WordPress setup guide

Agents read and update your website's content.

Ways to connect

Company admins connect apps, on the Integrations page in Everdeck: open WordPress, choose one of the ways below, follow its steps and fill in its fields. Everdeck checks what you enter before it saves anything, and asks you to confirm it’s you (your second factor) before you type any secret. How connecting works.

WordPress can be connected 2 ways. Where there’s a key or token to paste, that’s usually the quickest.

Application password (self-hosted WordPress, or WordPress.com with hosting features)

API key.

1. Sign in to wp-admin as the user the agent should work as. An Editor account works best: it can publish, upload images, manage categories and moderate comments. An Author can only publish their own posts and cannot moderate comments; a Contributor cannot publish or upload.
2. Open Users > Profile (or Users > Edit User for another account) and scroll to Application Passwords. WordPress 5.6 or later is needed, and the section only appears on sites served over HTTPS.
3. Enter a name such as "Everdeck" and click Add New Application Password.
4. Copy the password right away; it is shown only once. Paste it here with or without the spaces, together with the site URL and the username.
5. If the section is missing, a security plugin or the host has turned application passwords off; ask the site administrator to allow them.

Field	What to enter
Site URL	Web address. For example https://www.example.com. The address of the site itself, without /wp-admin. It must use HTTPS.
WordPress username	Text. The login name of the user the agent works as, not the display name.
Application password	A secret: Everdeck saves it encrypted and never shows it again. Where to find it.

Disconnecting deletes the credentials Everdeck saved, but Everdeck can't revoke them: the key, token or password itself keeps working at WordPress until you delete or rotate it there.

Your WordPress.com app (sites hosted on WordPress.com)

Your OAuth app.

This way signs in with an OAuth app you create for WordPress, as its steps describe: Everdeck never uses an app of its own. Register this redirect URI with your app:

https://everdeck.io/api/oauth/callback

Then save the app’s client ID and secret in Everdeck, on the connect page or under OAuth apps, and sign in.

1. Signed in to WordPress.com, open https://developer.wordpress.com/apps/new/ and create an application.
2. Enter a name and website, set the Redirect URLs to https://everdeck.io/api/oauth/callback, choose Type: Web, and save.
3. Copy the Client ID and Client Secret into the form.
4. Click Connect, sign in as the user the agent should work as (an Editor or Administrator of the site), and choose the site to give access to.

Field	What to enter
Site (optional)	Text. Only if the sign-in can reach several sites: the site ID or address (example.wordpress.com) the agent should work on.

Disconnecting deletes the tokens Everdeck saved. WordPress.com ends only the person's whole authorization of the app: remove it at wordpress.com/me/security/connected-applications.

What agents can do

An agent uses an action only when its charter grants it, on the agent’s Tools tab, where you choose whether each one runs by itself (Auto), asks first or never runs. Each action has a risk tier: tier 3 actions, which customers or the public see, ask first unless you choose otherwise, and tier 4 actions (money, deleting things, access) always need a person. How tools and tiers work.

Actions marked Reads outside content return things people outside your company may have written. Agents treat what they read as information, never as instructions, and their riskier actions later in the same session need approval.

• Find posts or pagesTier 0 · ReadReads outside contentwordpress_list_posts

  List or search posts or pages, newest first. Returns id, title, status (publish, future, draft, pending, private), link, dates and excerpt. Drafts are included by default.

• Read a post or pageTier 0 · ReadReads outside contentwordpress_get_post

  Read one post or page with its raw content (block editor markup or HTML), excerpt, status, categories, tags and featured image id. Read it before changing it.

• Write a draftTier 2 · ReversibleReads outside contentwordpress_create_draft

  Create a new post or page as a draft (or pending review). Nothing is published. The content is HTML such as <h2>Heading</h2><p>Text</p>; the block editor shows plain HTML as a Classic block.

• Edit a draftTier 2 · ReversibleReads outside contentwordpress_update_draft

  Change the title, content, excerpt, slug, categories, tags or featured image of a post or page that is still a draft or pending review. Refuses published, scheduled and private items; use update_post for those.

• Edit a live post or pageTier 3 · ExternalReads outside contentwordpress_update_post

  Change any post or page, including one that is already published; the change is visible on the site at once. Only the fields you send are changed; content replaces the whole body.

• Publish or scheduleTier 3 · Externalwordpress_publish_post

  Publish a draft post or page now, or schedule it by giving a future time in the site's timezone (WordPress then sets the status to future).

• List categories or tagsTier 0 · ReadReads outside contentwordpress_list_terms

  Find category or tag ids by name, most used first. Use the ids when writing posts.

• List commentsTier 0 · ReadReads outside contentwordpress_list_comments

  List comments, newest first: hold for comments waiting for moderation, approve for published ones, spam, or all. Optionally only on one post. Comment text comes from site visitors.

• Reply to a commentTier 3 · ExternalReads outside contentwordpress_reply_to_comment

  Publish a reply under a visitor's comment as the connected user. Replies from users who can moderate comments appear on the site at once.

• Approve, hold or mark spamTier 3 · ExternalReads outside contentwordpress_moderate_comment

  Approve a comment so it appears on the site, put it back on hold, or mark it as spam.

• Upload an image or fileTier 2 · ReversibleReads outside contentwordpress_upload_media

  Add an image or document to the Media Library from a public URL or a file in the company's Spaces, with alt text and caption. Returns the media id (for featured_media_id) and its URL.

What can start work

These events from WordPress can become tasks for your agents through Intake. How Intake works.

A post was created, edited, scheduled or published (any status except trash).

Connect WordPress first. Then, on the Intake page, open Webhooks and sources, find it under Connector triggers and select Start watching. Then, on the Rules tab, select New rule to say which requests become tasks and who gets them.

A visitor left a comment that is waiting for approval.

Connect WordPress first. Then, on the Intake page, open Webhooks and sources, find it under Connector triggers and select Start watching. Then, on the Rules tab, select New rule to say which requests become tasks and who gets them.

Testing, problems and disconnecting

Everdeck checks the connection when you save it. On the connection’s page in Integrations, Test checks it again at any time.

If WordPress later refuses the connection, for example because a key was deleted or a sign-in expired, the connection shows Needs attention on the Integrations page and the people who manage connections are told. Agents can’t use it until a company admin fixes it with Edit or Reconnect.

To stop agents using WordPress, open the connection and select Disconnect. Agents stop using it at once and its saved credentials are deleted. What else happens depends on how it was connected: each way above says.