# Protuno documentation > Every Protuno doc in one file (25 pages). Each section is one page of https://protuno.com/docs, with its address. ## Contents - Getting Started - What Is Protuno - Protuno Plugin - The Protuno Plugin, Explained - Install And Connect A Site - MCP Connectors And Abilities - Manage And Secure The Connection - Troubleshooting The Protuno Plugin - Protuno Workspace - Add A Site And Run Your First Audit - Read Your Site Report - What Protuno Can And Cannot Change - Run A Playbook And Read The Report - Routines: Put A Playbook On A Schedule - What Protuno Costs: Plans And Billing - Connectors: Connect A Platform Once - All 85 Checks, Referenced - Troubleshooting Sites, Scans And Runs - Connect Your AI App - Fix A Finding In Your AI App - Super Agents: Ask, Approve, Undo - Wren: The Care Super Agent - Rook: The Security Super Agent - Dash: The Performance Super Agent - Iris: The SEO Super Agent - Till: The eCommerce Super Agent - Echo: The Marketing Super Agent - Brain: What Protuno Remembers --- ## Getting Started ### What Is Protuno Page: https://protuno.com/docs/what-is-protuno > Point Protuno at a site, get the findings in plain words, then let your AI app do the work after you approve it, and read what it did. Protuno gives you a way to hand WordPress work to software and still know what happened. You point it at a site. It reads the site and tells you what it found in plain words. Then you connect the AI app you already use, such as Claude, and ask it to fix things. The AI app plans the work, you approve it in Protuno, and Protuno does the work on your staging site and writes down what it did. You check the fixes there, then move them to your live site in your own way. That is the whole idea. The rest of this page is how it works and what is live today. #### Start with the free audit The audit takes a domain and nothing else. No plugin, no login, no access to your server. It runs **54 checks** from the address alone. Connect the site and that becomes **85**, across eight areas: Security, Mail and DNS, SEO and Indexing, WordPress, Certificates, Performance, Commerce and Backups. **Every one of them is read only.** Nothing is written, nothing is changed, and the site does not know it is being looked at any more than it knows a visitor arrived. You get a score, and underneath it the findings that produced it. Not only a grade: “A certificate expires in 9 days” rather than “Security: B minus”. A finding you can forward to a client without rewriting it first. Run one at [protuno.com](https://protuno.com/#audit). It takes about forty seconds. #### Connect a site to see inside it An address only tells you so much. Connecting a site adds 31 checks that can only be read from inside the install: which plugins are actually active, what version of PHP is really running, whether the debug log is writing to a file anyone can download. Connecting is three steps and takes about two minutes. Start with your staging site. Protuno does the work on staging. Your live site is only read. ##### Step one: install the connector Download the Protuno Super Agent Connector from your dashboard, upload the zip in your staging site’s *Plugins, Add New, Upload Plugin*, and activate it. It is free, and it is the only thing you install. ##### Step two: the site declares what it can do The connector reads which abilities the site can offer and shows them to you before anything is granted. You see the list; you are not asked to trust a description of it. ##### Step three: paste a credential you own The plugin creates a WordPress application password and shows it to you once. You paste it into Protuno along with your username. The plugin keeps no copy. You can revoke it from your own WordPress user profile at any moment, without asking us, and the connection dies immediately. The key is yours, it lives in your site, and you can burn it whenever you like. ##### Then connect your AI app Protuno has no AI to buy. The thinking happens in the AI app you already use, such as Claude, Claude Code, Codex or Cursor, on your plan there. You add Protuno to it once, sign in to Protuno and press Allow. There is no API key to copy. Letting it run code on your sites is a separate box, off unless you tick it, and code only runs on sites set to Execute. [Connect your AI app](https://protuno.com/docs/connect-your-ai-app) has every step. #### Playbooks are the unit of work A playbook is one job, written out step by step *before* it ever runs. Take a backup. Check the backup is sound. Apply these updates. Load the site. Walk the checkout. If the site stops answering, put it back. No model decides at runtime what looks reasonable. You can read the entire sequence before you allow it, and it does the same thing on Tuesday that it did last Tuesday. That matters more than it sounds. An agency cannot audit a vibe. It can audit a list of steps. #### Super Agents do the work, in your AI app A Super Agent is a named agent that owns a group of playbooks. You ask one in your AI app, for example “Dash, clean up the database on my shop”. It shows you a plan, waits for you to approve it in Protuno, then runs the steps one at a time. - **Wren**, Care. Runs your updates behind a restore point, then loads the site again to be sure it still works. - **Rook**, Security. Reads what your site really has installed and closes the doors most installs leave open. - **Dash**, Performance. Finds the 4MB hero image and the cache that is not caching. - **Iris**, SEO. Crawls your site the way a search engine does. - **Till**, eCommerce. Walks one of your real products to the payment step. - **Echo**, Marketing. Confirms your forms still post and your tracking still fires. Only you can approve a plan, by pressing Approve on its card in Protuno. Your AI app can propose a plan, check it and decline it, but it cannot approve one. #### Permission is the product Permission is set per site, and there are two settings: - **Read only.** It analyses and reports. It changes nothing. - **Execute.** It may change files, the database and settings. A site you connect as a live site starts in Read only. A staging site starts in Execute, because staging is where Protuno does the work. Keep it that way: fix on staging, check the result there, then move the fixes to your live site in your own way, with your host’s push-to-live or the tools you already use. Only you can switch a site to Execute, in Protuno. Your AI app can set a site to Read only, never to Execute. On a Read-only site the tools that could change anything are taken out of the run before it starts, so the work is not a matter of asking the software nicely. An instruction is a policy. Taking the tool away is a good deal stronger than a policy. 17 of the 27 playbooks only read. The other 10 can change something, and they say so on their own card before you run one. A playbook that changes a site takes a backup first and checks it is sound before it goes any further. Plugin updates go further still: each plugin folder is stashed before its update and put back if the site stops answering. Three playbooks can also be rolled back from the run report afterwards, and the report tells you which changes it can undo and which it cannot. #### Activity is the receipt Every run across every site you can see, newest first, each with its own report. It is the least exciting screen in the product and possibly the most important one, because “what did you actually do this month” is a question every agency gets, and the honest answer should not be a memory. #### What is live today - **Live now.** The free site audit. 54 read-only checks from a domain alone. - **Live now.** Connecting a site, the connector plugin, and the 31 deeper checks that come with it. - **Live now.** 27 playbooks on every plan. Run any of them from your AI app, and put them on a schedule with routines on Pro and Agency. - **Live now.** The six Super Agents, working in your AI app. You approve every change in Protuno, and Protuno takes a backup first and can undo it. We are shipping in order of least risk to most: the playbooks that only read, then updates behind a backup that has been checked, then the ones that change more. #### Where to go next - [Run a free audit](https://protuno.com/#audit) on a site you look after. - [Read why we are building this](https://protuno.com/blog/introducing-protuno), and what we think agencies got wrong about AI. --- ## Protuno Plugin ### The Protuno Plugin, Explained Page: https://protuno.com/docs/protuno-plugin-explained > It connects one WordPress site to Protuno. Here is what it installs, what it deliberately leaves alone, and where an agent’s access on your site actually comes from. The Protuno plugin is the one thing you install on a WordPress site to connect it to Protuno. Install it on your staging site first, because that is where Protuno does the work. It is small on purpose. It does three jobs on one screen in wp-admin, then it gets out of the way. It never keeps a copy of the password it makes. This page covers what those jobs are, what the plugin leaves alone, and where the real access comes from. #### Three jobs, one screen Everything happens on one screen, under Protuno in the wp-admin menu. It opens by itself the first time you activate the plugin. ![The Protuno setup screen in wp-admin showing the Welcome, Abilities and Connect steps](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-01-welcome-screen.webp) *It opens by itself the first time you activate the plugin. Three steps across the top, and nothing else added to your admin menu.* ##### Step one: It checks what your site can expose Protuno’s Super Agents reach a site over MCP, the protocol apps use to call the abilities a site offers. The plugin does not run MCP itself. It looks for a connector that does: Agent Connector for WP, Angie or Novamira. If none is there, it installs Agent Connector for WP with one press. If one is installed but switched off, it switches it on. If more than one is running, it asks you which one Protuno should use. ![The Abilities step showing Agent Connector for WP marked Not found, with an Install and Enable MCP button](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-02-mcp-suggested.webp) *On a site with no MCP connector, the second step names the one it will install, lists what it exposes, and says plainly that the companion pack reaches WP-CLI, PHP and your files. Nothing is installed until you press the button.* ##### Step two: It creates the credential When you press Continue, the plugin creates a WordPress application password named `Protuno - AI Super Agent` and shows it to you, with your username, once. You paste both into Protuno when you add the site. ![The Protuno screen showing a username and an application password, with the password obscured](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-03-credentials.webp) *Shown once, with your username. Copy both before you leave the screen, because the plugin keeps no copy of the password.* ##### Step three: It reports the connection After that, the screen becomes a status page. It says whether the site is Live, Waiting or Disconnected, and when Protuno last read it. From there you can make a new password or disconnect. ![The Protuno connection screen reading Live, with the connector name and the time of the last read](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-04-connection-live.webp) *After that the screen is a status page: Live, Waiting or Disconnected, which connector is serving, and when Protuno last read the site.* #### What it does not do The plugin connects. It does not act. That line is drawn in what it is built to do, not in a setting. - **It registers no abilities** and runs no MCP server. Everything an agent can do on your site comes from the connector you enable. - **It runs nothing for a remote caller.** It executes no PHP, reads no options and lists no plugins for anyone outside wp-admin. - **It keeps no copy of the password.** WordPress stores only a hash of it, the way it does for every application password. - **It creates no tables, no logs and no user meta.** It writes five small options, and deleting the plugin removes them. **The plugin is the doorway, not the room.** What Protuno can do on your site is set by the connector you enable, and the screen shows you that before anything is granted. #### How the pieces fit Four things are involved in a connection. Only one of them is this plugin. ![The WordPress plugins list showing Protuno, Agent Connector for WP and Universal Abilities all active](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-05-three-plugins.webp) *Three separate plugins after setup. Protuno connects. Agent Connector runs the MCP server. Universal Abilities supplies the abilities that can change a site.