Skip to main content
Glama

šŸš€ MCP WordPress Server

The Most Comprehensive WordPress MCP Server

Manage WordPress sites with natural language through AI tools like Claude Desktop

Quick Start • Why This MCP Server? Installation Options • Documentation • Examples

CI/CD Pipeline GitHub Stars NPM Version NPM Downloads NPM Total Downloads Docker Pulls Line Coverage Branch Coverage Function Coverage Test Results MCP Evaluation

TypeScript Security Tests Vulnerabilities Penetration Testing Docker License

šŸŽ‰ NEW: v2.7.0 - Composition Architecture & Complete SEO Toolkit!

šŸŽÆ Why This MCP Server?

Transform WordPress management from complex admin panels to simple conversations:

āŒ Before: Login → Admin Panel → Navigate → Click → Fill Forms → Save
āœ… After:  "Create a new blog post about AI trends with SEO optimization"

Key Advantages:

  • šŸ† Most Complete: 59 tools vs 20-30 in alternatives

  • ⚔ Fastest Setup: 2-click Claude Desktop installation via DXT

  • šŸ”’ Production Ready: 512 tests (100% pass rate), security audited, battle-tested

  • šŸŽÆ TypeScript Native: 100% type safety, best-in-class developer experience

  • 🌐 Multi-Site: Manage unlimited WordPress sites from one place

Related MCP server: WordPress MCP Server

šŸš€ Quick Start

Get up and running in under 5 minutes:

Prerequisites

  • WordPress: Version 5.6+ with REST API enabled

  • Claude Desktop: Latest version installed

  • Application Password: Generated from WordPress admin panel

3-Step Setup

1ļøāƒ£ Generate WordPress Application Password

WordPress Admin → Users → Profile → Application Passwords → Add New

2ļøāƒ£ Install MCP Server (Choose One)

Option A: DXT Extension (Easiest)

# Download and install in Claude Desktop
curl -L https://github.com/docdyhr/mcp-wordpress/releases/latest/download/mcp-wordpress.dxt -o mcp-wordpress.dxt
# Then: Claude Desktop → Extensions → Install → Select DXT file

Option B: NPM Global Install

npm install -g mcp-wordpress

3ļøāƒ£ Test Your Connection

In Claude: "Test my WordPress connection"
Response: "āœ… Authentication successful! Connected to: Your Site Name"

šŸ“ŗ Watch 2-minute Setup Video | šŸ“– Detailed Setup Guide

⚔ Installation Options

Easiest installation - just 2 clicks!

  1. Download: mcp-wordpress.dxt (3.4MB)

  2. Install: Claude Desktop → Extensions → Install → Select DXT file

  3. Configure: Enter your WordPress site URL and credentials

āœ… Zero command line required
āœ… Automatic updates
āœ… Built-in security

šŸ“– Complete DXT Setup Guide →

šŸš€ Alternative: NPX (Power Users)

# Run directly - always latest version
npx -y mcp-wordpress

# Interactive setup wizard
npm run setup

šŸ“¦ Secondary: Smithery Package Manager

# Install via Smithery (MCP package manager)
smithery install mcp-wordpress

# Configure and start
smithery configure mcp-wordpress

āœ… Package management
āœ… Version control
āœ… Easy updates

Installing via Smithery

To install mcp-wordpress for Claude Desktop automatically via Smithery:

npx -y @smithery/cli install @docdyhr/mcp-wordpress --client claude

šŸ”§ Other Options

šŸ“‹ Configuration Examples

Single Site Setup

Environment Variables (.env)

WORDPRESS_SITE_URL=https://myblog.com
WORDPRESS_USERNAME=admin
WORDPRESS_APP_PASSWORD=xxxx xxxx xxxx xxxx xxxx xxxx
WORDPRESS_AUTH_METHOD=app-password

Claude Desktop Config

{
  "mcpServers": {
    "mcp-wordpress": {
      "command": "npx",
      "args": ["-y", "mcp-wordpress"],
      "env": {
        "WORDPRESS_SITE_URL": "https://myblog.com",
        "WORDPRESS_USERNAME": "admin",
        "WORDPRESS_APP_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx"
      }
    }
  }
}

Multi-Site Agency Setup

Configuration File (mcp-wordpress.config.json)

{
  "sites": [
    {
      "id": "main-corporate",
      "name": "Corporate Website",
      "config": {
        "WORDPRESS_SITE_URL": "https://company.com",
        "WORDPRESS_USERNAME": "admin",
        "WORDPRESS_APP_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx",
        "WORDPRESS_AUTH_METHOD": "app-password"
      }
    },
    {
      "id": "client-restaurant",
      "name": "Restaurant Client",
      "config": {
        "WORDPRESS_SITE_URL": "https://bestrestaurant.com",
        "WORDPRESS_USERNAME": "editor",
        "WORDPRESS_APP_PASSWORD": "yyyy yyyy yyyy yyyy yyyy yyyy",
        "WORDPRESS_AUTH_METHOD": "app-password"
      }
    },
    {
      "id": "client-ecommerce",
      "name": "E-commerce Client",
      "config": {
        "WORDPRESS_SITE_URL": "https://onlinestore.com",
        "WORDPRESS_USERNAME": "shopmanager",
        "WORDPRESS_APP_PASSWORD": "zzzz zzzz zzzz zzzz zzzz zzzz",
        "WORDPRESS_AUTH_METHOD": "app-password"
      }
    }
  ]
}

