# Requirements and compatibility

> What your site, host and AI app need: WordPress 6.0+, PHP 7.4+, HTTPS, headers, firewalls and proxies, multisite and the MCP versions PowerWP AI speaks.

PowerWP AI runs on ordinary WordPress hosting. Most sites meet every requirement already. This page lists what is needed, and what to check if a host, firewall or proxy gets in the way.

## Your site

| Requirement | Details |
|---|---|
| WordPress | 6.0 or newer. Tested up to 7.1. |
| PHP | 7.4 or newer. Below 7.4 the plugin stays inactive and shows a notice. The Environment checks suggest PHP 8.2 or newer when possible. |
| HTTPS | Required on public sites. See below. |
| PHP zlib extension | Needed to create snapshots and backups. |
| Loopback requests | The server must be able to request its own pages. PowerWP AI uses this for health checks, and WordPress uses it for WP-Cron. |
| Writable folders | The private storage folder (inside `wp-content` unless you set `WPAI_MCP_STORAGE_DIR`) and `wp-content/mu-plugins/` for the rescue loader. |
| Disk space | The Environment checks warn when less than 1 GB is free, because backups may not fit. |
| WooCommerce | Optional. 7.0 or newer. High-Performance Order Storage and the Cart and Checkout blocks are declared as compatible. The WooCommerce tools only work when WooCommerce is active. |
| WordPress Abilities | The two ability tools need WordPress 6.9 or newer. |
| Permalinks | Any structure works for key-based connections. Sign-in for Claude and ChatGPT needs a structure other than Plain. |
| Page builders | Elementor pages can be read and edited by widget (new in 1.6). Other page builders have no builder-specific tools: your AI app works on the page content WordPress stores, with a dry run and a recorded change. |

Run the **Environment checks** on **PowerWP AI › Dashboard** (select **Run checks**) to test most of this on your own server.

## HTTPS

AI requests over plain HTTP are refused with a 403 error, so keys never travel unencrypted. Sites on local development addresses are exempt. The setting is **Settings › Connection security › Require HTTPS**, on by default.

If your site sits behind a reverse proxy or load balancer that ends HTTPS, turn on **Trust X-Forwarded-Proto** in the same place. Otherwise PowerWP AI sees plain HTTP and refuses the request.

## Headers

Every setup step sends the key in an `X-WPAI-Token` header. `Authorization: Bearer` also works. Some hosts strip the Authorization header (Apache with FastCGI, some proxies, JWT plugins), which is why `X-WPAI-Token` is the default. The Environment checks test both headers and tell you which one reaches WordPress.

## Firewalls, CDNs and security plugins

- Web application firewalls and security plugins, such as Cloudflare, Wordfence, Sucuri and Solid Security, and "disable REST API" plugins can block `/wp-json/wpai/v1/`. Allow that path. PowerWP AI has its own token check, rate limits, lockouts and IP allow-lists.
- Behind Cloudflare or another proxy, every request seems to come from the proxy. Under **Settings › Connection security › Client IP source** choose the header your proxy sets: `REMOTE_ADDR`, `CF-Connecting-IP`, `X-Forwarded-For` or `X-Real-IP`. Pick a proxy header only if the site really is behind that proxy, or clients could fake their IP address. This matters for IP allow-lists and lockouts.
- Basic-auth protection or maintenance plugins must not block the server's requests to itself.
- Requests that carry a browser `Origin` header from another site are refused. Desktop and command-line apps send none.
- On nginx, deny web access to the storage folder. See [Install the plugin](/docs/get-started/install/#optional-keep-snapshots-and-backups-outside-the-web-root).
- If WP-Cron is disabled on your site, let a system cron call `wp-cron.php`. Backups still progress while the Backups screen is open or an AI app checks on them.

## Multisite

Install PowerWP AI on a single site. Multisite networks have not been tested, so they are not supported yet.

## MCP protocol versions

The endpoint is a Streamable HTTP MCP server at `/wp-json/wpai/v1/mcp` on your site. It supports protocol 2026-07-28 (stateless) and 2025-11-25, 2025-06-18, 2025-03-26 and 2024-11-05 (with sessions). See [MCP endpoint and headers](/docs/reference/mcp-endpoint/).

## Your AI app

The app must support remote MCP servers over Streamable HTTP. It then connects in one of two ways:

- **With a key.** The app sends the key in a custom header, or in a bearer-token field. Claude Code, Codex (also in the ChatGPT desktop app), Cursor, VS Code, Devin Desktop, Gemini CLI, Kimi Code, LM Studio and other apps connect this way.
- **By signing in.** Claude (claude.ai, the Claude app and the phone apps) and ChatGPT (on the web and in its apps) open your site's WordPress sign-in and need only the site's address. No key is copied. This is new in PowerWP AI 1.6. The site must be reachable from the internet, so it does not work for a site on your own computer. If sign-in is not offered, connect Claude Code with a key instead.

Some apps need a little more. The older Claude Desktop route uses a small connector, `mcp-remote`, which needs Node.js 18 or newer, though signing in to Claude is simpler. LM Studio needs version 0.3.17 or newer and a model that supports tool use. To run models on your own computer, use [LM Studio](/docs/connect/lm-studio/).

The AI app and its plan are not part of PowerWP AI.

:::cards
- [Install the plugin](/docs/get-started/install/) — Upload, activate and update.
- [Choose how to connect](/docs/connect/) — Setup steps per AI app.
- [Troubleshooting](/docs/help/troubleshooting/) — Fixes for blocked headers, firewalls and proxies.
:::

Source: https://powerwp.ai/docs/get-started/requirements/