* - **Protuno plugin**: What it does: Checks the site, creates the credential, reports the connection.; Where it lives: Your site - **MCP connector**: What it does: Runs the MCP server and registers the abilities an agent can call.; Where it lives: Your site - **Universal Abilities**: What it does: An optional pack for Agent Connector that lets an agent change things, not just read them.; Where it lives: Your site - **Protuno dashboard**: What it does: Where you paste the credential, approve each change and read every run. The Super Agents work from your AI app, through Protuno.; Where it lives: protuno.com #### Universal Abilities, said plainly When the plugin installs Agent Connector for WP, the same press adds Universal Abilities, its companion pack. It lets an agent run shell commands, evaluate PHP, read and write files, run WP-CLI and sign in to wp-admin. That is complete access to the install, and the screen says so before you press and again after. That is the reason to do the work on your staging site. Every call is logged in your Protuno dashboard, and you can switch the pack off under Plugins at any time. Agent Connector keeps working without it; your agents can then read the site but not change it. If you also connect your live site, consider switching the pack off there. ![The Agent Connector abilities screen listing registered abilities including shell execution and PHP evaluation](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-06-abilities-registered.webp) *The abilities actually registered on the site, listed inside Agent Connector. This is the real answer to what an agent can do here, not anything the Protuno plugin decides.* #### One server, and only that one If your site runs more than one MCP server, you choose which one Protuno uses. Protuno’s password is then refused on every other MCP route on the site. Your own logins and any other application passwords are not affected. #### You hold the key The password belongs to your WordPress user and lives in your site. You can end the connection from either end, without asking us: ![The WordPress profile Application Passwords section showing Protuno - AI Super Agent with a Revoke button](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-07-app-passwords-final.webp) *Users, Profile, Application Passwords. Revoke it here and the connection stops at once, without asking Protuno.* - Press **Disconnect** on the Protuno screen in wp-admin. - Or open **Users**, **Profile**, **Application Passwords** and revoke `Protuno - AI Super Agent`. Either way the connection stops at once. **Deleting the plugin does not revoke the password.** It removes the plugin’s own settings, but the connection keeps working until the password is revoked. Disconnect first if you want both gone. #### Where to go next - [**Install and connect a site**](https://protuno.com/docs/install-and-connect-a-site), starting with your staging site, from the requirements to the word Live. - [**MCP connectors and abilities**](https://protuno.com/docs/mcp-connectors-and-abilities), and what to read before you leave Universal Abilities on. - [**Manage and secure the connection**](https://protuno.com/docs/manage-and-secure-the-connection): rotate the password, disconnect, or revoke it from your own profile. - [**Troubleshooting**](https://protuno.com/docs/troubleshooting-the-protuno-plugin), which lists every message the screen can show and the shortest way past it. ### Install And Connect A Site Page: https://protuno.com/docs/install-and-connect-a-site > Install the plugin, switch on MCP abilities, and hand Protuno a password you own. On most sites it takes about two minutes. Connecting a site takes one plugin, one screen and about two minutes. Do it on your staging site first: Protuno does the work on staging, and your live site is only read. This page walks it from the requirements to the word Live on the connection screen. You will not need to open a file, edit a config or talk to your host, unless your site has something switched off that the plugin needs. When that happens, the screen tells you which thing it is. #### Before you start Check these first. Most sites already meet all of them. - **WordPress**: 6.9 or later. - **PHP**: 7.4 or later. - **HTTPS**: WordPress only issues an application password on a secure connection. A site set to the `local` environment type is exempt, so a local test site works. - **Your account**: An administrator. Anyone who can manage the site’s settings can connect it. - **Application passwords**: Switched on. They are on by default, but some security plugins turn them off. If your site has no MCP connector yet, Protuno installs Agent Connector for WP, and that asks for more: **WordPress 7.0 and PHP 8.1**. On an older site, step two says exactly which one falls short and offers Read The Requirements in place of the install. #### Install the plugin The plugin comes from your Protuno dashboard, not from WordPress.org, so you upload it once by hand. ![The WordPress Add Plugins screen with the Upload Plugin panel open](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-08-upload-zip.webp) *Plugins, Add New, Upload Plugin. The zip comes from your Protuno dashboard, not from wordpress.org.* 1. Download the plugin zip from your Protuno dashboard. 2. In your staging site’s wp-admin, open **Plugins**, **Add New**, **Upload Plugin**, choose the zip and press Install Now. 3. Press Activate. The Protuno screen opens by itself. If it does not, which happens on multisite or when you activate several plugins at once, open **Protuno** in the admin menu, or press **Connect site** under the plugin’s name on the Plugins screen. Updates come from protuno.com and appear under Dashboard, Updates, the same as any other plugin. #### Connect in three steps The screen has a rail across the top: Welcome, Abilities, Connect. Nothing on your site changes until you press a button that says it will. ##### Step one: Welcome The first screen introduces the Super Agents and what they look after. It changes nothing. Press **Set Up Protuno**. ![The Protuno Welcome step showing the Welcome, Abilities and Connect rail](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-01-welcome-screen.webp) *Step one changes nothing. It introduces the Super Agents and hands you a single button.* ##### Step two: Enable MCP abilities The second screen checks whether your site can expose abilities over MCP. It shows one of four things, and the heading tells you which. - **Install And Enable MCP Abilities**: What it means: No MCP connector on the site.; What to do: Press Install & Enable MCP. It installs Agent Connector for WP and Universal Abilities, and switches both on. - **MCP Abilities Found**: What it means: A connector is installed but switched off.; What to do: Press Enable The Abilities. Switching them on changes nothing else. - **Your Site Is Ready for Protuno Agents**: What it means: A connector is running.; What to do: Check it is marked Enabled, then press Continue. - **An MCP Server Is Already Running**: What it means: A server Protuno has not been tested against.; What to do: Read [what to do with an unrecognised server](https://protuno.com/docs/mcp-connectors-and-abilities). **Read what you are switching on.** The same press that installs Agent Connector adds Universal Abilities, which gives an agent complete access to the install. The card on this screen says so before you press. It is one more reason to start on staging. [Here is what it grants](https://protuno.com/docs/mcp-connectors-and-abilities). ![The Abilities step with Agent Connector for WP marked Not found and an Install and Enable MCP button](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-02-mcp-suggested.webp) *No connector on the site: Protuno names the one it will install, lists what it exposes, and says plainly that the companion pack reaches WP-CLI, PHP and your files.* If your site runs more than one MCP server, this screen asks which one Protuno should use, and Continue stays hidden until one is enabled. [Choosing between servers](https://protuno.com/docs/mcp-connectors-and-abilities) explains why there can only be one. ![The Abilities step reading MCP Abilities Found, they are switched off](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-12-mcp-abilities-found.webp) *A connector already installed but switched off. Nothing is downloaded; the button only enables what is there.* If your site does not allow plugins to be installed from the dashboard, the button reads **Get The Connector** instead. Install it by hand, come back, and the screen picks up where it left off. Switching on a connector that is already installed still works. When the connector is running, press **Continue**. This is the moment the password is created. ![The Abilities step reading Your Site Is Ready for Protuno Agents with both packs marked Enabled](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-13-site-is-ready.webp) *When the abilities are serving, the step confirms which packs are on. Press Continue to move to the credential.* ##### Step three: Copy your credentials The third screen, Your Site Credentials, shows two values: **Username** and **Application password**. Each has its own Copy button. **You see the password once.** The plugin does not save it, so it will not be shown here again. If you leave before copying it, make a new one with Regenerate Password on the connection screen. ![The Protuno credentials screen showing a username and an application password, password obscured](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-03-credentials.webp) *Shown once. Copy both before you leave the screen.* Press **Add Site to Protuno**. It opens your Protuno dashboard with this site already filled in. Paste both values there and save. Back in wp-admin, press **Done**. #### How you know it worked The Protuno screen becomes the connection screen, headed Protuno Is Connected. It reads **Waiting** until Protuno reads the site for the first time, then **Live**. ![The Protuno connection screen reading Live with the connector name and last read time](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-04-connection-live.webp) *Live, the connector that is serving, and the time Protuno last read the site.* You do not need to reload. While the tab is open, the screen checks by itself every few seconds and updates when Protuno arrives. If it stays on Waiting after you have pasted both values, see [Stuck on Waiting](https://protuno.com/docs/troubleshooting-the-protuno-plugin). #### Where to go next - [MCP Connectors and Abilities](https://protuno.com/docs/mcp-connectors-and-abilities): what each connector can do, and how to switch Universal Abilities off. - [Manage and Secure the Connection](https://protuno.com/docs/manage-and-secure-the-connection): what the connection screen tells you, and how to end it. - [Connect your AI app](https://protuno.com/docs/connect-your-ai-app), so the Super Agents can work on the site you just connected. ### MCP Connectors And Abilities Page: https://protuno.com/docs/mcp-connectors-and-abilities > Protuno reaches your site through an MCP connector. Which one you run, and what you switch on with it, decides what an agent can do. The Protuno plugin gives an agent nothing on its own. Every ability comes from an MCP connector: a separate plugin that runs an MCP server on your site and registers what an agent may call. Abilities are the individual things an agent can do. Read a post, run an update, check an order. The connector decides which exist, and the plugin shows you which connector is serving before anything is granted. Protuno works with three connectors. It only ever installs one of them. #### Supported connectors - **Agent Connector for WP**: Made by: Soflyy. Free and open source.; How Protuno treats it: Recommended, and the only connector Protuno installs for you. Needs WordPress 7.0 and PHP 8.1. - **Angie**: Made by: Elementor; How Protuno treats it: Used when it is running an MCP server. You install and update it yourself. - **Novamira**: Made by: Dynamic.ooo; How Protuno treats it: Used when it is running an MCP server. You install and update it yourself. A site that already runs one of these is never offered an install. Protuno uses what is there. ##### Installed, but not serving A connector can be active in your Plugins list and still run no MCP server. Some builds of Angie do this. It is switched on, but there is nothing for an agent to connect to. When that happens, step two names the plugin and says it is active but not running an MCP server. It then offers Agent Connector, because an agent needs a server to talk to and there is not one yet. #### Agent Connector for WP This is the connector Protuno installs when a site has none. The card on step two lists what it does: ![The Agent Connector card on the Abilities step listing what it runs and what it exposes](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-02-mcp-suggested.webp) *The card Protuno shows before anything is installed: what the connector runs, what it registers, and that the same press adds Universal Abilities.* - Runs an MCP server on your site. - Registers the abilities an agent needs, across your content, media, users and whatever your other plugins add. - Logs every ability call in your dashboard. It downloads from Soflyy’s own release page. The plugin only accepts downloads from a short list of known addresses over HTTPS, and refuses anything else. #### Universal Abilities Universal Abilities is Agent Connector’s companion pack. The same press that installs Agent Connector installs it too, unless your site has turned that off. **It gives an agent complete access to the install.