WordPress publishing

The WordPress adapter creates draft posts in your site through the official WordPress REST API using an Application Password. It works with self-hosted WordPress (5.6 or later) and WordPress.com Business or Commerce plans.

How does WordPress publishing work?

CiteFlow authenticates as a WordPress user with HTTP Basic auth using your username and an Application Password, then creates a post with POST /wp-json/wp/v2/posts and status: "draft". The post lands in your normal Drafts queue for editorial review before going live.

What do you need before setting it up?

• WordPress 5.6 or newer (Application Passwords are built in from 5.6).
• A WordPress user with the Editor or Administrator role.
• The WordPress REST API reachable from the public internet at https://your-site.com/wp-json/wp/v2/. Some security plugins or hosting providers (notably WP Engine and Kinsta on default settings) block REST writes; you may need to whitelist them.

How do you set up WordPress publishing?

1. Create an Application Password

1. Log in to WordPress as the user that will own posts.
2. Go to Users → Profile (or Users → All Users → Edit for another user if you are an admin).
3. Scroll to Application Passwords at the bottom.
4. Type a name (for example CiteFlow) and click Add New Application Password.
5. WordPress shows the generated password once, formatted like abcd 1234 efgh 5678. Copy it now; you cannot retrieve it later.

2. Add the endpoint in CiteFlow

1. Dashboard → Settings → Publishing destinations → Add endpoint.
2. Pick WordPress.
3. Fill in:
   • Site URL: the root of your site, for example https://example.com (no trailing slash, no /wp-json/...).
   • Username: the WordPress login of the user that owns the Application Password.
   • Application Password: the value from step 1.
4. Save.

3. Test the connection

Click Test connection. CiteFlow calls GET /wp-json/wp/v2/users/me with the supplied credentials. A successful response confirms the URL is reachable, the user exists, and the Application Password is valid.

How do fields map to WordPress?

CiteFlow does not set categories, tags, featured image, or author at this time. Apply those in your WordPress editor before publishing.

What are the tier limitations?

Endpoints (any mix of webhook and platform adapters) count against the overall publishing endpoint cap:

How do you troubleshoot WordPress publishing?

401 Unauthorized on connection test. The username or Application Password is wrong, or WordPress rejected the Basic auth header. Check:

• The username is the login name, not the display name.
• The Application Password is the one you just created (not the user's login password).
• Your hosting provider does not strip the Authorization header. Apache servers using mod_rewrite sometimes require RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] in .htaccess.

403 rest_cannot_create when publishing. The user does not have permission to create posts. Promote the user to Editor or higher, or create the Application Password under a different user.

404 Not Found calling /wp-json/.... The REST API is disabled. Check for security plugins (Disable REST API, Defender, etc.) or hosting restrictions. The REST API must be available at /wp-json/wp/v2/.

Posts arrive but the content looks garbled. WordPress requires HTML. CiteFlow sends sanitised HTML by default; if you have a custom WordPress filter that re-encodes entities, disable it for the CiteFlow user.

Cloudflare or WAF blocks the request. Whitelist the CiteFlow egress ranges (contact us) or relax rules for /wp-json/wp/v2/posts.

Need help?

If the test connection passes but real publishes fail, copy the error shown in your CiteFlow dashboard (it includes the WordPress response body) and contact support.