How to Turn Off or Control AI Features in WordPress 7.x

To switch off the built-in AI layer in WordPress 7.x for the whole site, add define( 'WP_AI_SUPPORT', false ); to your wp-config.php file. To keep AI but control it, look at Settings > Connectors, check where each API key is stored, and limit who can send prompts with one small filter.

Here is the part that surprises most site owners. When WordPress 7.0 "Armstrong" shipped on 20 May 2026, it added an AI Client to core, and if you paste an API key into the Connectors screen, that key is stored in your database without encryption. The core team says so openly in its own developer note, and a core contributor confirmed in the comments that every plugin on the site can access that setting.

By the end of this guide you will be able to find every AI key on your site, move it somewhere safer or delete it, turn AI off with one line, or keep it for admins only.

What the WordPress AI layer actually is

The AI Client is a built-in piece of PHP that lets plugins send prompts to AI models. A plugin says "I need text" or "I need an image", and WordPress passes the request to a provider the site owner has set up.

Think of it like the electrical wiring in a new flat. The wiring is in the walls from day one, but nothing happens until you plug in an appliance and pay for the power. In WordPress, the "appliance" is a provider plugin plus an API key (a secret password that lets your site use a paid AI service).

WordPress core does not bundle any AI provider. The core team lists three official provider plugins: AI Provider for Anthropic, AI Provider for Google and AI Provider for OpenAI. The 7.0 release post also mentions a separate AI plugin that adds features like image generation and alt text suggestions.

The Settings > Connectors screen is the control room. Each connector shows up as a card with its name, whether its plugin is installed and active, and, for API key connectors, where the key comes from and whether it is connected.

Why this matters: the wiring is present on every 7.x site, even if you never asked for AI. Plugins you already run can start using it the moment a key exists.

Where WordPress looks for a key

When a connector needs an API key, WordPress checks three places in this order:

1. An environment variable (a setting the server passes to PHP), such as ANTHROPIC_API_KEY.
2. A PHP constant in wp-config.php, such as define( 'ANTHROPIC_API_KEY', 'sk-...' );.
3. The database, which is where a key ends up when you paste it into the Connectors screen.

For AI providers, the name follows the pattern {PROVIDER_ID}_API_KEY, so the anthropic provider maps to ANTHROPIC_API_KEY. In the database, the option name follows the pattern connectors_{$provider_type}_{$provider_id}_api_key, for example connectors_ai_anthropic_api_key.

Heads up: a key in the database is masked on screen, but it is not encrypted in the table. Encryption is being discussed in core ticket #64789. Keys set as environment variables or constants are also reachable by third party code, so no location is fully private from the plugins you install.

The master switch

WordPress 7.0 also added a function called wp_supports_ai(). It answers one question: "Is AI allowed on this site right now?"

The logic is simple. If the constant WP_AI_SUPPORT is defined and set to false, the function returns false straight away. If not, it runs the wp_supports_ai filter, which defaults to true.

The official code reference lists this function as used by the connector setup code, by the connector registry and by the AI prompt builder. In other words, the switch sits in front of the parts that matter. At the time of writing (27 October 2026), the reference changelog lists only "Introduced" in 7.0.0, and the 7.1 release post announces no change to AI controls. A user note on the hook page confirms that define( 'WP_AI_SUPPORT', false ); in wp-config.php disables AI globally and overrides the filter.

Before you start

You will be editing the file that holds your database password, so treat it with respect.

• A WordPress site on version 7.0 or newer. At the time of writing (27 October 2026), the current stable release is 7.1.3, released on 6 October 2026 with 7 security fixes and 4 bug fixes.
• Admin access to wp-admin, so you can open Settings > Connectors and the Plugins screen.
• One way to edit files: cPanel File Manager, SFTP, or SSH with WP-CLI (the WordPress command line tool).
• A fresh copy of wp-config.php saved somewhere safe before you change anything.
• A plain text editor. The WordPress docs warn never to use a word processor like Microsoft Word for WordPress files.
• Time: about 10 minutes. Risk level: low, as long as you keep the backup.

Quick tip: if you are still on 7.0.x or 7.1.x below 7.1.3, update first in Dashboard > Updates and click Update Now. WordPress.org recommends installing 7.1.3 straight away because it is a security release.

Heads up: WordPress 7.2 Beta 1 came out on 20 October 2026 and is meant for testing only, not for live sites. Its final release is planned for 8 December 2026. Try these steps on 7.1.3, not on a beta.

Step by step: find and clean up your AI keys

Start here even if you plan to switch AI off. A key in your database is still a secret worth protecting.

Step 1: Open the Connectors screen

Log in to wp-admin and go to Settings > Connectors. This menu path comes from the WordPress 7.0 developer notes; if your version shows it in a slightly different place, look under the Settings menu.

You should see one card per connector. For each AI provider card, note two things: the connection status, and the key source, which tells you whether the key comes from an environment variable, a PHP constant or the database.

Step 2: Decide what to do with each key

You have three honest options for each key you find.