** With it on, an agent can run shell commands, evaluate PHP, read and write files, run WP-CLI and sign in to wp-admin. It is exposed over MCP to super admins. That is what lets a Super Agent actually fix things rather than only report them. It is also the part to think about before you leave it on, and the reason we suggest doing the fixing on your staging site. The screen tells you before you press and again after. ![The Agent Connector abilities list showing registered abilities including shell execution and PHP evaluation](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-06-abilities-registered.webp) *The abilities actually registered on the site. This list, not the Protuno plugin, is the real answer to what an agent can do here.* - **Every call is logged** in your Protuno dashboard. - **You can switch it off** under Plugins at any time. Agent Connector keeps running without it, so your agents can still read the site but can no longer change it. - **You can switch it back on** from step two, which shows Install Universal Abilities or Enable Universal Abilities when the pack is missing or off. Universal Abilities works with Agent Connector only. It is listed under Agent Connector on step two while Agent Connector is the server Protuno uses. #### Choosing between servers A site can run more than one MCP server at once. Protuno uses exactly one. ![The WordPress plugins list showing Protuno, Agent Connector for WP and Universal Abilities active](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-05-three-plugins.webp) *After setup there are three separate plugins. Switching the companion pack off under Plugins leaves the connector running.* If there is only one, there is no question to answer. Pressing Continue records it as your choice, so the password stays limited to it even if you add a second connector later. If there are several, step two says so and lists them under Providing abilities on this site. Enable the one Protuno should use. Enabling a different one turns the current one off, and Continue stays hidden until one is enabled. **Protuno cannot reach the others.** Its password is refused on every MCP server except the one you chose. Your own logins and any other application passwords are not affected. To change your choice later, open the Protuno screen, go back to step two and enable a different server. #### When another MCP server is running If your site runs an MCP server that is not one of the three above, step two says an MCP server is already running and that Protuno does not recognise it. Nothing needs removing. Your site simply runs a connector Protuno has not been tested against, so it cannot connect through it yet. You have two ways forward: - Switch to Agent Connector for WP, Angie or Novamira alongside it, and choose that one on step two. - Or turn your current server off and let step two install Agent Connector. #### Where to go next - [Install and Connect a Site](https://protuno.com/docs/install-and-connect-a-site), if you have not connected yet. - [Manage and Secure the Connection](https://protuno.com/docs/manage-and-secure-the-connection): how the password is limited to the server you chose. ### Manage And Secure The Connection Page: https://protuno.com/docs/manage-and-secure-the-connection > Read what the connection screen tells you, change the password, end the connection, and see exactly what Protuno can reach. Once a site is connected, the Protuno screen in wp-admin stops being a setup screen. It becomes the one place to see whether Protuno is reading your site, and to change or end that. The password behind it is yours. It lives in your site, and you can end the connection from either end without asking us. #### The connection screen The heading reads Protuno Is Connected, with your site’s domain beside a status word. ![The Protuno connection screen reading Live](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-04-connection-live.webp) *Live: Protuno has read the site in the last seven days.* - **Live**: Protuno has read the site in the last seven days. Live here is the connection status, not a sign that this is your live site rather than staging. - **Waiting**: The password has been handed over, but Protuno has not read the site in the last seven days, or at all yet. - **Disconnected**: The password has been revoked. Protuno cannot reach the site. Underneath are two facts: - **MCP abilities enabled** names the connector that is serving, or says Not running if none is. - **Last read** gives the time Protuno last read the site. Before the first read it shows Credential: Not used yet, and after a disconnect, Revoked. The screen updates itself. While the tab is open and visible, it checks every few seconds for up to fifteen minutes and reloads when the connection changes. It never reloads while a new password is on screen, so you will not lose one you have not copied. ![The Protuno connection screen reading Waiting with Credential Not used yet](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-14-connection-waiting.webp) *Waiting: the password has been handed over but Protuno has not read the site yet.* Open Protuno Dashboard takes you to your dashboard on protuno.com. ![The Protuno connection screen reading Disconnected with Credential Revoked](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-15-connection-disconnected.webp) *Disconnected: the password has been revoked and Protuno cannot reach the site.* #### Regenerate the password WordPress shows an application password once. If you lost it, or want to rotate it, make a new one. ![The regenerate confirmation panel explaining the current password stops working straight away](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-10-regenerate-confirm.webp) *Regenerate asks once, and says plainly that the current password stops working immediately.* 1. Press **Regenerate Password**. 2. Read the note and press Confirm. The current password stops working straight away, and Protuno cannot read the site until you paste the new one in. 3. Copy the new username and password. They are shown under Your new application password. 4. Press **Update in Protuno** and paste the new password into your dashboard. Only an administrator signed in to wp-admin can regenerate. A request made with the Protuno password itself is refused, so Protuno cannot issue itself a new key. #### Disconnect and reconnect Press **Disconnect**, then Confirm. This revokes the password and disconnects your site from Protuno completely. The connector stays installed. ![The disconnect confirmation panel explaining the password is revoked and the connector stays installed](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-11-disconnect-confirm.webp) *Disconnect revokes the password. The connector stays installed.* The screen then reads Protuno Is Disconnected and confirms your password has been revoked. Your Super Agents stop on this site. To start again, press **Reconnect**. If your connector is still set up, the plugin creates a new password straight away. If not, it takes you back to step two first. Disconnecting from your Protuno dashboard does the same thing from the other end. #### Revoke from your WordPress profile You do not need the Protuno screen, or us, to cut access. ![The WordPress profile Application Passwords section showing Protuno - AI Super Agent with a Revoke button](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-07-app-passwords-final.webp) *Users, Profile, Application Passwords. Revoking here stops the connection at once, without involving Protuno.* 1. In wp-admin, open **Users**, **Profile**. 2. Scroll to **Application Passwords**. 3. Find `Protuno - AI Super Agent` and press Revoke. Sites connected with an older version may show it as `Protuno`. The connection stops at once. #### How the password works The credential is a standard WordPress application password. It belongs to the administrator who pressed Continue, and WordPress stores only a hash of it. The plugin keeps no copy. **It only opens the server you chose.** Protuno uses the password to call your site’s REST API and the one MCP server you picked on step two. On any other MCP server on the site, the request is refused with a message saying the site is set to expose only that one connector to Protuno. That limit applies to the Protuno password alone. Your own sign-in and other application passwords work as before. Regenerate and Disconnect remove every Protuno password on the site, whichever user it belongs to. Application passwords made by other integrations are left alone. On multisite, a Protuno password belonging to a user you cannot edit is skipped, and the screen tells you so. #### What the plugin stores No tables, no logs and no user meta. Five small options, each doing one job: - **`protuno_do_redirect`**: Opens the Protuno screen once, after activation. - **`protuno_last_identified`**: When Protuno last read the site. Written at most once a minute. - **`protuno_disconnected`**: Tells a disconnected site apart from one that was never connected. - **`protuno_mcp_choice`**: Which MCP server you chose. - **`protuno_write_lock`**: A short lock so two changes cannot happen at once. Deactivating the plugin keeps these. Deleting it removes them all. **Deleting the plugin does not revoke the password.** The connection keeps working until the password is revoked. Disconnect first if you want both gone. #### Where to go next - [Troubleshooting](https://protuno.com/docs/troubleshooting-the-protuno-plugin), if the screen says something you did not expect. - [MCP Connectors and Abilities](https://protuno.com/docs/mcp-connectors-and-abilities): what an agent can do through the server you chose. ### Troubleshooting The Protuno Plugin Page: https://protuno.com/docs/troubleshooting-the-protuno-plugin > Every message the Protuno screen can show, what it means, and the shortest way past it. When the plugin cannot do something, it says why in plain words. This page lists those messages, grouped by where you meet them, with the fix for each. Find the words on your screen, then read the lines under them. Most fixes take a minute and a setting. #### This site cannot issue a password This screen appears instead of the setup steps when WordPress will not create an application password on your site. The line under the heading names the reason. Once it is fixed, press **Check Again**. ##### The site is served over http > Protuno cannot connect to a site served over http, because WordPress will not issue an application password on one. WordPress only issues application passwords on a secure connection. To fix it, add an SSL certificate. Most hosts do it from their control panel in a few minutes, and many at no cost. Then make sure both addresses under Settings, General start with https. ##### A security plugin turns them off > Wordfence is switching application passwords off on this site. Turn them back on in its settings, then check again. The screen names the plugin when it is Wordfence, Solid Security, Sucuri Security or All In One WP Security. Wordfence ships with this setting on by default. To fix it, open that plugin’s login security settings and allow application passwords. > Application passwords are disabled on this site, usually by a security plugin or the wp_is_application_passwords_available filter. Something is turning them off, but the plugin cannot tell what. To fix it, check your other security plugins first. If none of them is responsible, look for custom code or a must-use plugin that sets that filter. ##### They are off for your account > Application passwords are switched off for your account, usually by a security plugin. Another administrator can connect this site, or the policy can be changed for your user. Application passwords work on the site, but a policy blocks them for your user. To fix it, ask another administrator to connect the site, or change the policy in the security plugin for your account. ##### WordPress is too old > This site runs a WordPress version older than 5.6, which has no application passwords. Application passwords arrived in WordPress 5.6. To fix it, update WordPress. The plugin itself needs 6.9 or later. #### The connector won’t install These appear on step two, after you press Install & Enable MCP. ##### The download failed > The connector could not be installed: … Try again, and if it keeps failing the download source may be unreachable from this server. Your server could not fetch Agent Connector from its release page. The reason from WordPress appears in place of the dots. To fix it, press the button again. If it keeps failing, ask your host whether outbound HTTPS to github.com is blocked, or install Agent Connector by hand and come back. > Nothing was downloaded. The connector address is not on this plugin’s allowed list. If a filter on this site changed it, that is what to revert. The plugin only downloads from a short list of known addresses. Something on your site pointed it somewhere else, so it stopped. To fix it, remove the custom code that changed the connector’s address. ##### The site does not allow installs > This site does not allow plugins to be installed from the dashboard, so this one has to go in by hand. File changes