PasteTheme Wordpress Plugin - Rating, Reviews, Demo & Download

PasteTheme Preview Wordpress Plugin - Rating, Reviews, Demo & Download

No ratings yet

Free

Follow for free plugins, new theme releases and theme news

Plugin Description

Give ChatGPT, Claude or Gemini the PasteTheme prompt and ask for a section — a hero, a row of services, a contact form. Paste the code onto a PasteTheme drop zone (or press Ctrl+V on an empty one). The plugin cleans it, gives it your site’s look through its own section classes, and turns every heading, paragraph, image and button into a field you can click and change. Everything else stays exactly as pasted: WordPress itself refuses to move, remove or insert anything inside the section.

Paste, then edit only your words. Headings, text, list items, captions, images and buttons become fields; layout, spacing and code are locked.
A login for the client. Add your client on WordPress’s own Users Add User screen with the Site owner role (the card on Security & people says how, with a button to it): they can change every word and picture, cannot paste, move, delete or restyle a section, and never see the settings.
Re-paste to change the design. The whole section is replaced; the old version stays in the page’s revisions.
Clean by default. Scripts, style elements, style attributes, stray iframes, inline event handlers, meta and base tags, external form actions and HTML comments are removed on paste, each with a short warning.
Updates on their own. One button on Settings ticks WordPress’s own auto-update setting for every installed plugin and theme and for WordPress itself; each can be switched off again on the Plugins and Themes screens.
HTML, styled by the plugin. A pasted section keeps its markup, stored in the page the way a Custom HTML block is stored; the front end prints it through wp_kses with the plugin’s allow-list. Its look comes from the plugin’s own stylesheet through a fixed set of class names that the section prompt teaches your AI: a content box, two columns, cards in balanced rows, numbered steps, price plans, questions, forms, buttons, icons, videos at 16:9, a picture grid, a photo behind the words, figures, round portraits, small labels and three color tones, all in your site’s colors, light and dark. The classes work with any theme, and a pasted section without the plugin’s section class gets it. A style element, a style attribute or a script inside a pasted section is dropped with a warning: the plugin stores and prints no CSS or script from a section and has no box for either.
Setup first, then eight plain pages. Setup walks a new site through seven steps: name your site, choose your pages, pick your look, get messages from your contact form, sell online, switch features on or off, go live. Each step has one button to the screen its setting lives on. Pages & menu, Design, Forms, AI, Search & visits, Settings and Security & people hold the rest, grouped by what you came to do.
Two switches for your AI. “Let an AI connect” (off on a new site) and “Safe mode” (on for a new site: an AI changes words and pictures; a new section for a page that is on the site waits as a revision for you to approve; a new page, a page’s details or a ready-made site is refused with a note).
Coming soon or Live. One choice at the top of Setup: Coming soon shows visitors who are not logged in one plain page with your logo while you build; Live opens the site. A new site starts live.
Pick your pages. Tick the pages you want (Home, About, Services, Contact, Questions, Prices, the privacy policy) and whether each goes in the menu; each arrives with a real starter section, and Home becomes the front page.
Section edges. Straight, a slight curve or a wave where one full-width section meets the next, for the whole site, with a live light and dark preview; the PasteTheme theme draws the shapes.
Working contact forms. Paste a form and it sends: a hidden trap field, a fill-time check and a flood guard, always on, then emailed to you with the sender as reply-to. The Forms screen puts a ready-made contact form on any page in one click, says where messages go, lists every form, and keeps a list of the last fifty emails the site tried to send and whether each left (never the message itself). An AI connected to the site changes a form’s fields in place through the edit-form ability.
Clear caches in one click. WordPress, PHP and every caching plugin or host cache the plugin recognizes, from the dashboard, the admin bar or an agent ability; also after updates.
Faster images. New JPEG and PNG uploads are saved as WebP as well, and oversized originals are shrunk to a sane maximum; nothing you upload is deleted. Pictures below a page’s first section load when they are scrolled to.
Shop-ready. “Add a shop” in Setup’s Sell online step installs and switches on WooCommerce from wordpress.org and hands over to its own store setup; back on Setup the step shows your products, payments and whether the store is open. Pages with no shop on them skip WooCommerce’s classic stylesheets and its jQuery scripts.
Search and sharing, per page. Title, description and a hide-from-search switch, stored as plain post meta with documented names (hidden pages stay out of the sitemap too), and Open Graph and Twitter tags on every page: the page’s share image when one is set, else its featured image, else your logo, else the site icon.
The font your AI asked for. AI-written sections often name a Google font, and the link to Google is stripped on the way in. PasteTheme remembers the name and offers it on the Design page: one click downloads the font into your own uploads folder and serves it from your site, so visitors never load anything from Google.
SVG logos. Administrators who may publish raw HTML can upload SVG files. Each is cleaned first (scripts, event handlers, links that point outside the file), and a file that cannot be made safe is refused with a plain message.
A checkup, in plain words. A short list in Setup’s Go live step of the things that are easy to get wrong: a placeholder site email, automatic updates off, two page caches fighting, mail leaving from the wrong domain, the site hidden from search engines, a host that sends CSS and JavaScript uncompressed. Each line says the one thing to do.
A footer that reads like a footer. Real headings with the links grouped under them, two columns on a phone, and tap targets a thumb can hit.
Your logo on the login page. It links to your home page.
Hardened defaults. Security headers, generic login errors, no user listing over REST, ?author= or oEmbed, no file editor, no pingback or version headers, login lockouts (five failed attempts from one address lock it out for fifteen minutes), XML-RPC off.
Files that do not belong. Switch it on (Security & people Files that do not belong; it is off until you do) and once a day the site compares WordPress’s own files and every wordpress.org plugin’s files with the lists WordPress.org published for them, then looks for code where none belongs (the uploads folder, loose in wp-content), for a settings file that makes PHP run a hidden file first, and for database dumps a browser could download. A count on the menu, a line in Site checks, the list with what to do on Security & people, and an email the same day something new appears. Two email alerts are on from the start and ask no other server: one when a login becomes an administrator, one when an application password is added for someone who can edit the site.
If you ever leave. Your words and pictures are ordinary HTML in the page and never depend on the plugin: switch it off and they stay where they are.
Ready-made sections. Twelve sections in the editor’s inserter (heroes, feature cards, about, services with prices, testimonials, call to action, FAQ, contact form, two prices, a picture grid, the team), each landing as a locked section with editable words on your own colors.
Connect your AI with MCP. MCP is how AI assistants such as Claude and ChatGPT connect to a website. The AI screen gives this site’s address and a “Make a key for my AI” button that opens WordPress’s own Authorize Application screen, where you approve the connection and WordPress makes the key. A key made this way changes the site’s content through PasteTheme’s own tools, never its administration, and with Safe mode on it changes words and pictures only.
Built for agents too. Fifteen abilities on the WordPress Abilities API list, edit and replace sections and make and describe pages, the agent contract ships in the plugin folder as docs/AGENTS.md, and the same abilities are an MCP server at /wp-json/pastetheme/mcp, all on your own site’s REST API.