• Keep it in the database if this is a small personal site and you trust every plugin you run.
• Move it to wp-config.php as a constant, so it is not stored in a database table that gets copied into every backup and export.
• Remove it completely if you do not use AI, or if you do not know who added it.

Why this matters: database dumps get emailed, uploaded to staging sites and stored in backup tools. A key in wp-config.php stays in one file you control.

Step 3: Move a key into wp-config.php (optional)

This snippet sets the Anthropic key as a PHP constant. Replace the placeholder with your real key and keep the quotes.

define( 'ANTHROPIC_API_KEY', 'sk-your-key-here' );

Put it on its own line above the comment that reads /* That's all, stop editing! Happy blogging. */. That is also the spot WP-CLI uses by default when it adds a new constant. For other providers, use the same pattern with that provider's ID in capitals, followed by _API_KEY.

After saving, reload Settings > Connectors. The key source on that card should now say it comes from a PHP constant. Because the lookup checks constants before the database, the constant wins even if an old copy is still in the database.

Step 4: Delete the old database copy

If you moved a key or want it gone, remove the stored option too. With WP-CLI over SSH, this command deletes the Anthropic key from the database. Change the provider part of the name if you use a different one.

wp option delete connectors_ai_anthropic_api_key

You should see a line like Success: Deleted 'connectors_ai_anthropic_api_key' option. If you see a warning asking whether the option exists, there was no database copy to delete.

Quick tip: once a key has lived in a database you no longer trust, the safest move is to revoke it in your AI provider's account and create a new one. Deleting it from WordPress does not cancel it at the provider.

How to turn off AI site-wide with WP-CLI

This is the fastest route if you have SSH access. WP-CLI edits wp-config.php for you and places the line in the right spot.

Step 1: Back up wp-config.php

This command copies your config file to a dated backup in the same folder. Run it from your WordPress root folder.

cp wp-config.php wp-config.php.bak-$(date +%Y%m%d)

You should see no output. Run ls and you will see the new backup file next to the original.

Step 2: Add the switch

This command adds WP_AI_SUPPORT as a real boolean false, not the text "false". The --raw flag writes the value as is, without quotes.

wp config set WP_AI_SUPPORT false --raw --type=constant

WP-CLI places new constants before the line /* That's all, stop editing! by default. You should see a success message that says it updated or added the constant WP_AI_SUPPORT in the wp-config.php file.

Heads up: do not drop the --raw flag. Without it, WP-CLI writes the value as a quoted string, and the string 'false' is not the same as the boolean false in PHP. A non-empty string counts as true, so AI would stay on.

How to turn off AI site-wide with cPanel File Manager

No SSH? cPanel File Manager works fine for a one-line change.

Step 1: Open File Manager

Log in to cPanel and open Files > File Manager. Go to the root folder of your WordPress site, which is where wp-config.php lives. For a main domain installed with Softaculous, that is usually public_html; our guide on installing WordPress in cPanel with Softaculous shows where the installer puts the files.

If you cannot see dotfiles such as .htaccess and you want them, click Settings, tick Show Hidden Files (dotfiles) and click Save. You do not need this for wp-config.php itself.

Step 2: Make a backup copy

Select wp-config.php, click Copy in the toolbar, enter a path in a different folder (cPanel does not allow a copy into the same folder), and click Copy File(s). A folder in your home directory, outside public_html, is a good choice.

You should now see wp-config.php in that other folder.

Step 3: Edit the file

Select wp-config.php in your WordPress root and click Edit in the toolbar. If an encoding dialog appears, keep the suggested encoding and click Edit again.

Find the comment that starts with /* That's all, stop editing! and add this line on its own just above it. This is the full line that turns off AI for the whole site.

define( 'WP_AI_SUPPORT', false );

Save the file. The page should reload as normal, and your site should still open in a new browser tab.

Made-up example: Priya runs a small bakery site and her developer once tested an AI plugin on it. She has never used AI since, but Settings > Connectors still shows a connected key stored in the database. She deletes the key in the provider's dashboard, removes the option, adds the one WP_AI_SUPPORT line, and the whole job takes her eight minutes. Priya and her bakery are invented for this guide.

How to keep AI but limit who can use it

Maybe your team likes AI drafting, but you do not want every contributor spending your API credit. The AI Client has a filter called wp_ai_client_prevent_prompt for exactly this. When it returns true, no AI call is made, the support checks return false, and generation returns an error instead.

A must-use plugin (a plugin file that WordPress loads automatically and that cannot be switched off from wp-admin) is a good home for this rule. Must-use plugins live in wp-content/mu-plugins by default.

Step 1: Create the mu-plugins folder

If wp-content/mu-plugins does not exist yet, create it. This command does that over SSH from your WordPress root.

mkdir -p wp-content/mu-plugins

Step 2: Add the rule

Create a file called ai-admins-only.php directly inside wp-content/mu-plugins, not in a subfolder, because WordPress does not load must-use plugins from subfolders. This code blocks AI prompts for anyone who cannot manage site options, which in a standard setup means anyone below Administrator.

