Connect Grok Bot to WordPress
Choose an approved way for the AI tool to work with WordPress. Test it on a practice page before changing a real site.
Need a word explained? Open the glossary →
Full lesson & technical details
Three ways in: REST API with an application password, WP-CLI over SSH, and the hosting panel by computer use. Prove each with a page created from chat.
The three doors
| Door | What it does | Needs | Use for |
|---|---|---|---|
| REST API | Create and edit posts, pages, media, menus, settings over HTTPS | Application password | Content, media, SEO fields, most of the build |
| WP-CLI over SSH | Install themes and plugins, set options, search-replace, export/import, run updates | SSH access | Setup, theme/plugin installs, migrations, care plan |
| Computer use / browser | Clicks in wp-admin or the hosting panel | Browser access | DNS, SSL, staging buttons, the few settings with no CLI |
Grok Bot can also publish to WordPress through the Postiz plugin: a post object with __type: wordpress, title, type (post or page) and main_image uploaded with postiz upload. That is the lightweight path for the care-plan routine; the REST API is the full path for the build.
REST API in one breath
POST https://site.com/wp-json/wp/v2/pages with basic auth (grokbot:<application password>) and a JSON body { "title": "About", "status": "draft", "content": "<!-- wp:paragraph --><p>…</p><!-- /wp:paragraph -->" }. Content is block markup; the Bot writes it. Media: POST /wp-json/wp/v2/media with the file. SEO fields via the Rank Math or Yoast REST endpoints.
The proof
- Bot lists existing pages (GET). 2. Creates a draft page “Bot test” with one heading and one paragraph in block markup. 3. Uploads a 1200×630 image and sets it as featured. 4. Reads the page back and gives you the preview link. 5. Deletes it on your approval.
Then with WP-CLI: wp core version, wp plugin list, wp option get blogname.
Security rules
- The Bot has its own admin user; you can delete it in one click.
- Application passwords are secrets; the Bot references them by name.
- Every destructive command (delete, search-replace, update) is Auto-review “ask first”.
- The Bot never touches a live site without a backup first (
wp db exportor UpdraftPlus).
Worked example
<!-- wp:heading {"level":1} --><h1>Hello from Grok Bot</h1><!-- /wp:heading -->
<!-- wp:paragraph --><p>This page was created through the REST API.</p><!-- /wp:paragraph -->
<!-- wp:buttons --><div class="wp-block-buttons"><!-- wp:button --><div class="wp-block-button"><a class="wp-block-button__link" href="/contact">Book a call</a></div><!-- /wp:button --></div><!-- /wp:buttons -->
Block comments are what make the editor recognize the content; plain HTML lands as a “Classic” block the client cannot edit well.
Instructions you can copy (prompts)
Copy the instructions, replace the words inside {braces} with your details, and paste them into your AI tool. Check and edit the answer.
Using secrets WP_URL, WP_USER and WP_APP_PASSWORD: 1) GET the list of pages and show titles and ids; 2) create a draft page titled “Bot test” with a heading “Hello from Grok Bot” and one paragraph in WordPress block markup; 3) generate a 1200×630 soft abstract image, upload it to the media library and set it as the featured image; 4) read the page back and give me the preview link; 5) ask me before deleting it, then delete. If SSH is configured, also run `wp core version`, `wp plugin list --status=active` and `wp option get blogname` and show the output.
Create the grokbot admin user and application password, store them as secrets, run the proof card. Paste the page list and the WP-CLI output (or “no SSH” if your host lacks it).
Done when: A page created, featured image set, read back and deleted, all from chat; and WP-CLI responding if available.. Sign up to save your work to your account.
Quick knowledge check
3 questions, 60% passes. Checkpoints, the certification exam (three versions) and the reviewed final project are unlocked with a free account.
- The REST API authenticates with:
- Installing a theme or plugin is best done through:
- Before any change to a live site the Bot: