LW Site Manager

WordPress Site Manager using the Abilities API - full site maintenance via AI/REST.

Overview

Installation

composer require lwplugins/lw-site-manager

Or download from GitHub and upload to /wp-content/plugins/lw-site-manager.

Requirements

• PHP 8.1 or higher
• WordPress 6.9 or higher (requires Abilities API)

What is the Abilities API?

The WordPress Abilities API is a feature introduced in WordPress 6.9 that enables WordPress sites to expose structured, discoverable, and secure operations to external systems (AI assistants, automation tools, remote administration panels).

The Abilities API is a standardized interface through which:

• AI systems (Claude, ChatGPT, Gemini) can understand and execute WordPress operations
• Automation tools (n8n, Make, Zapier) can integrate with WordPress
• Central management interfaces can control multiple WordPress sites

Why Abilities API Over REST API?

Annotation Meanings

These annotations help AI systems and automation tools understand how “dangerous” an operation is and whether user confirmation is needed.

Features

Site Management

• Updates Management - Check and apply updates for core, plugins, and themes
• Plugin Management - Install, activate, deactivate, and delete plugins
• Theme Management - Install, activate, and delete themes
• Content Management - Full CRUD for posts, pages, and custom post types
• Taxonomy Management - Manage categories, tags, and custom taxonomies
• User Management - Create, update, and manage users
• Media Management - Upload and manage media files
• Comments Management - Moderate and manage comments
• Backup & Restore - Create and restore site backups
• Health & Diagnostics - Monitor site health and PHP errors
• Database Maintenance - Optimize, cleanup, and repair database
• Cache Management - Flush object cache, page cache, and OPcache
• Settings Management - Read and update WordPress options
• Meta Management - Manage post, user, and term metadata
• WooCommerce Integration - Manage products, orders, and reports (if WooCommerce is active)

AI Integration

LW Site Manager is designed for AI agent integration via multiple interfaces:

+-------------+     MCP      +-----------------+     REST     +-------------+
|   Claude    | <----------> |  MCP Adapter    | <----------> |  WordPress  |
|   (AI)      |              |                 |              |  Abilities  |
+-------------+              +-----------------+              +-------------+

LW Plugin Abilities

LW Site Manager also exposes abilities from other LW plugins when they are active. See each plugin’s documentation for their available abilities.

Authentication

Use WordPress Application Passwords for API authentication:

1. Go to Users > Your Profile > Application Passwords
2. Create a new application password
3. Use Basic Auth with your username and app password

curl -u "username:xxxx-xxxx-xxxx-xxxx" <URL>

REST API Endpoints

Read-only abilities use GET with input[] query parameters. Write abilities use POST with {"input":{...}} JSON body.

Ability Categories

Plugin Management Abilities

list-plugins

List all installed plugins.

Method: GET

Input:

Output:

{
  "plugins": [
    {
      "slug": "akismet/akismet.php",
      "name": "Akismet Anti-spam",
      "version": "5.6",
      "author": "Automattic",
      "active": true
    }
  ],
  "total": 7
}

install-plugin

Install a plugin from WordPress.org.

Method: POST

Input:

activate-plugin / deactivate-plugin

Activate or deactivate a plugin.

Input:

delete-plugin

Delete a plugin.

Input:

update-plugin

Update a single plugin.

Input:

Output:

{
  "success": true,
  "message": "Plugin updated successfully: 1.6.6 -> 1.6.7",
  "old_version": "1.6.6",
  "new_version": "1.6.7"
}

check-updates

Check for available updates (core, plugins, themes).

Input:

update-all

Update all plugins and themes at once.

Input:

Theme Management Abilities

list-themes

List all installed themes.

install-theme

Install a theme from WordPress.org.

Input:

activate-theme / delete-theme / update-theme

Manage theme lifecycle. Input requires theme (string, theme slug).

Content Abilities - Posts

list-posts

List posts with filtering and pagination.

Input:

get-post

Get detailed post information by id or slug.

create-post

Create a new post.

Input:

update-post

Update a post. Requires id, all other fields optional.

delete-post

Delete a post. Input: id (required), force (boolean, skip trash).

restore-post / duplicate-post / bulk-posts

Additional post operations. bulk-posts accepts ids (array) and action (publish, draft, trash, delete, restore).

get-post-types

List available post types. Filter by public (boolean).

set-post-terms / get-post-terms

Manage taxonomy terms for a post. Supports custom post types and custom taxonomies.

