Skip to main content
The WordPress connector posts articles to your site through the WordPress REST API, using an application password — a revocable credential that is not your login password.
Works with self-hosted WordPress and WordPress.com Business (any install where the REST API is reachable). Requires WordPress 5.6 or newer, which is when application passwords landed.

​
Before you start

  • A WordPress user that can publish posts (Author, Editor or Administrator). Posts are created as that user.
  • The site must be served over HTTPS — WordPress hides application passwords otherwise.

​
Step 1 — Create an application password in WordPress

  1. Sign in to your WordPress admin and open Users → Profile.
WordPress admin Profile screen with Profile highlighted under Users in the sidebar

Users → Profile

  1. Scroll to Application Passwords. Type a name you’ll recognise later — SEOsorted works well — and click Add Application Password.
Application Passwords section with the name SEOsorted and the Add Application Password button highlighted

Name the password, then add it

  1. WordPress shows the new password once, in groups of four characters. Click Copy.
WordPress notice reading Your new password for SEOsorted is, with a masked password in groups of four and a Copy button

Copy the password now — WordPress won't show it again

If you lose the password, revoke that entry and generate a new one — nothing else breaks. Paste it exactly as shown; the spaces are handled for you.
WordPress hides it when the site is not served over HTTPS, because the credential travels as a basic-auth header. Serve the site over HTTPS, or — for a local development site only — set WP_ENVIRONMENT_TYPE to local in wp-config.php.Some security plugins (Wordfence, iThemes Security, SolidWP) also disable application passwords or the REST API outright. Look for a “REST API” or “Application Passwords” toggle in the plugin’s settings.

​
Step 2 — Connect in SeoSorted

Project Settings → Integrations → WordPress → Connect.
Connect WordPress dialog with Site URL, Username and Application password fields and a Connect button

The WordPress connect form

​
string
required
Your site’s home URL, for example https://yourblog.com. Pasting the admin URL (https://yourblog.com/wp-admin/) is fine — the /wp-admin part is trimmed, and https:// is added if you leave it out.
​
string
required
The WordPress username the application password belongs to — the login name, not the display name and not the email address.
​
string
required
The value from Step 1. Spaces are fine. It must be at least 8 characters.
Click Connect. We call your site once to confirm the credentials work before saving anything, so a Connected badge means the connection is genuinely live.
The WordPress card on the Integrations tab with a Connected badge and the site URL

Connected — the card shows the site the workspace publishes to

​
Step 3 — Map fields (optional)

Out of the box, every article fills the standard post fields below. If your theme or plugins add fields — ACF fields, custom meta, a table of contents, taxonomies — open the WordPress card’s ⋮ menu and choose Configure. The Map WordPress fields dialog lists every field your site accepts over the REST API; fill each one from an article field, or set a fixed value that applies to every post, and save.
Custom fields only appear in the dialog when they are exposed to the REST API. For ACF, turn on Show in REST API on the field group.

​
Step 4 — Publish

Open a finished article, click Publish, and click Publish now next to WordPress.
Publish article dialog over the article editor with WordPress listed as a destination

Choosing WordPress as the destination

When the job finishes, the dialog reads Article Published with a View article button that opens the live post.
Publish dialog confirming the article was published, with a link to the new WordPress post

Published — the link goes to the live post

The published article rendered on the WordPress blog

The article live on WordPress

​
What gets published

Posts are created with status publish, authored by the connected user, in your default category. Anything you set in Map WordPress fields is written as well.

​
Re-publishing, unpublishing and deleting

  • Re-publish — after you edit a published article, the editor shows Re-publish instead of Publish. It updates the same WordPress post in place. The button stays disabled until something has changed. Clicking Publish again on an already-published article is refused with “This article is already published. Re-publish it to push your changes.”
  • Unpublish moves the post back to Draft in WordPress.
  • After an unpublish, SeoSorted forgets the post. Publishing the article again creates a new post; the earlier draft stays in WordPress until you remove it.
  • Deleting the article in SeoSorted deletes the WordPress post permanently — it skips the trash, so it can’t be restored from WordPress.

​
Tracking AI crawlers

Add a must-use plugin to see which pages AI crawlers visit and which ones they can’t open. Follow WordPress. With a caching plugin, or for full coverage, use Cloudflare (any site) instead. On WordPress.com, only the Business and Commerce plans allow it.

​
Common problems

We reached your REST API and it refused the login. Check that you used the username, not the email, and paste a fresh application password (Users → Profile → Application Passwords). A copied password with a missing character is the usual culprit.
Something in front of WordPress answered 403 before WordPress looked at the password — typically Wordfence, a hosting firewall, or Cloudflare bot protection. Allow requests to /wp-json/ from SeoSorted (our user agent contains SeoSorted/1.0), then connect again.
We tried both /wp-json/ and ?rest_route= and neither returned JSON. Usually one of:
  • a security plugin blocking the REST API,
  • the site sitting behind HTTP basic auth or a staging password,
  • a site that is not reachable from the public internet.
Test it yourself: open https://yoursite.com/wp-json/wp/v2/types in a browser. You should see JSON, not a login page or an error.
The password field was cut short. Copy the whole value from WordPress again.
Use Re-publish in the editor to update the existing post. Publish only creates the first copy.