> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pendpost.com/llms.txt
> Use this file to discover all available pages before exploring further.

# WordPress

> Set up WordPress posting with an application password. No app, no OAuth, no review.

The WordPress lane publishes posts to a self-hosted or WordPress.org site through its REST API. It publishes only once a WordPress credential is present in your `.env`; until then the lane is live-but-unauthenticated and waits for you to connect it (set `PENDPOST_MODE=mock` to exercise it through the mock driver).

You own your WordPress site and are responsible for its terms of service. pendpost drafts and schedules, but a human approves before anything goes live.

## Setup ceremony

The engine talks to the site's own REST API at `<site>/wp-json/wp/v2`, enabled by default on WordPress 5.6+. Authentication is an application password on the posting user, so there is no app to register and no OAuth.

1. **Record the site URL.** Record the site root, for example `https://blog.example.com`.
2. **Pick the posting user.** Posts publish as this user, so use an Author or Editor account you control. Record its username (the login name, not the display name).
3. **Create an application password.** In wp-admin open Users > Profile > Application Passwords, name it (for example `pendpost`), and create it. Copy the generated password immediately, because WordPress shows it once. Spaces in it are fine and accepted verbatim.

Then validate. It calls `/users/me` and confirms the account can publish posts:

```bash theme={null}
node scripts/wordpress-social.mjs auth
```

## Environment variables

| Variable | Purpose |
| - | - |
| `WORDPRESS_SITE_URL` | The site root, for example `https://blog.example.com`. |
| `WORDPRESS_USERNAME` | The posting user's login name. |
| `WORDPRESS_APP_PASSWORD` | The application password minted in Users > Profile. |

> [!NOTE]
>
> A lane publishes only once its credential is present. If the WordPress variables are blank, the WordPress lane is live-but-unauthenticated and waits for you to connect it. Set `PENDPOST_MODE=mock` to exercise it through the mock driver.

## Validate the lane

A present credential is not the same as a working one. After setup, validate the WordPress lane in the **Setup** tab, or run a live probe with the `health_recheck` tool, to confirm the credential is live and not just configured. The lane is ready when it reports live.

> [!NOTE]
>
> **Over MCP.** Setup and rotation are an interactive human ceremony; secrets are never written through MCP. An agent can still check status (`account_status`), run a live liveness probe (`health_recheck`), and read non-secret config (`config_get`) over MCP without touching credentials.

## Common failures

| Symptom | Cause | Fix |
| - | - | - |
| HTTP 401 with `rest_cannot_access` or a login error. | Application passwords are disabled (some security plugins turn them off), or the site forces basic auth off over HTTP. | Serve the site over HTTPS, re-enable application passwords in the security plugin, and mint a fresh password. |
| HTTP 403 on publish while auth succeeds. | The posting user's role cannot publish (a Contributor drafts only). | Give the user the Author role or higher. |
| Posts publish with broken formatting. | The markdown body uses constructs outside the engine's supported subset. | Stick to the subset (headings, lists, links, emphasis, code, quotes, images), or paste pre-rendered HTML into the body. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.