Quick answer
Review what the connector can do and whose account it can affect before authorizing it. A familiar AI interface does not make every third-party tool safe. Prefer a small set of validated website actions over a shared credential that can run arbitrary commands.
Check the website editor and publish boundary
Identify whether the tool edits native content, builder layouts, public files, or hosting settings. Those are different permissions. Require site ownership checks and a limited role; an application password follows that role rather than creating one-page access. Inspect the actual actions, make one reversible draft change, and prove revocation before broader use.
Before you start
Obtain the connector's documentation and identify its operator, authentication, hosting location, data retention, support process, and revocation controls. Know whether it is maintained and whether it is appropriate for your CMS and hosting plan.
What to do
- Check that authorization is per customer and per site. Reject a design that lets one customer select another tenant by changing an ID.
- Look for path and action allowlists, input validation, rate limits, audit records, and clear handling of secret values.
- Require draft or preview operations before publication, along with a backup and recovery strategy for writes.
- Test expired credentials, revoked access, forbidden paths, duplicate requests, and interrupted operations in staging before enabling production use.
Check the result
Record both successful actions and rejected unauthorized attempts. Confirm that disconnecting the app invalidates the underlying authorization, not just the visible chat connection.
If something does not work
If the operator cannot explain scopes, recovery, or isolation, keep the integration disconnected. Use a tested local deployment workflow while the design is reviewed.
Related help
- Review who has access to your website and connected services
- Share website errors with an AI assistant without exposing secrets
- Review an AI-generated website change before deployment
Official references
Reviewed October 31, 2026. Interfaces, vendor availability, and account features can change. Check your current account before making changes.
AI editing guidance and linked workflow documentation reviewed November 2, 2026. Existing video and earlier review history retained.
