WordPress runs a large share of the web, and it has a proper REST API — which means you can draft, schedule and publish into it from another tool without anyone logging into wp-admin and pasting HTML. This guide covers connecting it safely and the settings that decide whether a published post actually performs.
Connect with an Application Password, not your login
Never hand your WordPress account password to a third-party tool. Since WordPress 5.6 there is a built-in mechanism for exactly this: Application Passwords, which are revocable per-integration credentials.
- 1In WordPress, go to Users → Profile (or edit the user you want to publish as).
- 2Scroll to Application Passwords, enter a name that identifies the integration, and click Add New.
- 3Copy the generated password immediately — it is shown once and never again.
- 4In your publishing tool, supply the site URL, the WordPress username, and this application password.
Why this is safer
An application password only grants the capabilities of that user, can be revoked individually without changing your real password, and does not allow logging into wp-admin. If an integration is compromised you revoke one credential rather than resetting everything.
Publish as a user with the Author or Editor role rather than Administrator. Automation rarely needs the ability to install plugins or edit theme files, and limiting the role limits the blast radius.
Common connection problems
| Symptom | Usual cause | Fix |
|---|---|---|
| 401 Unauthorized | Authorization header stripped by the server | Add the SetEnvIf rewrite for HTTP_AUTHORIZATION to .htaccess, or ask your host to pass it through |
| 404 on /wp-json/ | REST API disabled or permalinks set to Plain | Set permalinks to Post name and re-save; check for a plugin disabling REST |
| 403 Forbidden | Security plugin blocking the API | Allowlist the REST route in Wordfence/iThemes or whatever is installed |
| Works locally, fails live | Firewall or Cloudflare rule blocking non-browser requests | Allowlist the publishing tool, or the request user agent |
| Post created but empty | Content sent in the wrong field | Content belongs in `content`, not `excerpt` or `description` |
The 401 case is far and away the most common, and it is a server configuration issue rather than a WordPress one — Apache and some managed hosts drop the Authorization header before PHP ever sees it.
What the REST API sets — and what it does not
The core API handles the post itself cleanly: title, content, excerpt, slug, status, publish date, categories, tags, featured image and author. Scheduling is just a matter of setting status to `future` with a `date` in the future.
What it does not handle natively is your SEO plugin's fields. Yoast, Rank Math and All in One SEO store meta title, meta description and canonical in post meta, and those fields are only writable over the API if the plugin registers them or you register them yourself.
- ●Rank Math and Yoast both expose their fields through the REST API in current versions, but the exact meta keys differ between them.
- ●If your SEO fields are not writable, the practical fallback is putting a well-written H1 and first paragraph in place and letting the plugin generate the meta description from the content.
- ●Do not leave meta descriptions blank on pages you care about — Google will write its own, and it will not be persuasive.
Check these before publishing
- 1Slug — short, keyword-bearing, no dates or stop words. Changing it after publish means a redirect, so get it right first.
- 2One H1 only. Most themes render the post title as the H1, so your body content should start at H2.
- 3Featured image sized and compressed. WordPress generates several sizes, but it will not fix a 4MB upload.
- 4Alt text on meaningful images — set it in the media library, not just the post.
- 5Categories and tags used deliberately. Tag archives are a common source of index bloat; noindex them unless they earn traffic.
- 6Internal links to and from the new post. A post with no inbound internal links is nearly invisible.
Watch tag and author archives
A default WordPress install indexes tag, category, author and date archives. On a small site that can be thousands of thin pages competing with your real content. Check Search Console's Page Indexing report after launch and noindex whatever is not earning traffic.
Automating the workflow
The value of API publishing is not saving the two minutes of copy-paste — it is that content can move through review and approval in one system and land in WordPress already formatted, tagged and scheduled.
A sensible pattern: draft and edit in your content tool, route through approval, publish to WordPress as `draft` first for a final visual check on the real theme, then flip to `publish` or schedule. Publishing straight to live with no rendered preview is how broken layouts reach production.
Publishing to WordPress from Flux N Pro
Connect under Settings → Integrations → CMS with your site URL, username and application password. Articles written or approved in the Content Hub can then be pushed to WordPress as draft, scheduled or published, and the connection can be re-tested at any time without re-entering credentials. Multiple WordPress sites can be connected on plans that allow more than one project.
Frequently asked questions
Do I need a plugin to publish to WordPress via API?
No. The REST API is built into WordPress core and enabled by default. You only need a plugin if your SEO meta fields are not exposed over the API and you want to set them programmatically.
What is an Application Password?
A revocable, per-integration credential built into WordPress since version 5.6. It authenticates API requests without exposing your real password, cannot be used to log into wp-admin, and can be revoked individually.
Why do I get a 401 error with correct credentials?
Most often the server is stripping the Authorization header before PHP receives it — common on Apache and some managed hosts. Adding a SetEnvIf rule for HTTP_AUTHORIZATION to .htaccess usually resolves it.
Can I schedule posts through the API?
Yes. Set the post status to `future` and provide a `date` in the future. WordPress cron then publishes it. Note that WP-Cron fires on page visits, so very low-traffic sites can publish late unless a real system cron is configured.
Can I publish to multiple WordPress sites?
Yes — each site is a separate connection with its own URL and application password. How many you can connect at once depends on your plan.
Try the Content Studio
Run the checks described in this guide against your own site — free, no account needed.
Open Content Studio →Get new guides by email
Occasional, practical SEO writing. No sequences, no upsells.