Safety & how it works
A technical look at the guardrails — and one thing we ask you to do.
Letting an AI change a live WordPress site shouldn’t be a leap of faith. YOLO is built so every change is observed, reversible and contained. Here’s exactly how — and why you should still keep your own independent backups.
Always keep your own backups too
YOLO’s snapshots, auto-rollback and built-in backups are strong, but no software is infallible. Please also run independent backups — ideally through your hosting provider (most offer automatic daily backups and one-click restore), or a dedicated backup plugin that stores copies off-site. If something ever goes badly wrong, an off-server backup is the recovery path that doesn’t depend on YOLO, your database, or even the site booting.
Every change is snapshotted
Before YOLO writes anything — a page, template, setting or extension — it records the previous state. Undo reverts the last change and redo re-applies it.
Auto-rollback on fatal errors
Activating a plugin or switching a theme is health-checked (REST + homepage). If it would fatal the site, it’s reverted automatically — the site stays up.
Self-healing, plugin-grade extensions
AI-written code runs as a managed extension. If one fatals it’s quarantined automatically, and every extension has activate / deactivate plus a clean uninstall that removes the tables, options and scheduled tasks it created.
Built-in backups & restore
Full bundles with an integrity marker, restore even across domains, and encrypted off-site copies you control. A restore always takes a pre-restore safety backup first.
Tamper-evident audit log
Every action is written to a hash-chained log you can verify. Alter or remove a row and the chain breaks — so you always have a trustworthy record of who did what.
Scoped access, off by default
Tokens are scoped — read, content, design, backup, restore, code, install. Writing code and installing plugins/themes are off until you switch them on.
Protect mode & safe collaboration
Lock the site before you hand it over; Protect blocks risky changes only you can re-enable. And multiple people or AIs can’t silently overwrite each other — clashes are detected and queued.
Secret-safe by design
When the AI inspects your configuration, secret values — keys, passwords, tokens — are never returned. It learns a key is set (type + last four), never the value.
Reporting a security issue
Found a vulnerability? Please report it privately to [email protected] (or via our contact form, marked “Security”) rather than disclosing it publicly. We aim to acknowledge within a few business days and are glad to credit you. See our security.txt.