WordPress
Connect your WordPress site with an application password and give your agent 14 tools to read posts, pages, and media, and, for owners, publish and edit content.
Connect a WordPress site and your agent works directly against the WordPress REST API. It can read your posts, pages, categories, tags, and media library, and, for owners, draft, publish, edit, and delete content. Fourteen tools in all, split so visitor-facing agents only ever read.
Before you start
- A WordPress site reachable over HTTPS: application passwords are disabled on plain-HTTP sites.
- WordPress 5.6 or newer (application passwords are built in from 5.6) with the REST API reachable: some security plugins or hosts block
/wp-json. - Your WordPress username and a fresh application password (not your login password).
Connect
- In WordPress, go to Users → Profile and scroll to Application Passwords. Give it a name like "AnyBot" and click Add New Application Password.
- Copy the generated password. It looks like
xxxx xxxx xxxx xxxx xxxx xxxxand is shown only once. Spaces are fine; AnyBot handles them either way. - In Integrations → WordPress, enter your site URL, your WordPress username, and that application password, then choose which permissions to grant.
The enabling gotcha: the application password is generated in your WordPress user profile, not in AnyBot, and if the section is missing your site is either on HTTP or has application passwords disabled by a plugin. It also inherits that user's role. Connect as an Editor or Admin if you want the agent to publish.
What the agent can do
| Tool | Access | Type | What it does |
|---|---|---|---|
wordpress_list_posts | Public-safe | Read | Lists posts with optional search, category, tag, and status filters (defaults to published). |
wordpress_get_post | Public-safe | Read | Returns a single post by ID. |
wordpress_list_pages | Public-safe | Read | Lists the site's pages. |
wordpress_get_page | Public-safe | Read | Returns a single page by ID. |
wordpress_get_site_info | Public-safe | Read | Reads site info: name, description, and URL. |
wordpress_list_categories | Public-safe | Read | Lists post categories. |
wordpress_list_tags | Public-safe | Read | Lists post tags. |
wordpress_list_media | Public-safe | Read | Lists items in the media library. |
wordpress_create_post | Owner-only | Write | Creates a post: draft by default, or published if you say so. |
wordpress_update_post | Owner-only | Write | Updates a post's title, content, status, categories, or tags. |
wordpress_delete_post | Owner-only | Write | Deletes a post. |
wordpress_create_page | Owner-only | Write | Creates a page. |
wordpress_update_page | Owner-only | Write | Updates an existing page. |
wordpress_upload_media | Owner-only | Write | Uploads a file to the media library from a URL you provide. |
Public-safe vs owner-only
The eight read tools are public-safe. You can expose them on a public channel so a visitor's agent can pull up a blog post or list your pages. The six write tools are owner-only: they only run on your own internal or admin surfaces, never for a website visitor, so a stranger can never create or delete content. On top of that, every tool is gated by the permissions you granted at connect time (read posts, write posts, read pages, write pages, read settings, manage categories, manage media). Grant only what the agent needs.
Worked example
You upload a screenshot and ask your internal agent: "Draft a launch post titled 'Spring Release' with the highlights, upload this image, and leave it as a draft for me to review." The agent calls wordpress_upload_media to add the image, wordpress_create_post to write the draft, and replies with the edit link. Nothing goes live until you publish it yourself.
Limits & honesty
- Read tools authenticate as your WordPress user, so they can see drafts and unpublished content. Keep that in mind when deciding what to expose publicly.
- New posts default to draft. The agent publishes only when the request is explicit and the connection has the write-posts permission.
- Custom post types and page builders (Elementor, ACF fields, and the like) aren't guaranteed. The tools work through the standard REST endpoints for posts, pages, and media.
Troubleshooting
- "WordPress not connected": the site URL, username, or application password is wrong, or the addon was disabled. Regenerate the application password and re-enter it.
- The tool never runs: its permission wasn't granted at connect time, or a write tool is being asked for on a public channel (owner-only). Check the granted permissions.
- API error (401): the app password is revoked or the connected user lost the role; (403): a security plugin is blocking the REST API; (404) on
/wp-json: pretty permalinks or the REST API are disabled.
FAQ
Do I paste my normal login password? No, always a dedicated application password. You can revoke it any time from the same profile screen without changing your login.
Can a website visitor publish to my blog? Never. All six write tools are owner-only and require write permissions; visitors only reach the read tools you expose.
Next
- Web Search, answer beyond your knowledge base with cited sources
- Custom API tools, connect any other service by its API
- Agent abilities, how tools attach to an agent