[{"data":1,"prerenderedAt":331},["ShallowReactive",2],{"blog-\u002Fblog\u002Frun-wordpress-site-on-autopilot":3},{"id":4,"title":5,"author":6,"body":7,"category":315,"description":316,"extension":317,"meta":318,"modifiedAt":319,"navigation":320,"path":321,"publishedAt":322,"readingTime":323,"related":324,"seo":328,"stem":329,"__hash__":330},"blog\u002Fblog\u002Frun-wordpress-site-on-autopilot.md","How to run your WordPress site on autopilot without losing control","The Talos team",{"type":8,"value":9,"toc":303},"minimark",[10,14,17,22,25,54,57,61,64,71,74,85,88,93,96,99,105,110,113,117,120,123,128,131,135,138,144,155,162,168,171,175,178,184,190,196,202,206,209,297,300],[11,12,13],"p",{},"There is a version of \"automate your WordPress site\" that means enabling auto-updates and hoping. That is not automation, it is deferral. The updates still happen unsupervised, nothing verifies the site afterwards, and when something breaks at 3am you find out from a customer.",[11,15,16],{},"Real automation needs three things that auto-updates do not have: a defined scope, a verification step, and a report. This post walks through how to build that with Talos workflows, and — more importantly — which work is actually worth automating and which is not.",[18,19,21],"h2",{"id":20},"start-with-the-work-that-is-invisible-until-it-fails","Start with the work that is invisible until it fails",[11,23,24],{},"The best automation candidates are checks nobody does because nothing prompts them. On most WordPress sites that list looks like this:",[26,27,28,36,42,48],"ul",{},[29,30,31,35],"li",{},[32,33,34],"strong",{},"Overdue cron events."," WP-Cron only fires on requests. On a low-traffic site, scheduled posts silently miss their slot and queued email never sends.",[29,37,38,41],{},[32,39,40],{},"Autoload pressure."," Every autoloaded option loads on every single request. Nothing in the WordPress admin tells you when that has grown to two megabytes.",[29,43,44,47],{},[32,45,46],{},"Error log volume."," A log that grows tenfold in a week is the earliest warning you get for most problems, and nobody reads it.",[29,49,50,53],{},[32,51,52],{},"Security-relevant plugin updates."," Twelve pending updates, one of which patches an actively exploited vulnerability, and no fast way to tell which.",[11,55,56],{},"None of these are urgent on any given day. All of them are the cause of something urgent eventually.",[18,58,60],{"id":59},"the-three-part-structure-of-a-safe-workflow","The three-part structure of a safe workflow",[11,62,63],{},"A Talos workflow is a prompt, a trigger, and a set of pre-authorized scopes. The scopes are the part that matters most, so start there.",[11,65,66,67,70],{},"When you enable a workflow, it stores the action scopes it is allowed to use. A scheduled run executes inside those scopes and ",[32,68,69],{},"cannot widen them",". It cannot add tools, and it cannot change who the email report goes to. This is what makes unattended running defensible: the worst-case behaviour of the workflow is bounded by something you set in advance, not by how the model behaves on the day.",[11,72,73],{},"For a weekly health check, the scopes are:",[75,76,81],"pre",{"className":77,"code":79,"language":80},[78],"language-text","site:read\nplugins:read\nemail:send\n","text",[82,83,79],"code",{"__ignoreMap":84},"",[11,86,87],{},"That is a workflow which physically cannot change your site. It reads, it summarises, it emails. If you are nervous about automation, this is where to start — and honestly, read-only reporting is where most of the value is anyway.",[89,90,92],"h3",{"id":91},"the-prompt-is-a-brief-not-a-command","The prompt is a brief, not a command",[11,94,95],{},"The instinct is to write the prompt like a script: \"run this, then this\". You get better results describing the outcome and the judgement you want applied.",[11,97,98],{},"Compare these two:",[100,101,102],"blockquote",{},[11,103,104],{},"Check Site Health. Read the error log. Check cron. Email me.",[100,106,107],{},[11,108,109],{},"Check Site Health, overdue cron events, error log volume since last week, and autoload pressure. Summarize anything that changed for the worse and email me the report. If nothing has meaningfully regressed, say so in one line.",[11,111,112],{},"The second gets you a useful report instead of a data dump, because it tells the agent what \"worth reporting\" means. That last sentence is doing real work: without it, you get a full report every week, you stop reading them by week three, and the automation has failed even though it is running perfectly.",[89,114,116],{"id":115},"choose-exception-based-reporting","Choose exception-based reporting",[11,118,119],{},"The single biggest determinant of whether a scheduled workflow stays useful is whether its output earns attention. A report that arrives every Monday saying \"everything is fine\" trains you to ignore Monday emails.",[11,121,122],{},"Ask for silence when nothing is wrong:",[100,124,125],{},[11,126,127],{},"Only