Works with any block theme. It is designed for the free PasteTheme theme: with that theme active, turning the plugin on makes a starter Home page. Everything described here works with this plugin alone. PasteTheme Pro is a separate plugin from pastetheme.com with features of its own, such as a form builder that keeps every message, redirects, more section edges and more ready-made sections.

External services

Agents and the MCP server are not an outside service: the abilities and /wp-json/pastetheme/mcp are routes on your own site’s REST API, answered by your own WordPress. The plugin runs no server of its own, relays nothing and stores no key for any remote party. An AI client you choose to connect logs in with an application password made for one of your users and gets only that user’s capabilities. A key made from the AI screen is limited further, to the site’s content through the PasteTheme abilities: its only writes through WordPress’s own routes are a picture upload and a named list of settings (the site’s name, tagline, logo and icon and PasteTheme’s display switches), users, plugins, themes, keys, site health, XML-RPC and every other setting answer 403 to it, and for its requests WordPress holds no plugin, theme, user, import or export capability. No ability installs, activates or removes plugins or themes, creates or logs in users, edits code or changes the security settings, and the security settings are not on the REST settings endpoint.

The “Make a key for my AI” button is not an outside service either. It opens WordPress’s own Authorize Application screen on your own site (wp-admin/authorize-application.php); after you approve, WordPress makes the key and, with JavaScript on, sends it back to the AI screen after the # in the address, a part browsers never send to any server (without JavaScript it arrives in the query, and the AI screen drops it unread). The plugin never makes, stores, logs or sends it.

