To connect Claude to WordPress through the REST API, all you need is an application password on a dedicated user. You then give Claude your site's API address, that username and that password. No plugin is required. Claude can then read your content and prepare drafts that you review before they go live. Here I'll show you the cautious version, the one I recommend to site owners who aren't developers.
- 🔑 Minimal method, a WordPress application password is all you need, with no plugin and no config file.
- ⚠️ Dedicated user, a Contributor account limits the possible damage to drafts.
- 💾 Back up first, a full copy of the site before the first test, no exceptions.
- 🎯 Reviewed drafts, Claude prepares, you publish: human review stays the final safeguard.
What does connecting Claude to the WordPress REST API mean?
The WordPress REST API is an interface built into the core of the CMS. It lets a program read and write posts, pages and categories through web addresses, without going through the dashboard. Connecting Claude to this API means giving it credentials so it can call those addresses on your behalf, based on a plain-English instruction.
In practice, according to instawp.com's guide, instead of running a POST /wp/v2/posts request yourself, you let Claude interpret your request and make the call, handling authentication and parameter formatting. You stay in control of what it's allowed to do, because those permissions depend on the WordPress account you lend it.
Why choose the REST API over an MCP plugin?
Because it's the shortest and least intrusive route. Lucas Fonseque, a website builder, presents it on lucasfonseque.fr (guide updated in October 2026) as the method he uses himself: no extension, five minutes of setup, and it works on any self-hosted WordPress site.
MCP (Model Context Protocol, an open standard from Anthropic that lets an AI discover and call the tools exposed by a server) goes further, but it adds another component to maintain on your site. My view fits in one sentence: as long as your need is "read and prepare drafts", the REST API is enough, and every component you leave out is one less attack surface.
One thing to check before you start: Claude needs to be able to reach your site. In Claude Cowork, the agent calls your API address from your computer, as Jamie WP shows in his demo on poodlepress.com. With Claude Code, the call goes out from your terminal. A local WordPress site that isn't published on the internet only works with these two setups.
What should you do before creating any password?
First of all, take a full backup of your site and create a WordPress user reserved for Claude. These two steps turn a potentially costly mistake into a harmless incident: the backup lets you roll back, and the restricted user stops Claude from touching anything that isn't content.
This is the step video tutorials play down the most. The excerpts I read from Darrel Wilson, Jamie WP and Themeisle videos go straight to the plugin or the password, before any advice about backups.
What role should you give Claude's user?
The Contributor role is the safest for drafting. In WordPress, a Contributor can write and edit their own posts but can't publish them. Even if Claude misreads an instruction, nothing goes live on its own.
The downside: a Contributor can't upload images to the media library and can't see other authors' drafts. If you want Claude to improve existing posts, you'll need the Editor role, which means more power. I always start with the lowest role, and only move up if a specific need justifies it.
How do you back up before the first test?
Use your host's backup tool or a backup plugin, and check that the copy includes both the database and the wp-content folder. A backup you've never restored is just an assumption: do at least one test restore on a staging site.
There's nothing exotic about this rule. A Reddit user on r/ClaudeAI, who owns a site inherited from a former developer (code scattered across snippet plugins, conditions firing on the wrong pages), asks exactly the question non-developers ask: can you let Claude make changes on a production site? Their own implicit answer is to validate every step by hand, and I agree.
How do you create an application password, step by step?
In the WordPress dashboard, open Users, then Profile on Claude's account, and scroll down to the "Application Passwords" section. Name the password (for example "Claude"), then click "Add New Application Password". WordPress shows the password only once, so copy it immediately.
An application password is a secondary credential generated by WordPress. It gives access to the API without revealing the account's login password. The feature has been part of WordPress core since version 5.6, and it's documented in the official handbook on developer.wordpress.org.
The process is the one Jamie WP describes: note the username, generate the password, copy it, then paste it into Claude along with the API address. He mentions that he revokes the password after the demo. Do the same as soon as your session is over, since revoking takes one click and doesn't change the account password.
What are the technical requirements?
