Title: PasteTheme Author: chattanoogatshirt Published: 1 ตุลาคม 2026 Last modified: 8 ตุลาคม 2026 --- Search plugins ![](https://ps.w.org/pastetheme/assets/banner-772x250.png?rev=3722619) ![](https://ps.w.org/pastetheme/assets/icon-256x256.png?rev=3722619) # PasteTheme By [chattanoogatshirt](https://profiles.wordpress.org/chattanoogatshirt/) [Download](https://downloads.wordpress.org/plugin/pastetheme.0.25.0.zip) * [Details](https://th.wordpress.org/plugins/pastetheme/#description) * [Reviews](https://th.wordpress.org/plugins/pastetheme/#reviews) * [Installation](https://th.wordpress.org/plugins/pastetheme/#installation) * [Development](https://th.wordpress.org/plugins/pastetheme/#developers) [Support](https://wordpress.org/support/plugin/pastetheme/) ## Description PasteTheme turns WordPress into a real business website, not a blog. Tick the pages you want and one click makes them. Ask ChatGPT, Claude or Gemini for a section, paste what it writes, and click any word or picture to change it. The contact form sends, email can be tested, search settings and security are set from the start, and any AI can connect safely. No page builder, and far fewer plugins to buy, update and keep track of. #### Everything a small site needs, built in * **A contact form that sends.** Paste any form your AI writes and it is emailed to you, with the sender as reply-to. A hidden trap field, a fill-time check and a flood guard are always on, and Cloudflare Turnstile joins them when you paste its two free keys. The Forms screen puts a ready-made contact form on any page in one click. * **Email you can check.** A test button, and a list of the last fifty emails the site tried to send and whether each one left (never the message itself). * **Found on search engines.** A search title, a description and a hide-from-search switch on every page, the picture a shared link shows, and hidden pages left out of the sitemap. * **Your look on one screen.** Logo, colors and fonts in light and dark, four ready- made looks, three header and three footer layouts, section edges, and boxes for your Facebook, Instagram, LinkedIn, YouTube, X and TikTok addresses that fill the footer’s social icons. * **Any Google font, served from your site.** A font your AI asks for is offered on Design: one click downloads it into your own uploads folder, so visitors load nothing from Google. * **Lighter photos.** New JPEG and PNG uploads are saved as WebP as well, and oversized originals are shrunk. * **A shop when you want one.** “Add a shop” installs WooCommerce from wordpress. org and hands over to its own store setup. * **Visits without cookies.** A private counter that never records who visited. * **One place to run it.** Setup walks you through seven steps, from your site’s name to going live, with Coming soon or Live at the top. Clear caches is one click from the admin bar. #### A real website in one click Tick the pages you want: Home, About, Services, Contact, Questions, Prices, the privacy policy. Each arrives with a real starter section, and Home becomes the front page. Twelve ready-made sections wait in the editor’s inserter, from heroes and services to prices, questions and a contact form. #### Copy. Paste. Website. * **The prompts are already written.** The AI screen has a section prompt and an agent prompt. Add your business and what the section should say; the prompt already teaches your AI the rules. * **Paste, then edit only your words.** Paste the code onto a drop zone (or press Ctrl+V on an empty one). Headings, text, list items, captions, images, buttons and videos become fields you click and change. Everything else stays exactly as pasted: WordPress itself refuses to move, remove or insert anything inside the section. * **Your site’s look, in every section.** A pasted section keeps its markup, stored in the page the way a Custom HTML block is stored; the front end prints it through wp_kses with the plugin’s allow-list. Its look comes from the plugin’s own stylesheet through a fixed set of class names the section prompt teaches your AI (columns, cards, steps, price plans, questions, forms, buttons, icons, videos and more), in your colors, light and dark. * **Clean by default.** Scripts, style elements, style attributes, stray iframes, inline event handlers, meta and base tags, external form actions and HTML comments are removed on paste, each with a short warning. The plugin stores and prints no CSS or script from a section and has no box for either. * **A new design is one paste away.** Paste over a section and the whole section is replaced; the old version stays in the page’s revisions. #### Safely connect any AI * **The AI you already use.** ChatGPT, Claude, Gemini or any AI that writes HTML. No credits to buy. * **Connect over MCP.** MCP is how AI assistants such as Claude and ChatGPT connect to a website. The AI screen gives this site’s address and a “Make a key for my AI” button that opens WordPress’s own Authorize Application screen, where you approve the connection and WordPress makes the key. A key made this way changes the site’s content through PasteTheme’s own tools, never its administration. * **Two switches.** “Let an AI connect” (off on a new site) and “Safe mode” (on for a new site: an AI changes words and pictures; a new section for a page that is on the site waits as a revision for you to approve; a new page, a page’s details or a ready-made site is refused with a note). * **See what your AI did.** The AI screen lists the last hundred calls your keys made, what each one touched, and whether it was done, failed or refused. * **Built for agents too.** Sixteen abilities on the WordPress Abilities API, described in docs/AGENTS.md, and the same abilities as an MCP server at /wp-json/pastetheme/ mcp on your own site. #### Updated regularly, and you see what changed New features and security fixes arrive in regular updates. What’s new on Setup shows what each update brought, with its date and with new features and security fixes marked. One button turns on WordPress’s own automatic updates for every plugin, theme and WordPress itself. #### Fast on every page No jQuery, no CSS framework, no page builder: nothing loads that a page does not use, and pictures below the first screen wait until they are scrolled to. pastetheme. com is built with PasteTheme: on a phone, 15 of its 18 pages score 100 on Google PageSpeed Insights and the other three 99 (tested 30 September 2026; your score depends on your host, plugins and pictures). #### Right on every phone * **Sections that fit any screen.** The section classes stack and resize with the screen, so a section pasted on a desktop already fits a phone. * **Preview at every size.** See a page at four widths at once (wide desktop, laptop, tablet and phone), or at any width from 320 to 2560 pixels, from Pages & menu or the editor’s Preview menu. #### Security built in, free * **The usual weak spots, closed.** Security headers, generic login errors, no user listing over REST, ?author= or oEmbed, no file editor, no pingback or version headers, XML-RPC off. * **Password guessers locked out.