# WordPress setup for PopMCP

You paste three things into PopMCP: your site's home URL, the WordPress username, and a 24-character application password generated on that user's profile screen.

- Auth: API credentials
- Setup time: 4 min
- API base URL: https://example.com/wp-json/wp/v2
- Credentials screen: https://example.com/wp-admin/profile.php (replace example.com with your WordPress domain)
- Provider docs: https://developer.wordpress.org/rest-api/

## Before you begin

- Self-hosted WordPress 5.6 or newer. Application Passwords ship in core from 5.6
- The site must be served over HTTPS. WordPress hides the Application Passwords section on non-SSL sites
- A WordPress user with the role you want PopMCP to act as. Administrator for users and settings, Editor is enough for posts, pages and media
- The REST API must answer at /wp-json. Some security plugins and hosts disable it or strip Basic auth headers

## Get your credentials

### 1. Check that the REST API answers

Open `https://your-site.com/wp-json` in a browser. A JSON response naming your site means the route PopMCP calls is live.

Screen: https://example.com/wp-json (replace example.com with your WordPress domain)

### 2. Open the profile of the user PopMCP will act as

Go to Users in the left sidebar, then Profile for your own account. For a different account click All Users, hover the row and click Edit.

Screen: https://example.com/wp-admin/profile.php (replace example.com with your WordPress domain)

### 3. Create the application password

Scroll to Application Passwords, type `PopMCP` in New Application Password Name, and click Add New Application Password.

Screen: https://example.com/wp-admin/profile.php#application-passwords-section (replace example.com with your WordPress domain)

### 4. Copy the password before you leave the page

Copy the 24-character value from the green confirmation box, or click Copy, then click Dismiss.

### 5. Paste the three values into PopMCP

Enter your home URL in Site URL with no trailing `/wp-json`, the login name in WordPress username, and the copied value in Application password. Click connect.

## Fields PopMCP asks for

- Site URL (siteUrl) [required]: Your site's home URL. The WordPress REST API lives under /wp-json.
- WordPress username (wpUsername) [required]: The WordPress user the application password belongs to.
- Application password (wpAppPassword) [required]: WordPress → Users → Profile → Application Passwords. Powers posts, pages, media, and users. Stored encrypted.

## Verify

PopMCP marks WordPress as Connected and names your site, using the title returned by /wp-json. Asking it to list your most recent posts returns real titles from the site.

## Troubleshooting

### 401 Unauthorized on every call

Cause: Many Apache and LiteSpeed hosts strip the HTTP Authorization header before PHP sees it, so WordPress never receives the Basic auth credentials.

Fix: Add `SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1` to .htaccess, or the CGIPassAuth equivalent, then reconnect. Also confirm you used the username and not the email address.

### The Application Passwords section is missing from the profile screen

Cause: The site is not served over HTTPS, or a plugin has used the wp_is_application_passwords_available filter to switch the feature off.

Fix: Install a valid TLS certificate, set WordPress Address and Site URL to https under Settings, General, then reload the profile page.

### 403 rest_forbidden or rest_cannot_edit

Cause: The user behind the application password lacks the capability for that route, for example a Subscriber trying to create posts.

Fix: Generate the application password on an Editor or Administrator account instead, then reconnect.

### 404 on /wp-json

Cause: Permalinks are set to Plain, or a security plugin such as Wordfence or Solid Security is blocking the REST API for unauthenticated probes.

Fix: Set Settings, Permalinks to Post name and save, then allow-list the REST API in the security plugin.

### The password stops working after a colleague edits the account

Cause: Changing a user's WordPress password does not revoke application passwords, but deleting the row under Application Passwords does.

Fix: Check the Application Passwords table on that user's profile. If the PopMCP row is gone, create a new one and reconnect.

---

Source: https://www.docs.popmcp.com/docs/integrations/wordpress/