Get AICOM and connect your site.
AICOM is the free WordPress plugin that links each of your sites to AICOMBase. Install it, click Connect, confirm — a few minutes per site, and no password is ever shared.
What AICOM is
AICOM is a free WordPress plugin by dudaster.com. On its own, it lets your preferred AI work on the site over MCP — with API keys, permissions, backups and a session record of every change. Connected to AICOMBase, it also reports the site’s health and AI work to your dashboard and accepts work sent from there, always checked against the site’s own rules first.
AICOM keeps working fully without AICOMBase. Connecting is optional, and you can disconnect at any time.
Before you start
- WordPress 6.0 or newer, and PHP 7.4 or newer.
- An administrator account on the WordPress site.
- AICOM 3.21 or newer. The AICOMBase connection has been in the plugin since version 3.17; AICOMBase also relies on what came after it — work sessions you can undo, and the site’s own permission limits.
- A free AICOMBase account, with one site included: aicombase.com/register
- The site must be able to make outgoing HTTPS requests — almost every host allows this.
Download and install AICOM
From your WordPress admin (easiest)
Go to Plugins → Add New, search for “AICOM”, click Install Now, then Activate.
Or upload it yourself
Download the plugin from wordpress.org/plugins/aicom — then in WordPress go to Plugins → Add New → Upload Plugin, choose the .zip file, install and activate it.
Check the version
In Plugins, AICOM shows its version. If it’s older than 3.21, update it first (Dashboard → Updates). Once active, an AICOM menu appears in the WordPress admin.
Connect the site to AICOMBase
Open AICOM → AICOMBase and click Connect
In the WordPress admin menu, under AICOM, open the AICOMBase page and click Connect. The plugin creates its own cryptographic identity for this site; the private key never leaves the site.
Confirm in AICOMBase
AICOMBase opens in a new tab. Sign in (or create your free account), check what the connection allows — identify this installation, report site and AICOM health, report sessions and activity, receive authorized tasks, enable monitoring — and click Connect site. The request is valid for 10 minutes.
Done
Back in WordPress the status shows Connected. In AICOMBase the site appears under Sites, and the first availability checks arrive within a few minutes.
Browser blocked the new tab? Click “Open AICOMBase to confirm” on the AICOM → AICOMBase page. Several sites? Repeat these steps on each one — your plan decides how many you can connect.
Configure AICOM for AICOMBase
All of this is on the AICOM → AICOMBase page in WordPress. The defaults are safe — you can leave them as they are.
| Setting | What it does |
|---|---|
| Local policy for AICOMBase work | The permissions AICOMBase may use on this site — by default everything except critical ones, such as managing plugins and settings. Your policy in AICOMBase and this local policy must both allow an action; a task that needs a permission not ticked here is refused and reported as a security event. |
| Pause remote work | AICOMBase sends no work to this site until you resume. Monitoring and reporting carry on. |
| Sync now | Sends the site’s status and what AICOM can do right away — useful after installing or removing a plugin such as WooCommerce. |
| Disconnect | Ends the connection on this site. AICOM keeps working, and you can connect again at any time. To also cancel the site’s keys in AICOMBase, revoke the site there (Sites → the site → Connection). |
| AICOMBase URL | Leave it empty. It’s only for developers running their own test server. |
| Connection log | What the plugin and AICOMBase said to each other recently — the first place to look when something seems stuck. |
Locks and pause always win: whatever is allowed elsewhere, a locked or paused site does nothing AICOMBase asks.
Then, in AICOMBase
Tell it where your visitors are
Set the site’s compliance profile, so the privacy checks use the right laws (for example EU and Romania).
Run the first site check
Privacy, accessibility, security and technical checks of your public pages — nothing on the site is changed.
Connect your AI agent
On the Keys page, create a key for your preferred AI — from a small local model to the most powerful one — choose the sites and permissions it may use, and paste the endpoint and key into your AI app.
The getting-started checklist on the Overview page walks you through these steps and ticks each one off by itself.
What is shared — and what never is
Sent to AICOMBase
Site health; WordPress, PHP and AICOM versions; what AICOM can do on the site; the record of AI work (sessions and activity); and, when site checks run, a limited view from inside (for example which plugins are active).
Never sent
Your WordPress password, the site’s private key and AI API keys. Posts, pages and other content only pass through when a task you or your AI agent started needs them.
Always checked on the site
Every task AICOMBase sends is signed, single-use and short-lived, and the site checks it against your local policy before anything runs.
Troubleshooting
I don’t see AICOM → AICOMBase in WordPress.
Your AICOM is too old. Update it to 3.21 or newer (Dashboard → Updates), or download the latest version from wordpress.org/plugins/aicom
AICOMBase says the connection request expired.
Connection requests are valid for 10 minutes. Go back to AICOM → AICOMBase in WordPress and click Connect again.
“This AICOM installation’s identity is already connected to another site.”
This copy of AICOM is already linked to a site in AICOMBase. Disconnect it on the AICOM → AICOMBase page, then connect again.
The status says Offline, or “Could not reach AICOMBase”.
The site couldn’t reach aicombase.com. Check that your host allows outgoing HTTPS requests, then click Sync now — the connection log shows the last error. AICOM keeps working in the meantime.
Work from AICOMBase is refused with a permission error.
The permission isn’t ticked in the local policy (AICOM → AICOMBase), or your policy in AICOMBase doesn’t allow it. The Capabilities page in AICOMBase shows, for every tool, whether AI may use it — and why not.
I reinstalled the plugin and now the site appears twice.
Deleting and reinstalling AICOM gives the site a new identity, so AICOMBase sees a new site — remove the old one from Sites. Disconnecting and reconnecting the same installation keeps its history.
Something else?
Ask on our Support page: github.com/dudaster/aicom/issues — please never post keys or passwords there, issues are public.