Connecting WordPress

Rankbench publishes to WordPress through its REST API, logging in with an application password. That is a separate password WordPress makes for one app, so you never share your real login, and you can revoke it any time without changing anything else.

It takes about five minutes. You need to be able to log in to your WordPress dashboard as an Administrator.

Before you start

Three things have to be true. Most failures come from one of them.

• Your site is on HTTPS. WordPress only offers application passwords on secure sites.
• Application passwords are switched on. They are on by default, but some security plugins switch them off. Wordfence does this with one checkbox. Step 1 covers it.
• The account can publish. Use an Administrator, Editor or Author account. A Contributor can only save drafts.

Step 1: Check application passwords are on

In your WordPress dashboard, go to Users → Profile and scroll down to Application Passwords.

If you see a box to type a name and a button Add New Application Password, they are on. Skip to step 2.

If it says Application passwords have been disabled by Wordfence, turn them back on:

1. Press Edit Wordfence Options, the button right under that message. It opens Wordfence's Firewall Options page.
2. Click Brute Force Protection to open that section.
3. Under Additional Options, untick Disable WordPress application passwords.
4. Press Save Changes at the top right of the page.

Go back to Users → Profile. The Application Passwords section now has the box and the button.

Step 2: Create an application password

1. In Users → Profile, scroll to Application Passwords.
2. Type Rankbench as the name.
3. Press Add New Application Password.
4. Copy the password it shows. It looks like abcd EFGH 1234 ijkl MNOP 5678.

Step 3: Add the connection in Rankbench

1. Open Content Calendar → Where it publishes.
2. Press Add a connection and choose WordPress.
3. Fill in the three fields:

• WordPress site URL: your site's home address, for example https://example.com. Not the /wp-admin address.
• Username: exactly as shown at the top of Users → Profile in WordPress, the profile where you made the password. It is not always your display name or email.
• Application password: the password from step 2. The spaces are fine.

1. Choose draft or publish. Draft sends articles for you to approve in WordPress. Publish puts them live.
2. Save.

Step 4: Press Test

On the connection, press Test. It checks the address, the login and the account's permissions, and either says Connected to WordPress or tells you exactly what to fix. The next section lists every message.

Fixing what Test tells you

Find the message you see, then do what it says underneath.

Application passwords are switched off on your site

A plugin or your host has turned them off. Follow step 1, make a password in step 2, paste it into the connection, and press Test again.

There is no WordPress REST API at that address, or it did not answer like a WordPress site

The site URL is wrong. Use the plain home address of the site, like https://example.com, with no /wp-admin or other path after it. If your blog lives in a folder, such as https://example.com/blog, use that.

WordPress did not accept this login

Application passwords are on, but WordPress did not log in with the details in the connection. There are two possible reasons. Many sites, including any running Wordfence, hide which one it is, so try them in this order.

First, the password or username. This is almost always it.

1. In WordPress, go to Users → Profile. Note the Username at the top of the page. It cannot be changed, and it is not always the same as your display name or email.
2. Scroll to Application Passwords, make a new one, and copy it straight away.
3. In Rankbench, press Edit on the connection. Paste the new password and type the username exactly as it appears in WordPress.
4. Save, then press Test.

If a brand new password still fails, it is your server. It is removing the login from requests before WordPress sees them. Your host can fix this in a minute. Send them this:

Please pass the HTTP Authorization header through to PHP so WordPress application passwords work.

If you manage the server yourself, it is one line.

On Apache, add this to .htaccess above the WordPress block:

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

On nginx with PHP-FPM, add this to the block that passes requests to PHP, then reload nginx:

fastcgi_param HTTP_AUTHORIZATION $http_authorization;

WordPress rejected the username or application password

The password is wrong or was revoked, or the username does not match the account that made it. Make a new application password in step 2 and paste it into the connection. Check the username is the one you log in with.

This user is not allowed to write posts

The account is a Subscriber or similar. Use an Administrator, Editor or Author account, make an application password on that account, and update the connection.

Connected, but this user can save drafts but not publish

The connection works, but the account is a Contributor. Either set the connection to draft, or use an Administrator, Editor or Author account.

A firewall or security plugin blocked the request

Something in front of WordPress answered instead of it. This is usually a security plugin's firewall or your host's. If you use Wordfence, check Wordfence → Tools → Live Traffic for a blocked request from Rankbench and allow it. Otherwise ask your host whether they block requests to /wp-json/.

A server error page, usually temporary

Your site's server had a problem. There is nothing to change. Press Test again in a few minutes. Rankbench retries scheduled articles by itself too, after 1, 2, 4, 8 and 16 hours.

If an article failed to publish

The article's day page shows the reason under Publishing history. Press Test on the connection to find out what to fix, fix it, and press Test again.

Rankbench does not keep retrying a refused article on its own, so your site is not sent the same failing request every hour. It tries again as soon as you change or re-test the connection. You can also publish any article by hand from its day page at any time.

Where to go next

Connecting where it publishes covers the other platforms. Publishing and what happens next covers what happens once a connection works.