** Five failed attempts from one address lock it out for fifteen minutes. * **Files that do not belong.** Switch it on (Security & people; off until you do) and once a day the site compares WordPress’s own files and every wordpress. org plugin’s files with the lists wordpress.org publishes, and emails you the day something new appears. Two alerts are on from the start and ask no other server: a new administrator, and a new application password for someone who can edit the site. * **A checkup in plain words.** Setup’s Go live step lists what is easy to get wrong, such as a placeholder site email or automatic updates off, each with the one thing to do. * **Two-step login in one click.** Security & people installs the Two Factor plugin from wordpress.org. #### A client-proof editor Add your client on WordPress’s own Users Add User screen with the Site owner role( the card on Security & people says how, with a button to it). They can change every word, picture and button; they cannot paste, move, delete or restyle a section, and never see the settings. #### Switch from any theme The Switch screen moves a site you already have in four steps: it activates the theme, carries over your logo, menu, search titles and mail settings, then lists the plugins whose jobs PasteTheme now does. Nothing is removed until you tick it. #### Yours to keep Your words and pictures are ordinary HTML in the page: switch the plugin off and they stay where they are. It works with any block theme and is made for the free PasteTheme theme. Everything works with this plugin alone. #### PasteTheme Pro When you’re ready for more, PasteTheme Pro is the upgrade: 24 plugins in one, from a form builder with an inbox to redirects, popups, sliders, a page cache and your own name on the dashboard. A separate plugin from pastetheme.com. See what it adds: https://pastetheme.com/pricing/ ### External services Agents and the MCP server are not an outside service: the abilities and /wp-json/ pastetheme/mcp are routes on your own site’s REST API. The plugin runs no server, relays nothing and stores no key for any remote party. An AI client you connect logs in with an application password made for one of your users and gets only that user’s capabilities. A key made from the AI screen is limited further, to the site’s content through the PasteTheme abilities: its only writes through WordPress’s own routes are a picture upload and a named list of settings (the site’s name, tagline, logo and icon and PasteTheme’s display switches); users, plugins, themes, keys, site health, XML-RPC and every other setting answer 403 to it, and for its requests WordPress holds no plugin, theme, user, import or export capability. No ability installs, activates or removes plugins or themes, creates or logs in users, edits code or changes the security settings, and the security settings are not on the REST settings endpoint. The “Make a key for my AI” button is not an outside service either. It opens WordPress’s own Authorize Application screen on your own site (wp-admin/authorize-application. php); after you approve, WordPress makes the key and, with JavaScript on, sends it back to the AI screen after the # in the address, a part browsers never send to any server (without JavaScript it arrives in the query, and the AI screen drops it unread). The plugin never makes, stores, logs or sends it. This plugin contacts an outside service only in the cases below: three start with an administrator’s click, the others only after you add Google Analytics, switch on the daily file check or a video switch, or paste Cloudflare Turnstile keys. Nothing else here contacts an outside service, and the plugin adds nothing from another site to your pages unless you add that Google Analytics id, a video or those keys. Clear caches asks any caching plugin it finds to empty its cache, and some, such as Cloudflare’s, contact their own service to do it. Google Fonts: when you add a font on the Design page (or accept one a pasted section asked for), the plugin asks fonts.googleapis.com which files that family needs, then downloads those files from fonts.gstatic.com into wp-content/uploads/pastetheme/ fonts on your own site. It sends the font’s name and, with the downloads, your site’s address in WordPress’s browser identifier; nothing about you or your visitors. The Switch screen’s carry-over does the same for the old theme’s body and heading fonts. Only when an administrator clicks, never on a page visit. Google Fonts terms: https:// developers.google.com/fonts/terms · Google privacy policy: https://policies.google. com/privacy WordPress.org, to install a plugin: two buttons, Two-step login (the Two Factor plugin, on Security & people) and Add a shop (WooCommerce, in Setup’s Sell online step), install and switch on another plugin from wordpress.org through WordPress’s own installer; ticking Shop in the pages picker on Pages & menu and pressing “Make these pages” installs WooCommerce the same way, and the tick says so. Each runs only when an administrator clicks: WordPress asks api.wordpress.org for the plugin by its name and downloads it from downloads.wordpress.org, sending what every WordPress install request carries (your WordPress version, language and site address). WordPress. org privacy policy: https://wordpress.org/about/privacy/ Google Analytics: if you paste a Google Analytics 4 Measurement ID on Settings Connections & keys, every page loads Google’s tag script from www.googletagmanager. com for visitors who are not logged in; Google Analytics receives their visits ( the page, the page they came from, their browser and device details and their network address) and sets its own cookies. Leave the field empty (the default) and nothing is loaded. Google terms of service: https://policies.google.com/terms · Google privacy policy: https://policies.google.com/privacy Cloudflare Turnstile: only if you paste the two keys of a Turnstile widget on Settings Connections & keys (empty by default; nothing is loaded until both are in). A page with a form then loads Cloudflare’s check from challenges.cloudflare.com, and when the form is sent (the shop’s account forms and, if switched on under Forms Spam protection, the login page too) your server asks challenges.cloudflare.com whether a person answered, sending the check’s token, your secret key and the visitor’s network address. Cloudflare terms: https://www.cloudflare.com/website-terms/ · Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/ YouTube and Vimeo: a video in a section plays from www.youtube-nocookie.com (https:// policies.google.com/privacy, https://www.youtube.com/t/terms) or player.vimeo.com( https://vimeo.com/privacy, https://vimeo.com/terms). Until play is pressed the page shows a picture: as installed, YouTube’s own thumbnail, which the visitor’s browser asks i.ytimg.com for with the video’s id; on phones and in Safari the player loads once the video scrolls into view. Two switches under Settings, Site features, both off until you choose them, make your