Build & Manage WordPress with AI
Xaflo connects Claude Code to your WordPress sites with a desktop app and a lightweight WordPress plugin. Audit content, write SEO, manage media, edit themes — all through natural language, running locally on your machine.
Everything Claude needs to know about your site
Xaflo gives Claude Code a curated set of 74 tools mapped to real WordPress operations. No more “I can’t see your site” — just ask and Claude does it.
Content operations
List, create, update, publish posts and pages. Bulk audits, multilingual coverage, term & taxonomy management.
Media library
Upload, edit alt/caption/description, find unused media, optimize images, audit accessibility — one prompt at a time.
SEO & analytics
Yoast, Rank Math, AIOSEO supported. Read traffic from Site Kit, MonsterInsights, Jetpack. Audit and fix in bulk.
Theme & customizer
Read theme files, edit the Customizer, manage menus and widgets. Sandboxed writes with rollback.
Multilingual
WPML and Polylang adapters built-in. Translate, link siblings, audit string coverage across all your languages.
Advanced
SQL queries (guarded), WP-CLI execution, plugin scaffolding, theme writes, backups — with confirmation tokens for destructive ops.
Three pieces. Five minutes. Yours forever.
Xaflo bridges Claude Code and WordPress through a tiny REST API plugin and a desktop app that manages every connection in one place.
-
Install the Xaflo WP Connect plugin
One zip, upload via Plugins → Add new on any WordPress 6.0+ site. Exposes a secure JWT-authenticated REST API just for you.
-
Install Xaflo Desktop
Single installer for Windows, macOS or Linux. Manages all your site connections, runs health checks, gives Claude Code its tool roster.
-
Generate a token and paste it
From WordPress admin → Xaflo → Tokens, generate a JWT with the scopes you need. Paste it once into the desktop app. Done.
-
Open Claude Code and start working
“Audit SEO on all my posts.” “Find broken links.” “Translate post 42 to English.” Claude does it. You stay in the driver’s seat.
Local-first. Private by design.
Everything runs on your machine. Your token never leaves your computer. Your WordPress data never touches a third-party server. The plugin only responds to requests signed with the JWT you control.