This plugin contacts an outside service in three cases started by an administrator’s click, a fourth only if you choose to add Google Analytics, and a fifth only after an administrator switches on the daily file check. Nothing else here contacts an outside service, and the plugin itself adds nothing from another site to your pages unless you add that Google Analytics id. Clear caches asks any caching plugin it finds to empty its cache, and some, such as Cloudflare’s, contact their own service to do it.

Google Fonts: when you add a font on the Design page (or accept one a pasted section asked for), the plugin asks fonts.googleapis.com which files that family needs, then downloads those files from fonts.gstatic.com into wp-content/uploads/pastetheme/fonts on your own site. It sends the font’s name and, with the file downloads, your site’s address in WordPress’s browser identifier; nothing about you or your visitors. The Switch screen’s carry-over does the same for the old theme’s body and heading fonts, read from that theme’s own settings. It happens only when an administrator clicks, never on a page visit and never on its own. Google Fonts terms: https://developers.google.com/fonts/terms · Google privacy policy: https://policies.google.com/privacy

WordPress.org, to install a plugin: two buttons, Two-step login (the Two Factor plugin, on Security & people) and Add a shop (WooCommerce, in Setup’s Sell online step), install and switch on another plugin from wordpress.org through WordPress’s own installer. Ticking Shop in the pages picker on Pages & menu and pressing “Make these pages” installs and switches on WooCommerce the same way; the tick says so. Each runs only when an administrator clicks: WordPress asks api.wordpress.org for the plugin by its name and downloads it from downloads.wordpress.org, sending what every WordPress install request carries (your WordPress version, language and site address). WordPress.org privacy policy: https://wordpress.org/about/privacy/

Google Analytics: if you paste a Google Analytics 4 Measurement ID on Settings Connections & keys, every page loads Google’s tag script from www.googletagmanager.com for visitors who are not logged in; Google Analytics receives their visits (the page, the page they came from, their browser and device details and their network address) and sets its own cookies. Leave the field empty (the default) and nothing is loaded. Google terms of service: https://policies.google.com/terms · Google privacy policy: https://policies.google.com/privacy

YouTube and Vimeo: a video pasted into a section plays from YouTube (https://policies.google.com/privacy) or Vimeo (https://vimeo.com/privacy), like any embedded video.

WordPress.org, for the daily file check: only after an administrator switches it on (Security & people Files that do not belong; off until then), once a day and whenever Check now is pressed, the plugin asks api.wordpress.org for the published checksums of your WordPress version and language (kept once fetched: a version’s list never changes) and downloads.wordpress.org for the published checksums of each installed wordpress.org plugin, by the plugin’s name and version (kept for a month). Which plugins come from wordpress.org is read from WordPress’s own update check; the plugin does not ask for that itself. Like every request WordPress makes, these carry your site’s address in the browser identifier. The comparison happens on your own server, and no file, setting or visitor information leaves it. Switching the check off, or deactivating the plugin, stops it at once. WordPress.org privacy policy: https://wordpress.org/about/privacy/

Setup’s site checks send nothing when Setup opens. The PHP line reads the answer WordPress’s own Dashboard and Site Health check already saved (core’s api.wordpress.org check, kept for a week); until WordPress has checked, the line says to open the Dashboard once. The email line looks up your domain’s SPF record (a DNS lookup of your own domain) only when you press Look up the domain, and keeps the answer for a week. The “Measure the front page” button fetches your own front page and two of its files once, from your own server. None of these sends anything about you or your visitors.

Screenshots

A home page on the PasteTheme theme, made by “Make these pages” on a new site. Every section is a pasted section.
The editor. A pasted section is locked: its headings, text, pictures and buttons are fields you click and change.
Setup: Coming soon or Live at the top, then seven steps, each with one button to the screen its setting lives on.
Pages & menu: every page, whether it is on the site and in the menu, and the pages picker.
Design: the name and logo, colors, fonts, the header and footer, and the section edges.
Forms: a ready-made contact form, where messages go, every form on the site, and whether each email left.
AI: connect your AI over MCP, the two switches, and the prompts to give it.
Security & people: what is always on, login lockouts, two-step login, a login for your client and the daily file check.
The same home page on a phone.