Connect WordPress

A WordPress connection is what lets RankGrep apply a fix instead of only describing it. It takes about two minutes.

Before you start

• The site must be served over HTTPS. RankGrep refuses to send credentials over plain HTTP.
• The WordPress REST API must be reachable at /wp-json/. Most sites have it; some security plugins switch it off.
• Install the RankGrep Connector plugin first if you want exact SEO titles, meta descriptions, and heading repairs. The connection works without it, but fewer fixes can be applied automatically.

1. Create an Application Password

In WordPress, go to Users → Profile, scroll to Application Passwords, type RankGrep as the name and click Add New Application Password. Copy the password WordPress shows. It is displayed once.

Use an account with the Editor or Administrator role. RankGrep needs to edit published pages and media; it does not need to manage plugins or users.

2. Connect in RankGrep

Open Connections for the website, choose WordPress, enter the WordPress username and the Application Password, and connect. RankGrep verifies the credentials against your site, records the account's role and capabilities, and detects the connector plugin or a supported SEO plugin.

What is stored

The Application Password is encrypted at rest and is never shown again, logged, or sent to any AI provider. Your real WordPress password is never asked for.

Revoking access

Delete the Application Password in WordPress under Users → Profile → Application Passwords. Every RankGrep write stops immediately. You can also disconnect from the Connections page in RankGrep, which deletes the stored credential.

Common problems

"WordPress connections require HTTPS." The website was added with an http:// address. Edit the website in RankGrep to its https:// address, then connect again.

The username or password is rejected. Check that the REST API answers at https://your-site.com/wp-json/wp/v2/users/me when signed in. Security plugins such as Wordfence or iThemes can block Application Passwords; look for a setting named REST API or Application Passwords and allow them. A password copied with spaces is fine; WordPress ignores them.

"WordPress received the credentials but did not recognise the username." The username must be the login you sign in to WordPress with, shown under Users, Profile, Username. The name you gave the Application Password is not a login. WordPress gives the same answer when the site has no Application Passwords left, so check the password you created is still listed there.

"The Application Password never reached WordPress." The server is dropping the Authorization header before WordPress sees it, which happens on some CGI and LiteSpeed hosts. Add CGIPassAuth On, or the SetEnvIf and RewriteRule lines for HTTP_AUTHORIZATION, to the site's .htaccess. RankGrep can only tell this case from the previous one when the connector is installed, since the connector reports whether the credentials arrived; without it the message names both possibilities.

A repair fails with a WordPress permission error. The connection itself succeeds with any role, but writing to a published page needs an Editor or Administrator. The homepage is found as the page whose address is the site root, which any role can read; only a site that shows a list of recent posts on its front has no homepage to write to, and the preview says so.

Meta descriptions come as guidance only. Neither the connector nor a supported SEO plugin is installed, so there is no field to write. Install the connector.