Development Environment

Local WordPress with Docker

# docker-compose.yml
version: "3.8"
services:
  wordpress:
    image: wordpress:latest
    ports:
      - "8080:80"
    environment:
      WORDPRESS_DB_HOST: db
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpress
      WORDPRESS_DB_NAME: wordpress
    volumes:
      - wordpress_data:/var/www/html

  db:
    image: mysql:8.0
    environment:
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wordpress
      MYSQL_PASSWORD: wordpress
      MYSQL_ROOT_PASSWORD: rootpassword
    volumes:
      - db_data:/var/lib/mysql

volumes:
  wordpress_data:
  db_data:

MCP WordPress Development Config

{
  "sites": [
    {
      "id": "local-dev",
      "name": "Local Development",
      "config": {
        "WORDPRESS_SITE_URL": "http://localhost:8080",
        "WORDPRESS_USERNAME": "admin",
        "WORDPRESS_APP_PASSWORD": "dev-password-here",
        "WORDPRESS_AUTH_METHOD": "app-password"
      }
    }
  ]
}

Production Deployment

Server Environment Variables

# /etc/environment or systemd service
WORDPRESS_SITE_URL=https://production-site.com
WORDPRESS_USERNAME=api-user
WORDPRESS_APP_PASSWORD=secure-production-password
WORDPRESS_AUTH_METHOD=app-password
NODE_ENV=production
CACHE_ENABLED=true
CACHE_TTL=3600
RATE_LIMIT_ENABLED=true
DEBUG=false

Docker Production Setup

# Dockerfile.production
FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY dist/ ./dist/
EXPOSE 3000
USER node
CMD ["node", "dist/index.js"]

JWT Authentication Setup

WordPress Plugin Configuration

// wp-config.php
define('JWT_AUTH_SECRET_KEY', 'your-secret-key-here');
define('JWT_AUTH_CORS_ENABLE', true);

MCP Configuration

{
  "sites": [
    {
      "id": "jwt-site",
      "name": "JWT Authentication Site",
      "config": {
        "WORDPRESS_SITE_URL": "https://site-with-jwt.com",
        "WORDPRESS_USERNAME": "api-user",
        "WORDPRESS_PASSWORD": "user-password",
        "WORDPRESS_AUTH_METHOD": "jwt"
      }
    }
  ]
}

🌟 What Makes This Special

šŸ† Feature Comparison

Feature

This Server

Competition

Tools Available

59 tools

20-30 tools

Claude Desktop DXT

āœ… 2-click install

āŒ Manual setup

Multi-Site Support

āœ… Unlimited sites

āŒ Single site

TypeScript

āœ… 100% coverage

āš ļø Partial/None

Performance Monitoring

āœ… Real-time analytics

āŒ Basic only

Test Coverage

āœ… 404 tests (100% pass / 30% lines)

āš ļø Limited

Production Ready

āœ… Security audited

āš ļø Unknown

šŸš€ Core Capabilities

WordPress Management

  • 59 WordPress Tools across 10 categories

  • Multi-Site Support - Manage unlimited WordPress installations

  • Flexible Authentication - App Passwords, JWT, Basic Auth, API Key

  • Real-Time Sync - Instant updates across all connected tools

Performance & Reliability

  • ⚔ Intelligent Caching - 50-70% performance improvement

  • šŸ“Š Real-Time Monitoring - Performance metrics and optimization insights

  • šŸ”’ Production Ready - Security-reviewed, 96.17% line coverage with Vitest testing framework

  • šŸ”„ Zero Downtime - Graceful error handling and automatic recovery

Developer Experience

  • 100% TypeScript - Complete type safety and IntelliSense

  • 🐳 Docker Support - Production-ready containerization

  • šŸ“š Auto-Generated Docs - API documentation with live examples

  • šŸ”§ Extensible - Custom tool development framework

🌐 Multi-Site Configuration

Perfect for agencies and developers managing multiple WordPress sites:

{
  "sites": [
    {
      "id": "main-site",
      "name": "Main WordPress Site",
      "config": {
        "WORDPRESS_SITE_URL": "https://site1.com",
        "WORDPRESS_USERNAME": "admin",
        "WORDPRESS_APP_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx"
      }
    },
    {
      "id": "client-blog",
      "name": "Client Blog",
      "config": {
        "WORDPRESS_SITE_URL": "https://client-blog.com",
        "WORDPRESS_USERNAME": "editor",
        "WORDPRESS_APP_PASSWORD": "yyyy yyyy yyyy yyyy yyyy yyyy"
      }
    }
  ]
}

Use with site parameter: wp_list_posts --site="main-site"

šŸ“– Complete Multi-Site Setup Guide

šŸ” Authentication Setup

  1. WordPress Admin → Users → Profile

  2. Scroll to Application Passwords

  3. Enter name: "MCP WordPress Server"

  4. Click Add New Application Password

  5. Copy the generated password

Alternative Methods

  • JWT Authentication - With JWT plugin

  • Basic Authentication - Username/password (dev only)

