WordPress first, for the obvious reason
WordPress powers more of the web than any other CMS, and it's where most content operations already live. It's the first integration we built and the one the rest were modelled on.
Connecting: application passwords, not your login
SEOtopilot connects using a WordPress application password — a purpose-made credential you generate in wp-admin in about thirty seconds. This matters for three reasons:
- It's not your admin password. Your actual login never leaves WordPress. The application password is a separate credential with API-only access.
- It's revocable in one click. Rotate or revoke it from wp-admin at any time; SEOtopilot's access dies instantly, nothing else changes.
- Nothing gets installed. No plugin taking updates, no code running inside your site, no compatibility roulette on your next WordPress upgrade. Publishing goes through the REST API WordPress already ships.
Two security notes on how we hold our side of the bargain: your site must be served over HTTPS — we hard-refuse to transmit credentials over plain HTTP — and the credential itself is stored encrypted, bound to your specific site so it can't be misapplied elsewhere.
What publishing actually does
When you approve an article in the review queue, SEOtopilot renders it to clean, sanitized HTML — headings, lists, links, tables; no inline scripts, ever — and creates the post via the REST API with your chosen slug, the excerpt, and draft-or-publish status per your site's settings.
Everything upstream has already happened by then: the fact-check annotations were reviewed by you, internal links placed, metadata generated. WordPress receives a finished article, not a first draft.
Draft mode, if you want a second gate
Some teams want articles to land in WordPress as drafts even after approving them in SEOtopilot — final formatting checks in the theme, a colleague's sign-off, scheduled slots managed WordPress-side. That's a per-site setting: approved articles arrive as WordPress drafts, and the final publish click happens in wp-admin. Belt, braces, your choice.
When something fails
Sites go down, certificates expire, passwords get rotated without telling the robot. Failed publishes retry automatically with backoff; a publish that keeps failing is surfaced with the actual error — never silently dropped. Your article stays safe in SEOtopilot with its full history regardless; see how the pipeline handles failure for the checkpointing details.
Getting started
Generate an application password in wp-admin under your user profile, paste it into SEOtopilot with your site URL and username, and the connection verifies itself immediately. From there the first article is a calendar entry away — and the whole setup, including generating the password, takes under five minutes on a stock WordPress install.