server fetch each thumbnail once (from i.ytimg. com; for Vimeo from vimeo.com/api/oembed.json, then i.vimeocdn.com; only the video’s address is sent) and keep it in uploads/pastetheme/video; the second also makes phones wait for the press. WordPress.org, for the daily file check: only after an administrator switches it on (Security & people Files that do not belong; off until then), once a day and whenever Check now is pressed, the plugin asks api.wordpress. org for the published checksums of your WordPress version and language and downloads. wordpress.org for the published checksums of each installed wordpress.org plugin, by the plugin’s name and version (kept for a month). Which plugins come from wordpress. org is read from WordPress’s own update check. Like every request WordPress makes, these carry your site’s address in the browser identifier. The comparison happens on your own server, and no file, setting or visitor information leaves it. Switching it off, or deactivating the plugin, stops it. WordPress.org privacy policy: https:// wordpress.org/about/privacy/ Setup’s site checks send nothing when Setup opens: the PHP line reads what WordPress’s own Site Health check already saved (core’s api.wordpress.org check, kept a week), and says to open the Dashboard once until it has. The email line looks up your domain’s SPF record (a DNS lookup) only when you press Look up the domain, and keeps the answer a week. “Measure the front page” fetches your own front page and two of its files once, from your own server. None of these sends anything about you or your visitors. ## Screenshots [⌊A real website from the free theme and this plugin alone: chattworks.com, a sample local jobs board, on a desktop and a phone. Every section is a pasted section.⌉⌊ A real website from the free theme and this plugin alone: chattworks.com, a sample local jobs board, on a desktop and a phone. Every section is a pasted section.⌉[ A real website from the free theme and this plugin alone: chattworks.com, a sample local jobs board, on a desktop and a phone. Every section is a pasted section. [⌊Edit only your words: click a heading, a sentence or a picture in a pasted section and change it, while the layout stays exactly as pasted.⌉⌊Edit only your words: click a heading, a sentence or a picture in a pasted section and change it, while the layout stays exactly as pasted.⌉[ Edit only your words: click a heading, a sentence or a picture in a pasted section and change it, while the layout stays exactly as pasted. [⌊Setup: Coming soon or Live at the top, then seven steps from your site's name to going live, each with one button to its screen.⌉⌊Setup: Coming soon or Live at the top, then seven steps from your site's name to going live, each with one button to its screen.⌉[ Setup: Coming soon or Live at the top, then seven steps from your site’s name to going live, each with one button to its screen. [⌊Preview at every size: one page on a wide desktop, a laptop, a tablet and a phone at once, from Pages & menu.⌉⌊Preview at every size: one page on a wide desktop, a laptop, a tablet and a phone at once, from Pages & menu.⌉[ Preview at every size: one page on a wide desktop, a laptop, a tablet and a phone at once, from Pages & menu. [⌊Design, Look: ready-made color sets in light and dark, one click to use.⌉⌊Design, Look: ready-made color sets in light and dark, one click to use.⌉[ Design, Look: ready-made color sets in light and dark, one click to use. [⌊Design, Header & footer: header and footer layouts, and the boxes for your social addresses that fill the footer's icons.⌉⌊Design, Header & footer: header and footer layouts, and the boxes for your social addresses that fill the footer's icons.⌉[ Design, Header & footer: header and footer layouts, and the boxes for your social addresses that fill the footer’s icons. [⌊Forms: a ready-made contact form on any page in one click, where messages go, and every form on the site.⌉⌊Forms: a ready-made contact form on any page in one click, where messages go, and every form on the site.⌉[ Forms: a ready-made contact form on any page in one click, where messages go, and every form on the site. [⌊AI: connect any AI over MCP with two switches and a key WordPress makes, and the prompts, already written.⌉⌊AI: connect any AI over MCP with two switches and a key WordPress makes, and the prompts, already written.⌉[ AI: connect any AI over MCP with two switches and a key WordPress makes, and the prompts, already written. [⌊What your AI did: every call your AI's key made, the page it touched, and whether it was done or refused.⌉⌊What your AI did: every call your AI's key made, the page it touched, and whether it was done or refused.⌉[ What your AI did: every call your AI’s key made, the page it touched, and whether it was done or refused. [⌊Security & people: login lockouts, two-step login in one click, a login for your client and the daily file check.⌉⌊Security & people: login lockouts, two-step login in one click, a login for your client and the daily file check.⌉[ Security & people: login lockouts, two-step login in one click, a login for your client and the daily file check. [⌊What's new: what each update brought, with the date, and new features and security fixes marked.⌉⌊What's new: what each update brought, with the date, and new features and security fixes marked.⌉[ What’s new: what each update brought, with the date, and new features and security fixes marked. ## Blocks This plugin provides 2 blocks. * Section (paste drop zone) Paste AI-generated section code here. PasteTheme locks the structure and opens only the text and images for editing. * Editable field One editable text, image, button or video inside a pasted section. Created by the paste pipeline — not inserted by hand. ## Installation 1. Install and activate the plugin. 2. Add a “Section” block to any page and paste your code, or press Ctrl+V on the empty drop zone. 3. Open PasteTheme Setup and follow the steps. Optional: activate the PasteTheme theme first for the design shell, the starter sections and the section edges. ## FAQ ### Do I need to know how to code, or a page builder? No. Describe what you want to ChatGPT, Claude or Gemini, copy what it gives you, and paste. You never edit the code, and there is no page builder: WordPress itself locks the section’s layout and leaves your words and pictures clickable. ### Does it work with ChatGPT, Claude and Gemini? Yes: any AI that writes HTML. Give it the section prompt from PasteTheme AI and ask for one section at a time: it writes the words in the HTML and uses PasteTheme’s class names for the look. ### Why WordPress 7.1? The section mechanic is built on the way 7.1’s Custom HTML block holds editable blocks inside it. ### What changes when I activate it? Nothing is hidden from visitors: a new site starts live, and Coming soon is a choice at the top of Setup. What does change: on a brand-new site comments are switched off, the way a business site has them, while a site that already has content of its own keeps them as they were (Settings Comments switches