  • API Key Authentication - With API Key plugin

šŸ“– Complete Authentication Guide

šŸ“‹ Available Tools (59 Tools)

Content Management

  • šŸ“ Posts (6 tools) - Create, edit, delete, list posts and revisions

  • šŸ“„ Pages (6 tools) - Manage static pages and revisions

  • šŸ–¼ļø Media (6 tools) - Upload, manage media library and files

User & Community

  • šŸ‘„ Users (6 tools) - User management and profiles

  • šŸ’¬ Comments (7 tools) - Comment moderation and management

  • šŸ·ļø Taxonomies (10 tools) - Categories and tags management

Site Management (Monitoring & Admin)

  • āš™ļø Site Settings (7 tools) - Site configuration and statistics

  • šŸ” Authentication (6 tools) - Auth testing and management

  • ⚔ Cache Management (4 tools) - Performance caching control

  • šŸ“Š Performance Monitoring (6 tools) - Real-time metrics and optimization

šŸ“– Complete Tool Documentation | Live API Reference

šŸ¤– Claude Desktop Integration

šŸŽÆ Real-World Use Cases

Content Creation & Management:

šŸ’¬ "Analyze my top 10 blog posts and create a new post about emerging trends"
šŸ’¬ "Upload these 5 images and create a photo gallery page with SEO optimization"
šŸ’¬ "Review all pending comments and approve the legitimate ones"

Site Management & Analytics:

šŸ’¬ "Check my WordPress site performance and provide optimization recommendations"
šŸ’¬ "Create a new user account for my freelance writer with editor permissions"
šŸ’¬ "Backup my site settings and show me cache performance statistics"

Bulk Operations:

šŸ’¬ "Update all posts from 2023 to include my new author bio"
šŸ’¬ "Find all images over 1MB and suggest compression strategies"
šŸ’¬ "List all users who haven't logged in for 6 months"

āš™ļø Configuration Methods

No configuration needed - built-in secure credential management!

Option 2: NPX in Claude Desktop

{
  "mcpServers": {
    "mcp-wordpress": {
      "command": "npx",
      "args": ["-y", "mcp-wordpress"],
      "env": {
        "WORDPRESS_SITE_URL": "https://your-site.com",
        "WORDPRESS_USERNAME": "your-username",
        "WORDPRESS_APP_PASSWORD": "your-app-password"
      }
    }
  }
}

šŸ“– Complete Integration Guide

šŸ“š Examples

Basic Content Management

Create and Publish a Blog Post

You: "Create a new blog post titled 'AI Revolution in 2024' with content about recent AI breakthroughs"
Claude: "I'll create that blog post for you..."
Result: āœ… Post "AI Revolution in 2024" created successfully (ID: 123)

Media Management

You: "Upload the image at /path/to/image.jpg and set it as featured image for post 123"
Claude: "I'll upload that image and set it as the featured image..."
Result: āœ… Image uploaded (ID: 456) and set as featured image

Advanced Workflows

SEO-Optimized Content Creation

You: "Create an SEO-optimized blog post about 'WordPress Security Best Practices' with:
     - Focus keyword: 'WordPress security'
     - Meta description
     - Proper heading structure
     - At least 1500 words"

Claude: "I'll create a comprehensive SEO-optimized post on WordPress security..."

Bulk Operations

You: "Find all draft posts older than 30 days and provide a summary"
You: "Update all posts in category 'News' to include a disclaimer at the end"
You: "Delete all spam comments from the last week"

Site Management

Performance Monitoring

You: "Analyze my site's performance and suggest optimizations"
Claude: "Let me check your site's performance metrics...
         - Cache hit rate: 67%
         - Average response time: 245ms
         - Recommendations: Enable object caching, optimize images..."

User Management

You: "Create a new editor account for john@example.com with a secure password"
You: "List all users who haven't logged in for 90 days"
You: "Update Sarah's role from Author to Editor"

Multi-Site Management

Working with Multiple Sites

You: "List all posts from my client-blog site"
Claude: "I'll list the posts from the client-blog site..."

You: "Compare traffic between main-site and client-blog"
Claude: "Here's a comparison of both sites..."

šŸŽØ Real-World Workflows

Content Marketing Agency Workflow

Scenario: Managing 20+ client blogs with consistent SEO optimization

šŸ’¬ "Analyze the top 5 performing posts across all sites and create similar content for underperforming clients"
šŸ’¬ "Batch update all client sites with the new privacy policy footer"
šŸ’¬ "Generate a weekly performance report comparing all client sites"
šŸ’¬ "Create social media snippets from the latest blog posts on each site"

E-commerce Store Management

Scenario: Managing product launches and inventory updates

šŸ’¬ "Create a product launch post with gallery, specifications, and pricing for the new iPhone case"
šŸ’¬ "Update all 'out of stock' products with restock notifications"
šŸ’¬ "Generate product comparison pages for similar items"
šŸ’¬ "Create seasonal landing pages with current promotions"

