How to Integrate Replit with WordPress

Application Passwords are built into WordPress 5.6 and later. They allow you to create separate per-application credentials without sharing your main admin password. Each Application Password can be revoked independently, so you can disable Replit's access without affecting other integrations. To generate an Application Password, log in to your WordPress admin dashboard. In the left sidebar, go to Users > Profile (or Users > All Users, then click your username). Scroll down to the Application Passwords section near the bottom of the profile page. If you do not see this section, check that your WordPress version is 5.6+ and that Application Passwords are not disabled by a security plugin. In the 'New Application Password Name' field, enter a descriptive name like 'Replit Integration' so you know what this password is for. Click 'Add New Application Password'. WordPress generates a password in the format XXXX XXXX XXXX XXXX XXXX XXXX (with spaces). Copy this entire value immediately — WordPress will not show it again. For authentication, you will use your WordPress username (the login username, not your display name) combined with this Application Password. The credentials are sent as HTTP Basic Authentication: base64-encoded 'username:application_password' in the Authorization header. Remove the spaces from the Application Password before encoding.

Open your Replit project and click the lock icon (🔒) in the left sidebar to open the Secrets panel. Create three secrets: WP_SITE_URL (your WordPress site URL, e.g., https://yoursite.com — no trailing slash), WP_USERNAME (your WordPress admin username), and WP_APP_PASSWORD (the Application Password you just generated, including any spaces — they will be removed in code). In Python, access them via os.environ['WP_SITE_URL']. In Node.js, use process.env.WP_SITE_URL. After adding secrets, restart the Repl if it is already running. The WordPress REST API base URL is your site URL followed by /wp-json/wp/v2/. For example, to list posts: GET https://yoursite.com/wp-json/wp/v2/posts. Authentication is HTTP Basic Auth — the Python requests library handles this with the auth=(username, password) parameter, and in Node.js you encode credentials as base64. Verify your credentials by making a read request to the /wp-json/wp/v2/users/me endpoint, which returns your user profile if authentication succeeds. A 200 response with your username confirms credentials are correct.

1import os
2import requests
3
4WP_URL = os.environ['WP_SITE_URL'].rstrip('/')
5WP_USER = os.environ['WP_USERNAME']
6WP_PASS = os.environ['WP_APP_PASSWORD'].replace(' ', '')  # remove spaces from app password
7
8api_base = f'{WP_URL}/wp-json/wp/v2'
9auth = (WP_USER, WP_PASS)
10
11# Test: verify credentials by fetching current user profile
12resp = requests.get(f'{api_base}/users/me', auth=auth)
13
14if resp.status_code == 200:
15    user = resp.json()
16    print(f'Authenticated as: {user.get("name")} ({user.get("slug")})')
17    print(f'Role: {list(user.get("roles", []))[0] if user.get("roles") else "unknown"}')
18elif resp.status_code == 401:
19    print('Authentication failed — check WP_USERNAME and WP_APP_PASSWORD in Secrets')
20else:
21    print(f'Error: {resp.status_code} — {resp.text[:200]}')

WordPress REST API endpoints follow consistent URL patterns. For posts: GET /wp-json/wp/v2/posts. For pages: GET /wp-json/wp/v2/pages. For media: GET /wp-json/wp/v2/media. Each endpoint supports a comprehensive set of query parameters for filtering, searching, pagination, and field selection. Read endpoints work without authentication for published content (any public post or page is readable without credentials). Authentication is only required to read draft posts or to perform write operations. This means your Replit server can fetch public WordPress content without needing to expose any credentials to the frontend. The script below demonstrates common read operations: listing recent posts with filtering, searching by keyword, and fetching a specific post by slug. The _fields parameter limits the API response to only the fields you need, which speeds up requests and reduces data transfer — especially useful when fetching many posts.

