How it works
You drop a saved HTML file (or a built static bundle) into wp-admin. The plugin sandboxes it, hands it a typed bridge to the posts, pages, and users you approve, and renders it however the app's manifest asks for: a dedicated URL like your-site.com/apps/calculator, a Gutenberg block inside a post, an Elementor widget, or your site's home page.
The short version
Free hosts 1 active app, no card, no expiry. Pro ($149.99/yr) lifts the cap and adds CLI deploy plus the in-admin AI builder.
01 · Think of it like this
Chrome is the runtime for browser extensions. Figma is the runtime for Figma plugins. With DesignSetGo Apps installed, your WordPress site becomes the runtime for DSGo apps: loading them, sandboxing them, owning auth, and feeding them site data through a typed bridge.
Runtime
Runtime
Runtime
02 · The bundle, install, runtime flow
Whatever your build emits (HTML, JS, CSS, WASM) plus
dsgo-app.json. The starter is Astro + TS; React, Vue, Svelte, Solid,
vanilla, anything that builds to static files.
The admin sees the app's requested capabilities, rendering mode, and network policy in plain English before the install completes.
inline · Network: sandboxed
Or as a Gutenberg block, an Elementor widget, or promoted to your site's home page.
The bridge handles auth and REST behind the scenes; your app just calls dsgo.posts.list().
03 · Two isolation modes
Same bundle format. Same bridge. Different rendering. Apps declare which they want in the manifest.
App renders as a real WordPress page with strict per-request CSP,
install-time and render-time HTML sanitization, multi-page routes via the manifest's
routes array, optional theme header/footer wrap, and automatic sitemap inclusion.
Crawlable, indexable, fast.
{
"isolation": "inline",
"routes": ["/", "/about", "/pricing"],
"theme": { "wrap": "full" }
}
App renders inside an iframe sandbox without allow-same-origin,
giving it an opaque origin. Single-page, not crawlable, but
ideal for drop-in Claude artifacts and apps that want the strongest isolation guarantee.
{
"isolation": "iframe",
"title": "Recipe poll"
} 04 · Apps become content
Once installed, an app is not locked to its /apps/{slug} address. You can drop it into any post or page as a Gutenberg block, paste it anywhere with the [dsgo_app] shortcode, or drag it into an Elementor layout. Same bundle, same sandbox, same bridge, no extra configuration.
Dedicated URL
your-site.com/apps/{slug}
The default. Shareable, linkable, sitemap-indexed in inline mode. Works as a standalone tool, a member portal, or a full multi-page experience.
Gutenberg block or shortcode
DSGo App block or [dsgo_app] shortcode
Insert from the block inserter or paste the shortcode. The app can read the post it lives in, so a calculator on a product page pulls that page's data automatically.
Elementor widget
DesignSetGo App widget
The widget appears in the Elementor panel. Drag it into any column, section, or popup. Works with Elementor Free and Pro, no shortcode required.
05 · The bridge and permissions
Apps never see a REST token. The parent calls REST on their behalf with permission checks in one place. The manifest declares what the app needs; the install dialog shows the admin a plain-English summary, not a flat list of permission strings.
The free tier is read-only by default: posts, pages, and the current user. Write methods and ai.prompt are Pro. Your AI provider API keys never leave your site; they live in the WordPress Connector your admin configured. WordPress calls your provider through that Connector, and DSGo never holds, sees, or charges for your keys.
// no REST token, ever
const posts = await dsgo.posts.list({
type: "rates",
status: "publish",
per_page: 12
});
const me = await dsgo.user.current();
const draft = await dsgo.storage.app.get("draft");
// scheduled work is declared in the manifest,
// not registered at runtime:
// "scheduled": { "jobs": [
// { "name": "refresh-rates", "schedule": "daily" }
// ]}
// then handled in code:
dsgo.scheduled.on("refresh-rates", async () => {
const updated = await dsgo.posts.list({ since: "1d" });
await dsgo.storage.app.set("cache", updated);
}); Seven permission buckets
06 · The stack underneath
DSGo is an orchestration layer on top of WordPress core APIs. The site admin sets up an AI provider (Anthropic, OpenAI, Google) once in Settings then Connectors; every DSGo app inherits it. We never hold credentials. We never pay for inference.
WP 7.0
Site admin configures Anthropic, OpenAI, or Google credentials once. Every plugin using WP AI Client inherits them.
WP 7.0
Provider-agnostic PHP API. Plugins call wp_ai_client_prompt(); the user's Connector handles the call.
WP 6.9 and 7.0
wp_register_ability() exposes AI-callable functions. DSGo apps can both invoke them and publish their own.
Ready to read code?
The CLI scaffolds a starter with the typed bridge wired up and a CLAUDE.md documenting every method. designsetgo apps init --astro adds Astro for multi-page apps.
$ npm i -g @designsetgo/cli $ designsetgo apps init my-mortgage --astro ✓ scaffolded · 12 files · 5 kB $ designsetgo apps deploy --site example.com ✓ live at example.com/apps/my-mortgage └ permissions: read_content, send_messages