News Website Operations

Scenario: Breaking news and content moderation

šŸ’¬ "Publish breaking news about the tech merger with social media integration"
šŸ’¬ "Moderate comments on controversial articles and flag inappropriate content"
šŸ’¬ "Create topic clusters around trending news stories"
šŸ’¬ "Schedule social media posts for peak engagement times"

Educational Institution Portal

Scenario: Course management and student communications

šŸ’¬ "Create course announcement pages with enrollment forms"
šŸ’¬ "Update faculty profiles with new publications and achievements"
šŸ’¬ "Generate student newsletter with upcoming events and deadlines"
šŸ’¬ "Moderate discussion forums and highlight valuable contributions"

Non-Profit Organization

Scenario: Fundraising campaigns and volunteer coordination

šŸ’¬ "Create donation campaign pages with progress tracking"
šŸ’¬ "Update volunteer opportunity listings with current needs"
šŸ’¬ "Generate impact reports showing donation effectiveness"
šŸ’¬ "Create event registration pages with automated confirmations"

šŸš€ Advanced Automation Examples

Smart Content Workflows

Automated SEO Optimization

You: "Optimize all posts from the last month for better SEO performance"
Claude: "I'll analyze and optimize your recent posts...
- Analyzed 15 posts from the last 30 days
- Updated meta descriptions for 12 posts
- Added focus keywords to 8 posts
- Optimized heading structure in 10 posts
- Improved internal linking in 15 posts
- Average SEO score improved from 67% to 89%"

Content Gap Analysis

You: "Identify content gaps in our blog compared to competitor topics"
Claude: "After analyzing your content and common industry topics...
- Missing topics: 'AI in Healthcare', 'Remote Work Security', 'Green Technology'
- Underperforming categories: 'Tutorials' (only 3 posts vs 15+ needed)
- Recommended: 8 new posts to fill major gaps
- Priority topics based on search volume and competition"

Maintenance Automation

Site Health Monitoring

You: "Perform a comprehensive site health check and fix any issues"
Claude: "Running complete site diagnostics...
- āœ… SSL certificate valid (expires: March 15, 2025)
- āš ļø 3 broken internal links found and flagged
- āœ… All images optimized (average load time: 1.2s)
- āš ļø 2 plugins need updates
- āœ… Database optimized (reduced size by 15%)
- āœ… Cache performance: 78% hit rate"

User Management Automation

You: "Clean up user accounts and update permissions for the new team structure"
Claude: "Updating user management...
- Deactivated 5 inactive accounts (no login >6 months)
- Updated 12 user roles to match new org chart
- Created 3 new editor accounts for content team
- Set up role-based content access restrictions
- Configured automated welcome emails for new users"

Performance Optimization

Intelligent Cache Management

You: "Analyze site performance and implement optimal caching strategies"
Claude: "Implementing performance optimizations...
- Enabled object caching (40% speed improvement)
- Configured CDN for static assets
- Optimized database queries (reduced load time by 25%)
- Set up page caching with smart invalidation
- Compressed and optimized 47 images
- Site speed improved from 3.2s to 1.8s average load time"

šŸŽÆ Industry-Specific Solutions

Healthcare Practices

šŸ’¬ "Create HIPAA-compliant patient information pages with secure forms"
šŸ’¬ "Update doctor profiles with latest certifications and specializations"
šŸ’¬ "Generate appointment booking pages with calendar integration"
šŸ’¬ "Create health education content with medical disclaimers"
šŸ’¬ "Create practice area pages with case study examples"
šŸ’¬ "Update attorney profiles with recent wins and bar admissions"
šŸ’¬ "Generate client intake forms with confidentiality notices"
šŸ’¬ "Create legal blog posts with proper citations and disclaimers"

Real Estate Agencies

šŸ’¬ "Create property listing pages with virtual tour embeds"
šŸ’¬ "Update agent profiles with recent sales and market statistics"
šŸ’¬ "Generate neighborhood guide pages with local amenities"
šŸ’¬ "Create mortgage calculator pages with current rates"

Restaurants & Food Service

šŸ’¬ "Create menu pages with dietary restriction filters"
šŸ’¬ "Update chef profiles with signature dishes and cooking philosophy"
šŸ’¬ "Generate event booking pages for private dining"
šŸ’¬ "Create food blog posts with recipe cards and nutritional information"

šŸ“– More Examples | Use Case Library

šŸ› ļø Troubleshooting Guide

Quick Diagnostics

Connection Issues

# Test WordPress connection
npm run status

# Debug mode with detailed logs
DEBUG=true npm run dev

# Test specific site in multi-site setup
npm run status -- --site="your-site-id"

Authentication Problems

# Verify WordPress application password
curl -u username:app_password https://your-site.com/wp-json/wp/v2/users/me

# Test authentication with different methods
npm run test:auth

# Regenerate application password
npm run setup

Performance Issues

# Check cache performance
npm run test:cache

# Monitor real-time performance
npm run test:performance

# Clear all caches
rm -rf cache/ && npm run dev

Common Error Solutions

Error

Cause

Solution

401 Unauthorized

Invalid credentials

Regenerate application password

403 Forbidden

Insufficient permissions

Check user role (Editor+ required)

