess.

How WordPress Is Preparing for AI Agents

WordPress is preparing for AI agents by publishing instructions they can follow and by giving them a standard, controlled way to connect to a website. Three pieces of work from the project matter most for anyone planning a build.

The Abilities API lets plugins, themes and core describe what they can do in a standard format that software can read. Each ability has defined inputs, outputs, permissions and logic, which gives an AI tool a predictable route into WordPress instead of guessing its way around admin screens.

The MCP Adapter then turns those abilities into tools an AI client can discover and run. Abilities are private by default, so a developer has to choose which ones to expose. That choice deserves the same care as any other permission on the website.

Where AI Written WordPress Code Falls Short

AI written WordPress code falls short where it needs judgement about security, context and long term upkeep rather than pattern matching. An agent can produce code that runs perfectly in a quick test while still handling user input carelessly or ignoring how the rest of the website works.

None of these problems is unique to AI. They are the same mistakes inexperienced developers make, which is why the answer is the same review process any professional team should already have.

The speed of AI makes that review more important, not less. When code arrives in seconds, it is easy to skip the slower step of reading it properly. That is where weaknesses slip through.

Plugins deserve particular care when an agent is involved. It will happily add a new plugin to solve each small request. Our guide to plugin bloat and performance explains why that habit slows websites down over time.

Security Checks That Matter Most

The most important security checks for AI written WordPress code are the ones WordPress itself sets out for every developer. The WordPress security handbook tells developers to validate and sanitise user input before using it, to escape on output and never to trust user input.

Those principles apply whoever writes the code. A reviewer should confirm that forms, settings pages and anything that touches the database follow them, because these are the places attackers look first.

The wider picture comes from UK guidance. The National Cyber Security Centre’s guidelines on secure AI system development include securing your supply chain and managing technical debt, both of which apply when AI tools become part of how a website is built.

Security also continues after launch. Updates, monitoring and quick fixes when issues appear are covered in our guide to improving WordPress security. They matter just as much for code an agent wrote.

How to Get the Benefits Without the Risks

The way to get the benefits of AI coding agents without the risks is to treat them as fast assistants inside a normal development process. Every change goes through version control, review, testing on a staging copy and a planned release, exactly as it would if a person had typed it.

Following the published WordPress coding standards also makes AI written code easier to maintain. Code that follows the same conventions as the rest of the project can be picked up by any developer later, rather than becoming a mystery nobody wants to touch.

Clear ownership completes the picture. Someone has to be responsible for the code once it is live, including updates and fixes, whether that is an in house team or a partner providing WordPress maintenance and security.

That responsibility is easier to keep when every change is recorded. A short note of what was changed, why and how it was tested saves time the next time someone needs to work on the same part of the website.

Which AI Is Best for Coding WordPress

The best AI for coding WordPress is the one that works within WordPress conventions, can test its own output and sits inside a development process with human review. Any agent produces weak code when it is given a vague brief and no way of checking its work.

A few qualities separate a useful setup from a risky one. These are the questions to ask of any tool and of any developer who uses one.

• Does it follow the WordPress coding standards and security handbook without being reminded?
• Can it run the code in a local or staging copy of WordPress and check the result?
• Does it produce code a developer can explain line by line?

Tools that load the WordPress agent skills and test their work in WordPress Playground meet several of these points. The deciding factor is still the person directing the agent. Our guide to hiring a WordPress developer covers the experience that matters.

Is WordPress Outdated

WordPress is not outdated, as the work on agent skills, abilities and MCP support shows a platform adapting to AI rather than being replaced by it. It still powers a large share of the web, with W3Techs reporting that WordPress runs 39.6% of all websites and 58.3% of websites where the content management system is known.

That scale works in favour of AI assisted development, because few platforms have as much public code and documentation as WordPress. Our look at WordPress 7 and the AI era covers what the latest release means for organisations planning their next build.

What This Means for Your Website

For most businesses, AI coding agents mean faster and cheaper changes to a WordPress website, as long as the people using them know WordPress well. The risk is not the agent itself but code that reaches a live website without anyone checking it properly.

When choosing who works on your website, ask how AI written code is reviewed and tested before release. A clear answer about standards, testing and ongoing WordPress support tells you far more than whether AI tools are used at all.