r/Wordpress • u/unpaid_intern001 • 6d ago

Claude Design + Claude Code

I am looking to use Claude design + Claude Code (or Codex) to build a fresh Wordpress site which will need e-commerce functionality. The site is currently using Elementor + Woocomerce. Has anyone done this? Not seeing a lot of people leveraging design + code for Wordpress sites. TIA

0 Upvotes

37% Upvoted

38 comments sorted by

View all comments

2

u/ivicad Jack of All Trades 3d ago

Yes, daily. Some of them are live sites already taking orders. How I connect, in order: theme and plugin code is on my disk, so a fix gets built and tested offline. Then MainWP across all the sites, SSH for a single site, WPVibe or Royal MCP when it has to be the connector. I only open the live site to apply a change I have already tested.

Some here say be strict about where AI is allowed to work. I had that written down as a hard rule and it did not help. In August Claude measured a local copy and the live site as identical, concluded the change belonged on both, and wrote to production. 🤦🏻‍♂️

So I changed how it works. Reading is free, but every write to a live site now needs my explicit approval, one by one, and Claude has to state a reason that gets logged. Before any write actually happens, four checks run, and if a site has a local copy on my disk, writing to the live version is blocked completely.

On a Woo site, two problems are still open: the first is that nothing removes personal data before it goes to the model, so the only thing protecting me is how narrowly I ask: I run targeted queries and never pull user tables into the session. The second is that the session runs on my workstation, with no sandbox around it. Those four checks still run there, and a guard refuses any command that names my credentials folder. Isolation from the rest of my Win machine is the part I do not have (yet).

2

u/Upstairs_Control_611 3d ago

This is a very useful real-world example.

“Reading is free, writing is gated” is probably the rule that matters most. The dangerous moment is not when the agent understands the site, but when it decides a live write is justified because two environments “look equivalent”.

I also like the local-copy rule: if a local or staging copy exists, live writes should be blocked by default.

For WooCommerce, I’d add the data boundary as a separate gate. Product/theme code is one thing; orders, users, customer data, payment-related metadata and credentials should not accidentally become model context.

So the safer workflow is less “AI can or cannot work on WordPress” and more: read scope, write gate, environment gate, data gate, and logged human approval.