Content Abilities - Pages

list-pages

List pages with filtering. Similar to list-posts but defaults to menu_order sort.

get-page / create-page / update-page / delete-page

Full CRUD for pages. Same structure as post abilities with additional parent, menu_order, and template fields.

page-hierarchy

Get hierarchical page tree.

page-templates

List available page templates.

front-page-settings / set-homepage / set-posts-page

Manage homepage and blog page settings.

restore-page / duplicate-page / reorder-pages / set-page-template

Additional page management operations.

Content Abilities - Comments

list-comments

List comments with filtering.

Input:

get-comment / create-comment / update-comment / delete-comment

Full CRUD for comments.

approve-comment / spam-comment

Quick status actions for comments.

bulk-comments

Bulk operations. Input: ids (array), action (approve, unapprove, spam, trash, delete).

comment-counts

Get comment statistics, optionally filtered by post_id.

Content Abilities - Media

list-media

List media items. Filter by mime_type (e.g., image, video).

get-media

Get detailed media item information including sizes.

upload-media

Upload media from URL or base64 data.

Input:

update-media / delete-media

Update metadata or delete media items.

Taxonomy Abilities - Categories

list-categories / get-category / create-category / update-category / delete-category

Full CRUD for categories. Supports custom taxonomies via the taxonomy parameter (e.g., product_category).

list-categories Input:

Note: The default category (Uncategorized) cannot be deleted. Posts in deleted categories move to default.

Taxonomy Abilities - Tags

list-tags / get-tag / create-tag / update-tag / delete-tag

Full CRUD for tags. Supports custom taxonomies via the taxonomy parameter (e.g., product_tag).

Note: Tags are not hierarchical. Deleted tags are automatically removed from associated posts.

Meta Abilities

Post Meta

get-post-meta Input:

User Meta

Term Meta

Note: Private meta keys (starting with _) are not included by default. Use include_private: true to include them. Meta values can be simple types or complex types (arrays, objects) - WordPress handles serialization automatically.

User Management Abilities

list-users

List users with filtering and pagination.

Input:

get-user

Get detailed user information by id, email, or login.

create-user

Create a new user.

Input:

Note: The password field is only included in the response if it was auto-generated.

update-user / delete-user

Update user fields or delete a user. Delete supports reassign_to for content reassignment.

reset-password

Reset a user’s password. Identify by id, email, or login.

get-roles

List all available roles with user counts.

Settings Abilities

General Settings

Updatable fields: blogname, blogdescription, admin_email, users_can_register, default_role, timezone_string, date_format, time_format, start_of_week, WPLANG

Note: siteurl and home cannot be modified via API for security reasons.

Reading Settings

Discussion Settings

Permalink Settings

Maintenance Abilities

Backup

create-backup Input:

Output:

{
  "success": true,
  "backup_id": "2026-01-13_07-04-13_8fMZyHG8",
  "status": "pending",
  "total_files": 6270,
  "total_size_human": "118 MB",
  "chunks_total": 13
}

Note: Backups run asynchronously. Use backup-status to track progress. Backups are stored in wp-content/uploads/wpsm-backups/.

Health & Diagnostics

health-check

Run a comprehensive site health check.

Input:

Output:

{
  "status": "recommended",
  "score": 87,
  "issues": [
    { "type": "warning", "message": "4 theme update(s) available", "category": "updates" }
  ],
  "php_version": "8.1.31",
  "wp_version": "6.9",
  "disk_usage": { "total_human": "37 GB", "free_human": "24 GB", "wordpress": { "total": "187 MB" } },
  "memory": { "limit": "256 MB", "usage": "8 MB" }
}

error-log

Get PHP error log.

Input:

Database

optimize-database

Optimize database tables.

Input: tables (array, optional - all tables if empty)

cleanup-database

Delete revisions, transients, spam and other unnecessary data.

Input:

Cache

flush-cache

Flush caches (object cache, page cache, OPcache, plugin caches).

Input:

Plugin Database Updates

WooCommerce Abilities

WooCommerce abilities are only available when WooCommerce is active.

Products

wc-list-products Input:

Orders

wc-update-order-status Input:

Reports

wc-sales-report Input:

wc-revenue-stats Input:

Output (with comparison):

{
  "success": true,
  "period": "last_7_days",
  "current": { "revenue": 850.00, "orders": 15, "items_sold": 28 },
  "previous": { "revenue": 720.00, "orders": 12, "items_sold": 22 },
  "changes": {
    "revenue": { "value": 130.00, "percentage": 18.06, "trend": "up" },
    "orders": { "value": 3, "percentage": 25.00, "trend": "up" }
  }
}

Extending with Custom Abilities

LW Site Manager provides two action hooks that allow any WordPress plugin to register its own abilities and categories.

