Documentation · Secure WordPress access
Connect WordPress without sharing your normal login password.
A WordPress Application Password is a separate, revocable credential for API access. Create one on each destination website, store it through SitePublisher AI’s protected connection workflow and keep your everyday WordPress password private.
For Pro remote connections · The local Free workflow needs no Application Password
What it is
A credential for one integration—not a second human login
WordPress Application Passwords are designed for software that needs authenticated REST API access. They cannot be used to sign in through the normal WordPress login screen.
Separate from the account password
SitePublisher AI receives the WordPress username and the generated Application Password. Your normal WordPress password is never required for the connection.
Create one safely →Tied to one WordPress user
The credential acts with the capabilities of the user who created it. Choose a dedicated account with the minimum content permissions the workflow needs.
Choose the right permissions →Individually revocable
You can disable this one integration without changing the user’s main password. WordPress also records useful metadata such as creation, last use and last IP.
Manage access safely →Before creating the password
Choose the destination user deliberately
An Application Password does not create new permissions. It inherits what the selected WordPress user is already allowed to do.
Required environment
The website must load consistently over HTTPS and WordPress must recognize the secure connection.
Use an active account with a unique username. A dedicated publishing user makes later review and revocation clearer.
Security, firewall and caching tools must allow authenticated requests to the standard WordPress REST API.
Capabilities for the workflow
SitePublisher AI verifies this minimum capability when the connection and categories are refreshed.
Required when the account must publish immediately or create scheduled posts instead of drafts only.
Required when SitePublisher AI sends a featured image to the destination Media Library.
Least privilege
An Administrator account is usually unnecessary.
Grant only the content permissions required for the approved workflow. An Editor can support broad editorial management; a more limited dedicated role may be suitable when it still has every required capability.
Create on the destination website
Generate one clearly named credential per connection
Complete these steps inside the WordPress administration area of the website that will receive the content—not on the central SitePublisher AI website.
Open the correct profile
- Sign in as the intended publishing user
- Open Users, then Profile
- Or edit another user from Users and All Users
- Scroll to the Application Passwords section
Add a recognizable name
- Identify SitePublisher AI and the central installation
- Include the destination when names could be confused
- Use a unique entry for every integration
- Never use the generated password as its name
Generate and copy it once
- Select Add New Application Password
- Copy the complete generated value immediately
- Grouped spaces may remain when you paste it
- Do not place it in email, chat, notes or screenshots
Store on the central website
Connect through preview-first encrypted storage
Return to the WordPress installation where SitePublisher AI Pro runs. Website data and credentials are stored only after the exact preview is approved and saved.
Enter the connection
Go to SitePublisher AI, Website Settings and open the Website Connections tab. Choose New website.
Add a clear internal label and the exact public HTTPS address of the destination.
Select Basic — username + application password. Do not choose Bearer unless a separate approved integration specifically requires it.
Enter the exact WordPress login username belonging to the profile that created the Application Password.
Verify and save
Paste the full generated value into the protected password field.
This read-only request verifies the authenticated user and retrieves all current categories, including empty ones.
Review the URL, authentication, username, credential action, categories and default category.
Save only the matching preview. SitePublisher AI then stores the credential in its encrypted vault.
Verify before production
Test the smallest WordPress action first
A successful category refresh proves authentication and edit access. It does not prove every later publication or media capability, so finish with one controlled draft.
First publication test
- Create one short, recognizable test article
- Select the new destination website
- Use an existing category from the refreshed list
- Save the article as Draft before publishing live
- Confirm the title, content, author and category on WordPress
Featured-image test
- Use one small valid Media Library image
- Confirm the destination account may upload files
- Check that the media item arrives only once
- Verify it is attached to the draft article
- Do not retry blindly after a timeout; inspect WordPress first
Successful connection
Authentication, content and media all pass.
Only after the draft is correct should you test direct publication, scheduling or a small Bulk Automation plan.
Rotate and revoke
Replace a credential without leaving an avoidable gap
Create a new credential first for planned rotation. Revoke immediately when exposure is suspected, even when that temporarily stops the connection.
Planned rotation
Use a new descriptive name that includes the rotation date or connection identity.
Edit the existing connection, paste the new value, refresh categories, preview and save.
Confirm the replacement works before removing the previous credential.
Return to the destination user profile and revoke only the superseded Application Password.
Exposure, removal or unreadable storage
Revoke the affected Application Password immediately, then generate and connect a replacement.
Revoke its named credential on the destination and delete the website connection in SitePublisher AI.
If the encrypted credential becomes unreadable, create a fresh Application Password and replace it in Website Connections.
Use the destination profile’s created, last-used and last-IP information to find credentials that are no longer needed.
Connection problems
Match the error to the failed layer
Preserve the exact HTTP message and time. Never paste the Application Password into a log, screenshot, contact form or support message.
No Application Passwords in Profile
- Confirm the destination uses HTTPS
- Confirm WordPress recognizes the request as secure
- Check security or must-use plugins for restrictions
- Ask the host whether the feature was disabled
Credential verification fails
- Use the exact WordPress username, not a display name
- Paste the complete Application Password
- Confirm the named credential was not revoked
- Ask the host whether Authorization headers are stripped
Connection works but an action fails
- Check edit-post permission for drafts and categories
- Check publish-post permission for live or future posts
- Check upload permission for featured images
- Review REST or firewall rules for posts and media
Official WordPress reference
Review the current WordPress security guide
WordPress documents creation, one-time display, HTTPS use, usage metadata, rotation, revocation and common authentication failures in its Application Passwords guide.
Application Password FAQ
Keep the credential separate and replaceable
These answers cover the most common security and connection questions.
Can I use my normal WordPress password instead?
No. SitePublisher AI should use a separate Application Password for a remote WordPress connection. Keep the normal account password for interactive login only.
Do the spaces in the generated value matter?
No. WordPress displays the credential in groups for readability and accepts it with or without those spaces.
Can I view the Application Password again in WordPress?
No. WordPress shows the generated secret only once. Existing entries show their name and usage metadata, but a lost value must be replaced with a newly generated credential.
Should every destination use its own credential?
Yes. Use one clearly named Application Password per integration and destination. This keeps audits understandable and lets you revoke one connection without affecting another.
Does two-factor authentication replace an Application Password?
No. Two-factor authentication protects interactive login, while an Application Password authenticates software through the API. A security plugin may still apply its own connection rules.
Why does SitePublisher AI Free not show Website Connections?
Free publishes on the WordPress website where the plugin is installed and does not need a remote credential. Multiple destination website connections are a Pro feature.
Does the destination website need SitePublisher AI installed?
No. A destination needs a compatible WordPress REST API, the approved user and its Application Password. It does not need another SitePublisher AI installation merely to receive content.
Continue the documentation
Next: Internal link management
Learn how Pro keeps links and keyword rules separated per website and adds approved internal links without mixing destinations.