I use AI every working day. Not as a gimmick, and not as a replacement for knowing what I’m doing, but the way a developer uses a code editor, a page builder or a search engine: to get to a good answer faster.
This guide covers the AI tools for WordPress development I actually use, ChatGPT, Claude and Elementor AI, and exactly where each one fits in a real project. More importantly, it covers where AI goes wrong, and the checks I run before anything it produces goes near a client’s site.
If you’re a business owner wondering whether AI-assisted work is worse, or a developer working out how to use these tools without shipping bugs, this is the honest version.

Short version
- AI is best at first drafts: code snippets, copy, meta descriptions and schema.
- It’s very good at explaining error messages and unfamiliar code.
- It’s confidently wrong often enough that everything needs reading and testing.
- AI code regularly misses WordPress security basics: sanitising, escaping, nonces and capability checks.
- Never paste passwords or customer data into an AI tool.
- The client pays for judgement and accountability. AI just shortens the typing.
Where AI fits in a WordPress project
Here’s the whole picture before the detail. The left column is what AI speeds up; the right column is what stays with me.
| Project phase | What AI helps with | What I decide and check |
|---|---|---|
| Planning | Draft sitemaps, page outlines, content checklists | Which pages the business actually needs, and in what order |
| Design | Section copy drafts, layout ideas when I’m stuck | The design system, the brand voice, the final layout |
| Development | Snippet drafts, regex, CSS fixes, explaining code | Architecture, plugin choices, security, reading every line |
| Debugging | Reading error logs, suggesting likely causes | Reproducing the bug and confirming the fix |
| SEO | Keyword grouping, meta drafts, schema drafts, FAQ ideas | Search intent, facts, validation |
| QA | Test checklists, edge cases to try | Actually testing on real devices |
Step 1: Planning and structure
1. Draft the sitemap and page outlines
I give the AI what I know from the client call: the business, the services, the audience and the goal of the site. It returns a first-draft sitemap and an outline for each key page. Then I cut, merge and reorder based on what the client actually told me. The draft is rarely right, but editing a list is much faster than starting one.
2. Group keywords by search intent
When I have a keyword list, AI is good at grouping it into clusters and labelling each one as “wants to learn” or “wants to hire”. That grouping decides which keywords belong on a service page and which belong in a blog post, which is how you avoid two pages competing for the same search.
Step 2: Writing code with ChatGPT and Claude
Most of my custom code is small: a PHP function in a code snippet, a CSS fix for a theme conflict, a few lines of JavaScript. This is where AI saves the most time, and where it needs the most supervision.
3. Write prompts like a ticket, not a wish
Vague prompts get vague code. I write the prompt the way I’d write a ticket for another developer:

Naming the hook, the WordPress and PHP versions and the security requirements up front means the first draft is far closer to usable.
4. Review every snippet against a checklist
I read every line before it touches a site. These are the problems I find most often in AI-written WordPress code, so these are what I check first:
| Check | What to look for |
|---|---|
| Sanitise input | Anything from $_POST, $_GET or a form passes through a function such as sanitize_text_field() |
| Escape output | Anything printed to the page uses esc_html(), esc_attr() or esc_url() |
| Nonces | Forms and AJAX actions verify a nonce so they can’t be triggered from another site |
| Capability checks | Admin actions check current_user_can() |
| Functions that exist | Every function and hook is real. AI sometimes invents plausible-sounding ones |
| Prefixes | Function names are prefixed, so they don’t clash with plugins |
| Right hook, right time | Code runs on the correct hook and only on the pages that need it |
The official WordPress security APIs documentation is the reference I check against when anything looks off.