are switched off on this site, usually by your host. To fix it, press Get The Connector, upload it through your host or SFTP, then come back. Switching it on from this screen still works. > Your account cannot activate plugins here. An administrator can switch on Agent Connector from the Plugins screen, and this page will carry on. Your user can see the screen but is not allowed to activate plugins. To fix it, ask an administrator to activate Agent Connector for WP under Plugins. ##### The site is below the connector’s requirements > It needs WordPress 7.0 or later. This site runs 6.9. Agent Connector for WP needs WordPress 7.0 and PHP 8.1. The screen shows the version it needs and the one your site runs, for WordPress or PHP. To fix it, update WordPress, or ask your host to move the site to a newer PHP. Read The Requirements has the full list. #### Universal Abilities didn’t install Agent Connector went in, but its companion pack did not. Your agents can read the site but not change it until the pack is added. > Agent Connector is installed and switched on, but Universal Abilities could not be added: … Press the button again to retry just that part. The first half of the install worked. Only the pack failed. To fix it, press the button again. It retries the pack alone. > WordPress will not install plugins on this site. Either your account lacks the permission, or file changes are switched off. Ask whoever hosts the site to add Universal Abilities. The same limit as above, met on the pack. To fix it, ask your host or an administrator to install Universal Abilities for Agent Connector. #### Stuck on Waiting The connection screen says Waiting when Protuno has not read the site in the last seven days, or has not read it yet. Right after you connect, work through these in order: ![Protuno showing that the application password no longer works, with a Reconnect this site button](https://cms.protuno.com/wp-content/uploads/2026/09/protuno-plugin-16-password-no-longer-works.webp) *What Protuno shows when the password it holds has been revoked or replaced. The project and its history stay; pasting a new password picks up where it left off.* - **Both values went in.** Check the username and the application password are pasted into your Protuno dashboard exactly as shown. - **It is the newest password.** If you pressed Regenerate Password, the old one stopped working. Paste the new one. - **The password still exists.** Look under Users, Profile, Application Passwords for `Protuno - AI Super Agent`. - **A connector is running.** MCP abilities enabled should name a connector, not say Not running. If it says Not running, go back to step two. - **Nothing is blocking the REST API.** A firewall or security plugin that blocks `/wp-json/` stops Protuno before it reaches the site. ##### Only one server is exposed > This site is set to expose only Agent Connector for WP to Protuno. Change it on the Protuno screen in wp-admin. Protuno tried to use an MCP server other than the one you chose. Its password only opens that one. To fix it, open the Protuno screen, go to step two, and enable the server you want Protuno to use. #### Disconnecting and revoking > Another change to this connection is already running, possibly in a second tab or by another administrator. Wait a moment and try again. Two changes cannot happen at once, so the second one waits. To fix it, wait a few seconds and press the button again. > There was no Protuno password on this site to revoke. The password was already gone, usually revoked from a user’s profile. To fix it, there is nothing to do. The site is already disconnected. > 1 Protuno password could not be revoked and still works: … Remove it from that user’s profile screen, under Application Passwords. One password could not be removed from here and is still active. To fix it, open that user’s profile and revoke it under Application Passwords. > 1 Protuno credential belongs to a user your account cannot edit, so it was left alone. A network administrator can remove it. On multisite, you can only remove passwords of users you can edit. To fix it, ask a network administrator to revoke it. #### Known plugin conflicts - **Wordfence, Solid Security, Sucuri Security, All In One WP Security.** These can switch application passwords off. The screen names them when they do. See [a security plugin turns them off](#a-security-plugin-turns-them-off) above. - **UiChemy.** Older UiChemy builds could remove the Protuno plugin while cleaning up a retired tool that shared its file name. The current Protuno plugin tells UiChemy to leave it alone. If Protuno disappeared after you installed or updated UiChemy, install the latest Protuno again. - **Tutor LMS.** It could leave the Protuno screen showing with no styling. The current version fixes this, so update the Protuno plugin. #### Permission messages > You do not have permission to view this page. The Protuno screen is for administrators only. To fix it, sign in as an administrator, or ask one to connect the site. #### Still stuck Note the exact words the screen shows and which step you were on. That is usually everything we need to tell you what is wrong. --- ## Protuno Workspace ### Add A Site And Run Your First Audit Page: https://protuno.com/docs/add-a-site-and-run-your-first-audit > Paste a domain for 54 checks from the outside. Connect the site and 31 more become readable, for 85 in total. Protuno starts with an address. Paste a domain and it runs 54 checks from the outside, the way any visitor sees your site. No account, no plugin, and you do not have to own the site to look at it. Connecting a site is the second step, and it is the one that changes what Protuno can see. Connect your staging site first: Protuno does the work on staging, and your live site is only read. This page covers both. #### What the free audit checks from your address alone The audit reads what the address gives up to anyone: the certificate, DNS and mail records, security headers, how fast the server answers, whether a store is reachable. It writes nothing and changes nothing. **54 checks run from the domain alone.** You get the literal finding rather than a grade. “A certificate expires in 9 days”, not “Security: B minus”. It is written so you can forward it to a client without rewriting it first. The first few findings show without an account. Opening the full report asks for a name and email. #### What connecting a site adds: 31 more checks An address only tells you so much. Some things can only be answered from inside the install: which plugins are genuinely active, the real PHP version, whether the debug log is writing somewhere downloadable, whether a restore point exists at all. Connecting a site adds **31 checks**, for **85 in total**. It takes one plugin and about two minutes. ![The Add a site screen in Protuno with the plugin download, a site address field and credential fields](https://cms.protuno.com/wp-content/uploads/2026/09/app-08-add-site.webp) *Add a site: download the plugin, check the address, then paste the username and application password the plugin shows you.* **Use the full address, including https://.** The field accepts a bare domain for the check but the connect step expects the complete URL. If the check reports that it could not read the site from here, that is a warning rather than a blocker. Carry on; the connect step will tell you if something is genuinely wrong. #### The deep scan starts on its own The deep scan starts on its own. It reads the site while you watch, counting up through the 85 checks, and the screen names each one as it goes. On most sites this takes about a minute. A large site can take two or three. #### Where your sites appear, ordered worst first Every site you add appears under Sites, ordered worst first rather than alphabetically, because the list is meant to answer one question: which of these needs me today. ![The Protuno sites list showing health score, open findings, plugin state and last scan date](https://cms.protuno.com/wp-content/uploads/2026/09/app-01-sites-list.webp) *Health, open findings, whether the plugin is connected, and when it was last looked at.* Each row says whether the site is connected and reading from the inside, or whether Protuno only has the address. #### Where to go next - [**Read your site report**](https://protuno.com/docs/read-your-site-report), and what the score and the five categories actually mean. - [**What Protuno can and cannot change**](https://protuno.com/docs/what-protuno-can-and-cannot-change), and why the work happens on staging. - [**Connect your AI app**](https://protuno.com/docs/connect-your-ai-app), so the Super Agents can fix what the audit found. ### Read Your Site Report Page: https://protuno.com/docs/read-your-site-report > What the score, the five categories and the findings actually mean, and which parts of the report to trust. A connected site gets a score out of 100, five category scores, and a list of open findings. This page explains what each of those is measuring, and which parts to trust. #### What the score out of 100 does and does not tell you The number at the top is a summary, not a verdict. It moves when findings open and close. It is useful for spotting that something changed since last week, and much less useful as an absolute grade. The findings underneath are the real output. Read those. ![A Protuno site report showing the score out of 100, failed and needs-attention counts, and the last scan time](https://cms.protuno.com/wp-content/uploads/2026/09/app-09-site-report-top.webp) *Score, how many findings failed, how many need attention, and when the site was last read.* #### The five report categories Findings group into **Security, Performance, Care, Growth and General**, each with its own score and its own list of what passed. The panel tells you how many checks in that category have something open, then lists every check underneath, including the ones that passed. Passed checks are worth reading. They are the evidence that something was actually looked at rather than skipped. #### Fix this, or How to fix Every finding states what was observed and why it matters, in the same plain register as the audit. Each one carries two buttons. - **How to fix** opens the exact change to make, in plain words. - **Fix this** hands the fix to your AI app, which checks the issue, tells you its plan and asks before it changes anything. Make it on your staging site, check it there, then move it to your live site in your own way. See [Fix a finding in your AI app](https://protuno.com/docs/fix-a-finding-in-your-ai-app). A missing DMARC record is the clearest example. Nothing inside WordPress can publish one, so no amount of access would let Protuno fix it. A fix does not close a finding by itself. The next scan checks again and decides. ![The full Protuno site report showing categories and a list of open findings with fix buttons](https://cms.protuno.com/wp-content/uploads/2026/09/app-07-site-report.webp) *The whole report: categories at the top, then open findings ordered by severity.* #### The five severity levels Findings carry one of five severities: **Critical, High, Medium, Low and Info**. Critical means something is either already broken or already exposed. A core file that does not match the official WordPress release is critical, because there are only two explanations and one of them is that someone injected code. Low and Info findings are still worth reading. They are the ones that become a problem later rather than today. #### Where to go next - [**What Protuno can and cannot change**](https://protuno.com/docs/what-protuno-can-and-cannot-change), and how to set a site to read only. - [**Run a playbook and read the report**](https://protuno.com/docs/run-a-playbook-and-read-the-report), for work that goes beyond a single fix. - [**Fix a finding in your AI app**](https://protuno.com/docs/fix-a-finding-in-your-ai-app). ### What Protuno Can And Cannot Change Page: https://protuno.com/docs/what-protuno-can-and-cannot-change > Read only and Execute, what the site’s mode actually controls, and how you approve every change. This is the part worth reading before anything else. Protuno does the work on staging. Your live site is only read. On top of that habit, the safety model rests on one setting you control per site, plus a clear-eyed view of what can and cannot be undone afterwards. #### Read only and Execute: the two site modes Every connected site is in one of two modes, changed from the site’s own screen: - **Read only**: Analyses and reports. Changes nothing. - **Execute**: May change files, the database and settings. A site you connect as a live site starts in **Read only**. A site you connect as a **staging** site starts in **Execute**, because staging is where Protuno does the work. Leave your live site in Read only. Fix on staging, check the result there, then move the fixes to live in your own way, with your host’s push-to-live or the tools you already use. That last step is yours, not Protuno’s. If you are connecting a staging install that matters, check the mode after connecting rather than assuming it. Only you can switch a site to Execute, and only in Protuno. Your AI app can set a site to Read only, never to Execute. #### The mode is the control The site’s mode is what decides whether anything can be written. A site set to Execute grants write access to any playbook that runs on it. A site set to Read only does not get written to: every tool that could change the site is removed from the run’s inventory before the model sees it, so it cannot make the change rather than being asked not to. The Read Only / Can Write label on a playbook card is real and is enforced, but only for scheduled runs: a routine for a playbook that can write will not fire on a read-only site, and the routine row says so. 17 of the 27 only read. The other 10 can change something. Two limits worth knowing, because the guardrail is good rather than absolute. Tools are removed by matching their names against a list of changing verbs, so an ability the plugin adds under an unfamiliar name would survive. And the REST tool is deliberately kept, because it is the main way a site is read at all; on a read-only site it is held to reads by instruction rather than by removal. Neither is a reason to distrust the mode. Both are reasons to do the work on staging and keep your live site in Read only, rather than treating the mode as the only thing between an agent and the site you care about. #### You approve before anything changes When you ask a Super Agent for a job, your AI app shows you the plan, and the plan appears as a card in Protuno. Only you can approve it, by pressing Approve there. Your AI app cannot approve for you. Each agent also has a trust level on each site, set on the agent’s page under On this site: - **Read.