How your site trusts flitagent.com
When an administrator clicks Connect in wp-admin and approves the connection on flitagent.com, the site starts trusting flitagent.com's public keys. From then on, every request flitagent.com sends your site is cryptographically signed, and the plugin refuses anything with a signature it can't check.
- We never hold a password, Application Password or token that can log in to your site.
- Our signing keys live only in our server's configuration, never in a database.
- Your site fetches our public keys once a day, and when it sees a key it doesn't know (at most every 5 minutes). That request carries no site details.
- Disconnect the site in wp-admin or in your FlitAgent account, and the connection is gone on both sides.
How AI apps sign in
AI apps reach your sites with standard OAuth: you sign in to your FlitAgent account in the app and click Allow.
| Item | Lasts |
|---|---|
| Access token | 1 hour |
| Refresh token | 30 days |
We store codes and tokens only as hashes. Revoke an app in Account → Connected apps and it loses every site at once; disconnect it from one site in that site's FlitAgent → Connect.
What AI apps can do
Each site has one setting, Access for AI tools: Read only, or Read and propose changes. Requests act as the administrator who connected the site, and never beyond what that person can do in wp-admin.
Every action is a named tool with checked inputs. AI apps can never:
- Run SQL against your database
- Run shell commands or arbitrary PHP
- Give anyone more rights than the connecting administrator has
- Change anything while the site is Read only
Content read from your site that could contain code is returned exactly and marked as untrusted, so an AI app treats it as data, not instructions.
Approvals, receipts and rollback
A proposed change shows a preview (“Preview: nothing has changed yet”) and waits in FlitAgent → Approvals, with what it will change, before and after, and the exact arguments that will run.
- You can auto-approve low-risk changes for a tool. Destructive changes, plugin, theme and core updates, changes that can't be rolled back, and plans always wait for you.
- Every change gets a receipt in FlitAgent → Activity: which app asked, as which user, how it was approved, and whether it can be rolled back.
- Most changes can be rolled back from their receipt. The few that can't, such as permanent deletes and core updates, say so before you approve them.
What we store, and for how long
Tool calls and their results pass through flitagent.com and are not stored. For each call we keep a usage record: the account, site, AI app, tool, whether it read or wrote, the outcome, how long it took and its size. No arguments, results or IP addresses.
| Record | Kept for |
|---|---|
| Each tool call | 90 days |
| Daily totals | 25 months |
| Approvals and receipts | On your own site, never on flitagent.com |
FlitAgent doesn't train AI models, on your content or anything else. Full details are in our privacy policy.
Limits
Limits protect your sites and ours from runaway agents. Every account has its plan's daily allowance and a per-minute cap.
| Plan | Tool calls a day |
|---|---|
| Free | 100 |
| Basic | 500 |
| Pro | 2,000 |
| Max | 5,000 |
Every plan: at most 120 tool calls a minute, and up to 50 sites per account.
Your account
- Passwords are stored only as WordPress password hashes.
- Email verification codes last 5 minutes and login links 15 minutes; each works once.
- Log out every other browser at once from Account settings.
- Deleting your account disconnects every site, ends every AI app's access and removes your personal data.
Payments
Paid plans are sold by Paddle.com, our Merchant of Record. Paddle collects your card and billing details; flitagent.com never sees your card number.
Services we use
| Service | What for |
|---|---|
| Hostinger | Hosts flitagent.com and the relay, and sends our email |
| Paddle | Checkout, billing and invoices |
AI apps such as ChatGPT and Claude are yours, not ours: their own terms cover what they keep.
Report a security problem
Found a vulnerability in flitagent.com or the FlitAgent plugin? Please tell us privately before sharing it anywhere, so we can fix it first.
- Email hello@flitagent.com with “Security” in the subject, or use the Security topic on the contact form.
- Include what you found, how to reproduce it and what it affects.
- We reply within 2 working days and keep you posted until it's fixed.
If a breach affects your account data, we tell you within 72 hours of confirming it.
A security question?
We answer within three working days, usually sooner.