email me if something moved materially in the wrong direction.",[11,129,130],{},"Now the arrival of the email is itself the signal.",[18,132,134],{"id":133},"schedules-versus-hooks","Schedules versus hooks",[11,136,137],{},"Talos supports two trigger types, and picking the wrong one is a common mistake.",[11,139,140,143],{},[32,141,142],{},"Schedules"," — once, daily, weekdays, weekly or monthly, in your site timezone — are right for periodic review. Health checks, update triage, content audits, client reports.",[11,145,146,149,150,154],{},[32,147,148],{},"Hooks"," fire on a WordPress action: content published, comment posted, user registered, plugin activated. These are right when the work should happen ",[151,152,153],"em",{},"because something happened",", not on a timer. Comment triage is the obvious case: triaging on posting keeps the queue permanently near zero, where a nightly sweep lets it fill up for 24 hours.",[11,156,157,158,161],{},"One caveat on schedules. Workflows are queued by WP-Cron, so a workflow due at 09:00 runs on the first cron tick at or after 09:00. On a quiet site, that might be 11:20. If timing matters, disable request-driven WP-Cron and point a server scheduler at ",[82,159,160],{},"wp-cron.php"," every minute:",[75,163,166],{"className":164,"code":165,"language":80},[78],"*\u002F1 * * * * curl -s https:\u002F\u002Fexample.com\u002Fwp-cron.php > \u002Fdev\u002Fnull 2>&1\n",[82,167,165],{"__ignoreMap":84},[11,169,170],{},"The workflow queue deduplicates occurrences, so overlapping cron requests will not double-run anything.",[18,172,174],{"id":173},"what-not-to-automate","What not to automate",[11,176,177],{},"This is the part most automation advice skips.",[11,179,180,183],{},[32,181,182],{},"Anything requiring editorial judgement about your business."," An agent can find every post missing a meta description. It should not decide unsupervised what your product page says.",[11,185,186,189],{},[32,187,188],{},"Anything you cannot verify afterwards."," If you cannot tell whether the automation did the right thing, you have not removed work, you have hidden it.",[11,191,192,195],{},[32,193,194],{},"Destructive operations on a schedule."," Plugin deletion, user removal, content purges. Talos classifies these as high impact and gates them behind explicit confirmation for a reason. Automating a confirmation gate away defeats its purpose.",[11,197,198,201],{},[32,199,200],{},"The first run of anything."," Run it manually, read the output carefully, then schedule it. Workflows support run-now precisely so you can watch a run before trusting it.",[18,203,205],{"id":204},"a-sensible-starting-set","A sensible starting set",[11,207,208],{},"If you want a concrete place to begin, these four cover most of the value with almost no risk, because three of them are read-only:",[210,211,212,228],"table",{},[213,214,215],"thead",{},[216,217,218,222,225],"tr",{},[219,220,221],"th",{},"Workflow",[219,223,224],{},"Trigger",[219,226,227],{},"Scopes",[229,230,231,249,267,281],"tbody",{},[216,232,233,237,240],{},[234,235,236],"td",{},"Monday health check",[234,238,239],{},"Weekly, Mondays 09:00",[234,241,242,245,246],{},[82,243,244],{},"site:read",", ",[82,247,248],{},"email:send",[216,250,251,254,257],{},[234,252,253],{},"Update triage",[234,255,256],{},"Weekly, Mondays 08:00",[234,258,259,245,262,245,265],{},[82,260,261],{},"plugins:read",[82,263,264],{},"web:research",[82,266,248],{},[216,268,269,272,275],{},[234,270,271],{},"Error log watch",[234,273,274],{},"Daily, 07:00",[234,276,277,245,279],{},[82,278,244],{},[82,280,248],{},[216,282,283,286,289],{},[234,284,285],{},"Comment triage",[234,287,288],{},"Hook, on comment posted",[234,290,291,245,294],{},[82,292,293],{},"content:read",[82,295,296],{},"comments:moderate",[11,298,299],{},"Only the last one writes anything, and its worst case is a comment left pending.",[11,301,302],{},"Add write scopes later, one at a time, once you have watched the read-only version behave for a few weeks. The point of automation is not to remove yourself from the loop entirely. It is to stop being the thing that remembers.",{"title":84,"searchDepth":304,"depth":305,"links":306},2,3,[307,308,312,313,314],{"id":20,"depth":304,"text":21},{"id":59,"depth":304,"text":60,"children":309},[310,311],{"id":91,"depth":305,"text":92},{"id":115,"depth":305,"text":116},{"id":133,"depth":304,"text":134},{"id":173,"depth":304,"text":174},{"id":204,"depth":304,"text":205},"Automation","Most WordPress maintenance is the same handful of checks done irregularly. Here is how to turn each one into a scheduled workflow with permissions that cannot expand.","md",{},null,true,"\u002Fblog\u002Frun-wordpress-site-on-autopilot","2026-07-14","8 min read",[325,326,327],"\u002Fwordpress-autopilot","\u002Fwordpress-ai-workflows","\u002Fwordpress-maintenance-automation",{"title":5,"description":316},"blog\u002Frun-wordpress-site-on-autopilot","CuAbG4w6GYIOTkaiFmd-GcJinzshz7pwoyrI8Od2nP0",1789114983634]