Publishing integrations

WordPress

We publish through the WordPress REST API with an application password — no plugin to install, nothing running on your server, and a credential you can revoke from your own dashboard.

Before you start#

You needWhy
WordPress 5.6 or newerApplication passwords are built in from 5.6. Earlier versions need a plugin we do not support.
A user who can publish postsEditor or Administrator. A Contributor can create drafts but not publish them, and the connection test says so.
HTTPS on the siteWordPress disables application passwords on plain http, and so do we.
The REST API reachableSome security plugins disable /wp-json entirely. If yours does, allowlist it — see troubleshooting.

Create an application password#

  1. Sign in to WordPress as the user you want articles published as.
  2. Go to Users → Profile (or Users → All Users and edit that user).
  3. Scroll to Application Passwords.
  4. Type a name you will recognise later — Rankli — and click Add New Application Password.
  5. Copy the password it shows you. It is shown once, with spaces in it. Keep the spaces; WordPress ignores them, and removing them by hand is a common way to get a 401.

An application password is a separate credential from the account password. Revoking it on that same screen instantly cuts off publishing and nothing else.

Connect it#

  1. In Rankli, open Integrations → New integration → WordPress.
  2. Site URL — the address of the site itself, e.g. https://acme.com. If WordPress lives in a subdirectory, include it: https://acme.com/blog.
  3. Username — the WordPress login name of that user, not their email.
  4. Application password — the one you just copied.
  5. Publish mode — Publish posts live at the scheduled time; Draft puts each article in your drafts for review. Start on draft if you want to see the first few.
  6. Save. We test the connection immediately.

The test answers two questions separately: whether the credentials authenticate, and whether that user may actually create a post. A credential that authenticates but cannot publish is the failure mode that otherwise only shows up on the first article.

What lands on your site#

FieldWhere it goes
TitleThe post title.
BodyThe post content as HTML, with our own image URLs rewritten to yours.
SlugThe post slug. A collision gets a suffix rather than overwriting your post.
Meta descriptionThe excerpt, and the meta description field of Yoast or Rank Math when one is present.
ImagesUploaded into your media library first, then referenced. The hero becomes the featured image.
Categories and tagsTaken from the connection settings; tags come from the article’s keyword cluster.
AuthorThe user whose application password this is.

Images are uploaded, not hotlinked. Every image is copied into your own media library before the post is created, so nothing on your site depends on our storage staying up or staying the same.

When it does not work#

401 Unauthorized

Nine times in ten the username is wrong (an email address instead of the login name) or the application password was edited. Copy it again, spaces included. If your host strips the Authorization header — some Apache configurations do — add this to .htaccess:

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

403 Forbidden, or the REST API 404s

A security plugin (Wordfence, iThemes, All In One WP Security) is blocking /wp-json or REST authentication. Allow the REST API for authenticated users, or allowlist our publisher, which identifies itself as:

User-Agent: rankli-publisher/1.0

The post appeared but the images did not

The media endpoint refused the upload — usually an upload size limit or a hardened wp-content/uploads. The article still publishes; the failure is recorded on the article row with the status WordPress returned.

A failed publish

Failures are listed on the article with the response we got. Fix the cause and retry from the article, or with POST /articles/{id}/retry-publish. Retries are idempotent: they update the post that already exists rather than creating a second one.