Track: Xavier Hall

AI models can generate a functional WordPress plugin in seconds, but “functional” rarely means production-ready. Out of the box, AI tools frequently ignore WordPress Coding Standards (WPCS), miss crucial data sanitization, and write monolithic spaghetti code. If left unchecked, an AI-generated plugin is a security vulnerability waiting to happen.

This session is a deep dive into the rigorous quality control workflows required when building with AI. We will cover the exact prompt engineering techniques and human-in-the-loop review processes needed to force AI models to properly implement nonces, escape outputs, and write modular PHP that passes enterprise-grade security audits. Learn how to trade boilerplate coding for high-level system architecture while keeping your AI tools firmly on the rails of WordPress best practices.

Key Takeaways:

• Identifying the most common security hallucinations and anti-patterns in AI-generated PHP.
• Prompt engineering techniques to strictly enforce WordPress data sanitization and output escaping.
• Automating WPCS compliance checks on AI-generated code.
• Building a bulletproof human-in-the-loop review process for AI output.

AI models and tooling get more capable every quarter. Nearly every organisation uses them, and most people say AI makes them personally more productive. Yet, according to industry surveys, the share of companies that can point to a measurable improvement in their results has barely moved.

I believe the reason is not capability or adoption, but that most companies do not know what to do with AI on an operational level. So it stays where it was easiest to deploy first: individual tasks. An old idea from manufacturing explains what happens next: merely speeding up a step does not raise output, but merely piles up work further down the line.

AI has made individuals faster at writing, coding and summarising. That gain is significant but has mostly plateaued. The constraint for better output has now moved to shared context, coordination and decision-making at an organisational level. This is where AI is barely (or badly!) deployed. The usual steps of mandating more usage and adopting more tools only provide marginal, if any, further improvements. Companies need to go through the same step change at the organisational level that individuals have already been through.

I run two products at work, and I will share what I learned trying to deploy AI into the real bottleneck on my own team: one repo of shared context and organisational memory that any role could point any agent at. What I found echoes the wider industry pattern, and I will bring the data to show it. While I will cover some tooling, this talk is mostly about a few principles I collected over the past year. You will leave with a way to find your own team’s bottleneck and a short list of decisions that move AI onto it.

An AI agent is three things: a goal, a set of tools, and a loop. This talk takes one apart on stage and shows that most of what is inside is code you have already written.

Two thirds of the time is the concepts, in plain terms. The model in the middle never does anything itself. It picks a function and fills in its arguments, and your code does the actual work. In WordPress that means your tools are the REST routes and action hooks you wrote years ago, and the model is a component you can swap out later.

The working example is a WooCommerce store, because it makes the cost obvious. Refunding one order takes six screens: Orders, filter by status, find it, scroll, Refund, line item, quantity, amount, confirm. Anyone who has run a store knows that path by heart. In the last third I replace it with a typed sentence, live: press Cmd-K, type “refund order 1042”, read a preview of what is about to happen, confirm. Then I show the code behind it, which is about a dozen ordinary PHP functions with a JSON schema for each. It is far less impressive than the demo, and that is the point. Nothing in it is specific to commerce; a membership plugin or an editorial workflow is put together the same way.

What you will take away: a working picture of what an agent is made of and how much of it you already own; why the model in the middle is a replaceable part, and what that means when you choose one; how much of the reliability comes from your code rather than from the model, the confirm step included; and an honest account of where this falls over today.

For developers who know WordPress and have not built an agent yet. No AI background needed.

One disclosure: the plugin I demo, Hoobert, is mine. It is free on the plugin directory with no paid tier, and the talk teaches the pattern rather than the plugin. The same code works without it.

Two clients on the same service, from the same team, to the same standard. One renewed. One didn’t. The easy explanation was that the second client was difficult — until we looked properly and found we’d been delivering the wrong kind of value, very well.

Client work falls into five buckets: revenue, efficiency, risk, retention, and foundation. The bucket isn’t about what you build. It’s about what the client is quietly measuring while you build it. Two clients can ask for identical work and judge it against completely different outcomes, and if you haven’t sorted that at intake, you find out at renewal.

This session covers how to classify work when the inquiry arrives, what changes downstream once you have — who does it, what you hand over, what you report — and why foundation work is the one bucket whose expectations have to be set before you start rather than defended after. Built from real projects, including the ones that taught us this the expensive way.

Most small-business websites are open 24/7, but the business behind them is not. When a prospect visits at night, submits an enquiry, or requests a quote, the site often does nothing until someone notices the notification. By then, the opportunity may already be gone. This talk shows how to build one connected WordPress-and-AI system that keeps the commercial engine moving: capturing intent, understanding enquiries, qualifying leads, responding with context, following up, updating the CRM, and bringing the owner in only when human judgement or a buying decision is needed. Using a real-world B2B export workflow as the model, the session will show WordPress as the owned front door, AI as the first-response and qualification layer, and automation as the connective tissue between content, forms, messaging, CRM, and calendars. The focus is not on stacking tools or launching another generic chatbot. It is on designing a system with a clear path from visitor to customer, sensible guardrails, measurable conversion points, and controlled AI spend.

Attendees will leave with a practical blueprint for turning a WordPress site from a digital brochure into a revenue asset that keeps doing the repetitive work while they focus on strategy, relationships, and closing high-value opportunities.

Every agency knows the dread of telling a high-growth client: “We need to freeze content publishing for two months while we migrate.” When one of our customer outgrew Webflow’s strict 300-page limit and rigid URL structures, their marketing team—pushing 120-140 posts a month—couldn’t afford to stop.

Instead of a traditional content freeze, we ran Webflow and WordPress in parallel.

In this session, I’ll walk through the exact architecture we used to perform a seamless migration. We will explore how we used a reverse proxy configuration to serve existing, high-converting marketing pages from Webflow, while simultaneously routing new blog traffic to a highly scalable WordPress environment deployed on AWS. To the user, it was a single, flawless domain; to the client, it meant uninterrupted organic growth.

Join this session to learn how to handle complex, enterprise-level migrations without halting your client’s marketing engine, and how to execute a smooth final cutover.

Learning Outcomes (What attendees will take away) 1. Technical Strategy: How to implement a reverse proxy to run two distinct CMS platforms seamlessly on a single domain. 2. Client Management: How to pitch and execute complex migrations without forcing the client into a restrictive “content freeze.”

What happens when you actually give an AI agent access to your WordPress site?

In this talk, I’ll show what I learned from putting AI agents to work with WordPress. We’ll look at what agents can do, where things start getting weird, and what can go wrong when an AI is allowed to read and modify real content.

I’ll cover things like APIs, MCP, permissions, validation, and human approval, but the focus will be on the practical side: building it, breaking it, and figuring out what actually makes sense.

You’ll leave with a better idea of what WordPress looks like in an agentic world, and how to build AI workflows that are useful without giving an AI the keys to everything.