Questions, answered.

Yes — by design. Access is granted through scoped tokens that you control, and the most powerful capabilities (writing code, installing plugins) are off by default and must be switched on deliberately. Every action is recorded in a tamper-evident audit log, and risky operations are snapshotted so they can be undone.

YOLO watches for it. A plugin activation or theme switch that triggers a fatal error auto-reverts; an extension that crashes is automatically quarantined so the site stays up; and there’s full undo/redo plus backups you can restore. The whole point is to let you try things without fear.

Yes. When you switch on plugin/theme installs, YOLO can run updates with a safety net: before updating it snapshots the files, applies the update, then runs a homepage + REST health check — and if the update breaks the site it automatically rolls back to the previous version. One bulk action updates everything that’s out of date, each rolled back independently, so keeping your whole stack current won’t take the site down. (YOLO never auto-updates itself this way — you update it from the Plugins screen.)

As much or as little as you allow. Tokens are scoped — read, content, design, code, install, backup, restore — so you can hand an agent a read-only token, a content-only token, or full access. You decide, per token, and can change your mind any time.

Yes — YOLO is builder-agnostic. It writes native Gutenberg blocks by default, can author full Elementor or Bricks pages when you want them, and can even build a complete block theme (FSE) from scratch — templates, parts, theme.json design system and all — then edit it file-by-file. You’re never locked into one builder, and what it makes is standard, portable WordPress.

Yes. YOLO can introspect your actual install — which plugins and versions you’re running, your post types, and how things are configured, right down to your WooCommerce and payment setup — so your AI’s work fits your site, not WordPress in general. It’s read-only and secret-safe: passwords and API keys are never returned, only the fact that a key is set.

Yes. Unlike loose code snippets, every YOLO extension has a proper plugin-style lifecycle. You can deactivate or delete it from wp-admin → Code & installs, and deleting it cleanly removes the database tables, options and scheduled tasks it created — no orphaned clutter left behind.

Yes — and you get the exact extension, not an AI’s second attempt at it (re-prompting builds something slightly different every time). Export it to a file and import it on another site, or flip on a revocable share link the other site installs straight from — and re-pulls updates from with one click. If your AI holds tokens for both sites, you can just ask it to copy an extension across. Every import is health-checked, syntax-linted and snapshotted like any other change, and YOLO warns you before sharing if the code looks like it contains a hardcoded password or key.

No — that’s the whole idea. Rather than stacking plugins, YOLO can write small, self-contained extensions. Our own transactional email and the contact form on this very site both run as YOLO extensions, not third-party plugins.

SVG is off by default, because a raw SVG can hide scripts. Turn on Allow SVG uploads in Settings and YOLO will accept .svg files — and sanitize every one on upload, stripping scripts, event handlers and remote references (using the same engine as the popular “Safe SVG” plugin) before it is ever stored. With the switch off, SVG stays blocked.

YOLO runs on your own server — it doesn’t phone home with your content. The only outbound traffic is what you configure: your AI tool’s API, or an off-site backup destination you set up yourself. See the privacy policy for specifics.

Short version: YOLO is self-hosted (your server, your data), safety-first (scopes, audit log, auto-rollback) and plugin-free by philosophy. We’ve written it up in detail — see vs Novamira, vs WP Godmode and vs Angie. And because it can introspect your actual site — the plugins, versions and config really installed here — your AI works from reality, not a fixed ‘skills’ library that can’t know your setup.

Three ways, one engine: a documented REST API, an MCP server for agent tools, and OpenAPI / GPT Actions for custom GPTs. Point your tool at your site, paste a token, and go. The get-started guide walks through it.

Standard self-hosted WordPress on typical PHP hosting. It’s a normal plugin, built by the same team that brought you Code Snippets — trusted on over a million sites — so there’s no special stack to provision. It needs WordPress 6.0+ and PHP 7.4+ — YOLO checks both when you activate it and refuses to run on anything older, so it never half-installs.

Instantly, from wp-admin. Delete or replace any token at any time and it stops working immediately. Tokens are stored hashed — never in plain text — and you can run several at once with different scopes and labels.

Yes — this site, and much of YOLO’s own tooling, were built by YOLO. It’s the most honest demo we could give you.

Yes. Anything your AI builds as an extension can be shared to another site behind a single revocable link — one extension, or a whole Kit of them. The receiving site installs the bundle in one go, each through the same safety checks (lint, snapshot, health-check, auto-revert), and members can be re-pulled when you update them. Great for standing up new client sites with your toolkit.

No. Download a YOLO skill from the Set up page and upload it once in Claude → Customize → Skills — it works in Claude Code, Claude Desktop and the Claude web app. (For a cloud surface to reach your site, the site needs a public URL and your domain on Claude’s network/egress allowlist.) You can also paste a one-off prompt, or use the one-click Cursor/VS Code installs.