How a Small Web Studio Uses AI Agents for Website Maintenance (and Where We Draw the Line)

Last week, two critical security flaws in PHP went public. PHP is the language WordPress runs on. By that afternoon, every site we host was protected. By the next afternoon, every one was patched and tested, and the older sites had moved to a supported version of PHP. We wrote up how that went here.

A studio our size doesn’t usually move that fast across dozens of websites. We did it because for the past few months we’ve worked with an AI agent: not a chatbot that answers questions, but an assistant that can actually do the work. It reads server settings, runs tests, compares results and writes up what it found.

Lots of people are curious about this, and some are rightly wary. So here’s what the agent does for us, what it gets wrong, and the rules we use.

What “AI agent” means here

A chatbot answers a question and stops. An agent is given a goal, like “check every site on this server for signs of tampering.” It works out the steps, carries them out with real tools, looks at the results and keeps going. It works much like a sharp junior technician who never gets bored on site number forty.

The difference that matters is that it can act, not just advise. That’s exactly why the rules below exist.

What the agent does for us

Security patching and checks. When the PHP advisory landed, the agent read it and checked every PHP version on our servers. It drafted the workaround, then applied it one site at a time after approval. After each change it checked every site still loaded. When we later moved older sites to a newer PHP, it compared each one against a “before” snapshot. That’s how it caught a site whose homepage was fine but whose inner pages broke because of a one-character typo in the theme.

Monitoring search performance. Every morning, the agent pulls each client’s Google Search Console and Google Analytics numbers into one dashboard. When a client asks “is the new site working?”, we’re not starting from scratch. We can see the trend, and the agent can dig into the details.

Reading the numbers honestly. Dashboards love big numbers. We recently reviewed our own site: Google Analytics counted 14 “key events” (form fills) since our relaunch. The agent went through all 14 one by one. About three were real local leads. Most of the rest were overseas companies pitching their own services. That’s a less flattering number, but it’s the true one, and it changed what we’re working on next.

The tedious SEO work. Every page on a WordPress site should have a target search phrase set in Yoast, the SEO tool most of our clients use. Across several client sites, more than 150 pages had none. The agent proposed a sensible phrase for each page, based on what the page is actually about, and set them. It then filled in the scores that show up as colored dots in WordPress, so each client can see their site’s health at a glance.

Writing it all down. Every change the agent makes is logged: what changed, why, and how to undo it. That record lives in our files, not in anyone’s memory.

What it gets wrong

AI agents are fast and thorough. They are not infallible, and it would be dishonest to pretend otherwise.

Early on, a batch plugin update script reported success on every site. It hadn’t checked enough: the update had quietly switched some plugins off, and the “health check” only asked whether each page loaded at all. A week later, a page on one site showed raw code where a slideshow should have been. We fixed it the same day. The lesson became a rule: after any update, compare which plugins are switched on before and after, and look at the page, not just whether it loads.

The agent can also be confidently wrong about something it can’t see, like assuming a feature is unused when a client depends on it. That’s why the next section exists.

Where we draw the line

These rules aren’t negotiable, for us or for the agent:

1. The agent investigates; a person approves. It can look at almost anything. Before it changes a client’s live site, Rob reads what it plans to do and says yes or no.
2. It never handles passwords. When a login is needed, Rob types it himself. The agent never sees client passwords, and none are stored where it can read them.
3. Look before touching. First passes are read-only. Changes happen one site at a time, never all at once.
4. Back up first, then check after. A backup is made before any change, and the result is compared against a “before” snapshot.
5. Nothing gets deleted by the agent. Suspicious or unwanted files are moved somewhere safe, and a person decides what to delete permanently.
6. The decisions stay human. What your site should say, how it should look and what’s worth doing next are judgment calls. The agent supports those calls; it doesn’t make them.

What this means for our clients

• Faster response when something urgent comes up, like last week’s PHP flaws.
• More thorough checks. The agent tests every page on the list, every time, including the forty-first.
• Plain-English reporting. We can show you what’s actually happening with your site and your leads, not just a traffic chart.
• The same people. You still talk to Rob. The agent works behind the scenes and doesn’t replace the relationship.

Thinking about AI agents for your own business?

The pattern that works for us carries over to almost any business: let the agent do the legwork, and keep a person on the decisions. Start with tasks that are repetitive, easy to check and easy to undo, like reports, audits and first drafts, before anything that touches customers or money.

If you’d like a website that’s looked after this carefully, or you just want to compare notes on putting AI agents to work in a small business, get in touch. We’re always happy to talk shop.