WordPress
Pair WordPress with RankPine through the official plugin, with application passwords available as a fallback.
The official RankPine – AI SEO Blog Automation plugin is the recommended way to connect WordPress. It creates a short-lived, single-use pairing and then authenticates every publish or update with a revocable signing key. You never copy a WordPress password into RankPine.
The existing application-password connection remains available for sites where you cannot install a plugin.
Connect with the RankPine plugin
Install and activate the plugin
In WordPress admin, go to Plugins → Add New Plugin, install RankPine – AI SEO Blog Automation, and activate it. During the directory-review period, use the release ZIP provided by RankPine through Plugins → Add New Plugin → Upload Plugin.
Start the one-time pairing
Open RankPine in the WordPress admin menu and select Connect to RankPine. WordPress creates a random connection code that expires after 10 minutes and can only be used once.
Your WordPress site and REST API must use HTTPS.
Approve the RankPine site
Sign in to RankPine if asked, select the matching RankPine site, and choose Approve connection. RankPine completes a signed test before saving the connection.
Choose publishing defaults
Return to WordPress admin → RankPine and choose:
- Draft, Pending review, or Published
- The default WordPress author
- Default categories and comma-separated tags
- Whether RankPine should download and set featured images
The WordPress-side publish mode takes precedence over the value in a remote request. New connections default to Draft.
What gets published
RankPine creates a standard WordPress post with:
- Title, slug, and the full article body as sanitized HTML
- The meta description as the WordPress excerpt
- Your selected author, categories, and tags
- A featured image, downloaded through WordPress's safe HTTP API when enabled
- RankPine's stable article ID, language, translation-group ID, and meta description as protected post metadata
If RankPine sends the same article again, the plugin finds its stable article ID and updates the existing WordPress post. Concurrent requests for one article are serialized, so a retry cannot create a duplicate.
Connection security
The pairing code is short-lived and single-use. The permanent signing secret is sent once over HTTPS, encrypted at rest on both sides, and never placed in a URL or returned to either browser.
Every inbound request includes:
- An HMAC-SHA256 signature checked with a constant-time comparison
- A timestamp that must be within five minutes
- A cryptographically random nonce that can only be used once
- A stable article ID used for idempotent post updates
WordPress still checks the connected user's capabilities. Publishing live
requires publish_posts; receiving drafts requires edit_posts. Disconnecting
deletes the site-side secret immediately. Rotating creates a new pairing while
the current connection stays active until the replacement succeeds.
Featured-image downloads must use HTTPS, pass WordPress's SSRF-safe URL checks, resolve to a public network destination, remain within 10 MB, and decode as a JPEG, PNG, GIF, or WebP image.
Test, rotate, or disconnect
Open WordPress admin → RankPine:
- Test connection runs the complete signed REST permission path locally.
- Rotate connection starts a new 10-minute pairing.
- Disconnect immediately rejects future RankPine requests.
The same screen shows the plugin, WordPress, and PHP versions, HTTPS REST status, connection time, and last authenticated request. Diagnostics never include the signing secret, article bodies, or account credentials.
You can also use Test on RankPine's Integrations page to verify that RankPine can reach the WordPress endpoint over the public internet.
Application-password fallback
Use this path if you cannot install the plugin. RankPine publishes through the official WordPress REST API with a per-app password that can be revoked without changing your normal login.
What you'll need
- Your WordPress site URL (for example,
https://yourblog.com) - A WordPress username with Author or Editor rights
- An application password for that user
Create an application password
In WordPress admin, go to Users → Profile. Scroll to Application
Passwords, enter a name such as RankPine, and select Add New Application
Password. Copy the password while WordPress displays it.
Connect in RankPine
Go to Settings → Integrations, choose Connect on WordPress, and use the Application password fallback form.
| Field | What to enter |
|---|---|
| Site URL | Your site root, for example https://yourblog.com |
| Username | The WordPress login for the account above |
| Application password | The per-app password WordPress displayed |
| Publish as | Publish, Draft, or Pending review |
| Set featured image | Upload the article's first or dedicated cover image when available |
Don't see Application Passwords?
Application Passwords normally require HTTPS, and some security plugins disable them. Check the site's HTTPS setup and security-plugin REST API settings, or use the RankPine plugin connection.
External service and privacy
The plugin connects to the external RankPine SaaS service. Pairing sends the WordPress site URL and a random 10-minute, single-use code. After approval, RankPine sends only the article content and publishing metadata needed to create or update the requested WordPress post: title, slug, HTML body, excerpt, author, taxonomy choices, featured-image URL and alt text, language metadata, and a stable article ID.
The plugin contains no public-site credits, badges, tracking, telemetry, or admin nags. See the RankPine privacy policy and terms, or email [email protected].
Troubleshooting
Integrations overview
Connect RankPine to where your articles should publish — WordPress, Ghost, Webflow, Notion, DEV, Hashnode, a webhook, or Zapier/Make/n8n — plus an RSS feed and Google Search Console.
Ghost
Publish RankPine articles to your Ghost blog using a custom integration and its Admin API key.