** Looks, never touches. Runs only playbooks that read the site. - **Ask.** Plans, then waits for your yes. Every step that changes the site asks again first, with Approve this change on the job card. - **Auto.** After you approve the plan, it runs without stopping to ask. Playbooks that need a backup make one as their first step. New agents start at Ask. On top of that, the work runs on your staging site, that your live site stays in Read only unless you change it, and that the sequence about to run was written down in full before it ran, so you can read it first. A playbook you build yourself can carry an approval checkpoint, which holds the run at that step until somebody approves it. The run then shows as **Waiting on you** in Activity. None of the 27 ready-made playbooks uses one. If you want a conversation before a change, have it in your AI app. It proposes, you approve in Protuno, and nothing is applied until you do. #### Rolling a run back Every run records what it changed, as it changes it, by re-reading the target and confirming it is different. The run’s report carries a **Rollback this run** button, and opening it shows exactly what would be put back and what would not, before you commit to anything. The record is the honest part. A change made through a named capability is recorded with enough to reverse it. A change made by running arbitrary PHP is recorded as “cannot be undone”, because nothing observed what the snippet did. So a report will tell you “every change this run made can be undone”, or “4 changes can be undone; 2 cannot”, rather than offering a button that might mean either. ##### What rollback fully covers Three playbooks are known to make only reversible changes, and they are exempt from the pre-run backup gate for that reason: - **Plugin Safe Update**: Reinstalls the previous version from wordpress.org. It also rolls itself back during the run: each plugin folder is stashed before its update and restored if the site stops working. - **Spam Comment Deleter**: It never deletes. It moves comments between moderation states, and rollback moves them back. - **Broken Link Checker**: Each edit lands as a post update that records the post’s previous body, so rollback restores the text. The edit is also a WordPress revision, so you can restore it by hand from the post history. ##### What rollback does not cover Everything else. WP Doctor, WP Hardening, Database Optimisation and AI SEO Optimiser all change things by running PHP on the site, which records “cannot be undone”. Those runs get the backup gate instead: the run refuses to start until a restorable backup exists. Database Optimisation is the clearest case, and the one worth reading twice. Its deletes are permanent. It does not run table optimisation and it does not use raw SQL; it removes revisions, spam and other bloat through WordPress’s own delete functions, and it skips any category that looks anomalous. Its second and third steps take a database backup and prove that backup is sound, before anything is deleted. That backup is the way back. Take your own as well if the site matters. **Automatic rollback is not a general guarantee.** It applies to plugin updates. Everything else either leaves a revision you can restore by hand, or cannot be undone at all. #### What the backup step actually checks Be precise about what is checked, because it is more than it sounds and less than a guarantee. A backup step does not just report that it ran. Protuno re-opens what it wrote: the archive has to open and contain files, the database dump has to be large enough to be real, decompress, carry the statements a dump carries, and be free of the specific corruption a past run produced. For a database-only backup, every table that exists on the site has to appear in the dump, and any that are missing are named. Only then does the verdict read Verified, and a run that needs a restore point will not proceed past a Failed one. What it does not do is restore the backup to see what comes back. Nothing is restored, extracted or written during the check. So it is a verified file rather than a rehearsed recovery. Run anything destructive on staging first, and before you move the result to a site that matters, take your own backup of that site as well and know it works. #### How to revoke Protuno’s access The credential Protuno holds is an application password issued by your own WordPress user. You can revoke it from Users, Profile at any moment, without contacting us, and the connection stops at once. #### Where to go next - [**Run a playbook and read the report**](https://protuno.com/docs/run-a-playbook-and-read-the-report), to see what a run actually produces. - [**What Protuno costs**](https://protuno.com/docs/what-protuno-costs), since only some of this costs anything. ### Run A Playbook And Read The Report Page: https://protuno.com/docs/run-a-playbook-and-read-the-report > A playbook is a fixed sequence written down before it runs. How to switch one on, run it, and read what came back. A playbook is one job written out step by step before it runs. Not a model deciding at runtime what looks reasonable: a fixed sequence you can read first, that does the same thing every Tuesday. #### The 27 playbooks, and where to find them All 27 live under Super Agents, in the Every playbook list, with the category, the number of steps and whether it can change the site shown on every card. 10 can change a site. The other 17 only read it. ![The Every Playbook grid on the Super Agents screen, showing playbook cards with their category, step count and whether they can write](https://cms.protuno.com/wp-content/uploads/2026/09/app-02-every-playbook.webp) *Scroll past the six agent cards and Every Playbook lists all 27, each with its category, its step count and whether it can write.* The six named agents above the list each own a group of these playbooks. You ask an agent in your AI app, and it picks the playbook for the job. **21 of the 27 carry a BETA tag** on their card. They run, and they are the ones still being shaped. Six do not: WP Security Audit, SSL And Domain Expiry Monitor, Cron Health Checker, SMTP Deliverability Check, Broken Image Finder and Spam Comment Deleter. #### What a playbook page shows you A playbook page shows every step in order, and each step opens to reveal the instructions it runs and what it hands to the next step. A playbook that needs a restore point has a backup step of its own, and it shows up as a step. ![A playbook detail page showing its steps in order and the sites it is switched on for](https://cms.protuno.com/wp-content/uploads/2026/09/app-11-playbook-detail.webp) *Steps on the left, sites on the right. Every playbook needs the plugin, so any site that is not connected is switched off here, with the reason on the row.* Two things are worth knowing. Each site gets **its own copy** of the steps, so editing one site’s playbook does not touch another’s. And switching a site off keeps that copy rather than destroying it, so switching back on returns what was there. #### Switching on is not running On each agent’s page, for the site you pick, each playbook has a switch, and they start switched on. The switch decides whether a playbook can be used on that site. It does not run it. To run one, ask in your AI app, or press **Fix this** on a finding. Run the playbooks that change things on your staging site, not your live one. #### Reading the run report Every run lands in Activity. A finished run carries one of three verdicts: **Passed**, **Needs attention**, or **Failed**. **Cancelled** is a fourth terminal state, for a run that was stopped rather than judged. While a run is still going you will also see Running, Finishing report, Waiting for a slot and Waiting on you. A job across several sites runs one site at a time. A failure on one does not stop the rest, and you get one combined report. ![A Protuno run report showing a critical action plan, the steps that ran, and a technical detail section](https://cms.protuno.com/wp-content/uploads/2026/09/app-10-run-report.webp) *A run that could not do its job, saying so. The report refuses to produce a grade rather than inventing one.* Each report has a **simple** and a **technical** view, and exports to PDF for sending on. After a run on staging, it is also your checklist: read what changed there before you move anything to your live site. The example above is worth dwelling on. Every step ran, but the site never returned WordPress data, so the run reports zero findings and explicitly declines to assign a posture grade. An unreadable site is not graded as healthy. That is the behaviour to expect throughout: uncertain is never reported as fine. #### Where to go next - [**Routines**](https://protuno.com/docs/routines-put-a-playbook-on-a-schedule), for work that should repeat without you asking. - [**Super Agents: ask, approve, undo**](https://protuno.com/docs/super-agents-ask-approve-undo). ### Routines: Put A Playbook On A Schedule Page: https://protuno.com/docs/routines-put-a-playbook-on-a-schedule > A playbook with a schedule is a routine. Routines run as scheduled tasks in your AI app, on Pro and Agency. A playbook with a schedule is a routine: Daily, Weekly or Monthly, at a time and in a time zone you pick, on one site. #### Routines run in your AI app A routine runs as a scheduled task in your AI app, on your plan there, not on Protuno’s clock. When you save one, a pop-up gives you the task text with a **Copy task** button and three steps for adding it in Claude. Until you add that task in your AI app, the routine does not run, and Protuno does not warn you. Claude needs a paid plan for scheduled tasks. #### The routines calendar Routines shows every scheduled playbook across every site, and when each one runs next. ![The Routines screen showing a month calendar with scheduled playbook runs and a summary of how many run in the next seven days](https://cms.protuno.com/wp-content/uploads/2026/09/app-03-routines.webp) *A month at a time, with how many runs land on each day, and what is due next.