Buildli

Buildli is the small, zero-dependency bridge between your self-hosted WordPress site and buildli.app — an AI-powered chat interface that edits your site on request. After activating the plugin and connecting your site, you can open the chat at buildli.app and ask for changes in plain language:

• "Create a Contact page with a simple form and a map."
• "Rewrite the homepage hero to focus on our new summer collection."
• "Translate the FAQ into French and publish it as a new page."
• "Fix the SEO titles on my five most-visited blog posts."

Every action is previewed before it runs, revisions are saved so any change can be undone, and an emergency recovery URL lets you disable the connector with a single click if anything ever goes wrong. Built-in safety:

• Preview-first — every write action is shown to you in the chat before it runs.
• Automatic revisions — updates snapshot the previous state so one click reverts them.
• Draft mode — an optional per-site toggle that forces every agent write to land in draft.
• Recovery URL — a secret one-time URL that disables the connector even if your admin is broken.
• Audit log — every tool execution is recorded in your Buildli dashboard.

Zero dependencies. The plugin is a few hundred lines of PHP that only uses WordPress core APIs — no third-party libraries, no database tables, no analytics, no outbound calls except to the Buildli API. Your API key stays with us. The plugin holds only its own site-specific token; the AI provider API key Buildli uses is never exposed to the plugin or your site. Self-hosted only. This plugin targets WordPress.org (self-hosted) sites — it cannot be installed on WordPress.com. Disclaimer. Buildli is an independent product and is not affiliated with, endorsed by, or sponsored by the WordPress Foundation, Automattic, or any other entity.

Automatic (recommended):

1. Sign up at buildli.app
2. Paste your site URL and click "Connect with WordPress"
3. Approve the connection in your WP admin
4. Done — the plugin is installed and configured automatically.

Manual:

1. Download the latest release ZIP from buildli.app or wordpress.org
2. In WP admin, go to Plugins → Add New → Upload Plugin, select the ZIP, click Install Now, then Activate
3. Go to Settings → Buildli and paste the token shown in your buildli.app dashboard

0.4.4

• Security: tool exception messages are now stripped of HTML before being returned to the cloud, preventing reflected-XSS via malformed third-party plugin error messages.
• Security: capabilities endpoint now returns only currently-active plugins. Inactive plugins are no longer enumerated in the response.
• Cleanup: added uninstall.php so the API token, recovery-token hash, and legacy plaintext recovery-token are deleted when the plugin is removed (not just deactivated). Multisite-aware.

0.4.3

• Security: recovery token is now stored as a SHA-256 hash in wp_options instead of plaintext. Sites upgrading from 0.4.2 or earlier will see the legacy plaintext value cleaned up automatically the next time the cloud handshakes with the connector.

0.4.2

• Multilingual support: new i18n adapter detects WPML or Polylang and exposes i18n.list_languages and i18n.get_translations so the AI can locate translated counterparts of any post and edit them through the regular post tools.

0.4.1

• Privacy Policy URL in readme.txt now points to the correct path (/legal/privacy).

0.4.0

• Universal adapter framework — Buildli now natively edits posts on Gutenberg, Elementor, WooCommerce, Yoast / Rank Math / AIOSEO, ACF, Divi, Bricks Builder, and Beaver Builder.
• Adapter-aware tool dispatch: one tool name (update_component) automatically routes to the right builder per post.
• New /buildli/v1/capabilities endpoint reports the active builders and integrations on the site so the AI knows what it can edit.
• Snapshot/restore now captures builder-specific meta (Elementor _elementor_data, Beaver _fl_builder_data, etc) so undo is faithful across builders.

0.3.1

• Plugin Check compliance: wrapped all throw new Exception() messages in esc_html() / esc_html__().
• Sanitized $_SERVER['REMOTE_ADDR'] with wp_unslash() + sanitize_text_field() in the recovery rate limiter.
• Shortened the readme.txt short description to fit the 150-character limit.

0.3.0

• Renamed plugin to Buildli; new REST namespace buildli/v1 and HTTP signature headers X-Buildli-*.
• All code prefixes, options, and constants updated to the buildli_ / BUILDLI_ prefix per WordPress.org guidelines.
• Recovery page styles moved to a registered stylesheet (no inline <style>).
• Removed load_plugin_textdomain() call (handled automatically since WP 4.6).

0.2.0

• Added /setup endpoint for one-click connection via Application Passwords.
• Added revert_to_revision and delete_post tools so in-chat undo can restore prior post states.
• Added site-event webhooks so manually-made changes keep the agent's context fresh.
• Added /health and read_site_info improvements.

0.1.0

• Initial release.