either way); the private visit counter starts counting (Search & visits Visits; it stores the page’s address and the referring site’s name, never who visited, sets no cookie and skips browsers that ask not to be tracked); a back-to-top button, a floating header, dark mode that follows the visitor’s device and your logo on the login page are on (Settings Site features); XML-RPC is off and login lockouts are on (Settings Advanced, Security& people). On a brand-new site “Let an AI connect” starts off, and while it is off no application password logs in, for any app (PasteTheme AI switches it on). With the PasteTheme theme active, a starter Home page is made and set as the front page, unless the site already has one. On a brand-new install the section edges start on the slight curve with every other section shaded; a site that was here before stays straight (Design Section edges). In the admin, for administrators: a Setup link on the plugin’s row on the Plugins screen and, once, a notice there pointing to Setup that goes away by itself, a small PasteTheme Setup box on the Dashboard while Setup has steps left (Hide this hides it for good), a Site owner role in the role list (a login that can change words and pictures only), and Clear caches in the admin bar. While Setup has steps left, an administrator who logs in lands on Setup instead of the Dashboard. WordPress’s Dashboard leaves out its Events and News, Quick Draft and Welcome boxes for every login, and while comments are off the Comments menu, its screen and the Dashboard’s comments box are hidden. After a plugin, theme or WordPress update, or a theme switch, caches are cleared the way Clear caches does it. The plugin checks nothing against WordPress.org until an administrator switches on the daily file check (Security & people Files that do not belong). Once it is on, the site checks its own files against WordPress.org’s published lists once a day, with a count on the PasteTheme menu while anything needs a look and an email to the site’s address the same day something new appears; switching it off stops it, and deactivating the plugin stops it and switches it off. From the start, the site’s address gets an email when a login is given the Administrator role or an application password is added for someone who can edit the site; these two alerts go to the site’s own address, contact no other server, and one switch on the same card turns them off. Developers: the new-site defaults are the PASTETHEME_NEW_SITE_COMING_SOON and PASTETHEME_NEW_SITE_EDGE constants, each behind a filter (pastetheme_new_site_coming_soon, pastetheme_section_edge_default). ### How do I connect my AI assistant? Open PasteTheme AI and switch on “Let an AI connect”. Copy the site’s address, press “Make a key for my AI” and approve on the WordPress screen it opens, then give your assistant the two. WordPress makes the key and, with JavaScript on, sends you back to the AI screen with it after the # in the address, where it is shown once (without JavaScript the AI screen cannot show it and says so); the plugin never makes, stores or sends it. Claude Code works with any site, even one on your own computer, in one line the AI screen writes for you. Claude, ChatGPT and other apps that run in the cloud need the site on the public internet, and ChatGPT makes changes only from a Business, Enterprise or Edu workspace. The key logs in as you and changes the site’s content through PasteTheme’s own tools: words, pictures, sections, new pages, page search settings, forms and putting pages live. Site-wide looks, templates, menus (beyond the links its own website and ready- made-site tools add), posts, comments, deleting, users, plugins and themes answer 403 to it, and with Safe mode on it changes words and pictures only. Revoke it whenever you like: the key list on the same screen opens WordPress’s own list of keys on that login’s profile. ### Does it replace a contact form plugin? For a business site’s contact form, yes: paste any form your AI writes and it sends, with a hidden trap field, a fill-time check and a flood guard always on, and the Forms screen puts a ready-made contact form on any page in one click. To change the fields, ask your AI (it edits the form in place over MCP) or paste the form again. Whether an email arrives is your host’s job; the Email card shows whether each one left. ### Is a new site secure out of the box? The usual weak spots start closed: security headers, generic login errors, no user listing, no file editor, no pingback or version headers, XML-RPC off, and password guessers locked out after five failed attempts. It is not a firewall or a malware scanner, and backups stay with your host. ### Where do contact form messages go? To the address on PasteTheme Forms (“Messages go to”); left empty, to the site’s own admin address. The Email card on the same Forms screen shows whether each email left. ### How do I change a form? Its heading, sentences and Send button change with a click, like the rest of the page. For the fields, ask your AI (it changes them in place) or paste the section again. A label wrapped around its box, the way many AI-written forms are built, is part of the form itself, so it changes the same way as a field. ### Does it work on multisite? Not in this version. On a sub-site WordPress filters pasted markup and quietly damages it; the plugin refuses with a clear message instead. One more limit on any site: an account without the unfiltered_html capability (an Editor on a multisite network) cannot paste or replace a section, and WordPress filters the page’s markup when such an account saves it, exactly as it does for a Custom HTML block. Give that person an administrator account to paste sections, or a Site owner login (Users Add User) if they only change words and pictures. ### Can I add Cloudflare Turnstile to my forms? Yes. Make a free Turnstile widget in your Cloudflare dashboard and paste its two keys on Settings Connections & keys. Every pasted form then shows Cloudflare’s check above Send, on top of the trap field, the fill-time check and the flood guard that are always on. Forms Spam protection has the switches: every form (on), the shop’s account forms (on) and the WordPress login page (off). Nobody is refused until one check has passed with your keys, so a wrong key cannot lock you out. