wordpress

WordPress Skill

Authentication Setup

WordPress REST API requires authentication. Ask the user for:

1. Site URL (e.g., https://example.com)
2. Auth method — prefer Application Passwords (WP 5.6+):
   • Users → Profile → Application Passwords → Add New
   • Returns username:app-password — base64 encode for Basic Auth header
3. API base: {site_url}/wp-json/wp/v2/

const headers = {
  'Authorization': 'Basic ' + btoa('username:app-password'),
  'Content-Type': 'application/json'
};

MCP Server Authentication (Recommended)

When a WordPress MCP server is configured, use its tools directly instead of raw HTTP. MCP tools handle auth automatically — no need to manage headers or tokens.

// .mcp.json — example WordPress MCP config
{
  "mcpServers": {
    "wordpress": {
      "command": "npx",
      "args": ["-y", "@anthropic/wordpress-mcp"],
      "env": {
        "WP_URL": "https://example.com",
        "WP_USERNAME": "admin",
        "WP_APP_PASSWORD": "xxxx xxxx xxxx xxxx"
      }
    }
  }
}

Security Best Practices

• Never store credentials in code — use environment variables or .env files
• Application Passwords are scoped to the user's role — create a dedicated API user with minimal permissions
• Rotate Application Passwords quarterly
• Use HTTPS exclusively — never send credentials over HTTP
• Add IP allowlisting in .htaccess or nginx if the API is only called from known servers
• Disable XML-RPC if not needed: add_filter('xmlrpc_enabled', '__return_false');

---

Core Operations

Create / Update a Post

POST /wp-json/wp/v2/posts
{
  "title": "Post Title",
  "content": "<p>HTML or Gutenberg blocks</p>",
  "status": "draft" | "publish" | "private" | "future",
  "date": "2026-03-22T10:00:00",
  "slug": "post-slug",
  "excerpt": "Short summary",
  "categories": [id1, id2],
  "tags": [id1, id2],
  "featured_media": media_id,
  "meta": { "custom_field": "value" },
  "template": "template-name.php"
}

# Update: PATCH /wp-json/wp/v2/posts/{id}
# Delete: DELETE /wp-json/wp/v2/posts/{id}?force=true