Wordpress Rest

---
name: wordpress-rest
description: WordPress REST API client — connect to a live WP site to publish/update posts & pages (draft→publish), upload media, manage categories/tags, write Yoast/RankMath SEO meta, and audit existing content. Use when pushing generated marketing content to WordPress or auditing live WP articles. Auth via Application Passwords (env vars only). Consumer/client skill (not for building WP plugin endpoints).
license: MIT
---

# WordPress REST Client

Connect to a live WordPress site to publish, update, and audit content via the `wp/v2` REST API.

## When to Use

- Push generated marketing/blog content to WordPress (draft by default)
- Update an existing WP post/page (idempotent, by slug or id)
- Upload media + set featured image
- Manage categories/tags
- Write Yoast/RankMath SEO meta
- Audit a live WP article (fetch → feed to `seo` / claude-seo skills)

**NOT for:** building WP plugin REST endpoints (PHP server-side — out of scope; that is the official `wp-rest-api` skill's domain).

## Credentials (env vars ONLY)

| Var | Purpose |
|---|---|
| `WP_SITE_URL` | e.g. `https://example.com` (no trailing slash) |
| `WP_USER` | WordPress username |
| `WP_APP_PASSWORD` | Application Password (WP Profile → Application Passwords) |

NEVER hardcode credentials. NEVER echo/log the password. Auth header = `Basic base64("$WP_USER:$WP_APP_PASSWORD")`.

## Safety gates (MANDATORY)

1. **PREFLIGHT** — `GET $WP_SITE_URL/wp-json/` must succeed before any write.
2. **DRAFT DEFAULT** — every create/update sends `status:"draft"` unless the user explicitly passed a publish flag AND confirmed.
   > Publishing to a live site is outward-facing and hard to reverse. This skill ALWAYS creates/updates as `status:"draft"`. To publish live, the user must explicitly request it (e.g. `--publish` flag on `/mk:content publish`) AND the model must echo the target URL + title and get an explicit "yes" before sending `status:"publish"`.
3. **IDEMPOTENT** — before create, `GET ?slug=<slug>`; if it exists → update that id, else create. Never blind-POST a duplicate.

## Quick Reference (load on demand)

- Auth & preflight: `references/auth-and-preflight.md`
- Posts & pages: `references/posts-and-pages.md`
- Media: `references/media.md`
- Taxonomies: `references/taxonomies.md`
- SEO meta: `references/seo-meta.md`
- Audit: `references/audit.md`
- Errors: `references/error-handling.md`

## Scripts

- `scripts/wp-auth-header.js` — build `Authorization: Basic <b64>` from env (password never printed)
- `scripts/wp-media-upload.js` — raw-binary media upload helper to `/wp-json/wp/v2/media`

## Implementation Workflow

1. Load `auth-and-preflight.md` → verify connectivity + capability.
2. For publish: load `posts-and-pages.md` → idempotent upsert (draft).
3. Media / taxonomy / SEO meta as needed (load those refs).
4. Confirm + flip to publish ONLY on explicit user flag + confirmation.
5. For audit: load `audit.md`.

Load only the reference needed for the current step to keep context lean.

## Cross-references

- `skills/integrations/mcp-wordpress/SKILL.md` — MCP wrapper (routes here as fallback)
- `.claude/skills/marketing/seo/SKILL.md` — claude-seo orchestrator (audit consumer)
- `.claude/workflows/automation-rules.md` — MCP + idempotency + PII rules