Documentation · Connecting a WordPress website
Connect another WordPress website securely.
Add a Pro destination with a dedicated WordPress Application Password, verify its REST access and categories, review the complete connection preview and only then store the encrypted credential.
SitePublisher AI Pro · Never use or share the account’s normal WordPress login password
Before you begin
Prepare the destination and the right WordPress user
The current website is available automatically in Free and Pro. Follow this guide only when Pro should publish to an additional WordPress installation.
A secure website URL
Use the public HTTPS root URL of the destination. HTTP is suitable only for a deliberately controlled development environment. Do not enter an admin address, REST endpoint, username or password in the URL field.
A publishing account
The WordPress user must be able to create and edit posts. Direct publication also requires permission to publish posts; otherwise the connection can still be used for drafts.
Available REST access
The destination must allow authenticated access to the standard WordPress REST API for users, categories, media and posts. Security layers must preserve the Authorization header.
Step 1 · Application Password
Create a separate credential for SitePublisher AI
An Application Password belongs to one WordPress user and one integration. It is intended for API access, can be revoked separately and does not replace the user’s normal browser login.
The generated value is shown only once. Keep it available until the connection has been verified, previewed and saved.
Open the destination user profile
Log in to the destination website and go to Users → Profile, or edit the intended publishing user as an administrator.
Find Application Passwords
Enter a descriptive integration name such as SitePublisher AI followed by the central website name.
Generate and copy
Create the Application Password and copy the complete generated value immediately. Spaces displayed by WordPress are only for readability.
Keep it dedicated
Do not reuse the credential for unrelated tools. Revoke it on the destination when the connection is retired or if exposure is suspected.
Step 2 · Website Settings
Enter the new connection details
In the central installation, open SitePublisher AI → Website Settings → Connection and choose New website.
Basic authentication
Select Basic — username + application password. This is the normal WordPress connection route supported by SitePublisher AI.
- Name: a recognizable internal website label
- Website URL: the destination’s public root URL
- Username: the WordPress login name
- Application password: the newly generated credential
Bearer token
Choose Bearer token only when the destination already provides a compatible bearer-authentication layer. Standard WordPress installations normally use an Application Password.
- No WordPress username is stored for this method
- The token must authenticate standard REST requests
- Use the exact token issued by the destination setup
- Verify permissions before saving
Connection fields
Use values from the destination WordPress website
The label is for your own workspace. The URL, username and Application Password must all belong to the same destination.
Website name
Choose a clear internal name that makes the destination easy to recognize in Single Article, Bulk Automation and Website Settings.
Website URL
Enter the root URL such as https://example.com. SitePublisher AI derives the standard WordPress REST address automatically; use HTTPS whenever real credentials are sent.
Username and credential
Use the actual WordPress login name and its dedicated Application Password. The ordinary account password should never be entered here.
Step 3 · Verify and refresh
Retrieve the categories before saving
Select Refresh all categories. This read-only request verifies the supplied credential and retrieves every destination category, including categories with no posts.
The category list remains temporary in the form until the complete connection is previewed and explicitly saved.
Authentication is verified
SitePublisher AI asks WordPress which user is authenticated instead of trusting a public category endpoint as proof of access.
Editing permission is required
If the account cannot create or edit posts, verification stops. Choose a suitable user or update that user’s WordPress capabilities.
Publishing permission is reported
The result states whether the user may publish directly. An account without that permission can save drafts but cannot use Publish now successfully.
Select an optional default category
Choose one of the refreshed categories as the website default, or keep No default category and select a category in each content workflow.
Step 4 · Preview and save
Approve the exact connection before it is stored
The connection, categories and encrypted credential are written to SitePublisher AI only after a matching preview and an explicit save.
Preview changes
- Performs no storage write
- Shows name, URL, authentication and username
- Shows category count and default category
- Lists every changed field
Check the summary
- Credential is marked created, retained or replaced
- The secret itself is never shown in the preview
- Changing any field invalidates the approval
- A new preview is required after changes
Save website
- Becomes available only after a valid preview
- Stores the website and category snapshot
- Stores the credential in encrypted form
- Adds the destination to Managed websites
After the connection is stored
Complete the destination’s publishing context
The connection proves where SitePublisher AI may write. The remaining Website Settings tabs define how content should be created for that destination.
Profile
Select the stored website and configure its country, languages, tone, audience, reading level and author preferences.
Review profile fields →AI and content defaults
Review the model, reasoning, content structure and other per-website defaults before starting a larger production run.
First publication test
Create one short article, save it as a draft and confirm the category, featured image and edit link on the destination before using Bulk Automation.
Review publication →Managing a stored connection
Edit, rotate or remove credentials safely
Use the Managed websites table to edit or delete a destination. Treat every credential change as a new connection approval.
Retain the stored credential
When editing a healthy connection, leave the password field empty to retain its encrypted value. Preview all other changes before saving.
Rotate an Application Password
Create a new credential on the destination, enter it in Website Settings, refresh categories, preview and save. Revoke the old credential afterward.
Refresh categories after changes
When categories are added, renamed or removed on WordPress, open the connection and use Refresh all categories before the next content batch.
Delete a connection
Deletion removes the managed website record and encrypted credential from SitePublisher AI. It does not remove posts already stored on the destination.
Troubleshooting
Use the verification message to find the blocked layer
Most connection problems come from the URL, credential, WordPress permissions or a security layer that blocks authenticated REST requests.
Authentication is rejected
Confirm the real WordPress username, generate a new Application Password and verify that HTTPS and the Authorization header are supported by the host or security plugin.
Access is denied: check permissions and the hosting firewall
A 403 can come from WordPress permissions or a hosting WAF that blocks the request before authentication. Removing Defender does not disable a separate hosting WAF. Check the destination’s firewall logs and ask the host to review the matched rule.
WPMU DEV rule 225170 has blocked this verification in a confirmed case. IP allowlisting did not resolve that case; temporarily disabling the WAF identified the blocked layer but is not a permanent fix. Follow the hosting firewall and HTTP 403 checklist, then verify again with the WAF enabled after the host’s correction.
Categories cannot be retrieved
Check that the public URL is correct and that firewalls, proxies, caching or security rules are not blocking standard WordPress REST responses.
A stored credential can no longer be decrypted
If the security keys of the central WordPress installation changed, enter the username and Application Password again, verify the connection, preview and save.
Frequently asked questions
Connection answers
A connected destination remains a normal WordPress website. SitePublisher AI uses its standard authenticated REST routes.
Must SitePublisher AI be installed on every destination?
No. A connected destination needs standard WordPress REST access and a suitable user credential; the SitePublisher AI plugin runs on the central website.
Can I use the user’s normal WordPress password?
No. Create a dedicated Application Password for API access. It can be revoked without changing the account’s normal login password.
Does Refresh all categories change the destination?
No. It verifies the credential and reads the category list. The snapshot is stored only after Preview changes and Save website.
Can an account without publish permission be connected?
Yes, if it can create and edit posts. Verification reports that it may save drafts but cannot publish directly.
What happens when I enter an existing website URL?
SitePublisher AI recognizes an exact stored URL and prepares a repair or update of that website instead of silently creating a duplicate connection.
WordPress security reference
Learn more about Application Passwords
WordPress documents Application Passwords as revocable, per-application credentials for authenticated tools. They are shown once, managed from the user profile and intended for secure API access over HTTPS.
Next guide
Ready to test the connected website?
Start with one reviewed draft. When the destination, category and featured image are correct, continue with Bulk Automation for a larger Pro workflow.