Hooks

Quick Start

// In your plugin's init or plugins_loaded hook:
add_action( 'lw_site_manager_register_categories', function (): void {
    wp_register_ability_category( 'my-plugin', [
        'label'       => __( 'My Plugin', 'my-plugin' ),
        'description' => __( 'My plugin management abilities', 'my-plugin' ),
    ]);
});
 
add_action( 'lw_site_manager_register_abilities', function ( $permissions ): void {
    wp_register_ability( 'my-plugin/get-status', [
        'label'               => __( 'Get Status', 'my-plugin' ),
        'description'         => __( 'Get current plugin status.', 'my-plugin' ),
        'category'            => 'my-plugin',
        'execute_callback'    => [ MyService::class, 'get_status' ],
        'permission_callback' => $permissions->callback( 'can_manage_options' ),
        'input_schema'        => [
            'type'    => 'object',
            'default' => [],
        ],
        'output_schema'       => [
            'type'       => 'object',
            'properties' => [
                'success' => [ 'type' => 'boolean' ],
                'status'  => [ 'type' => 'string' ],
            ],
        ],
        'meta' => [
            'show_in_rest' => true,
            'annotations'  => [
                'readonly'    => true,
                'destructive' => false,
                'idempotent'  => true,
            ],
        ],
    ]);
});

Naming Convention

Use your plugin slug as prefix to prevent naming collisions:

my-plugin/get-status
my-plugin/set-options
lw-seo/get-meta
lw-cookie/get-consent

Permission Manager

The $permissions parameter provides these methods:

You can also use a custom callback:

'permission_callback' => fn() => current_user_can( 'my_custom_capability' ),

Input/Output Schema

Both use JSON Schema format:

'input_schema' => [
    'type'       => 'object',
    'required'   => [ 'post_id' ],
    'properties' => [
        'post_id' => [
            'type'        => 'integer',
            'description' => __( 'The post ID.', 'my-plugin' ),
        ],
    ],
],

Execute Callback

A static method that receives array $input and returns array (success) or \WP_Error (failure):

class MyService {
    public static function get_status( array $input ): array|\WP_Error {
        if ( empty( $input['post_id'] ) ) {
            return new \WP_Error(
                'missing_id',
                __( 'Post ID is required.', 'my-plugin' ),
                [ 'status' => 400 ]
            );
        }
 
        $post = get_post( (int) $input['post_id'] );
        if ( ! $post ) {
            return new \WP_Error( 'not_found', __( 'Post not found.', 'my-plugin' ), [ 'status' => 404 ] );
        }
 
        return [ 'success' => true, 'status' => $post->post_status ];
    }
}

No Hard Dependency

Your plugin should work even if LW Site Manager is not installed. The hooks simply never fire:

// Safe - these hooks are no-ops if site manager is not active.
add_action( 'lw_site_manager_register_categories', [ MyIntegration::class, 'register_category' ] );
add_action( 'lw_site_manager_register_abilities', [ MyIntegration::class, 'register_abilities' ] );

Recommended File Structure

your-plugin/
  includes/
    SiteManager/
      Integration.php    # Hook registration + category
      Abilities.php      # wp_register_ability() calls
      Service.php        # Execute callbacks

Real-World Example: LW SEO

includes/SiteManager/
  Integration.php    # Hook registration
  SeoAbilities.php   # Ability definitions
  SeoService.php     # Execute callbacks

Registered abilities:

Official Sources

• Introducing the WordPress Abilities API 
• Abilities API - Common APIs Handbook 
• Abilities API in WordPress 6.9 
• @wordpress/abilities Package 
• GitHub: WordPress/abilities-api 

FAQ

What is the WordPress Abilities API?

The WordPress Abilities API is a feature in WordPress 6.9 that allows plugins to register standardized capabilities that can be executed via REST API, PHP, or JavaScript.

How do I authenticate API requests?

Use WordPress Application Passwords. Go to Users > Your Profile > Application Passwords to create one. Then use Basic Auth with your username and app password.

Does this work with WooCommerce?

Yes. When WooCommerce is active, additional abilities for managing products, orders, customers, and reports become available.

How does the HTTP method get determined?

The WordPress Abilities API determines HTTP method based on meta annotations:

• readonly: true - GET
• destructive: true, idempotent: true - DELETE
• otherwise - POST