# Connect WordPress to TeamDay

Step-by-step guide to connecting your WordPress site (WordPress.com or self-hosted) to TeamDay's AI WordPress Studio, including credential management and troubleshooting.

# Connect WordPress to TeamDay

This guide covers connecting your WordPress site to TeamDay, managing credentials, and resolving common connection issues.

For a deep-dive on cross-office workflows and the WordPress MCP ecosystem, see the [AI WordPress Management blog post](https://docs.teamday.ai/blog/ai-wordpress-management-agents).

---

## Quick Start

### WordPress.com

1. Open your TeamDay workspace → **AI Teams** → **WordPress Studio**
2. Click **Data Sources** → **Connect** → **WordPress.com**
3. Authorize with your WordPress.com account (OAuth — no passwords stored by TeamDay)
4. Start chatting: *"Show me my recent posts"*

**Requirement:** A WordPress.com paid plan with MCP enabled at [wordpress.com/me/mcp](https://wordpress.com/me/mcp).

### Self-Hosted WordPress

**Requirements:** WordPress 6.9 or newer.

**On your WordPress site:**

1. Install the **MCP Adapter** plugin — Plugins → Add New → search "MCP Adapter" (or download from [GitHub](https://github.com/wordpress/mcp-adapter))
2. Activate the plugin
3. Go to Users → Your Profile → scroll to **Application Passwords**
4. Enter name "TeamDay", click **Add New Application Password**
5. Copy the generated password (it won't be shown again)

**In TeamDay:**

1. Open **WordPress Studio** → **Data Sources** → **Connect** → **WordPress (Self-Hosted)**
2. Enter your WordPress URL (e.g., `https://myblog.com`), username, and the application password
3. Click **Connect**

TeamDay connects to your site's MCP endpoint automatically. No webhooks, no custom code.

---

## How Credentials Work

Understanding how TeamDay handles your WordPress credentials explains why the agent should never ask you for them in chat.

### Where credentials are stored

When you connect your WordPress site, TeamDay stores three things in your **Space configuration**:

- **Site URL** — your WordPress address
- **Username** — your WordPress login username
- **Application Password** — the password you created for TeamDay

These are stored securely and never exposed in chat. They persist across sessions, timeouts, and restarts.

### How the agent uses them

Every time you start a conversation (or resume one after a timeout), the agent receives:

1. **MCP tools** — If the MCP Adapter plugin is working, the agent gets structured tools to call WordPress abilities directly
2. **REST API access** — A pre-authenticated helper script that uses the same Application Password to call the WordPress REST API via `curl`

Both methods use credentials from your Space configuration. The agent is explicitly instructed that credentials are pre-configured and should **never** ask you for them.

### What if credentials expire?

Application Passwords in WordPress don't expire by default. But they can be:

- **Revoked** — If you (or another admin) delete the Application Password from WordPress admin
- **Invalidated** — If the WordPress user account is deleted or the username changes

If your credentials stop working, update them in **Space Settings → Data Sources** — not in chat.

---

## MCP vs REST API

TeamDay uses two methods to interact with your WordPress site. Understanding the difference helps when troubleshooting.

### MCP (Abilities API)

- Uses the MCP Adapter plugin endpoint (`/wp-json/mcp/mcp-adapter-default-server`)
- Provides structured tools the agent can discover and call
- Depends on WordPress 6.9+ Abilities API
- Currently limited — WordPress core only registers a few abilities

### REST API

- Uses the standard WordPress REST API (`/wp-json/wp/v2/`)
- Available since WordPress 4.7 — mature and comprehensive
- Supports all content management: posts, pages, media, comments, users, settings
- Authenticated with the same Application Password as MCP

**Key point:** Even if MCP tools fail or return 0 abilities, the REST API still works. Your agent always has full WordPress management capabilities through the REST API fallback.

---

## Troubleshooting

### Agent asks for credentials

**This should not happen.** Your credentials are stored in Space Settings → Data Sources. The agent knows they're pre-configured.

If the agent asks for your WordPress URL, username, or password:

1. **Don't enter credentials in chat** — they can't be stored there and are lost when the session ends
2. **Check your TeamDay version** — this was fixed in March 2026
3. **If credentials actually need updating** — go to Space Settings → Data Sources

### MCP shows 0 tools

The MCP Adapter plugin may fail to expose tools if:

- WordPress is below version 6.9
- The MCP Adapter plugin isn't activated
- A security plugin blocks the `/mcp/` endpoint
- The Abilities API has no public abilities registered

**This doesn't affect the agent's capabilities.** TeamDay automatically provides REST API access when MCP tools are unavailable. The agent can still write posts, manage media, moderate comments, and do everything else through the REST API.