1import os
2import requests
3
4WP_URL = os.environ['WP_SITE_URL'].rstrip('/')
5WP_USER = os.environ['WP_USERNAME']
6WP_PASS = os.environ['WP_APP_PASSWORD'].replace(' ', '')
7
8api_base = f'{WP_URL}/wp-json/wp/v2'
9auth = (WP_USER, WP_PASS)  # needed for drafts; public posts work without auth
10
11def get_posts(per_page=10, status='publish', search=None):
12    """Fetch published posts with optional search."""
13    params = {
14        'per_page': per_page,
15        'status': status,
16        '_fields': 'id,title,slug,status,date,excerpt,categories,tags'
17    }
18    if search:
19        params['search'] = search
20    resp = requests.get(f'{api_base}/posts', auth=auth, params=params)
21    resp.raise_for_status()
22    return resp.json()
23
24def get_post_by_slug(slug):
25    """Fetch a single post by its slug."""
26    resp = requests.get(f'{api_base}/posts', auth=auth, params={'slug': slug})
27    resp.raise_for_status()
28    posts = resp.json()
29    return posts[0] if posts else None
30
31def get_media(per_page=20):
32    """Fetch media library items."""
33    resp = requests.get(f'{api_base}/media', auth=auth, params={'per_page': per_page})
34    resp.raise_for_status()
35    return resp.json()
36
37# Example usage
38print('Recent posts:')
39posts = get_posts(per_page=5)
40for post in posts:
41    title = post['title']['rendered']
42    print(f"  [{post['id']}] {title} ({post['date'][:10]})")
43
44print(f'\nTotal fetched: {len(posts)}')

Writing to WordPress requires authentication via Application Passwords. Creating a post is a POST request to /wp-json/wp/v2/posts with a JSON body containing the post title, content, status (draft or publish), categories, and other fields. Updating an existing post uses a POST or PUT request to /wp-json/wp/v2/posts/{id}. WordPress content can be sent as plain text or HTML. For formatted posts (with headings, lists, images), send HTML in the content field. Gutenberg block format is not required — classic HTML works correctly via the REST API and renders properly in the WordPress editor. The code below creates a new WordPress post, publishes it immediately, and assigns categories and tags. It also shows how to upload media (images) to the WordPress media library via the /media endpoint — an important step for creating featured images for posts.

1import os
2import requests
3
4WP_URL = os.environ['WP_SITE_URL'].rstrip('/')
5WP_USER = os.environ['WP_USERNAME']
6WP_PASS = os.environ['WP_APP_PASSWORD'].replace(' ', '')
7
8api_base = f'{WP_URL}/wp-json/wp/v2'
9auth = (WP_USER, WP_PASS)
10
11def create_post(title, content, status='draft', categories=None, tags=None, excerpt=''):
12    """Create a new WordPress post."""
13    data = {
14        'title': title,
15        'content': content,
16        'status': status,  # 'draft' or 'publish'
17        'excerpt': excerpt,
18        'format': 'standard'
19    }
20    if categories:
21        data['categories'] = categories  # list of category IDs
22    if tags:
23        data['tags'] = tags  # list of tag IDs
24
25    resp = requests.post(f'{api_base}/posts', auth=auth, json=data)
26    resp.raise_for_status()
27    return resp.json()
28
29def update_post(post_id, updates):
30    """Update fields on an existing post."""
31    resp = requests.post(f'{api_base}/posts/{post_id}', auth=auth, json=updates)
32    resp.raise_for_status()
33    return resp.json()
34
35def upload_image(image_path, filename, alt_text=''):
36    """Upload an image to WordPress media library."""
37    with open(image_path, 'rb') as f:
38        resp = requests.post(
39            f'{api_base}/media',
40            auth=auth,
41            headers={'Content-Disposition': f'attachment; filename={filename}'},
42            files={'file': (filename, f, 'image/jpeg')},
43            data={'alt_text': alt_text}
44        )
45    resp.raise_for_status()
46    return resp.json()
47
48# Create a draft post
49new_post = create_post(
50    title='Automated Post from Replit',
51    content='<h2>Introduction</h2><p>This post was created via the WordPress REST API from a Replit backend.</p>',
52    status='draft',
53    excerpt='A demonstration of WordPress REST API integration with Replit.'
54)
55print(f'Created post ID {new_post["id"]}: {new_post["link"]}')
56
57# Publish it immediately
58published = update_post(new_post['id'], {'status': 'publish'})
59print(f'Post published: {published["status"]}')