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “PasteTheme” is open source software. The following people have contributed to this plugin. Contributors * [ chattanoogatshirt ](https://profiles.wordpress.org/chattanoogatshirt/) [Translate “PasteTheme” into your language.](https://translate.wordpress.org/projects/wp-plugins/pastetheme) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/pastetheme/), check out the [SVN repository](https://plugins.svn.wordpress.org/pastetheme/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/pastetheme/) by [RSS](https://plugins.trac.wordpress.org/log/pastetheme/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 0.25.0 – 8 Oct 2026 * New: Preview at every size. See a page at desktop, laptop, tablet and phone widths at once, or any width you type, from Pages & menu or the editor’s Preview menu. * New: add another card. Click a card, plan, quote or list item in a pasted section and choose Add another or Remove; the layout stays as it is. * New on Design: boxes for your Facebook, Instagram, LinkedIn, YouTube, X and TikTok addresses put the icons in your footer. * New: Side spacing on Design Layout: how much room sits between the screen edge and your words, logo and menu, the same setting the Site Editor shows. * New: links on the Plugins screen: Setup, Get Pro (gone once Pro is on), Guides and Rate PasteTheme. Setup’s Pro card links to the short movie of what Pro adds. * What’s new on Setup shows each piece’s last five updates with their dates, security fixes and new features marked. * A page’s share picture is shared at its full size, and X gets it too. * After two weeks with three sections pasted, the foot of PasteTheme’s own screens asks once for a review on wordpress.org; Not now, Done or the review itself ends it. * What your AI did says what went wrong in plain words. #### 0.24.2 – 7 Oct 2026 * New: What’s new on Setup. Each PasteTheme piece shows what its last update brought, with security fixes and new features marked; a waiting update says what it brings, and Check for updates asks WordPress now. * The Messages tab opens (it said “Cannot load”), and the Messages screen has the tab row too. * Settings, Connections & keys has a Test it button that opens the test email on Forms, Email. * Works with the theme under either of its names: PasteTheme from pastetheme.com, or Paste. #### 0.24.1 – 6 Oct 2026 * The PasteTheme screens have tabs along the top, so you can move between Setup, Pages & menu, Design and the rest without the side menu. * The footer Make these pages writes has a social icons row, filled in the Site Editor. Adding your social addresses keeps the Header & footer card on its layout. #### 0.24.0 – 5 Oct 2026 * New: the Cloudflare Turnstile spam shield is part of the free plugin. Paste the two keys of a free Turnstile widget on Settings Connections & keys and every form shows Cloudflare’s check above Send, on top of the trap field, fill-time and flood guards. Switches on Forms Spam protection: every form (on), the shop’s account forms (on), the WordPress login page (off). Nobody is refused until one check has passed with your keys. External services says what Cloudflare receives. * New on Design: a Look card with the theme’s ready-made color sets (light and dark; your fonts stay as you set them), and Header layout / Footer layout choices on the Header & footer card, from the theme’s own patterns. WordPress keeps both, so the Site Editor shows the same. * New for your AI: write-post. Your assistant can draft a blog post: the body goes through WordPress’s own post filter, each heading, paragraph, list, picture and quote becomes a block, and it is saved as a draft for you to read and publish. * New on AI: What your AI did, the last hundred calls your keys made, with the page or post each one touched and whether it was done, failed or refused. * New sites: a page made from Setup carries its own heading, so no big page title sits over a small section. Making pages puts WordPress’s untouched Sample Page back to a draft. The footer’s tagline line shows only while the site has a tagline. * One welcome notice on the Plugins screen after activation, shown once. The four cards on Security & people open by default. The AI screen names a locked-out address as the cause and says where to clear it. With “Let an AI connect” off, each profile says in plain words where keys went. * Security: the lockout count clears only when an editor logs in; the form flood guard follows the proxy switch; the uploads rule catches more PHP file types and is refreshed on sites that set it on an earlier version; the Site owner role cannot upload HTML or JavaScript files; the visit counter caps new addresses per day. * An SVG that states no size is remembered as such, not read again on every Media Library load. * Forms: a field added to a form inside a layout box lands beside the others; SVG icons and yes/no attributes come back unchanged after a save. * Switch: plain and styled pages convert through one converter; the log counts the script or style blocks left behind. * Accessibility: hint text at WordPress’s own description grey, and names for screen readers on three table headers. #### 0.23.0 – 3 Oct 2026 * New: a Layout card on Design: Site width, Whole screen and Text width, stored as WordPress’s own Wide and Content width, so core blocks, pasted sections, the header and the footer all follow (block themes). Typing the theme’s own number removes the override. * New: Link is a seventh color on Design, Colors. Left alone it follows the accent; a picked color holds; “back to a shade of the accent” returns it. Design, Colors now stores only the colors you changed, so a theme update reaches a site that has saved. * New: the drop zone has a Ready-made sections tab. Forms: Open the page opens the editor on that form’s section, already picked. Setup ends with Report a problem. * Pictures: when your AI swaps a picture, the new one gets its smaller copies for phones, and so does a picture swapped in the editor. Pictures in sections pasted before 26 September get them too, in a one-time pass; nothing to re-paste. * Fonts: a Google font you added is preloaded, so text no longer jumps; a font your AI names only in its CSS is offered on the Fonts card, one click to add. * Forms: a file box is left out of a form while nothing on the site can send files( it took a CV, said “sent” and dropped it). Another plugin can add form fields its script creates; they reach your email. The forms screens say so plainly on a server without PHP’s dom extension. * Ready-made sites use the full width and show your section edges. The notice says a page with the same name is rewritten (the old version stays in revisions) and the menu is set to its pages. An AI installing one keeps your existing pages and menu links and says so. Ready-made sites can come from other folders (filter pastetheme_preset_dirs). The Small business call to action no longer asks for a photo the form cannot take. * Paste: a note when onclick handlers or javascript: links are removed (they went silently). A section pasted without the prompt’s content box keeps off the screen edges, on other themes too. A paragraph written as can be edited. Changing a section’s Width updates its stored code. The editor says when a section holds old design settings the page no longer shows, and how to fix it. The section prompt asks AIs to put commands and code in < pre>`, so they stay copyable. * Switch: step 4 also clears the scheduled jobs of the plugins it removed; AIOSEO titles are found on servers with lower-case table names; plain typed pages convert; the old main menu carries. * AI keys no longer see files visitors send through forms; a wrong or revoked key gets a clear answer; a tool the site does not have answers "not