Nothing says "done" unless it is done (5.1.1 and plugin 5.1.3)
One of our tickets this release carried a line that ended up describing the whole thing: silence reads as success.
When a step can't do its job and says nothing about it, the system takes that quiet as confirmation that it worked.
So we went looking for everywhere Atarim could report "done" without having done the work, and we found four:
- A workflow step that couldn't reach your project tool but still showed Success
- A board move that failed and reported that it worked
- A monthly job set for the 31st that skipped every short month without mentioning it
- A backup that passed every check it was given but couldn't actually restore a site
All four now tell you what really happened, which is the theme of this release.
When Atarim tells you a job is finished, it's finished, and there's a working backup sitting behind it. Here is what all we shipped:
New features
A backup before the AI touches anything
Before Glitch changes files or the database on a WordPress site, he can now set a restore point and track it until it is ready. If a change goes wrong, the site goes back to how it was. This runs through JetBackup on the site. On hosts where the server does not run backups on time, Glitch runs the queue himself. So "ready" means ready.
We learned a rule here. A backup only counts if the tool that would restore it can reach it. A backup at the hosting level with a restore tool in the plugin will pass every check and be useless when you need it. The team knows the difference now.
Before you touch anything, set a restore point for this site covering files and the database, and tell me when it is ready and what it covers.
Or put it on repeat. The Weekly backup and verification workflow checks every site has a recent backup that works, and warns you the moment one is missing. Monthly WordPress update round already backs up first, then updates, then rolls back if something breaks.
Glitch can edit more of your sites, and undo it
Ask Glitch in a task to change something on a page. The plugin now handles Beaver Builder and SiteOrigin pages, along with Gutenberg and Elementor. Block edits are more reliable too. And if you don't like a change, it can be undone.
WP-CLI for the big jobs
Some jobs are too big for a normal tool. A search and replace across the whole database. A full database export. Rebuilding every image size. For these, Glitch can now run WP-CLI commands, in the background when needed. Only admins can ask for it. Every run is logged.
Use WP-CLI to list every installed plugin with its version, whether an update is available and whether it is active, then tell me the database size and the three largest tables.
Index can see AI search now
Index used to stop at Google's ten blue links, but now he can see more:
- Who Google's AI Overview cites, and the exact words it quoted.
- Which sites ChatGPT names for a brand or a search.
- What ChatGPT actually answers, with every source.
- And rank history month by month, so a report can show what moved without you saving the old one.
One rule we made sure of: when a site has no AI coverage, Index says zero and stops. He does not guess.
Using live UK search data, tell me whether this site is cited in Google AI Overviews or mentioned by ChatGPT for nutrition counselling searches, and show me how its rankings have moved month by month over the last year. If there is no coverage, say so plainly rather than estimating.

Swap in your own country. The tools need one.
A brand kit that tells you what it could not read
Paste a client's URL. The brief comes back with colours, fonts, tone and audience. We rebuilt how it reads a site. It reads the pages the brief is about, not just the front page. It picks the colours that cover the most of the page. It no longer treats a cookie-banner button as the brand's call to action. It finds the real logo and fonts.
Then a check runs on the result. If the site was measured before it finished loading, the kit is marked as not trusted, and the status bar tells you. No quiet guesses. If you regenerate a brief, it now tells you which fields came back empty instead of leaving them blank. And if a firewall blocks the read, you get a link to the whitelist guide.
Glitch checks for known security holes
Glitch can now scan a connected WordPress site for known weak spots in plugins, themes and core. He tells you the version you have and the version that fixes it.
Scan this site for known vulnerabilities in its plugins, theme and WordPress core. List each with the affected version and the fix version, and tell me which need patching this week. Only report ones you can confirm against the installed versions.
Or put it on repeat. The Monthly security scan finds weak spots before they become a breach, fixes the safe ones, and flags the rest for you.