404 Not Found

Wrong site URL

Verify WORDPRESS_SITE_URL

SSL Certificate Error

HTTPS issues

Add SSL exception or use HTTP

Connection Timeout

Network/firewall

Check WordPress REST API access

Tools not showing in Claude

Config file format

Validate JSON syntax

Plugin conflicts

WordPress plugins

Disable conflicting plugins

Rate limiting

Too many requests

Implement request throttling

WordPress-Specific Issues

REST API Not Available

# Test REST API directly
curl https://your-site.com/wp-json/wp/v2/

# Check if REST API is disabled
grep -r "rest_api" wp-config.php

# Verify permalink structure
wp-admin → Settings → Permalinks → Post name

Application Password Issues

1. WordPress Admin → Users → Profile
2. Scroll to "Application Passwords"
3. Ensure feature is enabled (WordPress 5.6+)
4. Generate new password if needed
5. Copy password exactly (includes spaces)

Multi-Site Configuration Problems

// Check mcp-wordpress.config.json format
{
  "sites": [
    {
      "id": "unique-site-id",
      "name": "Human Readable Name",
      "config": {
        "WORDPRESS_SITE_URL": "https://site.com",
        "WORDPRESS_USERNAME": "username",
        "WORDPRESS_APP_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx"
      }
    }
  ]
}

Environment-Specific Solutions

Claude Desktop Integration

// Verify claude_desktop_config.json format
{
  "mcpServers": {
    "mcp-wordpress": {
      "command": "npx",
      "args": ["-y", "mcp-wordpress"],
      "env": {
        "WORDPRESS_SITE_URL": "https://your-site.com",
        "WORDPRESS_USERNAME": "your-username",
        "WORDPRESS_APP_PASSWORD": "your-app-password"
      }
    }
  }
}

Docker Deployment Issues

# Check container logs
docker logs mcp-wordpress

# Verify environment variables
docker exec mcp-wordpress env | grep WORDPRESS

# Test network connectivity
docker exec mcp-wordpress curl https://your-site.com/wp-json/wp/v2/

NPX Runtime Problems

# Clear NPX cache
npx clear-npx-cache

# Use specific version
npx mcp-wordpress@latest

# Install globally instead
npm install -g mcp-wordpress

Getting Help

Self-Diagnostics

# Comprehensive health check
npm run health

# Security validation
npm run security:check

# Performance analysis
npm run test:performance

Debug Information Collection

# Generate debug report
DEBUG=true npm run status > debug-report.txt 2>&1

# Include system information
node --version >> debug-report.txt
npm --version >> debug-report.txt
os-info >> debug-report.txt

Community Support

🧪 Testing & Status

Current Test Status āœ…

  • Main Test Suite: 512/512 passed (100%) with Vitest

  • Security Tests: 40/40 passed (100%)

  • Performance Tests: 8/8 passed (100%)

  • CI/CD Pipeline: Fully functional with Vitest integration

Test Your Installation

# Check connection status
npm run status

# Run full test suite (Vitest)
npm test

# Run tests with coverage
npm run test:coverage

# Quick validation
npm run test:fast

šŸ”’ Security Status

Comprehensive Security Testing

Our security posture is continuously monitored through automated testing and vulnerability scanning:

Security Area

Status

Tests

Coverage

XSS Protection

āœ… Secure

6/6 passing

Script injection, URL validation, HTML sanitization

SQL Injection

āœ… Secure

3/3 passing

Query parameterization, input validation

Path Traversal

āœ… Secure

3/3 passing

File path validation, directory restrictions

Input Validation

āœ… Secure

9/9 passing

Length limits, format validation, sanitization

Authentication

āœ… Secure

7/7 passing

Bypass prevention, token validation

Rate Limiting

āœ… Secure

3/3 passing

DoS protection, request throttling

Information Disclosure

āœ… Secure

2/2 passing

Error sanitization, sensitive data protection

Penetration Testing

āœ… Secure

12/12 passing

Comprehensive attack simulation

Security Features

  • šŸ›”ļø Input Sanitization: All user inputs are validated and sanitized

  • šŸ” Authentication Security: Multi-method auth with bypass prevention

  • ⚔ Rate Limiting: Built-in protection against abuse and DoS attacks

  • šŸ” Vulnerability Scanning: Daily automated security scans

  • šŸ“Š Real-time Monitoring: Continuous security status updates

  • 🚨 Automated Alerts: Immediate notification of security issues

Security Testing Commands

# Run comprehensive security tests
npm run test:security

# Run penetration testing suite
npm run test:security:validation

# Security vulnerability audit
npm audit

# Full security validation
npm run security:full

Security Compliance

  • OWASP Top 10: Complete protection against common vulnerabilities

  • CVE Monitoring: Automated scanning for known vulnerabilities

  • Security Headers: Proper HTTP security headers implementation

  • Data Protection: Sensitive credential redaction and secure storage

  • Access Control: Role-based permissions and authentication validation

šŸ“– Complete Security Documentation | Security Test Results

šŸ› Troubleshooting

Common Issues

  1. "Cannot connect to WordPress"