available on this site". With "Let an AI connect" off, every profile says application passwords are off and links to the switch. * Security: PHP's X-Powered-By header is removed from front pages. The daily file check (when on) no longer re-flags your host's must-use plugins, reads .htaccess SetEnv lines, names host settings files, emails you when an administrator appears outside WordPress's user screens, and compares big plugin folders a few a day. Site checks lists pages whose old sections lost their styling. * Fixed: SVG logos show proper thumbnails in the Media Library. Floating header: pages start faster and in-page links land right under it. Slight curve preview is as shallow as the real curve. Long words in admin help text wrap on phones. Stacked grids keep the grid gap; an icon badge inside a card keeps its light tint. Safe mode names the profile- key limit. A dead "needs WordPress 7.1" notice is gone. * Uninstall removes the per-person notes and the file-check settings. #### 0.22.1 – 1 Oct 2026 * New: a “Footer contact line” on Design, Header & footer. What you type there ( your email address, phone number and hours) fills the “Get in touch” paragraph of the footer that “Make these pages” wrote, for as long as that paragraph is still PasteTheme’s own. An AI can set it too (`pastetheme_footer_contact`). * Site checks: on a site reached through Cloudflare, a new line says whether wrong passwords are counted per visitor, and names the switch that does it (Settings, Advanced, “Behind a proxy or load balancer”). * Faster first paint: the section stylesheet is small, so WordPress now prints it into the page instead of asking for one more file. * Fixed: in a pasted section a row of buttons straight after a row of cards, steps or pictures sat against them. It now keeps a gap. * The ready-made Contact section no longer mentions adding a photo (its form has no file field). #### 0.22.0 – 1 Oct 2026 * New: videos. Paste a YouTube or Vimeo link on its own into a section’s paste box (or have your AI pass it) and it becomes a section with that video. A video in any pasted section is now a field: click it in the editor and paste another link, or change its name, in the sidebar. Watch pages, youtu.be links, Shorts( shown upright), live streams, playlists, start times and vimeo.com links are all read. * A video now reaches the visitor as a picture with a play button, and the player loads when it is pressed, so the page stays light. On phones and in Safari, which do not let that press start a video with sound, the player loads once the visitor scrolls to it and one press plays. Two new switches under Settings, Site features, both off until you choose them: “Keep video pictures on this site” (your site fetches each video’s thumbnail once and serves it itself: sharper, and a Vimeo video gets one) and “Load videos only after a click” (nothing is asked of YouTube or Vimeo before the press, on any device). * The player is asked for YouTube’s cookieless address, to play inside the page on a phone, and to suggest videos from the same channel only; it is told which page it is on, which YouTube now requires. * For agents: list-sections reports video fields with their title, edit-field takes a YouTube or Vimeo address for one (alt sets its name), and convert and replace- section accept a bare video link. * Everything in 0.21.2 below, which was not published here. #### 0.21.2 – 1 Oct 2026 * “Make these pages” points the starter Home page’s two buttons at the Contact page. Before, they led nowhere until you gave each a link. * The footer “Make these pages” writes now follows the site: a new site name or tagline shows there, a page that leaves the site leaves its Pages list, and a link you add to the menu joins it. A line or a list you changed yourself is left alone. * The edit-field ability takes href for a button field, so a connected AI can say where a button goes, and list-sections says where each button goes now. * A page a connected AI adds with add-page joins the menu when set-page-live puts it on the site, as the tool always said it would. * A row of buttons inside a centred section is centred too. * A card on a shaded section takes the page color, and a small label (pt-badge) is a tint of the text, so both show on any ground. * Taking WordPress’s Sample Page off the site in the pages picker no longer makes the Switch screen appear on a new site. #### 0.21.1 – 30 Sep 2026 * Switch, step 4: the list of plugins and the old theme is a table again and its rows can be ticked. In 0.21.0 the boxes could not be ticked, and on a phone the screen scrolled sideways. #### 0.21.0 – 30 Sep 2026 * A style attribute in a pasted section is left out with a short warning, like a style element, so the plugin stores and prints no CSS from a section. A section saved before this version keeps its style attributes in the page, but the plugin no longer prints them; paste it again with the section prompt. * A pasted section element without the plugin’s section class gets it, so it takes your site’s look. * The section classes now cover icons, videos at 16:9, picture grids, a photo behind the words, figures, round portraits and small labels, and the content box, balanced rows, numbered steps and light and dark pictures work with any theme. * Two new library sections: a picture grid and the team. * A YouTube or Vimeo embed keeps its data attributes. * The Google font a pasted section asks for is read only from its font link. * Authors and Contributors keep the whole block editor in their own posts: only a Site owner login has a page’s blocks locked. * A key logs in only through the standard Authorization header or the copy the server makes of it, never through a header of another name. * The AI key is made on WordPress’s own Authorize Application screen, which “Make a key for my AI” opens; you approve there and come back to the AI screen with the key (with JavaScript on; without it, the AI screen drops the key unread and says to make another). Revoke opens WordPress’s own list of keys on that login’s profile. The plugin no longer makes, changes or deletes keys itself. * The client login is added on WordPress’s own Users Add User screen with the Site owner role; the card on Security & people says how and has a button there. The plugin no longer makes logins itself, and its line on Users Add New User is gone. Safe mode’s note no longer mentions logins. * The daily file check waits for you: it is off until an administrator switches it on under Security & people Files that do not belong, and nothing is asked of WordPress.org before then. Which plugins come from wordpress.org is read from WordPress’s own update check. The two email alerts are unchanged. * Setup’s site checks contact no other server when Setup opens: the PHP line reads what WordPress’s Dashboard already checked, and the email-domain line is looked up when you press Look up the domain. * The Switch no longer reads, shows or copies CSS or code from the old theme or from other plugins. Carry-over takes the accent color and the body and heading fonts