<?php
/**
 * Plugin Name: AI for admins only
 * Description: Blocks AI Client prompts for users without the manage_options capability.
 */

add_filter( 'wp_ai_client_prevent_prompt', function ( $prevent, $builder ) {
	return $prevent || ! current_user_can( 'manage_options' );
}, 10, 2 );

Save it. Open the Plugins screen and you should see a new Must-Use section that lists "AI for admins only".

Heads up: must-use plugins do not show update notices and cannot be paused from wp-admin. To remove this rule, delete the file.

How to check it worked

Check the constant with WP-CLI

This command reads the value of WP_AI_SUPPORT from wp-config.php.

wp config get WP_AI_SUPPORT

You should see false on its own line. If you see 'false' with quotes, the value was saved as text; go back and use the --raw flag.

Ask WordPress directly

This command loads WordPress and prints the result of the master switch.

wp eval 'var_dump( wp_supports_ai() );'

You should see bool(false). Before the change, the same command prints bool(true) on a normal 7.x site, unless a plugin already uses the filter.

Check in the browser

• Open Settings > Connectors and note what the cards now show. Behaviour of this screen with AI off may differ between versions, so trust the WP-CLI checks above as your main proof.
• Open a post in the editor and try the AI feature from the plugin you use. It should be missing, disabled, or show an error.
• If you used the must-use plugin, log in as an Editor in a private window and try an AI feature. It should fail, while it still works for an Administrator.

Troubleshooting

The site breaks right after you save wp-config.php

Symptom: a blank page or a PHP error on every page. Likely cause: a typo, such as a missing semicolon, a missing bracket, or curly quotes pasted from a chat app or document. Fix: restore your backup copy, then type the line again by hand using straight single quotes.

AI still works after adding the line

Symptom: wp eval 'var_dump( wp_supports_ai() );' still prints bool(true). Likely cause: the value was saved as the string 'false', or the line sits below the line that loads wp-settings.php, so WordPress has already started before the constant exists. Fix: run wp config get WP_AI_SUPPORT to see the stored value, then move the line above the "That's all, stop editing" comment and make sure false has no quotes.

Connectors still show a key you deleted

Symptom: you removed the database option, but the card still reports a connected key. Likely cause: the key also exists as an environment variable or a PHP constant, which WordPress checks first. Fix: look for a line such as define( 'ANTHROPIC_API_KEY', ... in wp-config.php, and ask your host whether an environment variable with that name is set for your account.

A plugin still shows AI buttons

Symptom: the AI buttons are still visible with AI switched off. Likely cause: the plugin draws its buttons without first asking WordPress whether AI is supported. The core team tells plugin authors to check support before showing any AI interface and to handle errors. Fix: the code reference shows the AI prompt builder itself checks the master switch, so run the wp eval check from the section above to confirm the switch is off, then report the leftover buttons to the plugin author so they add the check.

The must-use rule does nothing

Symptom: Editors can still use AI, and the file is not listed under Must-Use on the Plugins screen. Likely cause: the file is in a subfolder of wp-content/mu-plugins, or the opening <?php tag is missing. Fix: move the file to the top level of the folder and check the first line.

WP-CLI writes to the wrong site

Symptom: the success message appears but the site you are testing does not change. Likely cause: you ran the command from a different folder, and WP-CLI edited that site's config file. Fix: rerun the command with --path pointing to the right WordPress root, then use wp config get WP_AI_SUPPORT --path=... to confirm.

Pro tips and security notes

Turning AI back on is a one-liner too. This command removes the constant, and WordPress then falls back to the filter, which defaults to true.

wp config delete WP_AI_SUPPORT

You should see a success message saying the constant was deleted from the wp-config.php file.

• Protect the accounts that can reach Settings > Connectors. An admin login that can paste or read API keys deserves a second factor; our guide to two-factor authentication in cPanel, Plesk and DirectAdmin covers the hosting panel side.
• Audit your plugin list. Since any plugin can read a site-wide key, every plugin you keep is a plugin you trust with your AI bill.
• Set a spending limit in your AI provider's dashboard. At the time of writing (27 October 2026), the core AI Client note describes no site-level usage limits; a commenter asked for them and the request is tracked as a GitHub issue.
• If AI features slow your editor, our guide on how to improve website speed helps you find the slow parts.

When to ask a developer: if you run a multisite network, if keys are set as server environment variables you cannot see, or if a custom plugin calls the AI Client in ways you do not understand.

The one message worth forwarding

Copy this and send it to whoever looks after your site:

"Hi, our site runs WordPress 7.x, which includes a built-in AI Client. Could you please check Settings > Connectors and tell me which AI keys are connected and where each one is stored (environment variable, PHP constant or database)? Keys stored in the database are not encrypted and plugins on the site can access them. If we are not using AI, please revoke any keys at the provider, delete the stored option, and add define( 'WP_AI_SUPPORT', false ); to wp-config.php above the 'That's all, stop editing' comment. Then confirm that wp eval 'var_dump( wp_supports_ai() );' returns bool(false). Thanks!"

Takeaway: find your keys first, then decide, because one line in wp-config.php turns AI off, but only you can make sure no secret is left behind.