PAGUP Agent ControlWordPress access for AI assistants
Start free trial

What Is WAP AI Assistant in WordPress?

WAP is a client library that a WordPress plugin can integrate to display an AI chat interface. It is not WordPress core, and its presence does not identify the plugin, service or actions available on a particular site.

The four components

ComponentResponsibilityWhat must be verified
Host pluginChooses the admin screen, feature name, release and product scopePlugin name, installed version and official documentation
WAP ClientRenders the widget and can provision an Application Password and exchange a wrapped credential with a separate backendThe library version and the integration code used by the host plugin
WordPress identityOwns the Application Password; its role and capabilities govern WordPress authorizationUsername, role, capabilities, credential label and lifecycle
Separate backendReceives the integration-specific request and may call an exposed WordPress route or abilityEndpoint, data flow, available actions, retention and consent documentation for the exact integration

Request and credential path

  1. The host plugin loads the WAP widget on a named WordPress admin screen.
  2. If the integration provisions an Application Password, WordPress attaches it to one existing user. The password does not create a narrower role.
  3. WAP wraps and exchanges the credential according to its library architecture; the host plugin still determines how that library is configured.
  4. A backend or client sends a request to a route or ability exposed by the integration.
  5. WordPress authenticates the owning user, then the route or ability performs its own capability check.

Authentication and authorization are separate. A valid Application Password identifies its owner; it does not guarantee that a requested action is allowed.

Distinctions that prevent false conclusions

  • A WAP label does not prove which plugin created the credential. Confirm the screen, asset path, plugin directory and changelog.
  • WAP Client is not equivalent to Rank Math’s Help & Support Agent or to Rank Math’s separate MCP abilities.
  • One plugin’s WAP integration does not establish the tools, data access, write capacity, consent flow or retention policy of another integration.
  • An unfamiliar credential is not proof of malware, a backdoor or compromise. Record its owner and use before deciding what to do with it.

Verification record

Record the plugin and WAP versions, admin screen, WordPress user, credential metadata, exposed route or ability, successful narrow action, expected refusal and revocation result. Keep secrets out of screenshots, prompts, tickets and logs.

Sources and verification

This page was checked against the following primary sources. Last source review: .