from the old theme’s own settings. A plain page whose markup carries styling of its own (a style element, a stylesheet link or a style attribute) is no longer converted: it stays as it is, gets a page pack like a builder page, and the Switch log names it. The footer box’s log also says when style attributes were left out. #### 0.20.0 – 29 Sep 2026 * A style element in a pasted section is dropped with a short warning, the way a script always was. * Sections get their look from the plugin’s own stylesheet through a fixed set of class names: a content box, two columns, cards, price plans, priced lists, questions, ticks, facts, forms, buttons and three color tones, in your site’s colors, light and dark. The section prompt on the AI screen teaches them to your AI. * The ten library sections, the starter pages and the ready-made sites use those classes instead of style elements of their own. They look the same. * A section saved before this version keeps its style element in the page, but the plugin no longer prints it. Paste the section again with the prompt to give it the classes. * The AI key reaches content only: words, pictures, sections, new pages, page search settings, forms, putting pages live, visits, caches and a named list of settings, all through the plugin’s abilities. Its writes to WordPress’s own routes are refused except a picture upload (photos only), WordPress gives it no plugin, theme, user, import or export capability, it no longer switches Coming soon or reads comments and the other settings, and it does not log in over XML-RPC. A ready-made site installed by the AI no longer replaces an existing home page. * Two new abilities: add-page makes a draft page, and set-page-details sets a page’s title, address, excerpt, featured image, search title, search description and hide-from-search switch. * WordPress’s Additional CSS is no longer printed a second time by the plugin; WordPress prints it as it always does. * The If you ever leave card on Settings is gone: there is nothing left for it to move. * The Switch no longer copies the old theme’s CSS into Additional CSS. Its footer box drops style elements as well as scripts, and the page-wide style and script blocks of the pages it turns into sections are not carried. * An SVG animation in a section that changes a link’s address or an event handler is refused, and a data: address is kept only as a picture’s source. #### 0.19.0 – 29 Sep 2026 * Files that do not belong (since 0.21.0 it runs only after an administrator switches it on): once a day the site compares WordPress’s own files (and any theme WordPress ships, while the shipped version is installed) with the files WordPress published for your version and language, and every wordpress.org plugin, in use or not, with its published files; it looks for code in the uploads folder or loose in wp-content, for a settings file that makes PHP run a hidden file first, for code that reaches into WordPress’s folders by a back way, for a .maintenance file an update left behind, for files the known backdoor kit of September 2026 left, and for database dumps a browser could download. On a big site the plugin comparison and the uploads folder carry on where the last run stopped; an earlier finding the check could not get back to stays listed. A count on the menu, a line in Site checks, the list with what to do on Security & people (Check now, Block web access to these folders, and This one is fine on a file you know), and an email the same day something new appears. * Alerts: an email the moment a login is given the Administrator role through WordPress( a new user, a role change, a profile edit, or a plugin using WordPress’s user functions) or an application password is added for someone who can edit the site, saying who did it; at most ten an hour of each. On by default; a switch on the same card. * Login lockouts are kept in one setting of their own, so clearing caches no longer lifts them. * A password-protected page no longer shows the start of its text as its search and sharing description. * Login lockouts behind a proxy read the address the proxy added (the last X-Forwarded- For entry), so a forged header no longer slips past them. * Site checks says when WordPress was installed here and that its installer has been closed since, and names any plugin that is installed but switched off. * The shop page (WooCommerce) and the blog’s posts page now carry their own page’s search title, description, share picture and share address, the way every other page does; before, a listing had none. * The oEmbed answer (what another site gets when it embeds one of your pages) no longer names the page’s author or links to an author address; it names the site. A login-guessing run read usernames that way. #### 0.18.6 * Switch, step 3: the pages WordPress draws itself (Shop, Cart, Checkout, My account) no longer offer “Copy the page pack” and “See the old page”; there is nothing on them to copy. * Nothing else changes on a site. The readme’s Description is shorter (the directory shows the whole of it now) and one Save-button line carries its escaping note for Plugin Check. #### 0.18.5 – 29 Sep 2026 * A form’s hidden fields, and any check a plugin adds to the form, now sit right above the Send button instead of after it, so a visitor meets a challenge before pressing Send. #### 0.18.4 * Replacing a section that holds a form (a new design pasted over the old one, by hand or by an AI) keeps the form’s settings: its thank-you words, and what another plugin set on it. Before, a re-paste reset them. #### 0.18.3 – 28 Sep 2026 * The settings a key from the AI screen may change are a named list now (the site’s name, tagline, logo and icon; the PasteTheme switches, colors, image, section- edge and dark-mode settings) instead of “every PasteTheme setting but a few”: a setting added later stays with a person signed in to the dashboard until it is named. The visits counter switch joins the mail and analytics settings on the person-only side. * A refusal from an ability’s own permission check (a Site owner login asked to paste a section, an account without unfiltered_html) reaches the AI with its reason, on the MCP route too, instead of a bare “does not have necessary permission”. * Settings > Connections & keys: “Remove the saved password” is a switch row like every other setting. * A card with fewer than three rows keeps its Save button in place instead of pinning it to the bottom of the window. #### 0.18.2 * A key made with “Make a key for my AI” now reaches the site’s content only: the PasteTheme abilities and MCP route, pages, posts, media, menus, patterns, templates, the PasteTheme settings, and the site’s name, tagline, logo and icon. Other users, plugins, themes, the mail and analytics settings, the other WordPress settings, site health and key management answer 403 to it, whoever made it (it may read its own login). With Safe mode on, its page, menu, design and settings writes are refused too; pictures still upload. A key made on a user’s profile is WordPress’s own and is not