AI built my WordPress plugin. Here’s what worked – and what went wrong (building an app with AI, part five)
Red-gate.com·July 20, 2026
AI Summary
A developer used AI to build a WordPress plugin for their app, discovering both successful implementations and significant challenges like broken GitHub Actions pipelines. The experience revealed practical limitations of AI-assisted development when handling complex technical tasks like plugin creation and deployment automation.
Building a WordPress plugin was never part of Grant Fritchey’s comfort zone — but that’s the whole point of this series. In Part 5 of his AI-driven app build, Grant uses Microsoft CoPilot and GitHub Copilot to generate a working WordPress plugin for dbRosetta almost entirely through prompts. By the end, there’s a live, searchable web page – but also a growing list of lessons about what AI can – and can’t – do on its own.
Once again, this part of the series takes me into unfamiliar territory. I’ve never built a PHP plugin or a WordPress page…but that’s exactly what AI is for. So, let’s get into it.
This is the fifth part of Grant Fritchey’s series on building an app and database almost entirely through an LLM. The repo, including every prompt, lives on GitHub.
For anyone new here: I write prompts to Microsoft CoPilot (the paid version, running on my desktop), which then generates a prompt for Visual Studio (VS) Code and the GitHub Copilot agent.
There’s supposed to be a strict prompt structure we agreed on at the start of the series, but MS CoPilot keeps forgetting it. I’ve found that the more you try to correct AI on a given path, the more it drifts towards hallucination — so I’ve stopped fighting it, and just try to be more explicit upfront.
Please generate the necessary prompt for VS Code to create the WordPress application for dbRosetta. Include clear steps for any manual work, since VS Code can’t access my WordPress environment directly.
Start with just the page to read from the dbRosetta database — no admin UI or data entry yet. Keep it simple. Allow users to define a search term for a given database.
Results may include multiple terms and explanations, as supported by the current database design. Ensure there’s no possibility of SQL injection and that we’re making a secure connection to the Azure-hosted API.
Context: You are an expert WordPress plugin developer. Implement a minimal, secure plugin that allows a WordPress site to query the dbRosetta API (hosted in Azure) and display results.
The plugin must: provide a search form where users can enter a term and select a database; send the query securely to the API (HTTPS and JWT/OAuth tokens); display multiple terms and explanations returned by the API; prevent SQL injection by validating and sanitizing all user input; and be simple — no admin UI or data entry at this stage.
Full story reconstructed from Red-gate.com. Formatting and media may differ from the original.
Deliverables include a plugin folder at wp-content/plugins/dbrosetta/, a main plugin file with shortcode registration, an API client class, search form and results templates, and clear manual installation steps.
(Full prompt in the GitHub repo: https://github.com/ScaryDBA/dbRosetta)
The articles are all my own writing, but I do show some AI responses throughout. Those will always be clearly marked, so you’ll know which is me, Grant (nominally human), and which is the large language model (LLM).
With the prompt pasted in, VS Code didn’t ask a single question — it just generated a complete WordPress plugin. Per my instructions, it also listed the next steps I needed to take manually.
I know how to do these steps but, since I want to lean on AI as much as possible, I went back to MS CoPilot and asked it how to copy the plugin folder across to WordPress. It gave me detailed instructions about file permissions, FTP/SFTP, and command-line copying.
Then I looked at WordPress and found a simple “Install Plugin” button. All I needed was a .zip file. I went back to MS CoPilot and it confirmed as much:
“Yes — that’s actually the most straightforward way to install a custom plugin you’ve built in VS Code.”
Which then begs the question: if it’s the most straightforward way, why didn’t it lead with that in the first place?
This is something I keep running into. It’s not just about giving AI the right context and prompt. After all, MS CoPilot did know we’re working in WordPress, and knew we had a plugin ready. But when I asked “how do I copy the folder?”, it answered exactly that question — and nothing more. It couldn’t step back and say “actually, here’s what you should really do.” It just goes: “OK. Here we go. WHOOP.”
