Connect a reviewed Project to WordPress
Connect one reviewed Project to WordPress without putting a password into the page plan or browser storage, then keep every write inside the controlled publishing workflow.
Last updated
Before you connect
Finish the current Gate decisions first. The first connection is unavailable while any page still lacks the decision required to proceed.
- A public HTTPS WordPress site with the REST API enabled.
- A WordPress user that can create and edit Pages and set title, content, slug and Draft status.
- A WordPress Application Password for that user. Do not use the normal account password.
- Publish permission is required only when you want pSEO Guard to publish verified Drafts.
Create an Application Password
In WordPress, open Users → Profile → Application Passwords, give the credential a name you will recognize, then copy it once. WordPress shows the value only when it is created.
- Use a dedicated Editor account for the connection.
- Store the value in a password manager before leaving WordPress.
- Revoke and replace the Application Password if it is exposed; you do not need to change the WordPress login password.
Run Connection Test before Save
Connection Test performs read-only REST requests. It checks the site, authenticated user, Pages endpoint and field permissions without creating, updating, publishing or deleting content.
- The Site URL must be the final public HTTPS origin.
- Redirects must stay on the same origin.
- Save remains disabled when a required Draft field cannot be written.
How the credential is stored
After a successful test, Save encrypts the Application Password and stores it separately from the Project. The API returns only masked connection state.
- The credential is not written to IndexedDB, the page plan or static HTML.
- Leaving the Destination page clears the typed password from page memory.
- After a page has been written, the WordPress site identity is frozen. You may replace the credential for the same site, but you cannot silently point the existing records at another site.
Disconnect and recovery
Disconnect is available only before durable WordPress content history exists. Once a Project has remote page IDs or Jobs, keep the connection and rotate the same-site credential so rollback remains possible.
- An active deployment Job blocks Gate and Destination changes with an actionable 409 response.
- A failed Connection Test does not replace the existing saved connection.
- Credential cleanup errors are logged safely and do not turn a committed rotation into a false Save failure.
Next action
Use the rule reference when a page needs a decision, or continue through the Docs in order.