changed. (0.20.0 narrowed this to content through the abilities.) * Putting a page live through the set-page-live ability checks the page’s own publish capability (publish_pages) by name. #### 0.18.1 * The ten library sections, the four starter pages and the ready-made sites now say what goes in each place (“Your headline: what you do, in one line”, “A customer’s words, in their own voice”) instead of sample words about a made-up business. Nothing reads as if it came with WordPress, and nothing can go live by mistake as someone else’s copy. The layouts and the editable fields are the same. #### 0.18.0 * One shape for every setting: a row with its name on the left, the control on the right and one sentence under it; on/off is a switch; each card has one Save that stays in view while you scroll. Every card on every screen is drawn this way now. Nothing changed in what is saved. * Connections & keys, a new card on Settings: every login and key the site uses in one place (the Google Analytics id and the mailbox login for now; other plugins add theirs). The screens that use one say so and link there. * AI screen: two switches. “Let an AI connect” is off on a brand-new site, and while it is off no key works. “Safe mode” is on for a brand-new site: an AI changes words and pictures; a new section for a page that is on the site is saved as a revision for you to approve; a new page or a ready-made site is refused with a note. A site that was here before keeps working as it did (both switches unset). * After login an administrator lands on PasteTheme’s Setup screen, and WordPress’s Dashboard no longer shows “WordPress Events and News”, “Quick Draft” or the Welcome panel. #### 0.17.2 * One home for every setting. Setup’s steps no longer repeat the forms that live on Design, Pages & menu, Forms, Settings and Security & people: each step keeps its status line and has one button to the screen where the setting is. Extras is four buttons. * The pages picker and the ready-made sites are on Pages & menu, under the page and menu list. * Email (sender, SMTP, the test and the recent emails) is on Forms, next to the forms that send it; the “Did it send?” card is gone because the Email card says the same thing. * The AI screen opens with what your AI can do and the two things it needs; the rest is folded. * Caches: “Last cleared … ago” no longer names who cleared it. #### 0.17.1 * Forms: the handler reads only the fields the form itself declares (their names are signed into the form when the page is drawn); anything else posted is ignored. A page cached before this update shows “could not be sent” until its cache is cleared, which the plugin does itself after its own update. * SVG uploads: only for administrators who may publish raw HTML, a file with markup inside a style or title element is refused, and an animation may not target any namespaced href. * “Make these pages” no longer closes comments on posts that already exist; closing them all stays a tick of its own on Settings, Comments. * A site that already has content of its own keeps its comments on when the plugin is first activated; a brand-new site still starts with comments off. * Fixed: with comments off, a block theme still showed a post’s earlier comments. They are hidden there too now, as on a classic theme; nothing is deleted. #### 0.17.0 – 26 Sep 2026 * The PasteTheme menu is regrouped by what people come to do: Setup, Pages & menu, Design, Forms, AI, Search & visits, Settings and Security & people, plus the Switch while another theme left something to move. Setup takes Home’s address, so every old link lands on it. * Setup: seven steps, each with one sentence, a status line and where it lives afterwards, and Coming soon or Live at the top, which reads and sets WooCommerce’s own Coming soon too, so there is one answer. A new site starts live. * The pages picker: Home, About, Services, Contact, Questions and Prices, each with a real starter section, the privacy policy and the shop, each with its own“ In the menu” tick. WordPress’s automatic every-page menu is replaced by the pages you ticked. * Section edges on Setup and Design: straight, a slight curve or a wave, with a live preview in the site’s own colors, light and dark, drawn by the PasteTheme theme. * Forms and AI are screens of their own. Forms holds your contact form, every form on the site, spam protection and whether the last email left. AI holds connecting your AI over MCP, the prompts for your AI, every key on the site with when it was last used, and the switch that keeps AI training crawlers out. * The Form panel left the section sidebar. Pasted forms still send, and the edit- form ability still adds, removes, reorders and renames a form’s fields in place. * A page ticked for the menu joins it when it is published, not while it is a draft, and a page moved to the trash takes its menu link with it and gets it back in the same place when it is published again. * The agent contract moved to docs/AGENTS.md, and the section and agent prompts describe only this plugin. * Settings Privacy gets suggested policy text: what the forms, the visit counter, the login lockout and the email log keep, and the Google Analytics case. * Deleting the plugin removes the Site owner role; a login with that role keeps its account, and reinstalling the plugin gives the role back. * Pictures and video players below a page’s first section load when they are scrolled to; a picture from the media library gets WordPress’s wp-image class, so a phone downloads a smaller copy; a block theme’s pages with no shop content leave out WooCommerce’s classic stylesheets and its jQuery scripts. * No ?author= address names a login any more. #### 0.13.0 to 0.16.0 * Earlier releases: the admin grouped by task, the section library, the MCP server, the image, email, font and shop settings, the rule that stops uploaded files running as PHP (written only when an administrator presses its button), the Switch’s cleanup list (nothing ticked until you tick it), and the answers to … ## Meta * Version **0.25.0** * Last updated **5 ชั่วโมง ago** * Active installations **Fewer than 10** * WordPress version ** 7.1 or higher ** * Tested up to **7.1.3** * PHP version ** 8.0 or higher ** * Language * [English (US)](https://wordpress.org/plugins/pastetheme/) * Tags * [AI](https://th.wordpress.org/plugins/tags/ai/)[contact form](https://th.wordpress.org/plugins/tags/contact-form/) [security](https://th.wordpress.org/plugins/tags/security/)[seo](https://th.wordpress.org/plugins/tags/seo/) [site setup](https://th.wordpress.org/plugins/tags/site-setup/) * [Advanced View](https://th.wordpress.org/plugins/pastetheme/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/pastetheme/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/pastetheme/reviews/) ## Contributors * [ chattanoogatshirt ](https://profiles.wordpress.org/chattanoogatshirt/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/pastetheme/) ## Donate Would you like to support the advancement of this plugin? [ Donate to this plugin ](https://pastetheme.com/support/)