Docs/Publishing

Publish to WordPress

Send posts straight into a self-hosted WordPress site using an application password.

This is for self-hosted WordPress (a site you run yourself). WordPress.com-hosted blogs use a different API and aren't supported yet.

Before you start

  • Your site must be reachable over HTTPS — WordPress refuses to issue application passwords over plain HTTP.
  • You need an account on the site with permission to publish posts.
  • Nothing to install. This uses the REST API built into WordPress core.

Create an application password

  • In WordPress, go to Users → Profile and scroll to Application Passwords.
  • Type a name you'll recognise, such as blogcms, and hit Add New Application Password.
  • Copy the generated password. WordPress shows it once and never again.
No Application Passwords section on that page? Your site isn't being served over HTTPS as far as WordPress can tell. See Troubleshooting below.

Connect it

  • Site URL — your site's address, for example https://example.com
  • Username — the WordPress username the application password belongs to.
  • Application password — paste it exactly as shown. The spaces are fine; we strip them.

What gets published

  • Title, slug, excerpt and the full post body with headings, bold, links, lists and code blocks intact.
  • Tags and categories are matched to existing terms on your site by name, and created if they don't exist yet.
  • Posts arrive published, not as drafts.

What doesn't transfer yet

  • Featured images aren't uploaded — a post with a featured image arrives without a thumbnail.
  • Any images inside the post stay pointed at our servers rather than being copied into your media library.
  • Meta title and description are skipped, because core WordPress has no field for them without an SEO plugin.

Troubleshooting

  • Application Passwords section is missing — WordPress only offers them over HTTPS. If your site sits behind a proxy or CDN that talks to your server over plain HTTP, WordPress sees an insecure request. Forward the X-Forwarded-Proto header and honour it in wp-config.php.
  • WordPress rejected the credentials — the username or application password is wrong. Regenerate the password and paste it again.
  • Couldn't establish a secure connection — your site's TLS certificate is expired, self-signed, or missing part of its chain. Fix the certificate; we won't publish over a connection we can't verify.
  • Couldn't reach the site — check the domain resolves and the site is up.
  • Permalinks don't matter. If your site doesn't serve the REST API at the usual address we fall back automatically.
wp-config.php — only if your proxy terminates HTTPSif (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') { $_SERVER['HTTPS'] = 'on'; }