WordPress MCP setup
With the WordPress add-on you ask Claude about the posts, pages and comments on your website. You need your site address, a username and an application password. This page shows where to find them.
What you need
- A WordPress site that opens with https://.
- A user on that site for Claude. An Editor can work with posts and pages; settings and plugins need an Administrator.
- About five minutes.
- A seat on MCP Hosted, or MCP Self-hosted, with the WordPress add-on.
Where to find it
Your site address
This is the address of your website, for example https://www.example.com. If WordPress lives in a subfolder, add that too.
Your username
The login name of the WordPress user Claude works as. You see it under Users, Profile, next to Username.
Your application password
An application password is a separate password just for AddoCore. It is not your normal password, and you can revoke it on its own.
- Log in to WordPress as the user Claude works as.
- Go to Users, Profile and scroll down to Application Passwords.
- Type AddoCore as the name and choose Add New Application Password.
- Copy the password exactly as shown, spaces included. WordPress shows it only once.
No Application Passwords section? A security plugin may have turned it off. Turn it back on in that plugin, or ask whoever manages your site.
Paste it in AddoCore
- In My Account, open MCP Hosted and pick your seat. On MCP Self-hosted, open your license.
- Go to Tools and choose Set up on the WordPress card.
- Choose Save login details, then Test connection. A green result means it works.
One seat can use several sites. Add each site with its own user and application password. We store your login details encrypted.
About the WordPress add-on · Connect Claude to WordPress: how it works · All setup guides
Running it yourself
Only for MCP Self-hosted when you set things in the .env file instead of in My Account. With the steps above you do not need this.
Show the technical setup
A WordPress MCP setup connects mcp-core to one or more WordPress sites through the REST API, using a WordPress application password. You need the WordPress entitlement, a user on the site and three env vars. Claude then reads posts, pages, media, users, menus and settings; creating and changing content needs read-write mode.
What do you need for a WordPress MCP setup?
You need a running mcp-core installation and the WordPress add-on on the same license. Haven’t installed mcp-core yet? Use the mcp-core install guide first.
- An active license with the
tool:wordpressentitlement, from the WordPress MCP server add-on. - A WordPress site with the REST API reachable at
/wp-json/wp/v2, served over HTTPS. - A WordPress user for Claude, and an application password for that user.
- A seat in My Account → MCP Self-hosted with the WordPress tool ticked.
Added the add-on later? No reinstall and no new download. It is added to your license, and you get an email listing the env vars.
How do you create the application password for a WordPress MCP setup?
Log in as the user Claude acts as, go to Users → Profile and scroll to Application Passwords. Enter a name such as “mcp-core” and click “Add New Application Password”. WordPress shows the password once, in groups of four characters. Copy it as shown, spaces included.
Never use the account’s normal login password. An application password can be revoked on its own, without locking the user out. Its rights are the user’s rights: an Editor can manage posts and pages, but settings, plugins, menus and widgets need an Administrator. Pick the lowest role that covers what Claude has to do in this WordPress MCP setup.
Which env vars does the WordPress MCP setup use?
Three variables cover one site; a JSON variable covers several. The .env in your download contains the required lines empty and the optional ones commented out.
| Variable | Required | Default | Purpose |
|---|---|---|---|
WORDPRESS_SITE_URL | Yes (single site) | none | Site base URL, e.g. https://www.example.com |
WORDPRESS_USERNAME | Yes (single site) | none | The WordPress user the tool acts as |
WORDPRESS_APP_PASSWORD | Yes (single site) | none | The application password |
WORDPRESS_MODE | No | read-only | Fallback mode; the seat’s mode takes precedence |
WORDPRESS_CONNECTIONS | No | none | JSON array for several sites; replaces the three scalar vars |
WORDPRESS_SITE_URL=https://www.example.com
WORDPRESS_USERNAME=claude-editor
WORDPRESS_APP_PASSWORD=xxxx xxxx xxxx xxxx xxxx xxxxYou can also store these values in My Account → MCP Self-hosted → Tools. They are kept encrypted, a running mcp-core picks them up without a new download, and they override the same keys in .env.
How do you connect several sites in one WordPress MCP setup?
Set WORDPRESS_CONNECTIONS to a JSON array with one object per site. Once set, the three scalar variables are ignored.
WORDPRESS_CONNECTIONS=[{"id":"main","label":"Main site","url":"https://site-a.example.com","username":"admin","appPassword":"xxxx xxxx xxxx xxxx xxxx xxxx"},{"id":"blog","label":"Blog","url":"https://blog.example.com","username":"admin","appPassword":"yyyy yyyy yyyy yyyy yyyy yyyy"}]Each entry needs id, url, username and appPassword; label is optional. With two or more sites, every WordPress tool gets a required site parameter and Claude picks the site by id. With one site, that parameter does not exist.
What can Claude do in a read-only or read-write WordPress MCP setup?
Read-only registers 23 tools; read-write adds 18 more. In read-only mode the write tools are not registered at all. You choose the mode per seat when you add it in My Account → MCP Self-hosted → Seats; WORDPRESS_MODE is only the fallback. See entitlements vs. tool modes.
- Read-only: posts, pages, comments, search, media, users, categories, tags, post types and custom posts, menus, menu items and locations, sidebars, widgets, settings, plugins and themes.
- Read-write adds: create and update posts, pages and custom posts, upload and update media, create and update users, categories, tags and menu items, update settings, and moderate comments.
Built-in guardrails: new posts, pages and custom posts are drafts unless Claude passes status: "publish". Comment moderation can approve, hold, mark as spam or trash, but there is no delete tool for comments or users. Media uploads accept a URL or base64 data; URLs on private or internal addresses are refused, with a 25 MB limit and a 15-second timeout.
How do you restart and test the WordPress MCP setup?
Run the update script from your install folder:
./mcp-update.shJust bought the add-on? Force a license check:
docker exec mcp-core npm run refresh-licenseIn Claude, call mcp_status to see the license state, your seat and each tool’s mode. Then ask for “the five latest posts”. For clients with their own tokens, see MCP seats.
Which errors come up during a WordPress MCP setup?
These messages come from the tool and from the WordPress REST API.
- No WordPress tools at all: the log says “No WordPress site is configured”. Fill in the vars or
WORDPRESS_CONNECTIONS, then run./mcp-update.sh. - “WORDPRESS_CONNECTIONS is not valid JSON” or “is missing url/username/appPassword”: fix the array, on one line, with double quotes.
- “Multiple WordPress sites are configured — pass the site parameter” or “Unknown WordPress site”: wrong or missing id; the message lists the configured ones.
- “WordPress [id] API error 401”: wrong username or application password, or the password was revoked.
- API error 403 on menus, widgets, settings or plugins: the user lacks
edit_theme_options,manage_optionsoractivate_plugins. - Drafts missing from lists: non-published content is only visible to users with enough rights.
Your WordPress MCP setup is done when mcp_status lists the tool and a test query returns posts. The other add-ons are in the MCP setup guides.
Ready to try it?