Most WordPress security work begins after something has already gone wrong: a spike in failed logins, an unfamiliar admin account, a file that shouldn’t be there. The evidence is usually sitting in server and access logs, but few site owners have the time or skills to read through it.
In this talk I show how an AI coding agent, Claude Code, can do much of that investigation and repair when it is given controlled access to the real environment: WordPress and server logs, SFTP and SSH to the host, and the Cloudflare account in front of the site. Working from real incidents on sites I manage, I walk through the full loop:
Diagnose — the agent reads access, error and authentication logs, correlates them, and spots brute-force attempts, vulnerability scanning, suspicious requests and compromised files.
Trace the attack vector — it identifies how attackers are getting in, whether through an outdated plugin, an exposed XML-RPC endpoint, weak credentials or a misconfigured file permission.
Fix — it hardens the site by installing and configuring established security plugins, adjusting server and Cloudflare firewall rules, or writing a small custom plugin when no existing one fits the requirement.
Prevent — it turns what was found into lasting defences, such as rate limits, WAF rules, login protection and monitoring.
The talk is equally honest about the risks. Handing an AI agent SSH and production access is powerful and dangerous. I will share the guardrails I use, including least-privilege accounts, working on staging first, reviewing every change before it goes live, and keeping backups. I’ll also show real cases where the agent was confidently wrong, and how to verify its work instead of trusting it. Attendees leave with a practical, safe workflow they can apply to their own sites.