Publishing integrations

Connect WordPress to Rankli

We publish through the WordPress REST API with an application password, a credential you can revoke from your own dashboard. The Rankli plugin sets it up in one click and checks the site first; the same credential can also be made by hand.

Before you start#

You needWhy
WordPress 6.0 or newer for the plugin, 5.6 for the by-hand pathApplication passwords are built in from 5.6; the plugin requires 6.0 and PHP 7.4.
A user who can publish postsEditor or Administrator. A Contributor can create drafts but not publish them, and the connection test says so.
HTTPS on the siteWordPress disables application passwords on plain http, and so do we.
The REST API reachableSome security plugins disable /wp-json entirely. If yours does, allowlist it, see troubleshooting.

Install the Rankli plugin (recommended)#

The plugin does the setup and runs the checks that otherwise surface on the first publish. It creates a dedicated rankli user with the Author role, which can publish its own posts and upload images and nothing more, issues that user an application password, and shows the three values the connection screen asks for.

  1. Install and activate the Rankli plugin on your site.
  2. Go to Settings → Rankli.
  3. Read the health check: HTTPS, pretty permalinks, application passwords available, /wp-json/wp/v2/posts answering, and whether a security plugin known to block the REST API is active. A failing row prints its fix under it.
  4. Click Connect to Rankli. The site URL, username and application password appear once.
  5. Click Copy for Rankli, then Open Rankli’s WordPress connection screen, and paste.

The plugin sends nothing to Rankli and runs nothing on your front end; its only network request is your site calling its own REST API during the health check. Disconnect on the same screen revokes the password and leaves the user and its posts untouched. An optional one-line “Content by Rankli” credit is off by default.

Or create an application password by hand#

The same credential, made yourself, for a site where you would rather not add a plugin.

  1. Sign in to WordPress as the user you want articles published as.
  2. Go to Users → Profile (or Users → All Users and edit that user).
  3. Scroll to Application Passwords.
  4. Type a name you will recognise later, Rankli, and click Add New Application Password.
  5. Copy the password it shows you. It is shown once, with spaces in it. Keep the spaces; WordPress ignores them, and removing them by hand is a common way to get a 401.

An application password is a separate credential from the account password. Revoking it on that same screen instantly cuts off publishing and nothing else.

Connect it#

  1. In Rankli, open Integrations → New integration → WordPress.
  2. Site URL: the address of the site itself, e.g. https://acme.com. If WordPress lives in a subdirectory, include it: https://acme.com/blog.
  3. Username: the WordPress login name of that user, not their email. With the plugin, rankli.
  4. Application password: the one you just copied.
  5. Publish mode: Publish posts live at the scheduled time; Draft puts each article in your drafts for review. Start on draft if you want to see the first few.
  6. Save. We test the connection immediately.

The test answers two questions separately: whether the credentials authenticate, and whether that user may actually create a post. A credential that authenticates but cannot publish is the failure mode that otherwise only shows up on the first article.

What lands on your site#

FieldWhere it goes
TitleThe post title.
BodyThe post content as HTML, with our own image URLs rewritten to yours.
SlugThe post slug. A collision gets a suffix rather than overwriting your post.
Meta descriptionThe excerpt, and the meta description field of Yoast or Rank Math when one is present.
ImagesUploaded into your media library first, then referenced. The hero becomes the featured image.
Categories and tagsTaken from the connection settings; tags come from the article’s keyword cluster.
AuthorThe user whose application password this is.

Images are uploaded, not hotlinked. Every image is copied into your own media library before the post is created, so nothing on your site depends on our storage staying up or staying the same.

When it does not work#

401 Unauthorized

Nine times in ten the username is wrong (an email address instead of the login name) or the application password was edited. Copy it again, spaces included. If your host strips the Authorization header, some Apache configurations do, add this to .htaccess:

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

403 Forbidden, or the REST API 404s

A security plugin (Wordfence, iThemes, All In One WP Security) is blocking /wp-json or REST authentication. Allow the REST API for authenticated users, or allowlist our publisher, which identifies itself as:

User-Agent: rankli-publisher/1.0

The post appeared but the images did not

The media endpoint refused the upload, usually an upload size limit or a hardened wp-content/uploads. The article still publishes; the failure is recorded on the article row with the status WordPress returned.

A failed publish

Failures are listed on the article with the response we got. Fix the cause and retry from the article, or with POST /articles/{id}/retry-publish. Retries are idempotent: they update the post that already exists rather than creating a second one.