* There is a list view as well, grouped by playbook, showing each site’s own day and time. Switching a routine off takes it off the calendar without detaching the playbook from the site. Put routines for playbooks that change things on your staging site. On a live site left in Read only, a routine for a playbook that can write will not fire, and the row says so. ##### Which sites can schedule Routines are on Pro and Agency. On Free, you run any of the 27 playbooks by asking your AI app. #### Where to go next - [**What Protuno costs**](https://protuno.com/docs/what-protuno-costs), to see which plans include routines. - [**What Protuno can and cannot change**](https://protuno.com/docs/what-protuno-can-and-cannot-change), before leaving anything on unattended. ### What Protuno Costs: Plans And Billing Page: https://protuno.com/docs/what-protuno-costs > One price for the whole workspace, and no credits. The AI runs on your own AI app’s plan. Protuno has one price for the whole workspace and no credits. The AI work happens in your own AI app, such as Claude, on your plan there. Protuno never charges per job: watching, checking and fixing your sites cost nothing extra. #### Free, Pro and Agency compared - **Price**: Free: $0; Pro: $12 a month or $99 a year; Agency: $30 a month or $249 a year - **Sites**: Free: 3; Pro: Up to 10; Agency: Up to 25 - **Super Agents in your AI app**: Free: Yes; Pro: Yes; Agency: Yes - **Playbooks**: Free: All 27; Pro: All 27; Agency: All 27 - **Fixes with approval and Undo**: Free: Yes; Pro: Yes; Agency: Yes - **Brain remembers your rules**: Free: Yes; Pro: Yes; Agency: Yes - **Connectors**: Free: Yes; Pro: Yes; Agency: Yes - **One playbook on many sites**: Free: Yes; Pro: Yes; Agency: Yes - **Uptime checks**: Free: Every 5 minutes; Pro: Every minute; Agency: Every minute - **Routines**: Free: No; Pro: Yes; Agency: Yes - **White-label reports**: Free: No; Pro: Yes; Agency: Yes Yearly saves 31% on Pro and Agency. Prices are in US dollars and before tax; Paddle adds what is due where you are. More sites than your plan covers: every site keeps its site audit. Agent work, playbooks and routines run on the sites your plan covers. Your AI app is billed by its own provider, not by us. Routines run as scheduled tasks there, and Claude needs a paid plan for those. #### Changing plan Moving up is charged now, minus what is left of your current period, and the amount is shown first. Moving down starts at your next renewal. Cancelling stops the next charge; you keep the plan until the end of the period you paid for, then the workspace goes back to Free. All of this is in **Billing**, or at paddle.net. If you bought a credit pack under our earlier plans and still hold unused credits, contact support. #### Refunds You can ask for a full refund within **14 days** of any payment: your first payment, a renewal or a plan upgrade. There is no reason needed and no credits to deduct. Ask support; once Paddle approves it, the workspace goes back to Free. #### Where to go next - [**Connect your AI app**](https://protuno.com/docs/connect-your-ai-app). - [**Routines**](https://protuno.com/docs/routines-put-a-playbook-on-a-schedule), which need Pro or Agency. ### Connectors: Connect A Platform Once Page: https://protuno.com/docs/connectors-connect-a-platform-once > Connect a platform once for the workspace. Sixteen are listed, and being straight about how many are wired up today. A connector is a platform you connect once and every agent reads through. No playbook keeps a password or token of its own. Most are connected once for the whole workspace. **Two are per site**, WordPress and WooCommerce, and the screen has a “Per site” filter for exactly those. #### How many connectors are actually wired up Sixteen connectors are listed. Being honest about the state of them matters more than the number: **one of the sixteen is read by playbooks today**, and that one is WordPress. The rest can be connected now and will feed agents as they learn to read them. ![The Connectors screen showing sixteen available connectors grouped by whether they are connected](https://cms.protuno.com/wp-content/uploads/2026/09/app-04-connectors.webp) *Sixteen connectors, filterable by whether they can change things or only read.* The screen says this itself rather than leaving you to find out, and each card shows which playbooks use it or says “None yet”. #### WordPress, the only live connector **WordPress**, through the Protuno Super Agent plugin, is per site rather than per workspace, and it is what eight playbooks read. If a site stops answering, this is the connector that tells you, and it names the sites. #### The other fifteen connectors - **Monitoring**: Connectors: UptimeRobot, Sentry; Status: UptimeRobot is planned for the Uptime Checker - **Hosting**: Connectors: Kinsta, Hostinger, Pressable; Status: None yet - **Infrastructure**: Connectors: Cloudflare; Status: Planned for three playbooks - **Search**: Connectors: Firecrawl, Semrush; Status: Planned for the link and SEO playbooks - **Commerce**: Connectors: Stripe, WooCommerce; Status: None yet - **Delivery**: Connectors: Slack, ClickUp, Jira, Notion; Status: Send results out - **Developer**: Connectors: GitHub; Status: None yet #### Which connectors can change things Nine of the sixteen can change something at the other end. Seven can only look. The filter at the top of the screen splits them, and it is worth using before connecting anything that could act on your behalf. #### How many you can connect Connectors are on every plan, Free included. #### Where to go next - [**What Protuno can and cannot change**](https://protuno.com/docs/what-protuno-can-and-cannot-change), for the same distinction applied to your own site. ### All 85 Checks, Referenced Page: https://protuno.com/docs/all-85-checks-referenced > All 85 checks that run on a connected site, grouped the way the report groups them, and which 54 run from an address alone. This is every check that runs on a connected site, grouped the way the report groups them. Eighty-five in total: the 54 that run from the address alone, plus the 31 that can only be read from inside the install. #### 54 or 85: which number applies to your site - **From the domain alone**: Checks: **54**; What it needs: A web address. No account, no plugin. - **Connected site**: Checks: **85**; What it needs: The Protuno plugin installed and the site connected. The extra 31 are the things no outsider can see: which plugins are genuinely active, the real PHP version, what the database is carrying, whether a restore point exists at all. #### Why the report shows five categories and the website shows eight The report groups findings into **five** categories. Some of the marketing pages group the same checks into eight areas instead. The checks are identical; only the grouping differs. The five below are what you will see in the product. ##### Security (42 checks) The ways a site gets taken, and the records that decide whether its mail is trusted. - **2 core files do not match WordPress 7.1.1** - **HTTP isn’t redirected to HTTPS** - **Missing HSTS header** - **Missing X-Content-Type-Options: nosniff** - **No clickjacking protection** - **No DMARC record is published** - **No SPF record is published** - **Dashboard file editing is enabled** - **No content security policy** - **The WordPress login form is open to the internet** - **User accounts are listable via the REST API** - **Usernames are exposed via author enumeration** - **Database uses the default ‘wp_’ table prefix** - **No CAA record restricts who can issue certificates** - **WordPress 7.1.1 is named in the homepage source** - **WordPress version is publicly disclosed** - **Admin accounts** - **Certificate hostname coverage** - **Cookie security flags** - **Debug mode** - **Directory listing** - **DMARC policy** - **DMARC reporting** - **File permissions** - **For a DKIM key** - **For exposed debug.log** - **For exposed sensitive files** - **For login links on the homepage** - **For mixed content** - **HTTPS / SSL** - **Plugin files** - **Plugins against the directory** - **Referrer policy** - **Server version disclosure** - **SPF lookup count** - **SSL certificate expiry** - **The certificate chain** - **The public REST index** - **The store’s admin API** - **TLS protocol versions** - **Wp-config.php access** - **XML-RPC** ##### General (16 checks) The install itself, its mail delivery, its DNS, and the housekeeping nobody checks. - **Mail is being sent by the web server, not a mail service** - **Default WordPress sample content is still published** - **No site icon (favicon) is set** - **Timezone is set to a fixed UTC offset** - **Admin email** - **DNS TTLs** - **Mail servers** - **Nameservers** - **PHP version** - **Search visibility** - **Site URL consistency** - **The checkout page** - **Where mail is delivered** - **WooCommerce status** - **WordPress version** - **WP-Cron** ##### Growth (12 checks) Whether search engines and AI assistants can find the site, and what they are told. - **No canonical tag on the homepage** - **No llms.txt for AI assistants** - **No Open Graph tags on the homepage** - **No SEO plugin active** - **No explicit AI-crawler policy** - **Image alt text** - **Mobile viewport meta** - **Robots.txt crawl rules** - **Site tagline** - **Www and apex addresses** - **Www and apex resolve** - **XML sitemap** ##### Performance (10 checks) What the visitor waits for, and what the database is quietly carrying. - **Active plugins** - **Cart and checkout caching** - **Database autoload** - **Database bloat** - **For a page cache** - **For duplicate analytics tags** - **Measuring server response time** - **Persistent object cache** - **Response compression** - **Static-asset caching** ##### Care (5 checks) Whether there is a restore point, and whether the scheduled work is still running. - **Backups** - **For unmaintained plugins** - **Inactive plugins** - **Scheduled jobs** - **Spam & trash comments** #### What a check does when it cannot tell A check that cannot reach its answer says so, rather than passing. An unreadable cron array is reported as stopped, never as fine. A domain expiry that neither RDAP nor WHOIS will confirm comes back unknown, never “fine”. Worth knowing before reading a clean result as an all-clear. #### Where to go next - [**Read your site report**](https://protuno.com/docs/read-your-site-report), for what to do with the findings these produce. ### Troubleshooting Sites, Scans And Runs Page: https://protuno.com/docs/troubleshooting-sites-scans-and-runs > Every message Protuno can show on its own side, what it means, and the shortest way past it. Every message Protuno can show you on its own side, what it means, and the shortest way past it. The plugin has its own troubleshooting page for messages that appear in wp-admin. #### A site says it is not answering **“WordPress stopped answering”** on the Connectors screen, naming the sites. This is the most common state you will meet, and it almost never means Protuno is broken. It means the application password Protuno holds no longer works, or the site itself is unreachable. Common causes, in order: - The password was revoked or regenerated in WordPress and the new one was never pasted into Protuno. - The Protuno plugin, or the MCP connector it depends on, was deactivated or deleted. - The site is a staging or sandbox install that has expired. Open the site and press **Reconnect this site**. The project, its history and its findings all stay; only the credential is replaced. ![The Protuno run history table showing playbook runs across sites with passed, needs attention and failed outcomes](https://cms.protuno.com/wp-content/uploads/2026/09/app-05-run-history.webp) *Run history is the fastest way to spot a site that stopped responding: the outcome column changes before anything else does.* #### Protuno’s password no longer works The site page says the site is answering but the credential has been revoked or replaced. Same problem from the other end, same fix: reconnect and paste a fresh application password from the plugin’s own screen. **Delete project** sits next to it. That is not the fix. It throws away the site’s history. #### “Invalid site URL. Use a full URL like https://yoursite.com” On the add-site screen, when the address was entered without a scheme. Enter the complete address including `https://`. The field accepts a bare domain for the check step, but the connect step wants the whole URL. #### “Could not read yoursite.com from here” **A warning, not a blocker.** It means the check could not reach the site from where Protuno ran it. Carry on and connect; the connect step will say if something is genuinely wrong. Plenty of sites that report this connect perfectly. #### A playbook is greyed out on one of my sites On a playbook’s page some sites are switched off and unclickable, each with a reason. The reason is almost always the same one: the site is not connected. **Every playbook needs the plugin, including the ones that only read.