Safety and permissions

What Claude can and can't do, who can connect and how to revoke access.

Your account's rights, no more. Claude acts as the WordPress account that approved the connection. An editor can't reach administrator-only tools.
Drafts first. Creating and updating write drafts. Publishing, scheduling, editing a live post and moving to trash each need you to say so in the chat.
Who can connect: accounts that can write posts. Each connection is listed under Connected clients with its account and last use.
Revoke a single connection, or all of them, at any time. Turning the connector off stops every connection at once.
Sign-in: standard OAuth 2.1 with PKCE. Access tokens last an hour and refresh tokens are rotated on every use; a reused refresh token ends that whole connection. Only hashes of tokens are stored.

In the plugin