Using CMS AI Agent with WordPress
Everything you need for WordPress, in the order you will actually do it. If you are stuck, the last section has the real error messages and what each one means.
Switch these on first
- An account on the website with Editor or Administrator rights. Make a separate one for CMS AI Agent rather than using your own — then you can remove it later without disturbing anything else.
- An application password, created under Users → Profile on your own website. This is not your login password: it is a separate one that only works for this, and you can withdraw it at any time without changing anything else.
- The WordPress REST API reachable from outside. It is on by default, but some security plugins and some hosts switch it off or block it — if yours does, allow requests to /wp-json/ before you start.
Connecting your website
- In CMS AI Agent, add your website by its address — the same one you type into a browser, including https://.
- We check the address and tell you what we found: that it is WordPress, which version, and that its REST API is answering.
- Enter the username and the application password you created. Keep the spaces in the password — WordPress shows it in blocks of four and it works either way.
- Choose what the connection may do: read only, write drafts, change SEO. It is never "everything", and you can change it afterwards.
- Install the WordPress AI Agent plugin on your website. This step is optional and you can do it later: without it everything in WordPress's own REST API still works, and with it the few things core does not expose work as well.
What you can ask for on WordPress
-
Read content
Looking at what is already on the website: the list of pages and posts, who wrote each one, when it last changed, whether it is published, and the full text of any one of them.
"Which pages have not been touched in over a year?"
-
Create content
Adding something that was not there before: a new page, a new post, a new entry of whatever kind your website uses. It arrives as a draft, with a title, the body text and a short summary, ready for you to read before anyone else can.
"Add a page about our new opening hours and leave it as a draft."
-
Edit content
Changing something that is already there: the title, the body text, the summary. You are told exactly which items were touched, and your website keeps its own history of what they said before.
"Change the phone number on the Contact page to the new one."
-
Publish content
Moving something between draft, published and private. This is the step that decides whether the public can see a page, which is why it is a thing you ask for on purpose rather than something that happens on the way past.
"Publish the draft about the Saturday market."
-
Schedule content
Setting a date and a time in the future for something to appear, so a post written on a Tuesday afternoon goes live on Monday morning with nobody at a keyboard.
"Set the Christmas opening hours post to go live on the first of December."
-
Manage images and files
Putting images and files onto the website and filling in the text that belongs with them: the title, the caption, and the alt text that a screen reader speaks and a search engine reads in place of the picture.
"Put last week's photos into the gallery and write alt text for each one."
-
Manage categories and tags
Organising content so people can find it: which category a post sits in, which tags it carries, and creating a new category or tag where there is a real need for one.
"Put all the recipe posts into the Recipes category."
-
Edit SEO information
The text that does not appear on the page but decides how the page looks in a search result and when somebody shares it: the SEO title, the description under it, and the alt text on images.
"Which pages have no SEO description? Write one for each of them."
-
Manage menus
The menus a visitor clicks: adding an item, renaming one, putting them in a different order, moving one underneath another.
"Add the new Opening Hours page to the main menu, after Contact."
-
Custom content types
Few websites hold only pages and posts. A property site has properties, a restaurant has dishes, a school has courses. This is working with those, in their own fields, instead of forcing everything to be a blog post.
"Add a new dish to the menu: the name, the description and the price."
-
Site information
The plain facts about the website: what it is called, what software and which version it runs, how many pages and posts it holds, which languages it is written in, and when it last changed.
"How many pages does my website have, and when was each one last updated?"
-
Administrative information
What is installed, what has an update waiting, and who has an account on the website. Reads only: it cannot install, update, activate or remove a plugin or theme, change a setting, or add or change a user.
"Is anything on my website waiting for an update?"
What it will not do on WordPress
WordPress has no way to do this, so this agent does not offer it. What it would have meant:
-
Bulk changes
The same change across many items at once. Nothing happens straight away: you are shown the whole list first, with the value as it is now beside the value proposed for it, and it runs only after you have said yes. It can be stopped partway and it can be undone.
-
Manage redirects
Sending an old address to a new one, so a link somebody saved or a result still sitting in Google lands on the right page instead of an error. It can also list everything that is already being sent somewhere else.
Worth knowing about WordPress
- An application password can be withdrawn from Users → Profile on your own website at any moment, and the connection stops working immediately. You do not need us to do it, and you do not need to change your own password.
- Anything written arrives as a draft. Publishing is a separate thing you ask for, so nothing an assistant writes can reach the public by accident.
- SEO fields come from Yoast or Rank Math if you have one of them installed, and from the companion plugin if you do not. If neither is there, the SEO fields are the ones WordPress itself keeps, which is fewer.
- Security plugins are the usual reason a healthy-looking site refuses us. Wordfence, iThemes and several hosts block REST API requests from outside by default, and the error says so when they do.
When something goes wrong
The failures people actually meet, with the exact words CMS AI Agent will show you. The message is in English wherever you are, because that is what the software says.
The address is accepted, but the check cannot find WordPress at it.
What you will see
What to do
Open yoursite.com/wp-json/ in a browser. If you get a page of data, the API is fine and the address you gave us is probably wrong — check for a missing www, a redirect to another domain, or a site that lives in a subfolder. If you get an error or a 404, the REST API has been switched off, usually by a security plugin or a snippet in the theme.
The username and password are refused, even though they are the ones you just created.
What you will see
What to do
This is almost always the wrong kind of password. An application password is created under Users → Profile, at the bottom of the page, and is shown to you once — your normal login password will not work here and never does. Create a fresh one and paste it exactly as shown.
The account signs in, but nothing can be changed.
What you will see
What to do
The account is probably a Subscriber, Contributor or Author. Give it Editor rights, or make the connection with an account that already has them.
The site clearly answers in a browser, but we are turned away — often with "Not Acceptable" or a 403.
What you will see
What to do
Something in front of WordPress is blocking us: a security plugin, Cloudflare, or the host's own firewall. "Not Acceptable" in particular is usually ModSecurity on shared hosting. Ask your host to allow requests to /wp-json/, or add an exception in the security plugin.
Most things work, but one particular request says a plugin is needed.
What you will see
What to do
A few things have no route in WordPress's own REST API — what needs updating, redirects, and some SEO fields. Install the WordPress AI Agent plugin and they start working. Everything else carries on without it.