Your site must be served over HTTPS: by default, WordPress only offers application passwords over an encrypted connection, except in local environments. Some security plugins and hosting setups also disable the REST API or application passwords, in which case the section won't appear in the profile.
If it's missing, check your security plugins first, then ask your host. Don't work around the block by installing a random plugin.
How do you give Claude access and check that it works?
In Claude Cowork or Claude Code, tell Claude something like: "I'm connecting you to my WordPress site. The API address is https://your-site.com/wp-json/wp/v2/, my username is X and the application password is Y." This is the wording suggested on lucasfonseque.fr, and it works because WordPress accepts basic authentication with that pair.
Then ask for a harmless test: "Read me the titles of my five latest posts." If Claude answers correctly, the connection is working. A 401 error means the username or password was copied wrong (the spaces in the password must be either kept or removed consistently). A 403 error means the user's role doesn't allow the requested action, which is exactly what should happen when a Contributor tries to publish.
What can you ask Claude to do once it's connected?
Once connected, Claude can read your posts, pages, categories and metadata, create draft posts and edit existing content, within the limits of the account's permissions. According to lucasfonseque.fr, it can also fill in SEO titles and descriptions for a plugin like Rank Math, analyse your internal linking or audit your content.
The time saving is real. According to skuria.fr (article dated 18 April 2026), a structured post with completed metadata can be ready as a draft in under 5 minutes instead of 45. I treat that figure as a ballpark estimate from the guide's publisher, not an independent measurement.
What instruction gets you usable drafts?
A useful instruction specifies three things: the topic and audience, the mandatory status (draft, never publish) and the format constraints (headings, length, tone). Write them down once in an instructions file, for example CLAUDE.md if you work with Claude Code, so you don't have to repeat them with every request.
Example: "Create a draft on topic X for small business owners, 800 words, without publishing. Give me the preview link." The word "draft" is repeated on purpose: the status instruction must be as explicit as the content instruction.
How do you review before publishing?
Open the draft in WordPress, compare it with what you intended, check every figure and every link, then publish it yourself. skuria.fr makes human review a core principle of its setup, and its article points out that the connection is there to remove friction between the editorial decision and going live, not to churn out content.
This precaution matters for another reason too: generated text can contain made-up claims. The API won't catch them, so it's up to you. My guiding principle on ai-first.fr stays the same: AI reads, decides, acts and reports back, but a human stays in control of anything that commits the business.
What other ways are there to connect Claude to WordPress?
There are four other routes: a free MCP plugin installed on the site, a managed MCP server, a tool that adds AI capabilities directly inside WordPress, and the official WordPress.com connector. They're more powerful than the REST API, but each one hands part of the control to an external component.
The table compares the five methods on what matters to a business owner: setup time, what the AI can touch, and the risk to watch.
| Method | Setup | What Claude can do | Main risk |
|---|---|---|---|
| REST API + application password | 5 min, no plugin | Read, create drafts, edit depending on role | Password pasted into a conversation |
| Easy MCP AI plugin | Install from the plugin directory | MCP tools, direct connection with no middleman | One more plugin to maintain |
| InstaMCP (InstaWP) | One toggle, about 2 min | 43 typed tools, no server to manage | Only for sites hosted on InstaWP |
| Novamira | Free plugin, AI capabilities enabled | AI agent inside the WordPress admin | Very broad powers to keep in check |
| WordPress.com connector | Authorisation in Claude | Read only | WordPress.com sites only |
SOURCE: expresstech.io, instawp.com, cited transcripts · UPDATED 11/2026
When should you prefer an MCP server over the REST API?
When you want Claude to work on things the basic REST API exposes poorly: a page builder, a WooCommerce store, custom fields. One r/BricksBuilder user describes a 37-tool bridge for driving Bricks Builder from Claude Code, and another developer on r/Wordpress built a 96-tool plugin to manage products, orders and SEO in plain language.
On the official side, the WordPress developer blog introduced the MCP Adapter in February 2026. It builds on the Abilities API that arrived with WordPress 6.9 and lets Claude Desktop or Claude Code call functions declared by the site. That's the direction WordPress core is heading, so it's worth keeping an eye on.