Regardless, I now have a plugin installed and activated. I liked the credit line it gave itself: “By dbRosetta Team.” Ha — me (Grant) and two AIs!
Now, time to get the JWT setting, whatever that is…
Unbeknownst to the AI (but not to me – I already knew), the GitHub Actions deployment had been failing. When we went to get the JWT (JSON web token), VS Code discovered the deployments weren’t running — and also that they were only triggered on the Part 5 branch. We had to go back to that branch to start fixing things.
This kicked off a long back-and-forth session. I was copying and pasting error messages. The AI was updating and modifying scripts. First, the linting was so strict it was failing chunks of the generated code and, rather than fix the code, the AI loosened the lint rules – a classic development move!
Then, the other undertested code surfaced more issues. It was a long one. But after many iterations and several code updates (the AI doesn’t always remember prior context when generating new code), we successfully deployed the API to Azure.
Now, let’s get to testing the plugin. First: the dbRosetta web page.
Setting up the web page was almost comically simple. I created a new page, added [dbrosetta-search] to it, tested the URL, and it loaded. Done! I have a functional web page built almost entirely by AI.
Unfortunately, though, I hate how it looks. This was my first real view of what the user interface (UI) prompt produced. We’ll iterate. But first, let’s test the search…
<BOOM> Error. Here’s how the AI handled it:
“OK. The page loaded and the dbRosetta plugin was visible. When I typed in a search term, I got this error: body/filters must be object” The WordPress plugin is using the wrong API request format. Let me check the API client code and fix it… I see the issue. The plugin is sending filters as an array, but the API expects an object (key-value pairs)… The field is canonicalTerm, and filters should be an object. Let me fix the WordPress plugin.”
Once prompted with the error, it diagnosed the problem, read the relevant files, and fixed the code. It just couldn’t remember what it had built without being nudged. I updated the plugin and, this time, it worked.
I’m calling this a success. Yes, there was pain. Yes, you can’t just let the AI run without input, hand-holding, guidance, and the occasional smug “I told you so” feeling. But it did the job — and did it pretty well.
There’s work ahead. I need to refactor the UI to make it actually correct — right now it should let you specify where a term is from, and return results either for all databases or a selected one. I also want the AI to load up the test data.
Ahead of the next steps, I have to answer the question: should I let the AI decide what to build next to make this a fully functional application? Or do I wait to see if anyone wants to start issuing pull requests?
AI answers the questions you ask – not the ones you should have asked.When I asked how to copy a plugin folder, MS CoPilot gave me a detailed FTP walkthrough. The simpler answer — just zip it and use WordPress’s built-in upload — was never mentioned until I stumbled across it myself. It can’t reason around your question to a better solution.
Context doesn’t persist the way you’d hope.The AI forgot what it had built, introduced a format mismatch between the plugin and the API, and only diagnosed it correctly once I fed it the error message. It then fixed it quickly — but it needed the prompt.
The deployment pipeline will bite you when you least expect it.A failing GitHub Actions workflow quietly sat there until mid-build. Having a test scaffold in place made fixing it far less painful than it could have been.
Getting something working is fast – but getting it right takes longer.A functional web page in minutes is genuinely impressive. But “functional” and “correct” aren’t the same thing — the UI still needs a refactor, and the data isn’t loaded yet.
The junior developer analogy keeps proving itself. AI is fast, capable, occasionally forgetful, and very literal. Bottom line: you still need someone experienced in the room.
At this stage, dbRosetta has moved beyond its foundation of schema translation and API design into the practical challenge of presenting those capabilities through a WordPress plugin and web interface. While this step has pushed the project into less familiar territory, it marks an important milestone: the toolkit is no longer just a backend service, but something contributors and users can interact with directly.
The work so far has established a reproducible path from database migration scripts to a functioning plugin, and although there are still refinements ahead, the project now stands as a tangible, teachable reference implementation that bridges CI/CD workflows with accessible front-end integration.
This document contains proprietary information and is protected by copyright law.
