Skip to main content

Connecting to WordPress

Machined.ai lets you connect to unlimited WordPress sites to publish content directly.

Connections are set up per project. Open Project settings (the gear icon next to the project name at the top of the page), go to the Integrations tab, and click the WordPress tile under Connect a CMS.

The Integrations tab in Project settings, showing Publishing destinations with the CMSs you can connect

Only workspace owners and admins can add, edit or remove integrations. Other members see the connections but can't change them.

Connection methods​

There are two ways to connect:

Whichever method you use, enter just your site address in WordPress URL, for example https://your-site.com. Links that include /wp-admin, /wp-login.php or /wp-json are rejected.

Connecting automatically​

Select Automatic ("One-click OAuth setup"), enter your WordPress URL and click Connect. Machined takes you to your WordPress site, where you approve the connection. No credentials are needed. Once approved, you're brought back to the Integrations tab.

Make sure you're already logged in to your WordPress admin in the same browser before you start, as the user you want Machined to publish as (see What Machined can access). The approval link is valid for 15 minutes.

If the connection doesn't complete, you'll see a message explaining why, for example Authorization declined (the request was declined in WordPress), Connection link expired (start a new connection) or Site already connected (a connection for that site already exists).

Connecting Manually​

Select Manual ("Enter credentials") and enter your credentials.

  • WordPress URL: your site's domain (e.g. https://your-site.com)
  • Username: the WordPress username of the user you created the application password for (not the application password name)
  • Application Password: generated in the next step

Create an application password​

You can create the application password for any WordPress user. Machined can do anything that user can do, so to limit its access we recommend a separate user with the Editor role (see What Machined can access).

  1. Log into your WordPress admin as an Administrator and click Users in the sidebar

WordPress dashboard with Users highlighted in the sidebar

  1. To limit Machined's access (recommended): click Add User, fill in the new user's details, choose Editor as the role and save. To use an existing user instead, skip to the next step

The Users page with the Add User button highlighted

  1. On the Users page, click the username of the user Machined will publish as: the Editor you just created, or an existing user

The Users page with a username highlighted

  1. Scroll down to the Application Passwords section. Enter "Machined" in New Application Password Name and click Add Application Password

The Application Passwords section of a WordPress user profile

  1. Copy the generated password straight away with Copy. WordPress won't show it again

The new application password for Machined, with its Copy button

Paste the password into Machined and click Connect.

Once connected, the site appears under Publishing destinations with a Connected status.

What Machined can access​

When you connect, Machined gets access to your WordPress site to create and update posts.

What you give Machined​

An application password for a WordPress user. With the automatic connection, WordPress creates one for the user you're logged in as when you approve.

What it can do​

Anything that WordPress user can do. WordPress has no narrower kind of application password, so a password for an Administrator can also manage users, plugins and settings.

What Machined uses it for​

  • Checking the login, including the user's role
  • Listing categories and tags, and creating new ones
  • Creating and updating posts, and checking their status
  • Uploading images and setting their alt text and captions

How to limit it​

Create a separate WordPress user for Machined with the Editor role, and connect as that user rather than an Administrator. If you connect as an Administrator, Machined still connects but suggests an Editor user instead. The Author role limits Machined to its own posts, but WordPress doesn't let Authors create new categories or tags.

Across every connection​

  • The connection belongs to this project only. Other projects in your workspace can't publish through it.
  • Machined stores your application password encrypted, uses it only on its own servers when connecting and publishing, and never shows it in the app again.
  • Machined never deletes anything in WordPress. Unpublishing an article in Machined doesn't remove the post from WordPress.
  • Removing the connection in Machined deletes the stored application password. To cut off access straight away, also revoke the application password in WordPress: go to Users, click the user's username and find it under Application Passwords.

Managing a connection​

Each connection row has two actions:

  • Move to another project: moves the connection to a different project in your workspace
  • Remove connection: deletes the connection after you confirm

You can connect as many WordPress sites as you need. Each one is its own connection.

Troubleshooting​

WordFence users​

If you have WordFence installed, disable these two settings:

  • Disable WordPress application passwords
  • Block IPs who send POST requests with blank User-Agent and Referer

WP REST API returns 401​

A 401 error indicates an authentication problem.

  • Check your credentials are correct
  • The username must be your WordPress username, not the application password name
  • The application password may have been revoked. Check in WordPress
  • If WordFence is enabled, configure it as above

WP REST API returns 404​

A 404 error means the REST API endpoint can't be found.

  • Change permalink settings to Post name. See this Stack Overflow thread
  • If you're on Hostinger, disable the Hostinger AI and Hostinger Easy Onboarding plugins

WP REST API returns 403​

A 403 error means access is forbidden. The cause is almost always a security layer in front of your site blocking our connection, not your WordPress account or password.

Many hosts and security plugins (for example Wordfence, iThemes Security, or a Cloudflare firewall) block requests to the WordPress REST API by default. Machined uses that API to connect and publish, so when it's blocked, the connection fails.

How to fix it​

Ask your hosting provider or whoever manages your site's security to allow access to the WordPress REST API from external services. The most reliable way is to add this path to their allow-list:

/wp-json/wp/v2/users/

(More broadly, allowing /wp-json/ will cover publishing too.)

You can also ask them to allow our requests by name. They'll see the identifier MachinedAI in their logs.

Before you contact your host, double-check​

  • Enter just your site address, like https://yoursite.com, not a link that includes /wp-admin or any other path.
  • For the one-click connection, make sure you're already logged in to your WordPress admin in the same browser.
  • Confirm https://yoursite.com/wp-json opens in a browser and shows code (not a login screen or error page). If it doesn't, a plugin may be disabling the REST API.

Specific causes​

Cloudflare​

If the error includes rayId or challenge, Cloudflare is blocking the request.

JWT Authentication​

If the error includes jwt_auth_bad_auth_header, you have JWT authentication installed.

  • Remove the JWT Authentication plugin
WPEngine​

This can be caused by their legacy network configuration.

Last updated on