    • Verify WORDPRESS_SITE_URL

    • Test REST API: curl https://your-site.com/wp-json/wp/v2/

  2. "Authentication failed"

    • Check username and application password

    • Ensure Application Passwords are enabled

    • Run npm run setup to reconfigure

  3. "Tools not appearing in Claude"

    • Restart Claude Desktop after configuration

    • Check Claude Desktop config file format

Get Help

# Debug mode
DEBUG=true npm run dev

# Connection test
npm run status

# Re-run setup wizard
npm run setup

šŸ“š Documentation

Getting Started

User Guides

Integration Guides

Developer Documentation

Deployment & Operations

šŸ”§ Requirements

  • WordPress 5.0+ with REST API enabled

  • HTTPS recommended for production

  • User with appropriate permissions

  • Application Passwords enabled (WordPress 5.6+)

WordPress User Roles

Role

Access

Administrator

Full access to all functions

Editor

Posts, pages, comments, media

Author

Own posts and media

Contributor

Own posts (drafts only)

Subscriber

Read only

šŸ“¦ Installation Options

NPM Package

# Global installation
npm install -g mcp-wordpress

# Direct usage (recommended)
npx -y mcp-wordpress

Docker Images

# Latest version
docker pull docdyhr/mcp-wordpress:latest

# Specific version
docker pull docdyhr/mcp-wordpress:1.3.1

Distribution Channels

šŸš€ Next Steps

Ready to transform your WordPress management?

  1. šŸ† Download DXT Extension - Easiest setup (2 minutes)

  2. ⚔ Try NPX Method - Power user setup (5 minutes)

  3. šŸ“š Explore All Tools - See what's possible

  4. šŸ’¬ Join Discussions - Get help and share ideas


šŸ”— Similar Projects

Looking for alternatives or complementary tools? Check out these WordPress MCP implementations:


šŸ“‹ Changelog

v2.5.4+ (August 2024) šŸŽ‰

  • šŸ†• Multi-Site DXT Extension - New UI toggle for managing multiple WordPress sites in Claude Desktop

  • šŸ”§ Enhanced Configuration - Auto-detection of multi-site configuration files

  • ⚔ Performance Improvements - Optimized caching and request handling

  • šŸ›”ļø Security Updates - Enhanced input validation and dependency updates

  • šŸ› Bug Fixes - Resolved hook path issues and improved error handling

  • šŸ“š Documentation - Updated setup guides and troubleshooting information

v2.5.0 (July 2024)

  • šŸš€ Production Ready - Comprehensive testing suite with 96%+ coverage

  • šŸ”’ Security Framework - Full security validation and penetration testing

  • šŸ“Š Performance Analytics - Real-time monitoring and optimization tools

  • šŸŽÆ Tool Enhancements - 59 WordPress management tools across 10 categories

v2.0.0 (June 2024)

  • šŸ—ļø Architecture Overhaul - Migrated to modern TypeScript architecture

  • 🌐 Multi-Site Support - Complete multi-site WordPress management

  • šŸ’¾ Intelligent Caching - 50-70% performance improvement

  • šŸ” Authentication Methods - Support for 4 authentication types


šŸ™ Acknowledgments

Special thanks to Stephan Ferraro for the upstream project that inspired this implementation.


⭐ Found this helpful? Give us a star on GitHub! ⭐

Available Tools

70 tools
wp_approve_commentC

Approves a pending comment.

Inputs: id (required), site.

wp_cache_clearC

Clear cache for a WordPress site.

Inputs: site, pattern.

wp_cache_infoB

Get detailed cache configuration and status information.

Inputs: site.

wp_cache_statsB

Get cache statistics for a WordPress site.

Inputs: site.

wp_cache_warmC

Pre-warm cache with essential WordPress data.

Inputs: site.

wp_create_application_passwordC

Creates a new application password for a user.

Inputs: user_id (required), app_name (required), site.

wp_create_categoryC

Creates a new category.

Inputs: name (required), site, description.

wp_create_commentC

Creates a new comment on a post.

Inputs: post (required), content (required), site, author_name, +1 more.

wp_create_pageC

Creates a new page.

Inputs: title (required), site, status, content.

wp_create_postA

Creates a new WordPress post with comprehensive validation and detailed success feedback including management links.

Usage Examples: • Simple post: wp_create_post --title="My New Post" --content="<p>Hello World!</p>" • Draft post: wp_create_post --title="Draft Post" --status="draft" • Categorized post: wp_create_post --title="Tech News" --categories=[1,5] --tags=[10,20] • Post with featured image: wp_create_post --title="My Post" --content="<p>Content</p>" --featured_media=42 • Remove featured image: wp_create_post --title="My Post" --featured_media=0 • Scheduled post: wp_create_post --title="Future Post" --status="future" --date="2024-12-25T10:00:00" • Complete post: wp_create_post --title="Complete Post" --content="<p>Content</p>" --excerpt="Summary" --status="publish"

Inputs: site.

wp_create_tagC

Creates a new tag.

Inputs: name (required), site.

wp_create_userC

Creates a new user.

