內容簡介
PasteTheme 將 WordPress 轉變為真正的商業網站，而非單純的部落格。用戶只需勾選所需頁面，便可一鍵生成，並可輕鬆編輯內容。此外掛內建聯絡表單、電子郵件測試及搜尋引擎優化功能，讓小型網站的建立變得簡單且高效。
【主要功能】
• 一鍵生成商業網站所需頁面
• 內建聯絡表單及電子郵件測試功能
• 搜尋引擎優化設置
• 支援多種 Google 字型
• 自動將圖片轉換為 WebP 格式
• 簡化的網站設置流程
外掛標籤
開發者團隊
原文外掛簡介
PasteTheme turns WordPress into a real business website, not a blog. Tick the pages you want and one click makes them. Ask ChatGPT, Claude or Gemini for a section, paste what it writes, and click any word or picture to change it. The contact form sends, email can be tested, search settings and security are set from the start, and any AI can connect safely. No page builder, and far fewer plugins to buy, update and keep track of.
Everything a small site needs, built in
A contact form that sends. Paste any form your AI writes and it is emailed to you, with the sender as reply-to. A hidden trap field, a fill-time check and a flood guard are always on, and Cloudflare Turnstile joins them when you paste its two free keys. The Forms screen puts a ready-made contact form on any page in one click.
Email you can check. A test button, and a list of the last fifty emails the site tried to send and whether each one left (never the message itself).
Found on search engines. A search title, a description and a hide-from-search switch on every page, the picture a shared link shows, and hidden pages left out of the sitemap.
Your look on one screen. Logo, colors and fonts in light and dark, four ready-made looks, three header and three footer layouts, section edges, and boxes for your Facebook, Instagram, LinkedIn, YouTube, X and TikTok addresses that fill the footer’s social icons.
Any Google font, served from your site. A font your AI asks for is offered on Design: one click downloads it into your own uploads folder, so visitors load nothing from Google.
Lighter photos. New JPEG and PNG uploads are saved as WebP as well, and oversized originals are shrunk.
A shop when you want one. “Add a shop” installs WooCommerce from wordpress.org and hands over to its own store setup.
Visits without cookies. A private counter that never records who visited.
One place to run it. Setup walks you through seven steps, from your site’s name to going live, with Coming soon or Live at the top. Clear caches is one click from the admin bar.
A real website in one click
Tick the pages you want: Home, About, Services, Contact, Questions, Prices, the privacy policy. Each arrives with a real starter section, and Home becomes the front page. Twelve ready-made sections wait in the editor’s inserter, from heroes and services to prices, questions and a contact form.
Copy. Paste. Website.
The prompts are already written. The AI screen has a section prompt and an agent prompt. Add your business and what the section should say; the prompt already teaches your AI the rules.
Paste, then edit only your words. Paste the code onto a drop zone (or press Ctrl+V on an empty one). Headings, text, list items, captions, images, buttons and videos become fields you click and change. Everything else stays exactly as pasted: WordPress itself refuses to move, remove or insert anything inside the section.
Your site’s look, in every section. A pasted section keeps its markup, stored in the page the way a Custom HTML block is stored; the front end prints it through wp_kses with the plugin’s allow-list. Its look comes from the plugin’s own stylesheet through a fixed set of class names the section prompt teaches your AI (columns, cards, steps, price plans, questions, forms, buttons, icons, videos and more), in your colors, light and dark.
Clean by default. Scripts, style elements, style attributes, stray iframes, inline event handlers, meta and base tags, external form actions and HTML comments are removed on paste, each with a short warning. The plugin stores and prints no CSS or script from a section and has no box for either.
A new design is one paste away. Paste over a section and the whole section is replaced; the old version stays in the page’s revisions.
Safely connect any AI
The AI you already use. ChatGPT, Claude, Gemini or any AI that writes HTML. No credits to buy.
Connect over MCP. MCP is how AI assistants such as Claude and ChatGPT connect to a website. The AI screen gives this site’s address and a “Make a key for my AI” button that opens WordPress’s own Authorize Application screen, where you approve the connection and WordPress makes the key. A key made this way changes the site’s content through PasteTheme’s own tools, never its administration.
Two switches. “Let an AI connect” (off on a new site) and “Safe mode” (on for a new site: an AI changes words and pictures; a new section for a page that is on the site waits as a revision for you to approve; a new page, a page’s details or a ready-made site is refused with a note).