The more power a tool gives, the more the question "what's disabled by default?" matters. expresstech.io (13 January 2026) highlights this: on InstaMCP, the execute_php, db_query and site_files tools ship disabled. The rule I take away applies whatever the tool: only enable dangerous tools for a specific task.
Why I don't install an agent in the admin by default
Because the simplicity argument in video tutorials says nothing about risk. Darrel Wilson says the Novamira plugin is by far the easiest of all the methods he's tried, and his video is clear. What it doesn't cover is what happens if the agent gets something wrong on a live site.
I'm not disputing the simplicity, I'm disputing the order of priorities. For a small business, the right starting point is the narrowest scope that meets the need, and you widen it from there. On that front, an application password on a Contributor account is hard to beat.
Should you really connect Claude to your WordPress site?
Yes, if what you need is to prepare drafts, audit content and fill in metadata. No, if the idea is to let an AI publish on its own. In the first case, the REST API connection saves a measurable amount of time for a controlled risk. In the second, you create exactly the kind of chaos I want to help the business owners I work with avoid.
My recommendation comes down to four steps: backup, a dedicated Contributor user, an application password revoked at the end of each session, and review before publishing. If you'd rather not do it yourself, we can set up the connection for you, see Claude for WordPress.
What risks shouldn't you underestimate?
The first is the password itself: pasting it into a conversation puts it in a chat history. Use a dedicated, revocable one tied to a restricted account. The second is personal data: if your site holds comments or customer records, GDPR applies to whatever you let a third-party service read, as the European Commission explains on ec.europa.eu.
The third is the most mundane: a badly worded instruction. That's why the reviewed draft remains the final safeguard. To go further on method, read our guide to the Claude automations that actually save money, and on security, Claude and prompt injection, a real risk as soon as an AI reads web content and then acts on it. For your first setup, How to use Claude Code without knowing how to code covers the workstation basics.
Frequently asked questions
Do you need a plugin to connect Claude to WordPress?
No. The REST API is built into WordPress, and application passwords have been in core since version 5.6. A plugin is only useful for richer MCP tools, for example to drive a page builder or a WooCommerce store.
Is an application password safe?
It's safer than the login password, because it can be revoked on its own without changing the account password, and it can be tied to a user with limited permissions. It's still a secret: don't share it, don't leave it in a public file, and revoke it when your work session is over.
Can Claude publish a post on my site by itself?
Only if the account it uses has permission to. With a Contributor user, WordPress blocks publishing: Claude can only create drafts. That's why I recommend this role for a first test.
What's the difference between the REST API and MCP for WordPress?
The REST API is WordPress's native interface, called with a username and an application password. MCP is a standardised layer from Anthropic that exposes typed tools to Claude, through a plugin or a managed server. MCP offers more actions, while the REST API needs fewer components.
What if the Application Passwords section doesn't appear?
Check that your site runs on HTTPS, then that neither a security plugin nor your host is disabling the REST API or this feature. If the block persists, ask your host to enable it rather than installing an unvetted plugin.
Vidéos YouTube
- Easily Connect Claude AI to WordPress in 3 Minutes — Darrel Wilson
- How to Connect Claude to WordPress—Just Copy & Paste! — Darrel Wilson
- The Quickest & Easiest Way to Connect Claude Cowork to WordPress — Jamie WP
- The Easiest Way to Connect Claude Code to WordPress With MCP — Themeisle
Discussions Reddit
- Anyone actually used Claude Code + WordPress MCP for production site work? — r/ClaudeAI
- WordPress plugin Bricks API Bridge + MCP — r/BricksBuilder
- Claude Code WordPress Plugin — r/Wordpress
Articles & ressources
- Connect Claude to WordPress: Best Methods for Developers — expresstech.io
- From Abilities to AI Agents: Introducing the WordPress MCP Adapter — developer.wordpress.org
- Connecter Claude à WordPress : le guide technique complet — skuria.fr
- Connecter Claude à WordPress : guide complet 2026 — lucasfonseque.fr
- How to Connect Claude with WordPress in 2026: 5 Methods — instawp.com
- REST API Authentication — developer.wordpress.org