Adding a large language model (LLM) to a WordPress app can support practical features such as ticket summaries, product-description drafts, content suggestions, document search, and suggested customer replies. The important architectural decision is where the model request runs: keep it on the server, not in browser JavaScript.
In a safer setup, WordPress receives the user’s request, checks permissions and input, calls the LLM provider from PHP, validates the result, and returns only the data the interface needs. This guide walks through that workflow, including a custom REST API endpoint, front-end JavaScript, security controls, and common troubleshooting steps.
Define the feature before writing code
Begin with one specific use case. An administrator might enter a support message and receive a suggested reply, or a store manager might generate a short WooCommerce product description. A focused feature is easier to test and control than an unrestricted chatbot connected to the whole website.
Write down the expected input and output, the users who may access the feature, maximum input and output lengths, and actions the model must never take. If customer or business information is involved, decide which fields can be sent to an external provider and remove unnecessary sensitive data before making the request.
If you are building your WordPress development skills, these resources provide useful background: how to start coding for WordPress and the full stack WordPress development workflow.
Use a server-side WordPress-to-LLM workflow
A typical integration follows this sequence:
- A user submits text through an administrator screen or front-end interface.
- JavaScript sends the request to a WordPress REST API route.
- WordPress checks the nonce, user capability, input length, and request format.
- PHP sends a controlled request to the LLM provider.
- WordPress checks the provider response and returns a limited JSON result.
Keep the provider API key on the server. Do not put it in JavaScript, HTML, shortcode output, or a publicly accessible configuration file. A protected environment variable or secure server configuration is preferable to storing the key in the WordPress database when your hosting setup supports it.
Create a custom REST API endpoint
The following simplified plugin example shows the main safeguards: a capability check, input sanitization, a character limit, a server-side key, and a request timeout. Replace the provider URL, request body, and response path with the requirements of your chosen service.
<?php
add_action( 'rest_api_init', function () {
register_rest_route( 'my-ai/v1', '/draft', array(
'methods' => 'POST',
'callback' => 'my_ai_create_draft',
'permission_callback' => function () {
return current_user_can( 'edit_posts' );
},
) );
} );
function my_ai_create_draft( WP_REST_Request $request ) {
$text = sanitize_textarea_field( $request->get_param( 'text' ) );
if ( '' === $text || mb_strlen( $text ) > 3000 ) {
return new WP_Error(
'invalid_text',
'Enter between 1 and 3000 characters.',
array( 'status' => 400 )
);
}
$api_key = getenv( 'MY_LLM_API_KEY' );
if ( ! $api_key ) {
return new WP_Error(
'missing_api_key',
'The AI service is not configured.',
array( 'status' => 500 )
);
}
$body = array(
'model' => 'your-model-name',
'messages' => array(
array(
'role' => 'system',
'content' => 'Write a concise, helpful support reply. Do not invent facts.',
),
array(
'role' => 'user',
'content' => $text,
),
),
);
$response = wp_remote_post( 'https://api.example.com/v1/chat', array(
'timeout' => 30,
'headers' => array(
'Authorization' => 'Bearer ' . $api_key,
'Content-Type' => 'application/json',
),
'body' => wp_json_encode( $body ),
) );
if ( is_wp_error( $response ) ) {
return new WP_Error( 'llm_request_failed', 'The AI request failed.', array( 'status' => 502 ) );
}
$status = wp_remote_retrieve_response_code( $response );
$data = json_decode( wp_remote_retrieve_body( $response ), true );
if ( $status < 200 || $status >= 300 || empty( $data['output'] ) ) {
return new WP_Error( 'llm_bad_response', 'The AI service returned an invalid response.', array( 'status' => 502 ) );
}
return rest_ensure_response( array(
'draft' => sanitize_textarea_field( $data['output'] ),
) );
}This is a starting pattern rather than a complete production plugin. LLM providers use different endpoints, authentication methods, request formats, and response structures. Confirm each detail in the documentation for the service you select.
