JacAI for WordPress
Two free plugins and one paid dashboard tool, built on the same authenticated, capability-checked, signed-request security model. Discover content, publish it, and manage your private AI archives — all from inside WordPress.
Hover or tap a card to see its pipeline
Full technical specs, pulled from each plugin's own source and readme, are listed underneath every card.
Relevant Bot V2
Content discovery & normalized campaign handoff for existing WordPress content.
Auto Poster
Authenticated REST publishing bridge — draft, publish, schedule, update, idempotently.
AI Data Control
Private AI-conversation archive browser and presentation builder for WordPress.
Relevant Bot V2 — full spec
- Indexes posts, pages, and WooCommerce products (when WooCommerce is active) on the local WordPress install
- Emits a normalized content object — id, site_id, type, title, url, excerpt, content, categories/tags, keywords, language, featured image, publish/modified dates, content hash, campaign status
- Language detection for several commonly used writing systems, preserved through the JacAI workflow when configured
- WP-Cron scheduling for recurring scans, plus a manual "scan now"
- Content-hash change detection — re-scans skip content that hasn't changed
- JacAI connection is fully optional — the plugin works as a local content index on its own; nothing is sent anywhere until an endpoint, site ID, and site secret are configured
- HMAC-SHA256 signed handoff when JacAI is configured — timestamped canonical string (
timestamp\nPOST\npath\nsha256(body)), sent viaX-JacAI-Signature - Campaign memory — last-promoted date, campaign ID/status, so already-used content isn't resent by accident
- REST admin API authenticated with a random 40-character key over
X-RB-API-Key, compared with a timing-safehash_equals()
Auto Poster — full spec
- Authenticated REST publishing via a dedicated
X-AutoPoster-Keyheader (legacy JSON-bodyapi_keystill accepted for compatibility) - Draft, publish, and scheduled post states, set per request
- Idempotent article updates — keyed by an external
article_id, never creates duplicate posts on retry - Featured-image sideloading — WordPress safe-URL validation, a 12 MB size limit, and a JPEG/PNG/GIF/WebP/AVIF MIME allowlist
- SEO metadata — optional Yoast SEO / Rank Math field mapping
- Language metadata — optional Polylang integration for multilingual sites
- Signed outgoing webhooks — optional HMAC-SHA256-signed publish-event notification after a post goes live
- No AI service, social account, or external SaaS account bundled — remote requests only happen when you configure a client, supply a media URL, or set a webhook
AI Data Control — full spec
- Import a
conversations.jsonfile or a ZIP containing one — only that file is read out of an uploaded ZIP, nothing else is extracted - Browse and search conversation titles and messages, with soft-delete (the original imported archive is never modified)
- Paste-to-save capture for a conversation you don't have as a JSON export
- Presentation deck builder — assemble decks from conversations plus uploaded images/video/audio/PDF/HTML/text assets
- Export to printable / presentation HTML (prints cleanly to PDF; no native .pptx export in this release)
- Archive storage lives in a randomized directory outside the plugin folder, with best-effort Apache/IIS deny rules written alongside it
- Nothing leaves your site — archive operations run entirely on your own WordPress install, and the plugin is independent of, and not affiliated with, OpenAI, Anthropic, xAI, or DeepSeek
Your site already speaks the language
WordPress powers roughly a third of all websites — and more than six in ten sites that run on any content-management system at all. These three tools meet your content where it already lives: no separate CMS, no migration, no new login for your editorial team to learn.
Built the way a reviewer checks it
Every line below is a control actually present in the current plugin source — not a claim layered on top of it.
- ✓ Capability authorization — current_user_can('manage_options') gates every admin screen and privileged REST route
- ✓ Nonce-protected requests — wp_nonce_field / check_admin_referer / wp_verify_nonce on every settings save and upload form
- ✓ Sanitized input — sanitize_text_field / sanitize_key on every REST and form parameter before use
- ✓ Authenticated REST endpoints — per-plugin header key (X-RB-API-Key, X-AutoPoster-Key), compared with timing-safe hash_equals()
- ✓ Signed HMAC handoffs — SHA-256, timestamped canonical string, per-site secret
- ✓ Idempotent publishing — article_id-keyed updates, no duplicate posts on a retried request
- ✓ Per-site secrets — each install's API key / site secret is generated locally, not shared across sites
- ✓ No plaintext secrets — wp_generate_password() keys stored via the WordPress options table, never hard-coded
- ✓ Validated uploads — image MIME/size checks on sideloaded media; ZIP imports are path-traversal-protected and read only the expected file
- ✓ Sanitized rich content — pasted HTML cleaned server-side with WordPress's allowed-post-HTML rules
- ✓ Locked-down runtime storage — AI Data Control keeps archives in a randomized directory outside the plugin folder, with deny rules for Apache/IIS
This is an internal engineering checklist reflecting controls read directly from the current plugin source — not a third-party security audit, a completed Plugin Check run, or an endorsement by WordPress.org.
WordPress → JacAI → WordPress
Relevant Bot hands off signed content; JacAI's content engine processes it; Auto Poster publishes the result back.
Launch your JacAI apps
These plugins are the WordPress-side connectors. The AI, writing, and scheduling itself runs in these hosted apps.
JacAI SMM Dashboard
The full hosted backbone — writing, media, scheduling, OAuth, Zapier, and WordPress publishing in one place.
JAB — Self-Hosted Writer
Installable PWA writing/research/publishing app. One-time license, runs on your own account.
JacAI Writer
The lighter standalone writer — long-form drafting and editing without the full scheduling stack.
JacAI Dub
Translate, dub, and publish video straight to your channels from the same JacAI account.
WordPress.org Compatibility
Built for submission requirements
Built for WordPress.org submission requirements. Not claimed as WordPress-approved or WordPress-certified.
| Plugin | Version | License | WP min / tested to | PHP min | Plugin Check |
|---|---|---|---|---|---|
| Relevant Bot V2 | 0.3.0 | GPL-2.0-or-later | 6.0 / 7.1 | 7.4 | Run before submission |
| Auto Poster | 1.3.0 | GPL-2.0-or-later | 6.4 / 7.1 | 7.4 | Run before submission |
| AI Data Control | 1.1.0 | GPLv2 | 6.0 / 7.1 | 7.4 | Run before submission |
Written against WordPress core APIs (options, REST, cron, nonces, capability checks) rather than raw PHP file/DB access.
No telemetry beyond the documented, opt-in signed handoff. All three plugins keep their working data local to the WordPress install unless a connection is explicitly configured.
None of the three has a confirmed Plugin Check run recorded yet — shown here honestly as an open pre-submission step, not a passed result.
All three now ship real GPL-compatible license headers and readme License sections — Relevant Bot's was added in this 0.3.0 build.