WordPress
Connect WordPress to manage posts, pages, media, comments, categories, tags, and users for your site.
You paste three things into PopMCP: your site's home URL, the WordPress username, and a 24-character application password generated on that user's profile screen.
- Setup time
- 4 min
- Auth
- API credentials
- API base URL
- https://example.com/wp-json/wp/v2
- Rate limits
- WordPress core does not rate-limit the REST API. Any throttling comes from your host or a security plugin.
Before you begin
- Self-hosted WordPress 5.6 or newer. Application Passwords ship in core from 5.6
- The site must be served over HTTPS. WordPress hides the Application Passwords section on non-SSL sites
- A WordPress user with the role you want PopMCP to act as. Administrator for users and settings, Editor is enough for posts, pages and media
- The REST API must answer at /wp-json. Some security plugins and hosts disable it or strip Basic auth headers
Get your credentials
Check that the REST API answers
Open https://your-site.com/wp-json in a browser. A JSON response naming your site means the route PopMCP calls is live.
Open the profile of the user PopMCP will act as
Go to Users in the left sidebar, then Profile for your own account. For a different account click All Users, hover the row and click Edit.
Users
Application passwords belong to one user and inherit that user's role.
| Username | Name | Role | Posts | |
|---|---|---|---|---|
| contentbotEdit | Delete | Content Bot | ops@example.com | Editor | 0 |
| ameliaEdit | Delete | Amelia Reid | amelia@example.com | Administrator | 128 |
| newsletterEdit | Delete | Newsletter | news@example.com | Subscriber | 0 |
Application Passwords sits near the bottom of the profile screen, below Account Management.
Create the application password
Scroll to Application Passwords, type PopMCP in New Application Password Name, and click Add New Application Password.
Profile
Application passwords allow authentication via non-interactive systems, such as the REST API, without providing your actual password.
| Name | Created | Last Used | Last IP | Revoke |
|---|---|---|---|---|
| Old CMS syncCreated by amelia | Mar 4, 2026 | Never | - | Revoke |
Copy the password before you leave the page
Copy the 24-character value from the green confirmation box, or click Copy, then click Dismiss.
Profile
The spaces are cosmetic. WordPress accepts the value with or without them.
Paste the three values into PopMCP
Enter your home URL in Site URL with no trailing /wp-json, the login name in WordPress username, and the copied value in Application password. Click connect.
Connect in PopMCP
Open your workspace, choose WordPress in the marketplace, and fill in the connect dialog:
| Field | What to enter |
|---|---|
| Site URLtext | Your site's home URL. The WordPress REST API lives under /wp-json. |
| WordPress usernametext | The WordPress user the application password belongs to. |
| Application passwordsecret | WordPress → Users → Profile → Application Passwords. Powers posts, pages, media, and users. Stored encrypted.Encrypted with AES-256-GCM on save and never shown again. |
PopMCP verifies the credential against WordPress immediately. On success the connection flips to Verified and its MCP tools are provisioned.
Verify it worked
PopMCP marks WordPress as Connected and names your site, using the title returned by /wp-json. Asking it to list your most recent posts returns real titles from the site.
Troubleshooting
401 Unauthorized on every call
Why: Many Apache and LiteSpeed hosts strip the HTTP Authorization header before PHP sees it, so WordPress never receives the Basic auth credentials.
Fix: Add `SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1` to .htaccess, or the CGIPassAuth equivalent, then reconnect. Also confirm you used the username and not the email address.
The Application Passwords section is missing from the profile screen
Why: The site is not served over HTTPS, or a plugin has used the wp_is_application_passwords_available filter to switch the feature off.
Fix: Install a valid TLS certificate, set WordPress Address and Site URL to https under Settings, General, then reload the profile page.
403 rest_forbidden or rest_cannot_edit
Why: The user behind the application password lacks the capability for that route, for example a Subscriber trying to create posts.
Fix: Generate the application password on an Editor or Administrator account instead, then reconnect.
404 on /wp-json
Why: Permalinks are set to Plain, or a security plugin such as Wordfence or Solid Security is blocking the REST API for unauthenticated probes.
Fix: Set Settings, Permalinks to Post name and save, then allow-list the REST API in the security plugin.
The password stops working after a colleague edits the account
Why: Changing a user's WordPress password does not revoke application passwords, but deleting the row under Application Passwords does.
Fix: Check the Application Passwords table on that user's profile. If the PopMCP row is gone, create a new one and reconnect.