Connect the WordPress interface
An administrator screen or front-end script can send a POST request to /wp-json/my-ai/v1/draft. For an authenticated WordPress request, include a REST nonce in the header. Do not make the route public unless that is an intentional product requirement and you have added suitable abuse prevention.
fetch('/wp-json/my-ai/v1/draft', {
method: 'POST',
headers: {
'Content-Type': 'application/json',
'X-WP-Nonce': window.myAiSettings.nonce
},
body: JSON.stringify({ text: userText })
})
.then(response => response.json())
.then(data => {
if (data.code) {
throw new Error(data.message || 'Request failed');
}
document.querySelector('#ai-result').textContent = data.draft;
})
.catch(error => {
document.querySelector('#ai-result').textContent = error.message;
});Enqueue the script with wp_enqueue_script() and pass the nonce with wp_localize_script() or another supported WordPress method. Use textContent when displaying generated text. If the interface must display HTML, use a narrowly defined sanitization process rather than inserting model output directly into the page.
Add security, privacy, and cost controls
Protect the endpoint
Enforce capabilities on the server even when the interface hides the feature from certain users. Validate the request body, reject unexpected fields, limit input size, and consider rate limiting by user or IP address. Logs should record useful status information without exposing API keys, passwords, payment data, private customer messages, or complete sensitive prompts.
Treat model output as untrusted content
An LLM can produce inaccurate or misleading text. Treat its response as a draft, particularly for support, legal, medical, financial, refund, and order-related workflows. An approval step should come before publishing or sending generated content to customers.
If the model needs WordPress data, send only the fields required for the task. Never treat model output as a trusted command that can directly change posts, orders, user accounts, or site settings without separate validation and authorization.
Plan for failures and usage limits
Account for timeouts, invalid JSON, provider errors, quota limits, and temporary outages. Return a clear message to the user and provide a controlled retry option. Avoid exposing raw provider errors or internal configuration details in public responses. Input limits, access restrictions, suitable caching, and usage monitoring can also help prevent unnecessary requests.
Test the integration on staging before deploying it to a live site. The guide to creating a WordPress staging copy in cPanel explains one way to test changes without risking the production website.
Troubleshoot common integration problems
- 401 or 403 errors: Check the server-side key, authorization header, provider account permissions, and endpoint.
- WordPress REST errors: Confirm the route namespace, HTTP method, nonce, capability, and rewrite configuration. See the guide to fixing WordPress REST API errors.
- Empty responses: Inspect the decoded response and verify that your code uses the provider’s current output structure.
- Slow requests: Remove unnecessary prompt content, set a reasonable timeout, and consider a background job for longer operations.
- Unsafe or unexpected HTML: Return plain text where possible. Escape or sanitize the result according to the context in which it will be displayed.
When should you hire a WordPress developer?
A small, private administrator tool may be manageable if you are comfortable with PHP, JavaScript, and WordPress hooks. Professional help becomes more valuable when the feature involves customer-facing access, WooCommerce orders, subscriptions, document retrieval, asynchronous processing, audit logs, role-based permissions, or production monitoring.
A developer can plan the data flow, build a maintainable plugin, connect the REST API, protect credentials, integrate the feature with an existing store or dashboard, and test failure cases before launch. If you need broader WordPress support, compare the workflow in this guide to finding the right WordPress developer.
Frequently asked questions
Can I call an LLM directly from WordPress JavaScript?
A browser can technically make the request, but exposing the provider key would allow other people to copy and misuse it. A server-side WordPress endpoint keeps credentials and validation under your control.
Can an LLM automatically publish WordPress posts?
It can be connected to a publishing workflow, but automatic publication deserves strict controls. An approval queue is usually safer because generated content may contain errors or unsupported claims.
Should the integration be built as a plugin?
A custom plugin is generally easier to maintain than placing substantial integration code in a theme or page-builder snippet. It keeps the feature separate from the site’s presentation layer and makes testing and future replacement easier.
How can I reduce unexpected LLM costs?
Limit input length, restrict access, avoid duplicate requests, cache results where appropriate, and monitor usage. Make sure failures do not trigger unlimited automatic retries.
Conclusion
The safest way to integrate an LLM in a WordPress app is to keep the provider request on the server, protect the REST route with WordPress permissions and nonces, validate inputs and responses, and treat generated text as untrusted draft content. Start with one well-defined feature, test it on staging, and add usage controls before launch.
For a custom plugin, membership site, support dashboard, or WooCommerce store, a carefully designed integration can connect AI assistance to existing workflows without exposing credentials or giving the model unnecessary access to your site.