PAGUP Agent ControlWordPress access for AI assistants
Start free trial

Why Rank Math Shows a WAP AI Assistant Notice

Rank Math version 1.0.277, released on August 26, 2026, added a Support Agent inside the plugin and abilities for AI assistants to configure Rank Math settings. Version 1.0.277.1 then corrected an HTTPS-required notice that could appear on HTTPS sites when another plugin had disabled Application Passwords.

Therefore, the first safe action is version verification, not a permission increase. Update only through the normal WordPress or vendor release path, preserve a rollback point and retest the exact notice.

Three separate Rank Math and WAP components

Do not infer one permission model from a shared interface label. The documented components have different purposes and boundaries.

ComponentDocumented roleBoundary to preserve
Rank Math Help & Support AgentA read-only interface in Help & Support that answers support questions. Rank Math states that it cannot change account or site settings and does not access site data.It is not equivalent to the separate MCP writing tools.
Rank Math MCP abilitiesA separate set of MCP tools that can inspect or change documented Rank Math settings through its own connection and credentials.Available actions depend on the exposed tool and authenticated identity.
WAP ClientA library a plugin can integrate to render a widget, provision an Application Password and exchange a wrapped credential with a separate backend.Its architecture does not prove that every WAP integration has the same tools, data access or permissions.

Likely causes

  • The installed plugin version displays an incorrect or outdated HTTPS notice.
  • A security plugin, must-use plugin or custom filter disables Application Passwords globally.
  • A recent plugin update introduced, changed or corrected the assistant behavior.
  • The documentation or support answer describes a different plugin, client or version.
  • Another plugin changes HTTPS detection, REST access or Application Password availability.

Diagnostic sequence

  1. Record WordPress, plugin, client, connector and server versions before changing anything.
  2. Identify the plugin and admin page that renders the notice or assistant.
  3. Compare the installed version with the plugin’s official changelog and corrected releases.
  4. Confirm that the exact URL used by the assistant loads with a valid HTTPS connection.
  5. Check whether Application Passwords are globally available in the active WordPress environment.
  6. Review the Application Passwords section of the relevant user profile without exposing any secret.

Apply the smallest correction

  1. Update to the plugin release that documents or corrects the observed behavior.
  2. Remove or narrow the filter that disables Application Passwords only after confirming the intended security policy.
  3. Replace stale instructions with documentation tied to the installed client, plugin and version.
  4. Revoke credentials that are confirmed unused or no longer required.
  5. Escalate with sanitized, versioned evidence when the behavior remains specific to the plugin.

Verify the result

  • The notice disappears only under the corrected condition and does not return on unrelated admin pages.
  • The authenticated request resolves to the intended dedicated WordPress user.
  • Every observed credential has an owner, purpose, creator, status and revocation decision.
  • The final record contains versions, evidence, change, verification and rollback information without secrets.

What not to do

  • Do not describe the notice or credential as malware, a backdoor or a compromise without evidence.
  • Do not publish claims about remote data use, consent or permissions that have not been verified against the exact version.
  • Do not grant administrator access merely to make a connection test pass.
  • Do not place an Application Password, Authorization header, token or cookie in a prompt, ticket, log excerpt or screenshot.
  • Do not disable the WAF or security plugin globally to bypass one request.

Sources and verification

This page was checked against the following primary sources. Last source review: .