See what your AI did. The AI screen lists the last hundred calls your keys made, what each one touched, and whether it was done, failed or refused.
Built for agents too. Sixteen abilities on the WordPress Abilities API, described in docs/AGENTS.md, and the same abilities as an MCP server at /wp-json/pastetheme/mcp on your own site.
Updated regularly, and you see what changed
New features and security fixes arrive in regular updates. What’s new on Setup shows what each update brought, with its date and with new features and security fixes marked. One button turns on WordPress’s own automatic updates for every plugin, theme and WordPress itself.
Fast on every page
No jQuery, no CSS framework, no page builder: nothing loads that a page does not use, and pictures below the first screen wait until they are scrolled to. pastetheme.com is built with PasteTheme: on a phone, 15 of its 18 pages score 100 on Google PageSpeed Insights and the other three 99 (tested 30 September 2026; your score depends on your host, plugins and pictures).
Right on every phone
Sections that fit any screen. The section classes stack and resize with the screen, so a section pasted on a desktop already fits a phone.
Preview at every size. See a page at four widths at once (wide desktop, laptop, tablet and phone), or at any width from 320 to 2560 pixels, from Pages & menu or the editor’s Preview menu.
Security built in, free
The usual weak spots, closed. Security headers, generic login errors, no user listing over REST, ?author= or oEmbed, no file editor, no pingback or version headers, XML-RPC off.
Password guessers locked out. Five failed attempts from one address lock it out for fifteen minutes.
Files that do not belong. Switch it on (Security & people; off until you do) and once a day the site compares WordPress’s own files and every wordpress.org plugin’s files with the lists wordpress.org publishes, and emails you the day something new appears. Two alerts are on from the start and ask no other server: a new administrator, and a new application password for someone who can edit the site.
A checkup in plain words. Setup’s Go live step lists what is easy to get wrong, such as a placeholder site email or automatic updates off, each with the one thing to do.
Two-step login in one click. Security & people installs the Two Factor plugin from wordpress.org.
A client-proof editor
Add your client on WordPress’s own Users → Add User screen with the Site owner role (the card on Security & people says how, with a button to it). They can change every word, picture and button; they cannot paste, move, delete or restyle a section, and never see the settings.
Switch from any theme
The Switch screen moves a site you already have in four steps: it activates the theme, carries over your logo, menu, search titles and mail settings, then lists the plugins whose jobs PasteTheme now does. Nothing is removed until you tick it.
Yours to keep
Your words and pictures are ordinary HTML in the page: switch the plugin off and they stay where they are. It works with any block theme and is made for the free PasteTheme theme. Everything works with this plugin alone.
PasteTheme Pro
When you’re ready for more, PasteTheme Pro is the upgrade: 24 plugins in one, from a form builder with an inbox to redirects, popups, sliders, a page cache and your own name on the dashboard. A separate plugin from pastetheme.com. See what it adds: https://pastetheme.com/pricing/
External services
Agents and the MCP server are not an outside service: the abilities and /wp-json/pastetheme/mcp are routes on your own site’s REST API. The plugin runs no server, relays nothing and stores no key for any remote party. An AI client you connect logs in with an application password made for one of your users and gets only that user’s capabilities. A key made from the AI screen is limited further, to the site’s content through the PasteTheme abilities: its only writes through WordPress’s own routes are a picture upload and a named list of settings (the site’s name, tagline, logo and icon and PasteTheme’s display switches); users, plugins, themes, keys, site health, XML-RPC and every other setting answer 403 to it, and for its requests WordPress holds no plugin, theme, user, import or export capability. No ability installs, activates or removes plugins or themes, creates or logs in users, edits code or changes the security settings, and the security settings are not on the REST settings endpoint.
The “Make a key for my AI” button is not an outside service either. It opens WordPress’s own Authorize Application screen on your own site (wp-admin/authorize-application.php); after you approve, WordPress makes the key and, with JavaScript on, sends it back to the AI screen after the # in the address, a part browsers never send to any server (without JavaScript it arrives in the query, and the AI screen drops it unread). The plugin never makes, stores, logs or sends it.
