Fetch all published posts with GET /wp/v2/posts?status=publish&per_page=100, paginating via X-WP-TotalPages. Yoast SEO exposes a yoast_head_json object in each post response containing title, meta_desc, robots, and schema data. RankMath exposes similar fields. Flag posts with missing meta descriptions, titles over 60 characters, and pages without featured images. SEO meta fields are plugin-dependent — if neither Yoast nor RankMath is installed, the REST response contains no SEO data.
| Fact | Value |
|---|---|
| Platform | WordPress |
| Rate limits | No core limit — managed hosts may flag rapid paginated requests as scraping |
| Difficulty | Intermediate |
| Time required | 60 minutes |
| Last updated | May 2026 |
API Quick Reference
No core limit — managed hosts may flag rapid paginated requests as scraping
REST only
WordPress REST API SEO Audit Overview
WordPress exposes all published posts and pages through the REST API. SEO metadata from plugins like Yoast SEO and RankMath is automatically included in post responses as additional registered fields. By paginating through all posts and analyzing these fields programmatically, you can generate comprehensive SEO audit reports without manual review.
https://yoursite.com/wp-json/wp/v2Setting Up Application Password Auth for SEO Audits
- 1Log in to your WordPress admin dashboard
- 2Navigate to Users → Your Profile
- 3Scroll to the Application Passwords section
- 4Enter a name like 'SEO Audit Bot' and click Add New Application Password
- 5Copy the 24-character password — shown only once
- 6Strip spaces from the password before Base64 encoding
- 7An Editor or higher role is recommended to access all posts including private and future-scheduled ones
Key endpoints
/wp/v2/postsFetch published posts with SEO metadata fields. Yoast adds yoast_head_json to the response automatically when the plugin is active.
/wp/v2/pagesSame structure as posts but for static pages. Run the same audit on pages since they often have worse SEO coverage than posts.
Step-by-step automation
Detect Which SEO Plugin is Installed
Why: Yoast SEO and RankMath register different field names. Detecting which plugin is active before fetching posts allows the audit logic to use the correct field paths.
Fetch a single post and inspect the response to detect SEO field availability. This auto-configures the audit for the specific WordPress installation.
1# Fetch one post and check for Yoast/RankMath fields2curl -s \3 -H "Authorization: Basic $(echo -n "$WP_USER:$WP_APP_PASSWORD" | base64)" \4 "$WP_BASE_URL/posts?per_page=1&status=publish" | python3 -c "5import json, sys6data = json.load(sys.stdin)7if data:8 post = data[0]9 print('Fields:', [k for k in post.keys() if 'yoast' in k.lower() or 'rank' in k.lower()])10"Paginate Through All Published Posts
Why: With per_page=10 as the default, a 500-post site requires 50 requests. Setting per_page=100 reduces that to 5 requests. X-WP-TotalPages tells you the exact page count.
Fetch all published posts with SEO fields, handling pagination. For Yoast, request only the fields you need to reduce response size.
1# Fetch all published posts with Yoast fields (page 1)2curl -s \3 -H "Authorization: Basic $(echo -n "$WP_USER:$WP_APP_PASSWORD" | base64)" \4 "$WP_BASE_URL/posts?status=publish&per_page=100&page=1&_fields=id,title,link,date,featured_media,yoast_head_json" \5 | python3 -m json.tool | head -60Analyze SEO Fields and Flag Issues
Why: Automated analysis catches patterns that are invisible in manual review — like the 40 posts where the meta description is exactly the post excerpt (no custom SEO copy) or the 12 posts with titles over 60 characters.
Extract SEO fields from each post and check against best practices: meta title length, meta description presence and length, featured image presence, and canonicalization.
1# Not applicable — analysis is done programmatically after fetchingGenerate and Export the SEO Report
Why: A programmatic report gives you an actionable list of URLs sorted by issue severity, which is far more useful than manually reviewing posts one by one in the WordPress dashboard.
Compile audit results into a report structure. Output as JSON for further processing, CSV for spreadsheet review, or write directly to a Notion database or Google Sheet.
1# Not applicable for report generation — done programmaticallyComplete working code
Complete WordPress SEO audit automation. Paginates through all published posts and pages, extracts Yoast SEO or RankMath metadata, flags SEO issues, and exports a CSV report.
Error handling
Yoast SEO is not installed or is deactivated. SEO fields are registered by the plugin and only appear in responses when the plugin is active.
Check if Yoast SEO or RankMath is installed and active. If neither is installed, the REST response only contains core WordPress fields. Detect plugin availability before running the audit.
The Authorization header is missing or the Application Password was revoked.
Published posts are publicly readable without authentication. But if the site restricts public REST access (some security plugins do this), authentication is required. Verify credentials with GET /wp/v2/users/me.
The REST API is disabled or the endpoint path is wrong. Some security plugins (Wordfence, iThemes Security) can disable REST for unauthenticated users or entirely.