Inputs: email (required), password (required), username (required), site, +1 more.

wp_delete_application_passwordC

Revokes an existing application password.

Inputs: uuid (required), user_id (required), site.

wp_delete_categoryC

Deletes a category.

Inputs: id (required), site.

wp_delete_commentC

Deletes a comment.

Inputs: id (required), site, force.

wp_delete_mediaC

Deletes a media item.

Inputs: id (required), site, force.

wp_delete_pageC

Deletes a page.

Inputs: id (required), site, force.

wp_delete_postB

Deletes a WordPress post with options for trash or permanent deletion. Includes safety confirmations and detailed feedback on the deletion action.

Usage Examples: • Trash a post: wp_delete_post --id=123 (moves to trash) • Permanent deletion: wp_delete_post --id=123 --force=true • Bulk operations: Use multiple calls with different IDs

Inputs: site.

wp_delete_tagC

Deletes a tag.

Inputs: id (required), site.

wp_delete_userC

Deletes a user.

Inputs: id (required), site, reassign.

wp_get_application_passwordsC

Lists application passwords for a specific user.

Inputs: user_id (required), site.

wp_get_auth_statusB

Gets the current authentication status for a configured WordPress site.

Inputs: site.

wp_get_categoryB

Retrieves a single category by its ID.

Inputs: id (required), site.

wp_get_commentB

Retrieves a single comment by its ID.

Inputs: id (required), site.

wp_get_current_userA

Retrieves the currently authenticated user with comprehensive profile information including roles, capabilities, and account details.

Usage Examples: • Get current user: wp_get_current_user • Check permissions: Use this to verify your current user's capabilities and roles • Account verification: Confirm you're authenticated with the correct account • Profile details: View registration date, email, and user metadata

Inputs: site.

wp_get_mediaB

Retrieves a single media item by its ID.

Inputs: id (required), site.

wp_get_pageC

Retrieves a single page by its ID.

Inputs: id (required), site.

wp_get_page_revisionsC

Retrieves revisions for a specific page.

Inputs: id (required), site.

wp_get_postB

Retrieves detailed information about a single post including metadata, content statistics, and management links.

Inputs: site.

wp_get_post_revisionsA

Retrieves the revision history for a specific post, including details about changes, dates, and authors for content management and auditing purposes.

Inputs: site.

wp_get_site_settingsB

Retrieves the general settings for a WordPress site.

Inputs: site.

wp_get_tagB

Retrieves a single tag by its ID.

Inputs: id (required), site.

wp_get_userB

Retrieves a single user by their ID.

Inputs: id (required), site.

wp_list_categoriesC

Lists categories from a WordPress site.

Inputs: site, search, hide_empty.

wp_list_commentsB

Lists comments from a WordPress site, with filters.

Inputs: post, site, status.

wp_list_mediaB

Lists media items from a WordPress site, with filters.

Inputs: site, search, per_page, media_type.

wp_list_pagesB

Lists pages from a WordPress site, with filters.

Inputs: site, search, status, per_page.

wp_list_postsB

Lists posts from a WordPress site with comprehensive filtering options. Supports search, status filtering, and category/tag filtering with enhanced metadata display.

Usage Examples: • Basic listing: wp_list_posts • Search posts: wp_list_posts --search="AI trends" • Filter by status: wp_list_posts --status="draft" • Category filtering: wp_list_posts --categories=[1,2,3] • Paginated results: wp_list_posts --per_page=20 --page=2 • Combined filters: wp_list_posts --search="WordPress" --status="publish" --per_page=10

Inputs: site.

wp_list_tagsC

Lists tags from a WordPress site.

Inputs: site, search.

wp_list_usersA

Lists users from a WordPress site with comprehensive filtering and detailed user information including roles, registration dates, and activity status.

Usage Examples: • List all users: wp_list_users • Search users: wp_list_users --search="john" • Filter by role: wp_list_users --roles=["editor","author"] • Find admins: wp_list_users --roles=["administrator"] • Combined search: wp_list_users --search="smith" --roles=["subscriber"]

Inputs: site, roles, search.

wp_performance_alertsC

Get performance alerts and anomaly detection results

Inputs: site, limit, category, severity, +1 more.

wp_performance_benchmarkB

Compare current performance against industry benchmarks

Inputs: site, category, includeRecommendations.

wp_performance_exportC

Export comprehensive performance report

Inputs: site, format, timeRange, includeAnalytics, +1 more.

wp_performance_historyC

Get historical performance data and trends

Inputs: site, metrics, timeframe, includeTrends.

wp_performance_optimizeC

Get optimization recommendations and insights

Inputs: site, focus, priority, includeROI, +1 more.

wp_performance_statsC

Get real-time performance statistics and metrics

Inputs: site, format, category.

wp_search_siteB

Performs a site-wide search for content across posts, pages, and media with comprehensive results and metadata.

