Integrations

WordPress

Connect WordPress to manage posts, pages, media, comments, categories, tags, and users for your site.

API credentialsEcommerce & MarketplacesWordPress API docs

You paste three things into PopMCP: your site's home URL, the WordPress username, and a 24-character application password generated on that user's profile screen.

Setup time
4 min
Auth
API credentials
API base URL
https://example.com/wp-json/wp/v2
Rate limits
WordPress core does not rate-limit the REST API. Any throttling comes from your host or a security plugin.

Before you begin

  • Self-hosted WordPress 5.6 or newer. Application Passwords ship in core from 5.6
  • The site must be served over HTTPS. WordPress hides the Application Passwords section on non-SSL sites
  • A WordPress user with the role you want PopMCP to act as. Administrator for users and settings, Editor is enough for posts, pages and media
  • The REST API must answer at /wp-json. Some security plugins and hosts disable it or strip Basic auth headers

Get your credentials

Check that the REST API answers

Open https://your-site.com/wp-json in a browser. A JSON response naming your site means the route PopMCP calls is live.

Open this screen →

Open the profile of the user PopMCP will act as

Go to Users in the left sidebar, then Profile for your own account. For a different account click All Users, hover the row and click Edit.

Open this screen →

example.com/wp-admin/users.php
Northwind Journal
Users / All Users

Users

Application passwords belong to one user and inherit that user's role.

All (4)Administrator (1)Editor (2)Subscriber (1)
Add New User
UsernameNameEmailRolePosts
contentbotEdit | DeleteContent Botops@example.comEditor0
ameliaEdit | DeleteAmelia Reidamelia@example.comAdministrator128
newsletterEdit | DeleteNewsletternews@example.comSubscriber0

Application Passwords sits near the bottom of the profile screen, below Account Management.

Create the application password

Scroll to Application Passwords, type PopMCP in New Application Password Name, and click Add New Application Password.

Open this screen →

example.com/wp-admin/profile.php
Northwind Journal
Users / Profile

Profile

Application passwords allow authentication via non-interactive systems, such as the REST API, without providing your actual password.

Application passwords are only available on sites served over HTTPS.
Application Passwords
New Application Password Name
PopMCP
Add New Application Password
NameCreatedLast UsedLast IPRevoke
Old CMS syncCreated by ameliaMar 4, 2026Never-Revoke
Revoke all application passwords

Copy the password before you leave the page

Copy the 24-character value from the green confirmation box, or click Copy, then click Dismiss.

example.com/wp-admin/profile.php
Northwind Journal
Users / Profile

Profile

Be sure to save this in a safe location. You will not be able to retrieve it.
Your new password for PopMCP is:
Application password
wXyZ **** **** **** **** 9f2k
CopyDismiss

The spaces are cosmetic. WordPress accepts the value with or without them.

Paste the three values into PopMCP

Enter your home URL in Site URL with no trailing /wp-json, the login name in WordPress username, and the copied value in Application password. Click connect.

Connect in PopMCP

Open your workspace, choose WordPress in the marketplace, and fill in the connect dialog:

FieldWhat to enter
Site URLtextYour site's home URL. The WordPress REST API lives under /wp-json.
WordPress usernametextThe WordPress user the application password belongs to.
Application passwordsecretWordPress → Users → Profile → Application Passwords. Powers posts, pages, media, and users. Stored encrypted.Encrypted with AES-256-GCM on save and never shown again.

PopMCP verifies the credential against WordPress immediately. On success the connection flips to Verified and its MCP tools are provisioned.

Verify it worked

PopMCP marks WordPress as Connected and names your site, using the title returned by /wp-json. Asking it to list your most recent posts returns real titles from the site.

Troubleshooting

401 Unauthorized on every call

Why: Many Apache and LiteSpeed hosts strip the HTTP Authorization header before PHP sees it, so WordPress never receives the Basic auth credentials.

Fix: Add `SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1` to .htaccess, or the CGIPassAuth equivalent, then reconnect. Also confirm you used the username and not the email address.

The Application Passwords section is missing from the profile screen

Why: The site is not served over HTTPS, or a plugin has used the wp_is_application_passwords_available filter to switch the feature off.

Fix: Install a valid TLS certificate, set WordPress Address and Site URL to https under Settings, General, then reload the profile page.

403 rest_forbidden or rest_cannot_edit

Why: The user behind the application password lacks the capability for that route, for example a Subscriber trying to create posts.

Fix: Generate the application password on an Editor or Administrator account instead, then reconnect.

404 on /wp-json

Why: Permalinks are set to Plain, or a security plugin such as Wordfence or Solid Security is blocking the REST API for unauthenticated probes.

Fix: Set Settings, Permalinks to Post name and save, then allow-list the REST API in the security plugin.

The password stops working after a colleague edits the account

Why: Changing a user's WordPress password does not revoke application passwords, but deleting the row under Application Passwords does.

Fix: Check the Application Passwords table on that user's profile. If the PopMCP row is gone, create a new one and reconnect.

Reference

On this page