How to Control a WordPress Site Using Application Passwords and an Artificial Intelligence Agent

📋 Overview

WordPress includes a powerful built-in REST API that lets you read and modify almost everything on your site—from posts and comments to users and settings. By combining this with Application Passwords, you can safely grant access to external programs, scripts, or even artificial intelligence (AI) agents that act on your behalf.

In this guide, you’ll learn:

What WordPress Application Passwords are and how to create them
How to configure an AI agent “mode” that understands how to connect to your site
How to use simple curl examples to teach an AI agent to interact with the WordPress API directly

🔐 1. What Are WordPress Application Passwords?

Application Passwords allow you to connect to your WordPress site remotely using your username and a generated password—without needing to log into the WordPress dashboard. They provide a safe way for external tools (including AI systems) to perform actions like creating, editing, or deleting posts.

When you generate an Application Password, WordPress creates a special password for a specific application. It’s tied to your user account and can be revoked at any time.

How to Create One

Log in to your WordPress dashboard as an Administrator
Navigate to Users → Profile (or Edit Profile)
Scroll down to Application Passwords
Enter a name for your password (for example, “AI Agent”) and click Add New Application Password
Copy the generated password—you won’t see it again!

You now have a username (your WordPress login) and an application password (the key you just created). Together, they let authenticated software access the REST API.

🤖 2. Configuring an AI Agent Mode

To enable an AI agent to control your WordPress site, you provide it with a configuration file or “mode” that contains:

Your WordPress site URL
Your username
Your application password

For example, you might store this information in a JSON file:

{
  "site_url": "https://example.com",
  "username": "admin",
  "application_password": "abcd efgh ijkl mnop qrst uvwx"
}

Then, within the agent’s “mode instructions,” you describe how to use the WordPress REST API to send HTTP requests using curl. Most modern AI models already understand how to use REST APIs—WordPress included—but giving them a few working examples makes them far more effective.

📚 3. Teaching the Agent with cURL Examples

Below are three sample curl commands you can include in the agent’s instructions. These examples demonstrate how to list posts, create a post, and update a post through the WordPress API.

Example 1: Get a List of Posts

curl -X GET https://example.com/wp-json/wp/v2/posts \
  -u "admin:abcd efgh ijkl mnop qrst uvwx"

This command retrieves recent posts. The -u flag sends your username and application password for authentication.

Example 2: Create a New Post

curl -X POST https://example.com/wp-json/wp/v2/posts \
  -u "admin:abcd efgh ijkl mnop qrst uvwx" \
  -H "Content-Type: application/json" \
  -d '{"title": "Hello from AI", "content": "This post was created by an AI agent.", "status": "publish"}'

This tells WordPress to create and publish a new post with the provided title and content.

Example 3: Update an Existing Post

curl -X POST https://example.com/wp-json/wp/v2/posts/123 \
  -u "admin:abcd efgh ijkl mnop qrst uvwx" \
  -H "Content-Type: application/json" \
  -d '{"content": "This post has been updated by the AI agent."}'

Replace 123 with the actual post ID you want to modify.

🎯 4. Giving Control to an AI Agent

Once your agent’s mode file contains:

The credentials (username and application password)
The API examples (like the curl samples above)
The goal or instruction (e.g., “update the latest post”)

…the agent can autonomously interact with your WordPress site.

Most large-language-model-based agents (like GPT, Claude, or Gemini) can interpret these instructions out of the box. By including these examples in the agent’s mode, you’re effectively teaching it how to act as your remote WordPress assistant, capable of performing nearly any task you can do through the dashboard.

📝 AGENTS.md or mode file:

The user wants something done on a WordPress site. Use the configuration information in application_password.json to craft a cUrl to acomplish the given task. Run the cUrl with your terminal tool.

Credentials

Username and application password are stored in application_password.json.

Capabilities

Read: Access and retrieve data from the WordPress REST API.
Edit: Make changes to posts, pages, and settings via API.

Custom Instructions

Always use secure authentication with credentials from application_password.json.
Prefer cUrl for direct API interactions.
Follow WordPress REST API best practices for all requests.

Example cUrl Request

curl -u 
<username>:<application_password> \
  -X POST "https://website.com/wp-json/wp/v2/posts" \
  -H "Content-Type: application/json" \
  -d '{"title":"New Post Title","content":"Post body here","status":"publish"}'

Example: Create a Page (Custom Post Type)

curl -u 
<username>:<application_password> \
  -X POST "https://website.com/wp-json/wp/v2/pages" \
  -H "Content-Type: application/json" \
  -d '{"title":"New Page Title","content":"Page body here","status":"publish"}'

Example: Upload a Media Item

curl -u 
<username>:<application_password> \
  -X POST "https://website.com /wp-json/wp/v2/media" \
  -H "Content-Disposition: attachment; filename=\"image.jpg\"" \
  -H "Content-Type: image/jpeg" \
  --data-binary "@path/to/image.jpg"

Recent Posts