WordPress API

Interact with WordPress sites via the REST API. Create, update, and manage posts, pages, media, and more on any WordPress installation.

Quick Start

Single Site (Direct)

CODEBLOCK0

Multi-Site (CLI Wrapper) ⭐

CODEBLOCK1

Authentication

WordPress REST API supports two authentication methods:

1. Application Password (Recommended) ⭐

Setup:

1. 1. Go to: INLINECODE0
2. Scroll to "Application Passwords"
3. Name: "OpenClaw API" (or any name)
4. Click "Add New Application Password"
5. Copy the password (shows only once!)

Format: xxxx xxxx xxxx xxxx xxxx xxxx (24 characters with spaces)

Usage: Pass as --app-password to scripts or set WP_APP_PASSWORD environment variable

2. Basic Auth (Legacy)

Requires Basic Auth plugin. Less secure, not recommended for production.

Environment Variables

Set these to avoid passing credentials every time:

CODEBLOCK2

Multi-Site Management

Configuration

1. 1. Copy the example config:

1. 2. Edit config/sites.json with your sites:

CLI Wrapper (./wp.sh)

CODEBLOCK5

Batch Operations

CODEBLOCK6

Individual Scripts

All scripts support both command-line arguments and environment variables.

Update Post

CODEBLOCK7

Supports:

• - Content (HTML or Gutenberg blocks)
• Title
• Status (publish, draft, pending, private)
• Featured image ID
• Custom fields (meta)

Create Post

CODEBLOCK8

Get Post

CODEBLOCK9

Returns full post data as JSON.

List Posts

CODEBLOCK10

Options:

• - --per-page N - Posts per page (default: 10, max: 100)
• INLINECODE7 - Page number
• INLINECODE8 - Filter by status (publish, draft, pending, private)
• INLINECODE9 - Filter by author

Plugin Integration

Detect Plugins

Automatically detect installed WordPress plugins (ACF, Rank Math, Yoast, JetEngine):

CODEBLOCK11

ACF (Advanced Custom Fields)

Read and write ACF fields with automatic fallback to postmeta:

CODEBLOCK12

Features:

• - Automatic REST API detection with postmeta fallback
• Support for simple, repeater, and group fields
• JSON input/output for complex field structures

SEO Meta (Rank Math & Yoast)

Read and write SEO meta fields with auto-detection:

CODEBLOCK13

Supported fields:

• - Rank Math: title, description, focuskeyword, robots, canonicalurl, schema
• Yoast: title, description, focuskeyword, canonical, metarobotsnoindex, metarobots_nofollow

JetEngine Fields

Read and write JetEngine custom fields (stored as postmeta):

CODEBLOCK14

Elementor Content

Manage Elementor page builder content via _elementor_data meta field:

CODEBLOCK15

Supported widget types:

• - Headings (heading)
• Text Editor (text-editor)
• Buttons (button)
• Generic fallback for other widgets

How it works:

• - Gets page data with _elementor_data meta field
• Parses JSON structure
• Finds widget by ID (recursively through nested elements)
• Updates content based on widget type
• Saves back to WordPress

Media Upload

Upload images and files to WordPress media library:

CODEBLOCK16

Features:

• - Supports local files and URLs
• Auto-detects MIME type
• Returns media ID for further operations
• Can set as featured image in one call

WooCommerce Products

Manage WooCommerce products via REST API v3:

CODEBLOCK17

Authentication:

• - Requires WooCommerce Consumer Key and Consumer Secret
• Get from: WooCommerce → Settings → Advanced → REST API
• Environment variables: WC_CONSUMER_KEY, INLINECODE16

Supported fields:

• - --title / --name - Product name
• INLINECODE19 - Regular price
• INLINECODE20 - Sale price
• INLINECODE21 - Full description
• INLINECODE22 - Short description
• INLINECODE23 - publish, draft, pending, private
• INLINECODE24 - Stock keeping unit
• INLINECODE25 - Stock amount
• INLINECODE26 - Enable stock management

Gutenberg Blocks

WordPress uses Gutenberg block format for content. See references/gutenberg-blocks.md for details.

Example block:
CODEBLOCK18

API Reference

See references/api-reference.md for complete WordPress REST API documentation.

Common endpoints:

• - /wp-json/wp/v2/posts - Posts
• INLINECODE28 - Pages
• INLINECODE29 - Media
• INLINECODE30 - Users
• INLINECODE31 - Categories
• INLINECODE32 - Tags

Error Handling

All scripts return:

• - Exit code 0 on success
• Exit code 1 on error
• JSON output to stdout
• Error messages to stderr

Security

• - ✅ DO: Use Application Passwords
• ✅ DO: Use HTTPS only
• ✅ DO: Store credentials in environment variables
• ❌ DON'T: Hardcode passwords in scripts
• ❌ DON'T: Use Basic Auth in production
• ❌ DON'T: Commit credentials to git

Limitations

• - Requires WordPress 4.7+ (REST API built-in)
• Requires Application Passwords plugin for WordPress <5.6
• Some endpoints require specific user permissions
• Rate limiting depends on host configuration