Revoking access

If an agent is doing something you did not intend, this is the order to work in. Each step is independent — do the first one immediately and work down.

1. Revoke the key or session

Open Agents and revoke the key. It stops working at once; in-flight calls fail. For an MCP client signed in with OAuth, remove the Pressbotics server from that client. If you are not sure which agent it was, revoke all of them and re-issue — the cost is small.

2. Put the site under review

Switch the site to review-everything. Nothing new reaches WordPress without you approving it, which buys you time to work out what happened without disconnecting anything.

3. Disconnect the site

Disconnecting removes the stored credential entirely. No key, on any plan, can then publish to it.

4. Revoke the Application Password in WordPress

This step is the one people skip. Deleting our copy of a credential does not invalidate it at your site. Go to Users → Profile → Application Passwords in wp-admin and revoke the Pressbotics entry.

Then look at what happened

• Activity lists every action with its agent, site, timestamp and outcome.
• Anything published can be reverted in WordPress — switch to draft, or restore a revision.
• Pressbotics cannot manage users, settings, plugins or themes, so the blast radius of a compromised agent is posts you can undo.

If you believe something reached your site that our records do not explain, email info@pressbotics.com.