After connecting WordPress, SEO Agent can write workflow-generated articles to WordPress, save them as drafts, and then you confirm the title, body, images, internal links, and CTA before publishing. It never asks you to hand over your WordPress admin password to AI; instead, it uses WordPress's official application password.
4 things to prepare before starting
- You can log in to the WordPress admin, and your account has permission to publish articles.
- Remember the homepage URL of your website, for example
https://www.example.com, do not fill in the admin URL or article URL. - The website must be accessible via HTTPS, and the browser address bar must not show "Not Secure".
- Confirm that the WordPress REST API is not completely blocked by a security plugin or firewall.
Step 1: Create an application password in WordPress
- Log in to the WordPress admin panel.
- Open "Users → Profile", or directly open your own profile page.
- Scroll down to the "Application Passwords" section, and in the name field, enter SEO Agent.
- Click "Add New Application Password", and WordPress will display a password that appears only once.
- Copy and save it immediately to your password manager. Application passwords often contain spaces; you can keep the spaces when pasting, and SEO Agent will handle it automatically.
If you don't see "Application Passwords", common causes are that the website does not have HTTPS, the WordPress version is too old, or the host/security plugin has disabled application passwords. Fix these issues first, and do not switch to a method of directly giving your admin password to a third party.
Step 2: Add a WordPress publishing connection in SEO Agent
Log in to SEO Agent and open “Profile → Data & Publishing Connections”. In the Publishing Connections section, select WordPress, then fill in the following four items:
| Field | What to fill in | Example |
|---|---|---|
| Connection name | A name you can easily recognize | My Blog |
| Website URL | WordPress homepage URL, without a trailing slash | https://www.example.com |
| Username | The WordPress username for which you just created the application password | editor |
| Application password | The one-time application password just generated | xxxx xxxx xxxx xxxx |
When finished, click “Save Publishing Connection.” The system encrypts the application password, and it will not be shown again in the list. To change the password later, delete the old connection and add it again.
Step 3: Test the Connection
After the connection is created, click “Test” in the connection list. SEO Agent will access WordPress’s standard API to confirm that the username and application password are valid. A successful test displays “Connected”; if the test fails, no articles will be published.
- 401: The username or application password is incorrect. Re-copy the application password.
- 404: The website address is incorrect, or the REST API is disabled. First open in a browser:
https://your-domain/wp-json/. - 403: A firewall, security plugin, or hosting rule is blocking the request. Please add SEO Agent requests to the allowlist.
- Timeout: Check whether the website is accessible from outside and whether the HTTPS certificate is valid.
Step 4: Publish as a Draft First, Then Officially Publish
After the connection is successful, send a clear instruction in Codex:
“Write an article about CRM software suitable for small businesses. First use SEO Agent to research keywords and SERP, then generate the article and fact-check it. Pause when research is complete and wait for my confirmation; after confirmation, publish it to 'My Blog' with the status set to Draft.”
The workflow runs as “Research → Writing → Check → Wait for Confirmation → Publish → Monitoring”. Once you see “Wait for Confirmation”, you can check:
- Whether the title is accurate and truly fits the product and customers.
- Whether the body contains unconfirmed information such as prices, features, or case studies.
- Whether images, internal links, buttons, and contact information are working properly.
- Whether the page URL, category, tags, and publishing status are correct.
After confirming the draft is correct, send: “I approve this article, please publish it officially.” If you still need to modify the page, you can include the page path or specific modification requirements when confirming.
Step 5: Set Up Monitoring After Publishing
Publishing is not the end of SEO. After connecting GSC and GA4, you can have Codex create scheduled monitoring, for example: “Check this article's clicks, CTR, ranking, and conversions every week; notify me if there is a significant decline, but wait for my confirmation before making fixes.”
When monitoring detects an issue, SEO Agent will first generate diagnostics and fix suggestions. Notifications will appear in the site; after SMTP is configured, it can also send emails. The fix workflow requires human approval by default and will not overwrite WordPress pages without your knowledge.
How do I revoke the connection?
- Go back to WordPress’s “Users → Profile → Application Passwords”.
- Find the app password named "SEO Agent" and click Revoke.
- Open SEO Agent's Data & Publishing Connections page and click “Delete” beside the corresponding connection.
Revoking the app password will not delete already published articles; it only prevents future automatic publishing. When reconnecting, simply create a new set of app passwords.