Connect Claude to your WordPress site safely

This guide connects an AI assistant to your WordPress site so that it can draft, edit and publish content for you, using the method WordPress itself supports: the MCP Adapter plugin and an application password. It is written for a site owner on Noiz hosting who has never done this before. The whole setup takes about fifteen minutes, and the safety steps are part of it, not an extra.

Last reviewed: 19 October 2026, against WordPress 6.9, MCP Adapter and Claude Desktop. Works on every Noiz hosting plan that runs WordPress over HTTPS.

Official Documentation Reference

• WordPress MCP Adapter and its CLI usage guide: the plugin and the connection settings.
• WordPress: Application Passwords: how application passwords work and why they exist.
• WordPress: Roles and Capabilities: what each user role may do.
• Anthropic: Connect to local MCP servers: adding a connector to Claude Desktop.

Before you start

• Your site runs WordPress 6.9 or later. Check under Dashboard > Updates. The Abilities API that the connector uses is part of WordPress core from 6.9.
• Your site is served over HTTPS. Every Noiz plan includes a free Let's Encrypt certificate; if your address still shows "Not secure", see How to install a free Let's Encrypt SSL certificate in Plesk first. An application password sent over plain HTTP can be read in transit.
• You have Claude Desktop or Claude Code installed on your computer, and Node.js, which the connector's small helper program needs. Other MCP clients work the same way.
• You have a recent backup. Take one now in Plesk: How to generate a full backup in Plesk. Our article on backing up before AI-driven changes explains why this is the step people skip and regret.

Step 1: Create a user for the assistant

Never connect an assistant with your own administrator account. Give it a user of its own, so that you can see what it did, limit what it may do, and remove it without touching anything else.

1. In the WordPress dashboard go to Users > Add New User.
2. Username: something you will recognise in logs, for example claude-editor. Email: an address you control (WordPress needs one; the assistant never reads it).
3. Role: Editor. An Editor can create, edit and publish posts and pages and upload media, and cannot install plugins, change themes, add users or change settings. For most content work that is exactly enough. If you only want drafts, choose Author or Contributor instead and promote later.
4. Set a long random password and keep it in your password manager. The assistant will not use this password; it uses the application password from the next step.
5. Click Add New User.

Do not choose Administrator. If a task genuinely needs it, such as installing a plugin, do that task yourself.

Step 2: Create an application password

An application password is a separate password that only works for programmatic access (the REST API). It cannot be used to log in to the dashboard, it can be named, it shows when it was last used, and it can be revoked on its own.

1. Log in to WordPress as the new user, or stay logged in as yourself and open Users > All Users and edit the new user.
2. Scroll to Application Passwords. Enter a name that says which tool it is for, for example Claude Desktop, office laptop.
3. Click Add New Application Password.
4. WordPress shows the password once, as six groups of four characters. Copy it into your password manager now. You will not see it again; if you lose it, revoke it and make another.

If the Application Passwords section is missing, your site is not on HTTPS, or a security plugin has turned the feature off. Fix HTTPS first; if a plugin is the cause, allow application passwords for this one user rather than switching the plugin off.

Step 3: Install the MCP Adapter plugin

1. Go to Plugins > Add New Plugin and search for MCP Adapter (by the WordPress AI team). Install and activate it.
2. The plugin needs no settings for this guide. It creates a connector at https://your-domain/wp-json/mcp/mcp-adapter-default-server that only answers to an authenticated user.

The adapter exposes "abilities" that WordPress and its plugins register: posts, pages, media, and, if you run WooCommerce, products and orders. Each ability checks the user's own permissions, so the Editor you created still cannot do an administrator's work through the connector.

Step 4: Connect Claude Desktop

Claude Desktop reads its connectors from a configuration file. Open Settings > Developer > Edit Config, which opens claude_desktop_config.json, and add this block, replacing the three values with your own:

{
  "mcpServers": {
    "my-wordpress-site": {
      "command": "npx",
      "args": ["-y", "@automattic/mcp-wordpress-remote@latest"],
      "env": {
        "WP_API_URL": "https://your-domain/wp-json/mcp/mcp-adapter-default-server",
        "WP_API_USERNAME": "claude-editor",
        "WP_API_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx"
      }
    }
  }
}

Save the file and restart Claude Desktop. Your site is listed under + > Connectors in the chat box. For Claude Code, the same connection is one command in your terminal:

claude mcp add my-wordpress-site -e WP_API_URL=https://your-domain/wp-json/mcp/mcp-adapter-default-server -e WP_API_USERNAME=claude-editor -e WP_API_PASSWORD="xxxx xxxx xxxx xxxx xxxx xxxx" -- npx -y @automattic/mcp-wordpress-remote@latest

The configuration file now holds a password, so treat it as one: it stays on your computer, it is not shared, pasted into a chat or committed to a code repository, and the password in it is the application password, never your login password.

Step 5: Test with something harmless

Ask the assistant: "List the five most recent posts on my site, with their status." It should answer with real titles. Then ask it to "create a draft post titled Connection test with one paragraph of placeholder text". Check in the dashboard that the draft exists, that it is attributed to the new user, and that it is a draft and not published. Delete it.

If the assistant cannot connect, the three usual causes are a typing error in the password (copy it again, spaces included), a site not on HTTPS, or a security plugin blocking the REST API for that user. The last-used date on the Application Passwords screen tells you whether the connection reached WordPress at all.

Working with it day to day

• Draft, then approve. Ask for drafts and publish them yourself, or let the assistant publish and check your site after each session. The user's name on every post tells you which edits were the assistant's.
• One task at a time. "Update the opening hours on the Contact page" works well. "Tidy up the whole site" is how things get lost.
• Watch the last-used date. If the application password shows a use at a time you were not working, revoke it and create a new one.

Revoking access

Open Users > All Users, edit the assistant's user, and under Application Passwords click Revoke next to the password. The connector stops working immediately. To remove the assistant entirely, delete the user and attribute its content to yourself when WordPress asks. Do this for any tool you stop using and before you hand the site to someone else.

What this does not give the assistant

The connection is to WordPress only. The assistant cannot reach your hosting account, your email, your files outside WordPress, your database or your Noiz console, and it cannot change the site's theme or plugins with an Editor's permissions. The next article shows how the same connection manages a WooCommerce shop; the sPremium articles cover an AI coding tool working on your site over SSH, where the access, and the care needed, are larger.

Keeping it working

The MCP Adapter, like WordPress itself, changes. If you would rather someone kept core, the plugin and the connection updated and tested, that is what WordPress Care does, on any Noiz hosting plan.