Claro can work with InstaWP and rocket.net hosting
Connect an InstaWP or rocket.net account. Claro can then work at the hosting level, not only on the site. He can list sites, check backups, and run actions that wait for your OK. Every write waits for your approval. A run with no one watching only gets the read tools. You can link a project to its rocket.net site by hand. And rocket.net and WP Activity Log now show on the project card.

The smaller ones
- Per-project permissions now have their own screen in Project Settings.
- Plugin updates keep plugins on. Updating through the dashboard, or in bulk, no longer turns anything off.
- One task card everywhere. Boards, Inbox, Chat and the sidebar now show the same card, with subtasks rolled up. There is a new full-width card with actions built in.
- Onboarding rebuilt. Sign up, connect, verify, invite and password screens now share one design. Changing your email partway through sign up no longer locks you out of your own workspace.
Security
- Changing your password now asks for your current password. Before this, anyone with a logged-in session could set a new password, sign the real owner out, and stay in. We found it while re-checking a report from an outside security researcher in May. His finding did not hold up. This one did.
- Sign-up analytics no longer carry raw email addresses or invite and activation tokens.
- Brand values pulled from a crawled site are cleaned before they go into the brand mock. A bad site cannot inject code into your project overview.
- Hosting and connected-account tools are kept away from client roles. A run with no one watching cannot publish theme changes.
Improvements
Silence no longer reads as success
- A workflow integration step that cannot run is marked Skipped, with the reason. One the other tool rejects is marked Failed, with that tool's message. Twenty places across eight integrations used to stay quiet.
- A failed board move now says it failed and puts the card back.
- Monthly schedules set to the 29th, 30th or 31st no longer skip short months in silence.
- Automations that did nothing no longer report success.
Long jobs finish
A long run used to die when the chat got too long. Now a long thread is squeezed into a checkpoint and picked back up. A thread can hold one goal and keep working on it when idle, so multi-step work does not stall waiting for you. Approving something wakes the run that was waiting on it. And each tool has its own time budget, with a nudge if the AI starts going in circles.
WordPress work goes to the right specialist
Page builders, forms, theme files, going live, block themes, hosting and client accounts each have an owner now. Claro no longer promises a button that is not on screen, or an approval step that may not happen. The monthly update round can now update core, themes and major versions, and put the site back if the check after fails. A review pass can now say a finding is wrong.
and
- Stop actually stops. The reply ends the moment you hit stop.
- AI actions cost about a third less than they did in 5.1.0.
- Attachment icon on the task list. Status changes that stick. Custom webhooks that fire from every path. Annotate works on touch screens. The Artifacts page collects properly.
Bug fixes
- Password reset screens clear their messages and show the full password rules. A throttled "send it again" shows a real message instead of a status code. Asking for a reset with an unknown email shows the same success screen as a known one, and the docs now say why: it stops people using the form to find out who has an account.
- Workspace invite rows show their errors.
- Opening the feedback experience without a site shows an invalid-link screen instead of spinning.
- A network failure is no longer reported as "project could no longer be found".
- Editing or deleting the first comment updates the task title.
- Two WordPress connections at once no longer knock each other out.
- JetBackup errors say what went wrong instead of printing "%s".
- Partner dashboard numbers corrected.
- Display names stick instead of falling back to the email address.
- Locked projects hide their tasks. Manually added projects get a thumbnail.
Coming next
Shopify, Cloudways and Cloudflare are built, tested, and behind a staff-only flag. Claro will manage store pages and theme files, run Cloudways hosting, and handle DNS, cache and the other things a project owns on Cloudflare.
Do It with no browser tab. The backend can already edit WordPress blocks directly. So a change asked for from the dashboard can run with no browser open. It is running on our own sites first.
Task screenshots from your own browser. The feedback experience will take the shot from your tab after a one-time OK. That way logged-in pages and moving content make it into the task. Same story: ours first, then yours.
Try any of this on a client site this week and tell me what happened. The good and the bad. That is where the next release comes from. π€





