This plugin contacts an outside service only in the cases below: three start with an administrator’s click, the others only after you add Google Analytics, switch on the daily file check or a video switch, or paste Cloudflare Turnstile keys. Nothing else here contacts an outside service, and the plugin adds nothing from another site to your pages unless you add that Google Analytics id, a video or those keys. Clear caches asks any caching plugin it finds to empty its cache, and some, such as Cloudflare’s, contact their own service to do it.
Google Fonts: when you add a font on the Design page (or accept one a pasted section asked for), the plugin asks fonts.googleapis.com which files that family needs, then downloads those files from fonts.gstatic.com into wp-content/uploads/pastetheme/fonts on your own site. It sends the font’s name and, with the downloads, your site’s address in WordPress’s browser identifier; nothing about you or your visitors. The Switch screen’s carry-over does the same for the old theme’s body and heading fonts. Only when an administrator clicks, never on a page visit. Google Fonts terms: https://developers.google.com/fonts/terms · Google privacy policy: https://policies.google.com/privacy
WordPress.org, to install a plugin: two buttons, Two-step login (the Two Factor plugin, on Security & people) and Add a shop (WooCommerce, in Setup’s Sell online step), install and switch on another plugin from wordpress.org through WordPress’s own installer; ticking Shop in the pages picker on Pages & menu and pressing “Make these pages” installs WooCommerce the same way, and the tick says so. Each runs only when an administrator clicks: WordPress asks api.wordpress.org for the plugin by its name and downloads it from downloads.wordpress.org, sending what every WordPress install request carries (your WordPress version, language and site address). WordPress.org privacy policy: https://wordpress.org/about/privacy/
Google Analytics: if you paste a Google Analytics 4 Measurement ID on Settings → Connections & keys, every page loads Google’s tag script from www.googletagmanager.com for visitors who are not logged in; Google Analytics receives their visits (the page, the page they came from, their browser and device details and their network address) and sets its own cookies. Leave the field empty (the default) and nothing is loaded. Google terms of service: https://policies.google.com/terms · Google privacy policy: https://policies.google.com/privacy
Cloudflare Turnstile: only if you paste the two keys of a Turnstile widget on Settings → Connections & keys (empty by default; nothing is loaded until both are in). A page with a form then loads Cloudflare’s check from challenges.cloudflare.com, and when the form is sent (the shop’s account forms and, if switched on under Forms → Spam protection, the login page too) your server asks challenges.cloudflare.com whether a person answered, sending the check’s token, your secret key and the visitor’s network address. Cloudflare terms: https://www.cloudflare.com/website-terms/ · Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/
YouTube and Vimeo: a video in a section plays from www.youtube-nocookie.com (https://policies.google.com/privacy, https://www.youtube.com/t/terms) or player.vimeo.com (https://vimeo.com/privacy, https://vimeo.com/terms). Until play is pressed the page shows a picture: as installed, YouTube’s own thumbnail, which the visitor’s browser asks i.ytimg.com for with the video’s id; on phones and in Safari the player loads once the video scrolls into view. Two switches under Settings, Site features, both off until you choose them, make your server fetch each thumbnail once (from i.ytimg.com; for Vimeo from vimeo.com/api/oembed.json, then i.vimeocdn.com; only the video’s address is sent) and keep it in uploads/pastetheme/video; the second also makes phones wait for the press.
WordPress.org, for the daily file check: only after an administrator switches it on (Security & people → Files that do not belong; off until then), once a day and whenever Check now is pressed, the plugin asks api.wordpress.org for the published checksums of your WordPress version and language and downloads.wordpress.org for the published checksums of each installed wordpress.org plugin, by the plugin’s name and version (kept for a month). Which plugins come from wordpress.org is read from WordPress’s own update check. Like every request WordPress makes, these carry your site’s address in the browser identifier. The comparison happens on your own server, and no file, setting or visitor information leaves it. Switching it off, or deactivating the plugin, stops it. WordPress.org privacy policy: https://wordpress.org/about/privacy/
Setup’s site checks send nothing when Setup opens: the PHP line reads what WordPress’s own Site Health check already saved (core’s api.wordpress.org check, kept a week), and says to open the Dashboard once until it has. The email line looks up your domain’s SPF record (a DNS lookup) only when you press Look up the domain, and keeps the answer a week. “Measure the front page” fetches your own front page and two of its files once, from your own server. None of these sends anything about you or your visitors.
