Large language models are now a common part of the content creation workflow, but the last step is almost always manual: you copy the text from the chat interface and paste it into the WordPress editor.

This step can be removed. WordPress includes a REST API and an authentication method called application passwords, and Claude can execute code that sends requests to it. With a few minutes of configuration, you can ask Claude to create a post on your site and have it appear in the WordPress admin a few seconds later.

In this guide I will cover the complete process, from the creation of the application password to the prompt, the Claude settings, and the security and troubleshooting aspects.

If you prefer a video, the same procedure is available on our YouTube channel:

How This Method Works

Three separate pieces make this possible.

The WordPress REST API

Every WordPress installation since version 4.7 exposes a REST API under the /wp-json/ route. Posts are managed through the /wp-json/wp/v2/posts endpoint, and a POST request to that route creates a new post.

Application passwords

Introduced in WordPress 5.6, this feature generates a dedicated password that authenticates API requests without exposing your account password. Authentication uses HTTP Basic Auth, which means each request carries an Authorization header built from your WordPress username and the application password. The authentication page of the REST API handbook describes the available methods.

Code execution in Claude

Claude can run code in a sandboxed environment, which is what allows it to send an HTTP request to your site. Network access from that environment is restricted by default, so your domain must be explicitly allowed. The Anthropic documentation covers the feature in Create and edit files with Claude.

Requirements

Before starting, verify the following:

  1. WordPress 5.6 or later, so that application passwords are available.
  2. A site served over a secure connection. Application passwords are supported only on sites using SSL or on installations where the environment type is set to local. On a standard local installation without the WP_ENVIRONMENT_TYPE constant defined, the feature will not appear.
  3. A user account with sufficient capabilities. Creating and publishing posts requires the publish_posts capability, which belongs to the Author role and above. A Contributor can only create drafts.

Step 1: Create the Application Password

In the WordPress admin, open your user profile from Users → Profile, then scroll down to the Application Passwords section.

WordPress user profile page with the Application Passwords section visible
The Application Passwords section in the WordPress user profile.

Enter a name that identifies where the password will be used, for example Claude, and click Add Application Password. The name has no functional effect, but it helps to identify the password when you have several integrations.

WordPress generates the password and displays it once. It is shown in groups of four characters separated by spaces, and both the spaced and unspaced forms are accepted during authentication.

Generated application password displayed in the WordPress admin after creation
The generated password is displayed only once, immediately after creation.

Copy it now. If you lose it, the only option is to revoke the entry and generate a new one.

Step 2: Write the Prompt

The prompt has to communicate the task, the target site, the credentials, and the desired post status. Here is a working example.

I need you to publish a post named "Test Post 1" with dummy content
on the site example.com with username admin and application
password 8bx1 8RtR XzqV 4fVJ f3w3 ZMTa and set it to private status.

A few notes on this structure:

  • The username is mandatory. As explained above, Basic Auth requires it. Without it, Claude has to guess or look it up, and many sites restrict the endpoint that would reveal it.
  • Specify the status explicitly. If you omit it, the WordPress REST API defaults to draft. Using private for the first test keeps the post out of public view while you verify the integration.
  • The domain can be written with or without the protocol. Claude builds the endpoint URL from it.

Once the integration works, the same prompt structure can carry the real content, along with any other field the REST API accepts, such as the excerpt, the categories, or the tags.

Claude interface showing the prepared prompt with domain, username and application password
The complete prompt, with the domain, the username and the application password.

Step 3: Allow Your Domain in the Claude Settings

Code execution in Claude runs with restricted network access. By default only a limited set of domains is reachable, mostly package managers, so a request to your site is blocked before it leaves the sandbox.

Open the Claude settings and select the Capabilities tab, then scroll down to the Code execution and file creation section. Three things need to be in place:

  1. Code execution and file creation must be enabled.
  2. Allow network egress must be enabled.
  3. Your domain must be listed under Additional allowed domains.
Claude settings showing the Code execution and file creation section with the additional allowed domains field
The domain is added under Additional allowed domains in the Capabilities tab.

Note that these are account-level settings rather than per-device ones, so a change made in the desktop application also applies to claude.ai and to the mobile apps.

Step 4: Send the Prompt and Verify the Result

Close the settings, return to the conversation and send the prompt. Claude writes and executes the request, then reports the outcome. This normally takes a few seconds.

Claude confirming that the post has been created on the WordPress site
Claude confirms that the post has been submitted.

Do not rely on the confirmation message alone. Open the Posts menu in the WordPress admin and check that the post exists, that the title matches, and that the status is the one you requested.

WordPress Posts list showing the new post created through the REST API
The new post appears in the Posts menu with the private status.

If the post is there, the integration works and the remaining steps in this guide are refinements.

Step 5: Follow-Up Instructions

Once the credentials are in the conversation, Claude retains them for the following messages. This means further operations require only a short instruction, without repeating the domain or the password.

Scheduling is a useful example.

Schedule publishing this post for 9:00 AM next Monday.

Other follow-up operations work the same way. You can update the content of the post, assign categories or tags, change the excerpt, or switch the status from private to published.

Security Considerations

An application password is a credential with real reach, and a few precautions are worth applying.

  • Application passwords carry the full capabilities of the user. WordPress does not provide granular scopes for them. A password created on an Administrator account can do anything that administrator can do, including operations unrelated to publishing. For this reason, consider creating a dedicated user with the Author or Editor role and generating the application password from that account.
  • Revoke passwords you no longer use. The Application Passwords section lists every generated password with its last use date, and each one can be revoked individually from there. Revoke the password immediately if you have shared a screen, published a screenshot, or stopped using the integration.

Troubleshooting

The Application Passwords section is missing from the profile

The site is not served over a secure connection, or a security plugin has disabled the feature.

The request returns a 403 error, or Claude reports that the domain is blocked

The domain is missing from Additional allowed domains, or network egress is disabled. Check both, and start a new conversation after changing the settings.

The response mentions that you are not allowed to create posts

The user account lacks the required capability. Contributors cannot publish, and a post created with the publish or private status requires the publish_posts capability.

The REST API returns a 404 or an authentication error on every request

Some security plugins disable the REST API for unauthenticated requests or restrict specific routes. Check the configuration of any security plugin installed on the site.

An Alternative Approach: MCP

The method described here is direct and requires no plugin, but it is not the only option. The Model Context Protocol provides a more structured connection between Claude and WordPress, with defined tools rather than ad hoc requests, which is preferable if you interact with your site regularly rather than occasionally.

We covered that setup in a separate video: Connect Claude to WordPress Using MCP.

Working With Markdown

If you work with Markdown, whether written manually or generated with Claude, our Ultimate Markdown plugin can create WordPress posts from it, with a manual import or using its own REST API endpoint.

Conclusion

Publishing from Claude through the WordPress REST API requires no additional software. You need an application password, a domain added to the Claude allowlist, and a prompt that includes the domain, the username and the password.

The part that deserves attention is not the setup but the credential. Use a dedicated account with the minimum role the workflow needs, and revoke the password when the integration is no longer in use.