Requirements and compatibility
What your site, host and AI app need: WordPress 6.0+, PHP 7.4+, HTTPS, headers, firewalls and proxies, multisite and the MCP versions PowerWP AI speaks.
PowerWP AI runs on ordinary WordPress hosting. Most sites meet every requirement already. This page lists what is needed, and what to check if a host, firewall or proxy gets in the way.
Your site#
| Requirement | Details |
|---|---|
| WordPress | 6.0 or newer. Tested up to 7.1. |
| PHP | 7.4 or newer. Below 7.4 the plugin stays inactive and shows a notice. The Environment checks suggest PHP 8.2 or newer when possible. |
| HTTPS | Required on public sites. See below. |
| PHP zlib extension | Needed to create snapshots and backups. |
| Loopback requests | The server must be able to request its own pages. PowerWP AI uses this for health checks, and WordPress uses it for WP-Cron. |
| Writable folders | The private storage folder (inside wp-content unless you set WPAI_MCP_STORAGE_DIR) and wp-content/mu-plugins/ for the rescue loader. |
| Disk space | The Environment checks warn when less than 1 GB is free, because backups may not fit. |
| WooCommerce | Optional. 7.0 or newer. High-Performance Order Storage and the Cart and Checkout blocks are declared as compatible. The WooCommerce tools only work when WooCommerce is active. |
| WordPress Abilities | The two ability tools need WordPress 6.9 or newer. |
| Permalinks | Any structure works for key-based connections. Sign-in for Claude and ChatGPT needs a structure other than Plain. |
| Page builders | Elementor pages can be read and edited by widget (new in 1.6). Other page builders have no builder-specific tools: your AI app works on the page content WordPress stores, with a dry run and a recorded change. |
Run the Environment checks on PowerWP AI › Dashboard (select Run checks) to test most of this on your own server.
HTTPS#
AI requests over plain HTTP are refused with a 403 error, so keys never travel unencrypted. Sites on local development addresses are exempt. The setting is Settings › Connection security › Require HTTPS, on by default.
If your site sits behind a reverse proxy or load balancer that ends HTTPS, turn on Trust X-Forwarded-Proto in the same place. Otherwise PowerWP AI sees plain HTTP and refuses the request.
Headers#
Every setup step sends the key in an X-WPAI-Token header. Authorization: Bearer also works. Some hosts strip the Authorization header (Apache with FastCGI, some proxies, JWT plugins), which is why X-WPAI-Token is the default. The Environment checks test both headers and tell you which one reaches WordPress.
Firewalls, CDNs and security plugins#
- Web application firewalls and security plugins, such as Cloudflare, Wordfence, Sucuri and Solid Security, and "disable REST API" plugins can block
/wp-json/wpai/v1/. Allow that path. PowerWP AI has its own token check, rate limits, lockouts and IP allow-lists. - Behind Cloudflare or another proxy, every request seems to come from the proxy. Under Settings › Connection security › Client IP source choose the header your proxy sets:
REMOTE_ADDR,CF-Connecting-IP,X-Forwarded-FororX-Real-IP. Pick a proxy header only if the site really is behind that proxy, or clients could fake their IP address. This matters for IP allow-lists and lockouts. - Basic-auth protection or maintenance plugins must not block the server's requests to itself.
- Requests that carry a browser
Originheader from another site are refused. Desktop and command-line apps send none. - On nginx, deny web access to the storage folder. See Install the plugin.
- If WP-Cron is disabled on your site, let a system cron call
wp-cron.php. Backups still progress while the Backups screen is open or an AI app checks on them.
Multisite#
Install PowerWP AI on a single site. Multisite networks have not been tested, so they are not supported yet.
MCP protocol versions#
The endpoint is a Streamable HTTP MCP server at /wp-json/wpai/v1/mcp on your site. It supports protocol 2026-07-28 (stateless) and 2025-11-25, 2025-06-18, 2025-03-26 and 2024-11-05 (with sessions). See MCP endpoint and headers.
Your AI app#
The app must support remote MCP servers over Streamable HTTP. It then connects in one of two ways:
- With a key. The app sends the key in a custom header, or in a bearer-token field. Claude Code, Codex (also in the ChatGPT desktop app), Cursor, VS Code, Devin Desktop, Gemini CLI, Kimi Code, LM Studio and other apps connect this way.
- By signing in. Claude (claude.ai, the Claude app and the phone apps) and ChatGPT (on the web and in its apps) open your site's WordPress sign-in and need only the site's address. No key is copied. This is new in PowerWP AI 1.6. The site must be reachable from the internet, so it does not work for a site on your own computer. If sign-in is not offered, connect Claude Code with a key instead.
Some apps need a little more. The older Claude Desktop route uses a small connector, mcp-remote, which needs Node.js 18 or newer, though signing in to Claude is simpler. LM Studio needs version 0.3.17 or newer and a model that supports tool use. To run models on your own computer, use LM Studio.
The AI app and its plan are not part of PowerWP AI.