Connect WordPress with an application password

Blog AI connects to WordPress through WordPress's own REST API, using an application password: a separate password that WordPress creates for one app. It isn't your login password, it can't be used to sign in to your admin screens, and you can revoke it at any time without affecting anything else.

This works with self-hosted WordPress and with hosts that allow application passwords. It's built into WordPress itself, so there's nothing to install for the basic connection.

Before you start

• Your site must use HTTPS (an address starting https://). WordPress only offers application passwords over a secure connection, and Blog AI only sends to https:// addresses.
• Use a WordPress user who can publish posts. An Administrator, Editor or Author works. A Contributor can't publish, so the connection test fails. Posts appear under this user's name.
• Know the exact address your site loads at, including www. if it uses it. Blog AI doesn't follow redirects when it writes to your site, so an address that redirects fails the test (it tells you the address to use instead).
• Yoast SEO or Rank Math? You'll also want the free Blog AI Connector plugin, so the Google title and description reach your SEO plugin.
• Hosted on WordPress.com? Application passwords and the REST API Blog AI uses need a WordPress.com plan that allows plugins. On other WordPress.com plans, use a webhook instead.

Create an application password and connect

1. Open your profile. In your WordPress admin, go to Users → Profile (the user Blog AI will publish as).
2. Create the password. Scroll to Application Passwords, type a name you'll recognise, such as "Blog AI", and click Add New Application Password.
3. Copy it. WordPress shows the password once, in groups of four characters. Copy it now; the spaces don't matter.
4. Start adding a site. In Blog AI, go to Sites, click Add site, and choose Connect with a WordPress application password.
5. Enter the details. A site name, your Site address (URL), your WordPress username (not your email address, unless that's your username) and the Application password.
6. Test it. Click Test connection. "Connection successful!" means Blog AI reached your site and your user can publish. If you use Yoast SEO or Rank Math, the test says so, and asks you to install the connector plugin if it's missing.
7. Add the site. Click Add site and import posts. Blog AI imports your published posts and pages so it can learn your voice and audit your content.

If there's no Application Passwords section in step 2, see the problems below.

What Blog AI sends when it publishes

Also sent: the post's key takeaways and FAQ in the post, the focus keyword, and, with the connector 1.4.0+, structured data.

Never done: Blog AI never deletes posts on your site, and it never changes the web address (slug) of a post that's already live. Removing a site from Blog AI leaves every post on WordPress as it is.

Scheduling uses WordPress's own scheduler: the post waits in WordPress as "Scheduled". WordPress releases scheduled posts when someone visits your site, so on quiet sites they can be late; if a post is still waiting 10 minutes after its time, Blog AI publishes it for you.

Updates: Update live post and applied refreshes send the title, body and excerpt (and the featured image, if you chose a different one). The Google title and description are sent separately. See Update a post that is already live.

Revoking access

To cut Blog AI off from your site, go to Users → Profile → Application Passwords in WordPress and click Revoke next to the Blog AI password. Publishing stops straight away. To connect again, create a new password and use Fix connection: see Fix a broken connection.

Common problems and fixes

There's no Application Passwords section

• Your site isn't on HTTPS. Application passwords only appear on secure sites.
• A security plugin has turned them off. Plugins such as Wordfence, iThemes or "Disable REST API" can disable application passwords or the REST API. Allow them, at least for logged-in users.
• Your host has disabled them. Ask your host's support.

"WordPress rejected the username or application password"

The username or password is wrong, or the password was revoked. Check you entered the username (Users → Profile shows it; it can't be changed), not the display name or email. Then create a fresh application password and paste it again: an extra character at either end is the usual culprit.

"WordPress rejected the credentials while trying to … (HTTP 401)" or "(HTTP 403)"

This happens while publishing, after the connection worked. Usually the application password was revoked, the user was deleted or downgraded, or a security plugin or firewall started blocking the REST API. Create a new password, then use Fix connection. If it keeps happening, allow authenticated requests to /wp-json/ in your security plugin or ask your host.

"The WordPress user … cannot publish posts"

The user is a Contributor or Subscriber. Use an Author, Editor or Administrator account, or change this user's role in WordPress.

"No WordPress REST API found at …/wp-json. Check the site URL."

The address isn't your WordPress site, or the REST API is switched off. Enter the address your site's home page loads at. If that's right, a plugin may be hiding /wp-json/; allow it.

"This URL redirects to …"

Your site redirected the request, for example from http:// to https://, or to or from www.. Enter exactly the address the message suggests. If you move your site later, update the address in Fix connection: publishing fails with "WordPress redirected the request to …, so nothing was saved" until you do.

"Yoast SEO is active but the Blog AI Connector plugin is not installed"

The post published, but without the Google title, description and canonical address. Install the Blog AI Connector plugin, then open the post and send the title and description again with Update live post. For Rank Math the warning reads "Rank Math SEO meta could not be set".

Titles show "&" or "’"

Older versions of Blog AI could send some titles with HTML codes in them. Blog AI now sends titles, excerpts and SEO fields as plain text. Edit the title in Blog AI and click Update live post; if Blog AI says "There are no changes to push", correct the title in WordPress instead.

The featured image doesn't show

• Check the post in WordPress: if the image is set there, your theme doesn't show featured images on posts (many block themes need the Featured Image block in the single post template).
• If the image isn't set, publishing showed an error such as "Featured image is larger than 15 MB": choose a smaller image and update the post.
• Changed the image after publishing? Update live post now sends a newly chosen featured image. Removing the image in Blog AI doesn't remove it from WordPress.

The post looks different from my other posts

Blog AI sends HTML, which the block editor shows in a Classic block. That's normal and displays like any other post. Your theme decides fonts and spacing. Blog AI never adds embeds (videos, iframes); add those in WordPress. Once a post contains them, Update live post refuses with "The live post contains content Blog AI can't rewrite without losing it", so your embeds are safe; edit that post in WordPress.

Internal links point to the wrong address

Blog AI links to your other posts using the addresses Google Search Console reports for them. If your permalinks changed recently, connect Google and let it sync, then run Import posts and pages so Blog AI knows the current addresses.

Scheduled posts go out at the wrong time

You pick the time in your own computer's time zone; WordPress shows it in the site's time zone (Settings → General → Timezone). If the two differ, the time looks shifted in WordPress but the post goes out at the moment you picked.

"WordPress failed to … (HTTP 429)" or "(HTTP 503)"

Your host is limiting requests or was briefly down. Wait a few minutes and click Retry publish. Retrying never creates a duplicate: Blog AI updates the post it already created.

Next

If you use Yoast SEO or Rank Math, install the Blog AI Connector plugin. Zip install before 1.2.0? Reinstall it. Then connect Google. Problems with another connection? See Connection troubleshooting.