### Authorization header stripped

**Symptom:** `Unexpected token '<' is not valid JSON` or `401 rest_not_logged_in`.

This is very common on **LiteSpeed servers** (GreenGeeks, Hostinger, Namecheap, most cPanel hosts). The web server strips the `Authorization` header before it reaches WordPress.

**Fix:** Create `wp-content/mu-plugins/fix-auth-header.php`:

```php
<?php
/**
 * Fix Authorization header stripped by LiteSpeed/Apache CGI/FastCGI.
 */
if ( ! isset( $_SERVER['HTTP_AUTHORIZATION'] ) ) {
    if ( isset( $_SERVER['REDIRECT_HTTP_AUTHORIZATION'] ) ) {
        $_SERVER['HTTP_AUTHORIZATION'] = $_SERVER['REDIRECT_HTTP_AUTHORIZATION'];
    } elseif ( isset( $_SERVER['CGI_HTTP_AUTHORIZATION'] ) ) {
        $_SERVER['HTTP_AUTHORIZATION'] = $_SERVER['CGI_HTTP_AUTHORIZATION'];
    }

    if ( ! isset( $_SERVER['HTTP_AUTHORIZATION'] ) && function_exists( 'getallheaders' ) ) {
        $headers = getallheaders();
        if ( isset( $headers['Authorization'] ) ) {
            $_SERVER['HTTP_AUTHORIZATION'] = $headers['Authorization'];
        } elseif ( isset( $headers['authorization'] ) ) {
            $_SERVER['HTTP_AUTHORIZATION'] = $headers['authorization'];
        }
    }
}
```

This uses PHP's native `getallheaders()` to bypass server-level header filtering. Works on LiteSpeed, Apache CGI, and all other server configurations. See the [full troubleshooting guide](https://docs.teamday.ai/blog/ai-wordpress-management-agents#troubleshooting) for alternative approaches.

### 401 Unauthorized

Common causes:

- **Authorization header stripped** (most common on shared hosting) — use the mu-plugin fix above
- **Application Password revoked** — check Users → Profile → Application Passwords in WordPress admin, then update in Space Settings → Data Sources
- **Wrong username** — must be the WordPress *login* username, not display name or email
- **LiteSpeed cache** — add `?_=timestamp` to bust cache, or exclude `/wp-json/` from LiteSpeed caching
- **Security plugin** — whitelist `/wp-json/mcp/` in Wordfence, miniOrange, or similar plugins

### Subdirectory installs

Enter the full path where WordPress is installed:

- `https://example.com/blog/` if WordPress runs at `/blog/`
- `https://example.com/` if WordPress runs at the root

TeamDay appends the MCP endpoint path automatically. If you enter the wrong root, the connection will fail.

---

## Security

### Application Passwords

Application Passwords are the recommended authentication method for API access:

- **Scoped** — they only grant REST API access, not WordPress admin login
- **Revocable** — delete any time from Users → Profile → Application Passwords
- **Auditable** — WordPress logs which Application Password was used for each request
- **Per-app** — create a dedicated one for TeamDay, separate from other integrations

### Revoking access

To disconnect TeamDay from your WordPress site:

1. **In WordPress admin:** Users → Profile → Application Passwords → delete the "TeamDay" entry
2. **In TeamDay:** Space Settings → Data Sources → remove the WordPress connection

Either step alone is sufficient — revoking the Application Password immediately blocks all API access.

---

## Next Steps

- [AI WordPress Management](https://docs.teamday.ai/blog/ai-wordpress-management-agents) — deep-dive blog post with cross-office workflows and advanced troubleshooting
- [WordPress Studio](https://docs.teamday.ai/agents/ai-wordpress-studio) — product page with capabilities overview
- [MCP Servers Overview](https://docs.teamday.ai/guides/mcp-servers/what-are-mcp-servers) — how MCP connections work across all TeamDay integrations
- [MCP Plugins](https://docs.teamday.ai/guides/mcp-plugins) — OAuth integrations and advanced MCP configuration