Chat CMS
Learn more▾
I built this so a range owner could change his website by asking, instead of digging through WordPress. He can update content, see what changed, and keep track of recurring jobs in one place.
What made it possible
The model is never the security boundary. Every write goes through a server-side validator (scoped CSS only, no scripts or iframes, embed allowlist), deletes can only go to trash and need an explicit confirmation, and the endpoint list is structural, so pages, posts and media are the only things it can reach. The host's bot wall then blocked the Worker's rotating IPs. I proved it with a matched test (same request, only the source IP differed), routed traffic through a small static-IP proxy, and got that IP allowlisted.
Built with
- Cloudflare Workers
- Anthropic tool use
- WordPress REST
- Cloudflare Access
- Airtable