Verify the REST URL by visiting yoursite.com/wp-json/ in a browser. If disabled, check security plugin settings or contact your host. The correct path is /wp-json/wp/v2/posts, not /api/v2/posts or /wp/v2/posts.
Paginating through hundreds of posts generates many sequential requests that managed hosts may flag as scraping.
Add a 500ms delay between page requests. Process posts and pages as separate runs rather than simultaneously. Schedule the audit during off-peak hours.
The REST API's filter query may be excluding posts due to a plugin conflict, or the per_page and page parameters aren't being applied.
Test with a minimal request: GET /wp/v2/posts with no parameters to confirm basic access. If that returns posts, add parameters one at a time to isolate the issue.
Rate Limiting for WordPress SEO Audit Requests
| Scope | Limit | Window |
|---|---|---|
Security checklist
- Store WP_APP_PASSWORD as an environment variable — never hardcode in scripts or commit to version control
- Use HTTPS — Application Passwords do not work over plain HTTP
- Published posts are readable without auth — only use authentication if you also need to audit drafts
- Consider using a dedicated read-only Editor account for the audit — avoid using admin credentials for reporting tasks
- Output CSV reports to a private location — they contain your full post inventory including URLs and SEO state
Automation use cases
Weekly SEO Health Email
Schedule the audit weekly and email the CSV report to the content team with a summary of the top 10 most-issues posts needing attention.
New Post SEO Gate
After publishing a new post, run an instant audit on that single post and alert via Slack if the meta description is missing or the title is over 60 characters.
Content Audit Dashboard
Push audit results to a Notion database or Google Sheet, creating a live SEO dashboard with issue tracking and historical trend data.
Site Migration Validation
Run the audit before and after a site migration to verify that SEO metadata survived the move and no pages became noindexed accidentally.
Best practices
- Request only the fields you need with _fields=id,title,link,date,featured_media,yoast_head_json — reduces response size by 80% and speeds up pagination
- Always check for the presence of yoast_head_json before accessing nested properties — Yoast may be installed but inactive on specific post types
- Add 500ms delays between page requests when auditing large sites to avoid triggering managed host throttles
- Audit pages separately from posts — /wp/v2/pages uses the same SEO fields but is a separate endpoint
- Flag posts where meta_description length is < 50 chars as well as missing — very short descriptions are almost as bad as none
- Include the noindex audit — posts accidentally set to noindex are invisible to search engines and often go unnoticed for months
- Schedule weekly rather than daily — SEO metadata changes slowly and daily runs waste API quota without providing new signal
Ask AI to help
Copy one of these prompts to get a personalized, working implementation.
I'm building a WordPress SEO audit script that fetches all published posts via the REST API with Yoast SEO fields (yoast_head_json). I want to detect posts with: missing meta descriptions, titles over 60 characters, and no featured image. The script handles pagination via X-WP-TotalPages. Can you help me add a duplicate meta description detector that flags posts that share the same meta description text?
Frequently asked questions
Why doesn't yoast_head_json appear in my post API responses?
Yoast SEO must be installed and activated to register the yoast_head_json field. Check the Plugins page in WordPress admin. Also verify that the Yoast REST API endpoint is enabled — go to Yoast SEO → General → Features → REST API endpoint and ensure it's on.
Can I get SEO data from posts without Yoast or RankMath?
WordPress core does not include SEO metadata fields in the REST API. Without Yoast SEO or RankMath, your audit will only have access to the post title (title.rendered) and raw content — not SEO-specific title tags, meta descriptions, or robots directives. Install one of these plugins to enable SEO field exposure.
How do I audit SEO on WooCommerce product pages?
WooCommerce registers products as a custom post type. Access them via GET /wp/v2/product (if registered with show_in_rest: true). Yoast SEO extends to product pages and includes yoast_head_json in product responses. The same audit logic applies.
Does this work for WordPress.com hosted sites?
WordPress.com uses its own REST API (developer.wordpress.com) which differs from self-hosted WordPress. The endpoint paths are different and the SEO plugin integration may not expose the same fields. This guide applies to self-hosted WordPress.org installations.
Can I update SEO metadata via the REST API?
Yes. Yoast SEO allows updating yoast_head_json fields via PATCH /wp/v2/posts/{id} with the meta.yoast_wpseo_title and meta.yoast_wpseo_metadesc fields. This varies by Yoast version — check the Yoast REST API documentation for the exact meta key names used in your installed version.
What's the best way to schedule this audit automatically?
For self-hosted scripts, use cron (Linux/Mac) or Task Scheduler (Windows) to run weekly. For cloud automation, AWS EventBridge Rules or GitHub Actions scheduled workflows are clean options. The script should take 30-120 seconds to run depending on post count — well within any scheduler timeout.
How many API requests does auditing a 500-post site require?
At per_page=100, a 500-post site requires 5 requests for posts plus additional requests for pages. Total is typically 7-12 requests for a complete audit. This is well within any reasonable rate limit — even managed hosts with aggressive throttling will handle 12 requests without issue.
Need this automated?
Our team has built 600+ apps with API automations. We can build this for you.
Book a free consultation