** A playbook step does not reach the address the way the free audit does. It goes through the site’s connection, so on a site with no connection every step would print “No site connected for this project” and the run would finish having done nothing. Connecting is also what proves the site is yours; an address on its own is a URL somebody typed. The wording changes to say which kind of playbook it is (“because this playbook changes the site”, “because this playbook runs code on the site”), but the gate is the same in all three cases. Connect the site and the toggle becomes available. #### A run failed and every step says “BROKEN CHAIN” The first step could not establish any facts about the site, so everything after it had nothing to work with. Each following step says so by name, for example “BROKEN CHAIN, missing PREFLIGHT from Node 1”, and stops rather than guessing. The usual cause is an address that answers, but not as WordPress: an expired staging sandbox serving its host’s landing page, or a holding page in front of the real site. The report says so explicitly and refuses to produce a score. A run that could measure nothing does not get graded. #### A routine never runs Routines are on Pro and Agency, and they run as a scheduled task in your AI app. Check that you added the routine’s task in your AI app after you saved it: Protuno does not warn you when the task is missing. Claude needs a paid plan for scheduled tasks. A different line, “Last scheduled run did not start: site read-only”, means the routine fired and was refused because the playbook can write and the site is in Read only. If this is your live site, leave it in Read only and put the routine on your staging site instead. If it is your staging site, switch it to Execute. #### The scan still shows domain-only results after connecting The deep scan runs on connect and takes a minute or two, longer on a large site. If the count stays at the domain-only figure, the credential was accepted but the connector is not serving. Open the Protuno screen in the site’s own wp-admin: it names the connector that is serving, or says it is not running, in which case the connector plugin has been deactivated. #### Your AI app cannot see Protuno If your AI app says it has no Protuno tools, the connection did not finish. Open **AI apps** in Protuno to see the apps you connected, then connect the app again. Reconnecting the same app replaces the old connection rather than adding a second one. #### Still stuck Email [support@protuno.com](mailto:support@protuno.com), any day of the week, with the site address and the run that went wrong. Every run has its own report and a link you can paste. ### Connect Your AI App Page: https://protuno.com/docs/connect-your-ai-app > Protuno works inside the AI app you already use. Connect Claude, Claude Code, Codex or Cursor once, with no API key to copy. Protuno works inside the AI app you already use. Your AI app does the thinking, on your plan there. Protuno does the work on your sites and keeps the guardrails. You sign in to Protuno once, and there is no API key to copy. #### The fastest way: copy one prompt In Protuno, open **AI apps** (in the sidebar, under Setup) and press **Copy prompt**. Paste it into your AI app. The app connects Protuno for you, asks you to sign in once, then checks your sites. ![The AI apps screen in Protuno with the Copy prompt card and the steps for connecting Claude](https://cms.protuno.com/wp-content/uploads/2026/10/docs-2026-10-ai-apps-connect.webp) *AI apps: one prompt to paste, or the steps for each app.* #### One command: Claude Code, Codex and Cursor If your AI app can run commands, it connects Protuno with one command. It runs the command itself; you only sign in. - **Mac, Linux or Git Bash:** `curl -fsSL https://protuno.com/api/mcp/connect.sh | sh -s claude-code` (or `codex`, or `cursor`) - **Windows PowerShell:** `$env:PROTUNO_APP='claude-code'; irm https://protuno.com/api/mcp/connect.ps1 | iex` Your browser opens Protuno. Sign in and press **Allow**. The command adds Protuno to your app as a custom connector. Then restart the app so Protuno’s tools load; Cursor loads them without a restart. The key is never shown to you or printed. #### Claude: web, desktop and phone 1. In Claude, open **Customize**, then **Connectors**. 2. Choose **Add**, then **Add custom connector**, and name it Protuno. 3. Paste `https://protuno.com/api/mcp` and continue. 4. Choose **Connect**, sign in to Protuno and choose **Allow**. It then works in every Claude app. Free Claude plans can add one custom connector. 5. So Claude does not ask twice, set **Read-only tools** and **Change something with a connected service** to Always allow on the Protuno connector page in Claude. Protuno still asks you before any change you set to Ask in Connectors, and refuses anything set to Never. 6. In a new chat, ask something like “Check my sites with Protuno”. #### Claude Code, Codex and Cursor by hand - **Claude Code:** run `claude mcp add --scope user --transport http protuno https://protuno.com/api/mcp`, then type `/mcp`, pick protuno and sign in. A browser window opens once. - **Codex:** run `codex mcp add protuno --url https://protuno.com/api/mcp`, then `codex mcp login protuno`. - **Cursor and others:** add a remote MCP server (Streamable HTTP) at `https://protuno.com/api/mcp`. In Cursor that is Settings, then MCP, then Add a new MCP server. Sign in to Protuno when the app asks. If your app cannot sign in to a remote server, run it through the bridge instead: `npx -y mcp-remote https://protuno.com/api/mcp`. #### What your AI app can and cannot do The Allow screen lists it before you agree. Running code on your sites is a separate box, “Also let it run code on my sites”, off unless you tick it. Code only runs on sites set to Execute, and it asks before each run. Only you approve plans and changes, in Protuno. Your AI app can set a site to Read only, never to Execute. Everything your AI app does for you runs on your plan there, including routines, which run as scheduled tasks in the app. Claude needs a paid plan for those. #### See and disconnect your apps AI apps lists every app you signed in from, with when it was connected and last used. **Disconnect** cuts one off right away. Reconnecting the same app replaces the old connection rather than adding a second one. #### Where to go next - [**Fix a finding in your AI app**](https://protuno.com/docs/fix-a-finding-in-your-ai-app). - [**Super Agents: ask, approve, undo**](https://protuno.com/docs/super-agents-ask-approve-undo). ### Fix A Finding In Your AI App Page: https://protuno.com/docs/fix-a-finding-in-your-ai-app > Protuno finds what is wrong. Your own AI app fixes it, on your plan, and asks you before it changes anything. Protuno finds what is wrong. Your own AI app fixes it, on your plan, and asks you before it changes anything. #### Two buttons on every finding - **How to fix** shows the change to make, in plain words. - **Fix this** hands the fix to your AI app. ![Open findings on a connected site, each with a Copy fix for Claude Code button and a How to fix button](https://cms.protuno.com/wp-content/uploads/2026/10/docs-2026-10-findings-copy-fix.webp) *With an app on your computer connected, the button copies the fix for it.* #### What Fix this does It depends on what is set up. - **The site has no plugin yet.** It asks you to connect the plugin first, because no AI app can fix anything inside a site without it. - **No AI app is connected.** It asks you to connect one. See [Connect your AI app](https://protuno.com/docs/connect-your-ai-app). - **Claude on the web is connected.** The button reads **Fix in Claude** and opens Claude with the request already typed in. - **An app on your computer is connected**, such as Claude Code, Codex or Cursor. The button reads **Copy fix for** and the app’s name. It copies the request and tells you to paste it in the app and press Enter. #### The request it hands over “Use Protuno to fix this issue on (your site): “(the finding)”. Check it first, tell me your plan in plain words, and ask me before you change anything.” Press Enter, read the plan, and approve it in Protuno. Protuno takes a backup before it changes anything, and the fix can be undone from the run report. #### Read only and staging On a site in Read only, your AI app can plan the fix but cannot apply it. Do the fix on your staging site, check it there, then move it to your live site in your own way. A fix does not close a finding by itself. The next scan checks again and decides. #### Where to go next - [**Read your site report**](https://protuno.com/docs/read-your-site-report). - [**What Protuno can and cannot change**](https://protuno.com/docs/what-protuno-can-and-cannot-change). ### Super Agents: Ask, Approve, Undo Page: https://protuno.com/docs/super-agents-ask-approve-undo > Six named agents, each with its own playbooks. Ask one in your AI app, approve the plan in Protuno, and undo a fix from its report. A Super Agent is a named agent that looks after one kind of WordPress work and owns its playbooks. There are six: - [**Wren**](https://protuno.com/docs/super-agent-wren), Care. 8 playbooks. - [**Rook**](https://protuno.com/docs/super-agent-rook), Security. 6 playbooks. - [**Dash**](https://protuno.com/docs/super-agent-dash), Performance. 2 playbooks. - [**Iris**](https://protuno.com/docs/super-agent-iris), SEO. 5 playbooks. - [**Till**](https://protuno.com/docs/super-agent-till), eCommerce. 1 playbook. - [**Echo**](https://protuno.com/docs/super-agent-echo), Marketing. 5 playbooks. ![The Super Agents screen with the six agent cards and the Every playbook list](https://cms.protuno.com/wp-content/uploads/2026/10/docs-2026-10-super-agents-list.webp) *The six agents, then every playbook.* #### How a job runs 1. You ask in your AI app, for example “Dash, clean up the database on my shop”. 2. Protuno picks the agent and returns its playbooks, the site’s saved rules and anything that blocks changes. 3. Your AI app proposes a plan. Each site is marked “will run” or “skipped”, with the reason. 4. The plan appears as a card in Protuno, and only you can approve it, by pressing **Approve**. Your AI app cannot approve for you. 5. The steps run one at a time. A step that changes the site waits for **Approve this change** on the job card, unless the agent is at Auto. 6. The run and its report land in Activity, and the job shows under Recent jobs on the agent’s page. #### Trust level, per agent and per site Each agent has its own page. Pick a site under **Working on**, then set the level under **On this site**: - **Read.** Looks, never touches. Runs only playbooks that read the site. - **Ask.** Plans, then waits for your yes. Every step that changes the site asks again first. - **Auto.** After you approve the plan, it runs without stopping to ask. Playbooks that need a backup make one as their first step. New agents start at Ask. On a site in Read only, an agent can only run playbooks that read it, whatever its level. ![Wren's page in Protuno showing Working on, the Read, Ask and Auto levels under On this site, and its playbooks with switches](https://cms.protuno.com/wp-content/uploads/2026/10/docs-2026-10-agent-wren.webp) *An agent’s page: the site it works on, its level on that site, and its playbooks.* #### Playbook switches On the agent’s page, every playbook is on for the site you picked unless you switch it off. Switched off, nothing runs it there. #### Several sites in one job A job across several sites runs one site at a time. A failure on one does not stop the rest, and you get one combined report. One job works on a site at a time; others wait their turn. #### Fixes and Undo Protuno takes a backup before every fix, on every plan, and a fix can be undone from the run report. The next scan decides whether a finding is closed. #### Where to go next - [**Connect your AI app**](https://protuno.com/docs/connect-your-ai-app). - [**What Protuno can and cannot change**](https://protuno.com/docs/what-protuno-can-and-cannot-change). ### Wren: The Care Super Agent Page: https://protuno.com/docs/super-agent-wren > Wren looks after Care: 8 playbooks, 2 that can change the site. What each one does, and how to ask Wren for a job. **Wren** looks after Care. Runs your updates behind a restore point, then loads the site again to be sure it still works. Watches uptime, certificates and the jobs that quietly stop. Ask Wren in your AI app, for example “Wren, update the plugins on my shop”. Wren shows you a plan, you approve it in Protuno, and it runs the playbooks one step at a time. ![Wren's page in Protuno with its trust level and playbooks](https://cms.protuno.com/wp-content/uploads/2026/10/docs-2026-10-agent-wren.webp) *Wren’s page: the site it works on, its level on that site, and its playbooks.* #### Wren’s playbooks Wren has 8 playbooks. 2 can change the site, and each asks before its change step. The other 6 only read. - **Plugin Safe Update**: Reads or changes: Changes the site; Steps: 8 steps · asks before its change step; What it does: Updates your plugins one at a time behind a checked backup. Each plugin folder is stashed before its update and put back if the site stops working, then the site is checked again. - **WP Doctor**: Reads or changes: Changes the site; Steps: 5 steps · asks before its change step; What it does: Diagnoses a WordPress problem: checks the setup, reproduces the problem, matches it to a known cause, applies the fix behind a safety snapshot, then checks and reports. - **Major Update Readiness**: Reads or changes: Reads only; Steps: 2 steps; What it does: Before a WordPress update, checks every active plugin and the theme against the version you set, and tells you what to test first. - **Plugin Conflict & Redundancy Check**: Reads or changes: Reads only; Steps: 2 steps; What it does: Finds active plugins doing the same job (two caches, two SEO suites, two firewalls) and inactive plugins left installed. - **Uptime Checker**: Reads or changes: Reads only; Steps: 7 steps; What it does: Checks the site is really up, looking for a word that should be on the page, and confirms an outage before calling it one. - **SSL And Domain Expiry Monitor**: Reads or changes: Reads only; Steps: 6 steps; What it does: Checks when your certificate and domain expire, with the days left. - **Cron Health Checker**: Reads or changes: Reads only; Steps: 4 steps; What it does: Checks WordPress scheduled jobs, including stuck or overdue ones and the Action Scheduler. - **Premium License Expiry**: Reads or changes: Reads only; Steps: 7 steps; What it does: Lists premium plugins and themes whose licence has expired or is about to, which would quietly stop their updates. #### On Wren’s page Pick a site under **Working on**. **Recent jobs** shows what you gave Wren from your AI app. **On this site** sets its level there: Read, Ask or Auto. Every playbook is on for that site unless you switch it off. #### Where to go next - [**Super Agents: ask, approve, undo**](https://protuno.com/docs/super-agents-ask-approve-undo). - [**Run a playbook and read the report**](https://protuno.com/docs/run-a-playbook-and-read-the-report). ### Rook: The Security Super Agent Page: https://protuno.com/docs/super-agent-rook > Rook looks after Security: 6 playbooks, 1 that can change the site. What each one does, and how to ask Rook for a job. **Rook** looks after Security. Reads what your site actually has installed and watches the advisory feeds against it. Tells you the morning something you run becomes a problem. Ask Rook in your AI app, for example “Rook, check my site for vulnerable plugins”. Rook shows you a plan, you approve it in Protuno, and it runs the playbooks one step at a time. ![Rook's page in Protuno with its trust level and playbooks](https://cms.protuno.com/wp-content/uploads/2026/10/docs-2026-10-agent-rook.webp) *Rook’s page: the site it works on, its level on that site, and its playbooks.