Usage Examples: • Search everything: wp_search_site --term="WordPress" • Search posts only: wp_search_site --term="tutorial" --type="posts" • Search pages: wp_search_site --term="about" --type="pages" • Search media: wp_search_site --term="logo" --type="media" • Find specific content: wp_search_site --term="contact form"

Inputs: term (required), site, type.

wp_seo_analyze_contentC

Analyze WordPress post content for SEO optimization opportunities including readability, keyword density, structure, and technical factors

Inputs: site.

wp_seo_bulk_update_metadataC

Update SEO metadata for multiple posts with progress tracking and error handling

Inputs: site.

wp_seo_generate_metadataC

Generate SEO-optimized metadata including title tags, meta descriptions, OpenGraph, and Twitter Card data

Inputs: site.

wp_seo_generate_schemaC

Generate JSON-LD structured data schema for enhanced search results

Inputs: site.

wp_seo_get_live_dataC

Retrieve live SEO data from WordPress including plugin-specific metadata and configurations

Inputs: site.

wp_seo_keyword_researchC

Research keywords and get suggestions based on topic and competition analysis

Inputs: site.

wp_seo_site_auditC

Perform comprehensive SEO audit of the WordPress site including technical, content, and performance analysis

Inputs: site.

wp_seo_test_integrationC

Test SEO plugin integration and detect available SEO plugins on the WordPress site

Inputs: site.

wp_seo_track_serpC

Track search engine result page positions for target keywords

Inputs: site.

wp_seo_validate_schemaC

Validate JSON-LD schema markup for correctness and compliance

Inputs: site.

wp_spam_commentC

Marks a comment as spam.

Inputs: id (required), site.

wp_switch_auth_methodC

Switches the authentication method for a site for the current session.

Inputs: method (required), site, password, username, +1 more.

wp_test_authA

Tests the authentication and connectivity for a configured WordPress site with detailed connection diagnostics.

Usage Examples: • Test connection: wp_test_auth • Multi-site test: wp_test_auth --site="my-site" • Verify setup: Use this after configuring new credentials • Troubleshoot: Run when experiencing connection issues • Health check: Regular verification of WordPress connectivity

Inputs: site.

wp_update_categoryC

Updates an existing category.

Inputs: id (required), name, site.

wp_update_commentC

Updates an existing comment.

Inputs: id (required), site, status, content.

wp_update_mediaC

Updates the metadata of an existing media item.

Inputs: id (required), site, title, caption, +2 more.

wp_update_pageC

Updates an existing page.

Inputs: id (required), site, title, status, +1 more.

wp_update_postB

Updates an existing WordPress post with comprehensive validation and change tracking. All parameters except ID are optional - only provided fields will be updated.

Usage Examples: • Update title: wp_update_post --id=123 --title="New Title" • Update content: wp_update_post --id=123 --content="<p>Updated content</p>" • Change status: wp_update_post --id=123 --status="publish" • Update categories: wp_update_post --id=123 --categories=[1,5,10] • Set featured image: wp_update_post --id=123 --featured_media=42 • Remove featured image: wp_update_post --id=123 --featured_media=0 • Multiple updates: wp_update_post --id=123 --title="New Title" --status="publish" --categories=[1,2]

Inputs: site.

wp_update_site_settingsC

Updates one or more general settings for a WordPress site.

Inputs: site, title, timezone, description.

wp_update_tagC

Updates an existing tag.

Inputs: id (required), name, site.

wp_update_userC

Updates an existing user.

Inputs: id (required), name, site, email.

wp_upload_mediaC

Uploads a file to the WordPress media library.

Inputs: file_path (required), post, site, title, +3 more.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    B3/5.0

    Scored across 70 tools

    Disambiguation4/5

    Each tool targets a distinct resource+action (posts, pages, media, comments, categories, tags, users, settings), so boundaries are mostly clear. Minor overlap exists within clusters like wp_cache_stats vs wp_cache_info and the many SEO/performance analysis tools, but descriptions help differentiate them.

    Naming Consistency4/5

    Most tools follow a consistent wp_verb_noun pattern (wp_create_post, wp_list_users, wp_delete_comment). A few deviate to noun-first ordering (wp_performance_stats, wp_cache_stats, wp_cache_clear) and auth tools vary (wp_test_auth, wp_get_auth_status), but the overall convention is predictable.

    Tool Count2/5

    At 70 tools the surface is very heavy, well beyond the 3-15 sweet spot. While WordPress is a broad domain, the large SEO, performance, and cache clusters inflate the count and increase selection burden.

    Completeness4/5

    CRUD coverage is strong and near-complete across the core content types (posts, pages, media, comments, categories, tags, users, settings) plus auth and revisions. Gaps like site/plugin/theme administration and menu management exist but core workflows are well served.

    Maintenance

    ActivityInactive
    ResponsivenessNo recent community issues

    Related MCP Connectors

    Related MCP Servers

    • A
      license
      Not graded
      quality
      D
      maintenance
      A comprehensive MCP server for WordPress automation that enables users to manage content, themes, and site configurations using AI-driven workflows and the WordPress REST API. It provides a wide array of tools for site planning, management, and optimization compatible with tools like Cursor and Claude.
      48 npm
      1
      ISC
    • A
      license
      Not graded
      quality
      D
      maintenance
      MCP server for WordPress content management that provides a secure interface for AI assistants to interact with WordPress sites, enabling content creation, editing, and media management without destructive operations.
      MIT