AI Webmaster gives the AI assistant you already use (Claude Code, Claude Desktop, or Cursor) its own limited login to your HomeRunner site. It can draft blog posts, build a new page from one you already have, update your navigation menu, and fill in SEO titles and descriptions. Anything guests would see goes live only after you approve it. Every action is logged, and you can cut off the access at any time.
What it does #
Your assistant connects to your website the same way it connects to your files or your calendar, through a small server the Toolkit runs at a private address on your site. Once connected, you talk to the assistant in plain language and it does the website work in the background.
Some things you can ask for:
- “Draft a blog post announcing the new hot tub at the Pines cabin. Keep it under 300 words and end with a link to the cabin’s page.”
- “Make a Boulder page from the Denver page. Swap every mention of Denver for Boulder and leave everything else alone.”
- “Add a link to the Winter Specials page to the main menu, right after Properties.”
- “Which of my pages have no meta description? Write one for the first five you find and show me before you save.”
- “Publish the draft you wrote yesterday.”
The assistant works under a separate login of its own, with a role that can do the tasks above and nothing else. It cannot delete anything, install or remove plugins, manage users, change site settings, or upload scripts. It never gets your admin password.
Two rules keep you in control:
- Drafts first. New posts and pages are always created as drafts with a preview link. Publishing is a separate step.
- Approvals for anything live. Publishing a post, editing a page that is already public, changing the menu, or changing SEO fields on a live page takes two calls. The first shows you what would change and changes nothing. Only after you say yes does the assistant call again with the approval, and only then does the change go live.
Every call the assistant makes is written to an activity log inside the Toolkit, with the tool it used and how it went. You can look at it any time.
How to turn it on #
1. Check the requirements #
- WordPress 6.9 or newer.
- The WordPress MCP Adapter, which Rank Math SEO includes. If your site does not run Rank Math, install the WordPress MCP Adapter plugin instead.
- Node.js 18 or newer on the computer where your assistant runs. Claude Code and Claude Desktop use it to reach the site.
The Toolkit panel tells you if anything is missing.
2. Switch on AI Webmaster #
In the HomeRunner Toolkit Hub, open the Security section and switch the module on. The panel shows the private address your assistant will use and the list of tools it will have.
3. Create the login #
In the same panel, pick how long the login should stay valid (30 days to a year; 90 is the default) and click Create credential. The Toolkit creates a dedicated user on your site and shows the credential once.
Copy it right away. It is never shown again. If you lose it, create a new one; the old one stops working the moment the new one exists.
4. Connect your assistant #
Under the credential, the panel shows two ready-made snippets with the credential already filled in.
- Claude Code. Paste the one-line command into your terminal.
- Claude Desktop or Cursor. Paste the JSON block into the assistant’s configuration file and restart it.
The snippets include the credential only until you reload the page.
5. Say hello #
Start a new conversation and ask for a site snapshot. The assistant reports your site name, how many posts and pages you have, your menus, which SEO plugin is installed, and when its login expires. From there, ask for what you need in your own words.
What the assistant can do #
| Tool | What it does | Needs your approval |
|---|---|---|
| Site snapshot | Site name, versions, theme, counts, menus, SEO plugin, login expiry | No |
| List and read posts | Titles, status, content, categories, tags, featured image, SEO fields | No |
| List and read pages | Same for pages, and whether a page is built with the page builder | No |
| Create a post draft | New blog post as a draft, with categories, tags, and a featured image | No, it is a draft |
| Update a post or page | Title, content, excerpt, slug, categories, tags, featured image | Yes, if the item is already live |
| Publish | Turns a draft into a live post or page | Yes, always |
| Create a page from a template | Copies one of your pages and swaps the text you name | No, it is a draft |
| List and read menus | Every menu and its items | No |
| Add a menu item | A link to a page or a custom address, optionally nested | Yes, always |
| Reorder menu items | New order for a menu | Yes, always |
| SEO overview | How many pages have a focus keyword and description, and which need attention | No |
| Set SEO fields | SEO title, meta description, focus keyword for one post or page | Yes, if the item is already live |
| Read HomeRunner settings | Your HomeRunner plugin settings as they appear on the HomeRunner settings screen: connection, sync, properties, explorer, map, booking widget, checkout, reviews, users, add-ons, advanced, monitoring | No |
| See toolkit modules | Every Toolkit module, whether it is on, and its settings | No |
Page-builder pages (YOOtheme) keep their layout. The assistant can copy one of them into a new page and swap the words, but it cannot write page layouts from scratch. HTML the assistant writes into a blog post is cleaned the same way WordPress cleans a contributor’s post: paragraphs, headings, lists, links, and images stay; scripts and forms are removed.
The two settings tools are read-only. Ask questions like “Is auto-sync on?” or “Which toolkit modules are enabled?” and the assistant reports what it finds; changing a setting stays in your hands on the HomeRunner and Toolkit screens. Your Central connection key, passwords, and other secrets are never part of what it reads.
Approvals, expiry, and revoking #
When the assistant tells you a change needs approval, it shows the preview link or lists exactly what would change. Nothing happens until you answer. If you approve, it makes the change and confirms.
The login expires on the date you chose. After that, every call is refused until you create a new credential. The panel shows when the login was created and when it expires, along with the last time it was used.
To cut off access early, click Revoke credential twice (the second click confirms). The assistant’s next call fails. Turning the module off, or deactivating the Toolkit plugin, revokes the login as well.
Activity log #
The bottom of the panel lists the most recent calls with the time, the tool, the post or page it touched, the outcome, and a one-line summary. An outcome of “partial” means the main change landed but a detail did not (a category could not be created, for example); the assistant reports the same detail to you in the conversation. Choose how long to keep the log, from 30 days to a year.
Good to know #
- The assistant treats the text on your site as content to read and edit, never as instructions. A sentence hidden in a page cannot tell it what to do.
- One login exists at a time. Creating a new credential replaces the old one everywhere.
- The Toolkit’s own address is the only place the login works. It is refused on every other part of WordPress.
- Posts the assistant writes are marked as such in the database, so you can always tell its drafts from a person’s.
- Settings the assistant reads come back with sensitive values left out. Keys, tokens, and passwords never appear in its answers.