# Your first safe session

> Try PowerWP AI with a read-only connection. Eight example questions, what your AI app does, and how to check the activity log afterwards.

A first session should not change anything. You give your AI app a connection that can only read, ask it to look around, and then check in the activity log exactly what it did. It shows you how PowerWP AI behaves before you give any app more permissions.

## Set up a read-only connection

:::steps
1. Open **PowerWP AI › Connections** and choose your AI app. If you have not installed and activated the plugin yet, start with the [Quickstart](/docs/get-started/quickstart/).
2. Under the question about what the app may do on your site, choose **Read-only diagnostics**. On the Free plan it is the only choice.
3. Under **More options** pick a short expiry, such as 7 days, if you only want to try it.
4. Connect the app with the steps on the screen and wait for the green "is connected" box.
:::

Read-only diagnostics gives the app the **Read & diagnostics** permission: site and server information, logs, health checks, content, options, WooCommerce data and read-only database queries. Passwords and keys are masked for connections without the Secrets permission.

Read-only means nothing is changed. What your app reads still reaches your AI provider, so ask only for what you need. See [Data and privacy](/docs/security/data/).

## Questions to ask

These are examples. Paste them into your AI app one at a time. Adjust the wording to your site.

**1. The overview**

```
Give me an overview of my site.
```

The app calls `site_overview` and answers with versions, theme, active plugins, caching, pending updates and recent PHP errors.

*Example reply on the demo store your-store.com. Your app's wording will differ.*

> "your-store.com runs WordPress 7.1 on PHP 8.3 with the Kitchenware theme and 14 active plugins. Page caching is on. Three plugin updates are waiting. In the last 24 hours the PHP log holds one warning, from the Recipe Cards plugin. I changed nothing."

In **PowerWP AI › Activity** you see the call to `site_overview`, marked OK.

**2. Errors**

```
Are there any errors in the logs from the last 24 hours? Don't change anything.
```

Uses `error_log_read`. It can read the WordPress debug log, the PHP error log and WooCommerce logs.

**3. Problems on real pages**

```
Check my homepage, one product page and the cart for problems.
```

Uses `page_check`, which loads each page from the server and reports the status, timing, PHP errors printed in the page and WordPress critical-error screens.

**4. Slow pages**

```
Which of those pages is slowest, and what could be slowing it down? Only report, don't change anything.
```

Builds on `page_check` timings and may add `server_info` for PHP limits, caching and disk space.

**5. Updates**

```
Which plugins and themes need updates, and is any of them risky to update?
```

Uses `updates_check` and `plugins_list`.

**6. WooCommerce health**

```
How healthy is my WooCommerce store? Look at failed orders, stock problems and payment gateways.
```

Uses `wc_overview`. This needs WooCommerce. Orders and customers contain personal data, so ask only for what you need.

**7. SEO basics**

```
Do an SEO check of my homepage: title, meta description, headings, images without alt text. Only report.
```

The [SEO check for one page](/docs/reference/recipes/#page_seo_check) recipe covers this. See [SEO audit and fixes](/docs/guides/seo/) for more.

**8. A security look**

```
Run a security check and list anything suspicious. Don't change anything.
```

Uses `security_scan` (a heuristic scan) and `integrity_check` (compares WordPress core files with the official checksums). A clean result is not proof that the site is clean.

## What your AI app does

Each question becomes one or more tool calls: requests to your site that PowerWP AI checks against the connection's permissions before running them. With Read-only diagnostics only reading tools run. If you ask for a change, the app is told it lacks the permission and should say so instead of working around it.

Some apps ask you to trust the server or to approve each tool call. That is the app's own setting, not PowerWP AI's.

## Read the activity log afterwards

:::steps
1. Open **PowerWP AI › Activity**. Entries are listed newest first.
2. Check the **Last 24 hours** numbers at the top: AI requests, tool calls, errors and security events.
3. Set **Channel** to **AI requests** to see only what your AI app did. Each row shows the time, the tool name, the status (OK, Error, Tool error or Denied), the client (your AI app), the IP address and the duration.
4. Select a row to open its details.
5. Open **PowerWP AI › Changes**. After a read-only session there should be no new changes.
:::

Passwords and keys are hidden before anything is written to the log. Entries are kept for 60 days by default (**Settings › Activity log**). You can export what is loaded as CSV or JSON.

> [!TIP] A "Denied" entry is not a problem. It means PowerWP AI refused something the connection was not allowed to do, which is the permission system working.

## Next steps

When you want your app to make changes, create a second connection with more permissions, for example **Content manager**. On the Free plan, [upgrade](/pricing/) first: the key stays the same. Ask for a plan before any change, and create a checkpoint before multi-step work so you can roll back what that connection changed in one step.

:::cards
- [Permissions and presets](/docs/concepts/permissions/) — Decide what each app may do.
- [Change log and undo](/docs/safety/undo/) — Roll back one change or a whole session.
- [Work safely on a live site](/docs/guides/safe-workflow/) — A routine for changes on a store.
- [Recipes](/docs/concepts/recipes/) — Ready-made procedures your app can run.
:::

Source: https://powerwp.ai/docs/get-started/first-session/