Watch out: a snippet that works is not the same as a snippet that’s safe. AI code very often works in testing and still skips escaping or nonce checks. Those gaps are exactly what attackers use, as I explain in my guide to removing malware from WordPress.
5. Test on staging, never on live
Every snippet goes onto a staging site first. With a code snippets plugin, a fatal error usually deactivates the snippet, but on a live store even a few seconds of a broken checkout is too much.
Step 3: Debugging with AI
6. Get the real error first
AI can’t fix “the site is broken”. It can help a lot with an actual error message. Turn on the debug log on staging, as described in the WordPress debugging guide, reproduce the problem and copy the exact message:
define( 'WP_DEBUG', true );
define( 'WP_DEBUG_LOG', true );
define( 'WP_DEBUG_DISPLAY', false );
7. Give context, then test the suggestions yourself
I paste the error, the WordPress and PHP versions and the plugins involved, and ask for the likely causes in order. AI is good at narrowing a fatal error down to one plugin or one line. It’s my job to reproduce the bug, confirm the cause and test the fix.
8. Use it to read unfamiliar code
When I inherit a site with custom code nobody documented, asking for a plain-English explanation of a function saves real time. I still read the code myself, but I start with a map instead of a maze.
Step 4: Elementor AI inside the editor
9. Section copy drafts
Elementor’s built-in AI can draft headings and text right inside a widget. I use it to get past an empty layout, then rewrite the result in the brand’s voice with the client’s real offer. Unedited AI copy reads like every other site, which is the opposite of what a business needs.
10. Small custom CSS
For small styling fixes, such as a hover effect or a spacing tweak at one breakpoint, Elementor AI can write the custom CSS for a widget. I check it doesn’t add !important everywhere or target more than it should.
11. Images: placeholders only
AI images are fine for mood boards and placeholders while the client gathers real photos. For the live site, real photos of the real business build far more trust, and for many industries they’re simply more honest.
Step 5: SEO groundwork
12. Meta titles and descriptions
Writing 30 meta descriptions that each fit 160 characters and each say something different is exactly the kind of work AI does well. I give it the page content and focus keyword, then edit each one so it’s accurate and actually makes someone want to click.
13. Schema drafts, always validated
AI drafts JSON-LD schema quickly. It also invents properties that don’t exist. Every schema block I publish goes through Google’s Rich Results Test or the Schema Markup Validator first.
14. FAQ ideas from real questions
AI suggests the questions people commonly ask about a service. I keep the ones real clients have asked me and write the answers myself, because a FAQ answer is a promise and it has to be true.
Step 6: Testing and QA
15. Generate the test checklist, then run it yourself
Ask for edge cases on a form or a checkout and AI will list things you might not think of: empty fields, very long names, special characters, a coupon applied twice. I turn that into a checklist and then test on real phones and browsers. AI can’t tap a button on an iPhone for me.
16. Accessibility basics
AI can review a block of HTML for missing labels, poor heading order or missing alt text. I pair that with an automated tool such as Lighthouse and a quick keyboard-only test. Together they catch most of the common problems before launch.
Want a site built this way? AI for speed, a developer for every decision and every test.
A real example: from prompt to shipped snippet
Here’s the kind of task I hand to AI every week, using the prompt from Step 2: add a “Last updated” date under the title of blog posts. A typical first draft looks fine and works when you test it:
add_filter( 'the_content', function( $content ) {
return '<p>Last updated: ' . get_the_modified_date() . '</p>' . $content;
} );
Run it through the review checklist and three problems show up. It runs on every page, product and feed, not just blog posts. The output isn’t escaped. And an anonymous function can’t be removed later by a child theme or another snippet. The version that actually ships:
add_filter( 'the_content', 'fh_last_updated_date' );
function fh_last_updated_date( $content ) {
if ( ! is_singular( 'post' ) || ! in_the_loop() || ! is_main_query() ) {
return $content;
}
$updated = get_the_modified_date( 'j F Y' );
return '<p class="fh-updated">Last updated: ' . esc_html( $updated ) . '</p>' . $content;
}
The AI saved me the typing. The review is what made it safe to put on a client’s site. That split, AI for speed and a developer for every decision, is the whole idea behind how I use AI tools for WordPress development.
Where AI goes wrong
These are the failures I see most often, and how I catch each one:
| Failure | Example | How I catch it |
|---|---|---|
| Invented functions or settings | A WordPress function or plugin option that sounds right but doesn’t exist | Check the official docs, run it on staging |
| Outdated advice | Old jQuery patterns, deprecated functions, settings that moved | Check against current versions |
| Missing security | No nonce, no escaping, no capability check | The review checklist in Step 2 |
| Invented facts | A statistic, a feature the client doesn’t offer, a fake source | Every claim on a page is checked with the client |
| Generic copy | Text that could be on any competitor’s site | Rewrite with the client’s real details and voice |
| Overconfident fixes | “This will definitely fix it” for a guess | Reproduce the bug, then confirm the fix |

Client data and privacy rules
These are non-negotiable for me:
- No passwords, API keys or access details ever go into an AI tool.
- No customer personal data. If I need help with an order or user issue, I replace names, emails and addresses with placeholders first.
- No confidential client strategy unless the client is happy with it.
- Code and copy are reviewed before they’re used, so nothing ships just because a tool produced it.
- Clients can ask how AI was used on their project, and I tell them plainly: which parts were drafted with AI, and that every part was reviewed and tested by me before it went live.
How to start using AI in your own WordPress work
If you’re a developer or a site owner who hasn’t built AI into your routine yet, start small and keep the risk low. This is the order I’d recommend:
- Explaining, not writing. Paste an error message or a confusing function and ask what it does. Nothing touches your site, so nothing can break.
- Drafts you edit by hand. Meta descriptions, alt text, a first outline for a page. You read every word before it’s used.
- Small CSS fixes on staging. Low risk, easy to check visually, easy to undo.
- PHP snippets, with the review checklist. Only once you’re comfortable spotting missing escaping, nonces and capability checks.
- Your own prompt library. Save the prompts that worked, with the context lines filled in for your usual stack, so every request starts from a good template.
Skip anything that asks you to give an AI tool direct access to a live site, a hosting panel or a database. Copy and paste keeps you in control of what goes where.
Is AI-assisted work worse?
Not when it’s done this way. Used properly, AI tools for WordPress development remove the slow, repetitive typing and leaves more time for the parts clients really pay for: getting the structure right, catching the bug before launch, and making the site easy for their team to manage. The responsibility doesn’t move to the tool. If something breaks, it’s still mine to fix.
The same approach runs through everything else I write about, from Elementor global templates to the launch checklist I use before every site goes live.
Keep reading
Frequently asked questions
Which AI tools for WordPress development are worth using?
I use ChatGPT and Claude for code, debugging and SEO drafts, and Elementor AI for copy and CSS inside the editor. The tool matters less than how carefully you review what it produces.
Is AI-written code safe to use on WordPress?
Only after a developer reads and tests it. AI drafts often miss security checks such as sanitising input, escaping output, nonces and capability checks, or use functions that don’t exist.
Can AI build a whole WordPress website?
It can draft pieces of one, such as page outlines, copy and snippets. Planning the structure, choosing plugins, securing the site and testing it on real devices still need a developer.
Should clients worry that a developer uses AI?
No, as long as the developer reviews everything and owns the result. AI shortens the typing. Judgement, testing and accountability still come from the person you hired.
Is it safe to paste client data into ChatGPT or Claude?
Don’t paste passwords, API keys or customer personal data. Replace real names and details with placeholders, and share client strategy only when the client is comfortable with it.
Will AI replace WordPress developers?
It’s replacing the repetitive parts of the job, not the decisions. Site structure, security, debugging real problems and quality control still need someone who knows what they’re doing.
$ need --help
Need this done on your site?
Tell me what is going on. I reply within one business day.