* #### Rook’s playbooks Rook has 6 playbooks. 1 can change the site, and it asks before its change step. The other 5 only read. - **WP Security Audit**: Reads or changes: Reads only; Steps: 8 steps; What it does: A security audit graded A to F, covering setup and exposure, vulnerable plugins and themes, and access control. Every finding is checked against real code first. - **Plugin Vulnerability Checker**: Reads or changes: Reads only; Steps: 4 steps; What it does: Checks every installed plugin and its exact version against known vulnerability data, and tells you which need updating first. - **WP Malware Scan**: Reads or changes: Reads only; Steps: 6 steps; What it does: Scans files and the database for malware and checks each finding before it reports it. It finds only; it does not remove. - **WP Hardening**: Reads or changes: Changes the site; Steps: 5 steps · asks before its change step; What it does: Applies safe WordPress hardening one change at a time, after a backup, and lists the risky changes it leaves for you. - **New Admin Watch**: Reads or changes: Reads only; Steps: 2 steps; What it does: Reports every administrator and their application passwords: new admins, the default “admin” username and new or unused application passwords. - **Comment & Signup Spam Exposure Audit**: Reads or changes: Reads only; Steps: 2 steps; What it does: Shows where comments are open, the size of the spam and pending queues, and signups that look like bots. #### On Rook’s page Pick a site under **Working on**. **Recent jobs** shows what you gave Rook from your AI app. **On this site** sets its level there: Read, Ask or Auto. Every playbook is on for that site unless you switch it off. #### Where to go next - [**Super Agents: ask, approve, undo**](https://protuno.com/docs/super-agents-ask-approve-undo). - [**Run a playbook and read the report**](https://protuno.com/docs/run-a-playbook-and-read-the-report). ### Dash: The Performance Super Agent Page: https://protuno.com/docs/super-agent-dash > Dash looks after Performance: 2 playbooks, 1 that can change the site. What each one does, and how to ask Dash for a job. **Dash** looks after Performance. Clears the database bloat that slows every page, and finds the images nobody uses or that are stored twice, with the space each one takes. Ask Dash in your AI app, for example “Dash, clean up the database on my shop”. Dash shows you a plan, you approve it in Protuno, and it runs the playbooks one step at a time. ![Dash's page in Protuno with its trust level and playbooks](https://cms.protuno.com/wp-content/uploads/2026/10/docs-2026-10-agent-dash.webp) *Dash’s page: the site it works on, its level on that site, and its playbooks.* #### Dash’s playbooks Dash has 2 playbooks. 1 can change the site, and it asks before its change step. The other 1 only read. - **Database Optimisation**: Reads or changes: Changes the site; Steps: 8 steps · asks before its change step; What it does: Cleans database bloat (revisions, spam and trashed comments, expired transients and similar) through WordPress’s own delete functions, after taking and checking a database backup. Deletes are permanent; the backup is the way back. - **Unused & Duplicate Media Report**: Reads or changes: Reads only; Steps: 4 steps; What it does: Finds images uploaded more than once and images nothing uses, with the space they take. Deletes nothing. #### On Dash’s page Pick a site under **Working on**. **Recent jobs** shows what you gave Dash from your AI app. **On this site** sets its level there: Read, Ask or Auto. Every playbook is on for that site unless you switch it off. #### Where to go next - [**Super Agents: ask, approve, undo**](https://protuno.com/docs/super-agents-ask-approve-undo). - [**Run a playbook and read the report**](https://protuno.com/docs/run-a-playbook-and-read-the-report). ### Iris: The SEO Super Agent Page: https://protuno.com/docs/super-agent-iris > Iris looks after SEO: 5 playbooks, 3 that can change the site. What each one does, and how to ask Iris for a job. **Iris** looks after SEO. Crawls your site the way a search engine does, and reports the pages that quietly stopped being linked or indexed. Ask Iris in your AI app, for example “Iris, find the broken links on my blog”. Iris shows you a plan, you approve it in Protuno, and it runs the playbooks one step at a time. ![Iris's page in Protuno with its trust level and playbooks](https://cms.protuno.com/wp-content/uploads/2026/10/docs-2026-10-agent-iris.webp) *Iris’s page: the site it works on, its level on that site, and its playbooks.* #### Iris’s playbooks Iris has 5 playbooks. 3 can change the site, and each asks before its change step. The other 2 only read. - **Technical SEO Audit**: Reads or changes: Reads only; Steps: 8 steps; What it does: A full SEO audit: crawling, indexing, sitemaps and robots, canonicals and redirects, schema and Core Web Vitals, across up to 50 pages, ranked by impact. - **AI SEO Optimiser**: Reads or changes: Changes the site; Steps: 11 steps · asks before its change step; What it does: Improves the SEO of one post at a time: title, meta description, image alt text and structured data, applied behind a backup and a WordPress revision so it can be undone. - **Broken Link Checker**: Reads or changes: Changes the site; Steps: 10 steps · asks before its change step; What it does: Finds broken links across up to 50 pages and fixes only the safe ones, where there is one clear replacement. Every fix can be rolled back. - **Broken Image Finder**: Reads or changes: Reads only; Steps: 5 steps; What it does: Finds broken images and missing alt text across up to 50 pages. Changes nothing. - **Bulk Featured Images**: Reads or changes: Changes the site; Steps: 2 steps · asks before its change step; What it does: Sets a featured image on published posts that have none, from images in your library whose names match the post title. At most 25 per run, never replaces an existing image, and can be rolled back. #### On Iris’s page Pick a site under **Working on**. **Recent jobs** shows what you gave Iris from your AI app. **On this site** sets its level there: Read, Ask or Auto. Every playbook is on for that site unless you switch it off. #### Where to go next - [**Super Agents: ask, approve, undo**](https://protuno.com/docs/super-agents-ask-approve-undo). - [**Run a playbook and read the report**](https://protuno.com/docs/run-a-playbook-and-read-the-report). ### Till: The eCommerce Super Agent Page: https://protuno.com/docs/super-agent-till > Till looks after eCommerce: 1 playbook, all of them read only. What each one does, and how to ask Till for a job. **Till** looks after eCommerce. Checks a WooCommerce store for what quietly stopped working: stuck orders, payment gateways left in test mode, stock, webhooks and store pages. Ask Till in your AI app, for example “Till, check my store for stuck orders”. Till shows you a plan, you approve it in Protuno, and it runs the playbooks one step at a time. ![Till's page in Protuno with its trust level and playbooks](https://cms.protuno.com/wp-content/uploads/2026/10/docs-2026-10-agent-till.webp) *Till’s page: the site it works on, its level on that site, and its playbooks.* #### Till’s playbooks Till has 1 playbook, and it only reads the site. - **WooCommerce Health Review**: Reads or changes: Reads only; Steps: 2 steps; What it does: Checks a WooCommerce store for what quietly stopped working: stuck and failed orders, payment gateways left in test mode, stock, switched-off webhooks and missing store pages. #### On Till’s page Pick a site under **Working on**. **Recent jobs** shows what you gave Till from your AI app. **On this site** sets its level there: Read, Ask or Auto. Every playbook is on for that site unless you switch it off. #### Where to go next - [**Super Agents: ask, approve, undo**](https://protuno.com/docs/super-agents-ask-approve-undo). - [**Run a playbook and read the report**](https://protuno.com/docs/run-a-playbook-and-read-the-report). ### Echo: The Marketing Super Agent Page: https://protuno.com/docs/super-agent-echo > Echo looks after Marketing: 5 playbooks, 3 that can change the site. What each one does, and how to ask Echo for a job. **Echo** looks after Marketing. Checks your contact forms and that the site can actually send email, and keeps comment spam and stray text under control. Ask Echo in your AI app, for example “Echo, check my contact forms still send”. Echo shows you a plan, you approve it in Protuno, and it runs the playbooks one step at a time. ![Echo's page in Protuno with its trust level and playbooks](https://cms.protuno.com/wp-content/uploads/2026/10/docs-2026-10-agent-echo.webp) *Echo’s page: the site it works on, its level on that site, and its playbooks.* #### Echo’s playbooks Echo has 5 playbooks. 3 can change the site, and each asks before its change step. The other 2 only read. - **Contact Form Health Check**: Reads or changes: Reads only; Steps: 2 steps; What it does: Checks your form setup: form plugins, where forms sit, missing SMTP, a From address on another domain, forms with no recipient and missing spam protection. Never sends a test email. - **SMTP Deliverability Check**: Reads or changes: Reads only; Steps: 3 steps; What it does: Checks the site can really send email with a real test send, and reports SPF, DKIM and DMARC. - **Spam Comment Deleter**: Reads or changes: Changes the site; Steps: 4 steps · asks before its change step; What it does: Moves confirmed spam comments to the trash, after a plan you can read, then reports what was removed. - **Disable Comments**: Reads or changes: Changes the site; Steps: 2 steps · asks before its change step; What it does: Stops new comments and pings: closes the Discussion defaults and up to 25 open items per run. Existing comments are never deleted. Can be rolled back. - **Find & Replace Text**: Reads or changes: Changes the site; Steps: 2 steps · asks before its change step; What it does: Replaces a phrase you choose in post and page titles, excerpts and content, at most 10 items per run, showing each change before and after. Can be rolled back. #### On Echo’s page Pick a site under **Working on**. **Recent jobs** shows what you gave Echo from your AI app. **On this site** sets its level there: Read, Ask or Auto. Every playbook is on for that site unless you switch it off. #### Where to go next - [**Super Agents: ask, approve, undo**](https://protuno.com/docs/super-agents-ask-approve-undo). - [**Run a playbook and read the report**](https://protuno.com/docs/run-a-playbook-and-read-the-report). ### Brain: What Protuno Remembers Page: https://protuno.com/docs/brain > The rules you give Protuno and the lessons it learns from runs. Every run uses them, on every plan. The Brain is what Protuno remembers about your sites: rules you gave it, lessons it learned from runs, and patterns it noticed across sites. Every run uses them. #### Where to see it On **Home**, under What Protuno remembers, press **Open Brain**. It opens What the brain knows: a map of your sites, their memories and the tags that connect them. The key along the bottom shows Sites, Your rules, Lessons, Patterns and Tags. ![What the brain knows in Protuno, with one lesson for the Wear Earth demo site open](https://cms.protuno.com/wp-content/uploads/2026/10/docs-2026-10-brain-what-the-brain-knows.webp) *Click a site or a dot to read the memory, see where it came from, and edit or forget it.* #### Read, edit or forget Click a site or a dot to read a memory and see where it came from, for example “You said it in chat”. Then press **Edit** to change it, or **Forget this** to remove it. #### Adding memories Tell your AI app a rule, for example “Always update UpdraftPlus before any other plugin on my shop”, and it saves it to the Brain. Your AI app can also edit and forget memories for you. #### How rules are used Your saved rules are checked before any change. Notes saved about a site are treated as information, never as instructions. The Brain is on every plan, Free included. Saving and recalling memories costs nothing extra. #### Where to go next - [**Super Agents: ask, approve, undo**](https://protuno.com/docs/super-agents-ask-approve-undo). - [**Connect your AI app**](https://protuno.com/docs/connect-your-ai-app).