Connect your WordPress site

Before you start

You need three things:

• WordPress 5.6 or newer. Application Passwords arrived in 5.6, in December 2020. Anything maintained since then has it.
• The site served over HTTPS. WordPress refuses to show the feature on a plain HTTP site, and we will not send credentials over one either.
• An Administrator account on the site. An Editor works for writing and images, but an Administrator avoids permission surprises when a new category is needed.

Self-hosted WordPress on any host works. WordPress.com works on a Business plan or above — below that, the REST API you need is not available.

Method A — Application Password

This is the one to use unless it turns out to be unavailable. It creates a credential that works only for the API, can be revoked on its own, and never touches your real password.

1. Open your profile

Sign in to your WordPress admin, then go to Users → Profile in the left-hand menu. The direct address is https://your-site.com/wp-admin/profile.php.

Scroll right to the bottom of that page — the section is the last thing on it, below Account Management.

2. Name it and create it

In New Application Password Name type something you will recognise later — YoDon is the obvious choice — and press the button underneath.

That button says Add Application Password on WordPress 6.8 and later, and Add New Application Password on older versions. Same thing.

3. Copy the password immediately

WordPress shows the new password once, in six groups of four characters, and never again. Copy it now — the spaces do not matter, WordPress strips them before checking.

4. Paste it into YoDon

In your dashboard go to Sites → Connect a site → WordPress → Application Password, then fill in:

• Site URL — the site's home page, e.g. https://example.com, not the wp-admin address.
• WordPress username — the username you just signed in with, not your display name.
• Application password — what you just copied.

We check the connection before saving, so if it goes through, the site really is reachable. You will also see which SEO plugin we detected.

Method B — the connector plugin

Use this when Application Passwords are unavailable or your host strips the header they rely on. It authenticates with its own token instead.

1. Download the plugin

Get it from the connect dialog, or download the YoDon Connector directly. Keep it zipped — WordPress wants the .zip.

2. Upload and activate it

In your WordPress admin go to Plugins → Add New Plugin (just Add Plugin on WordPress 6.8 and later), press Upload Plugin at the top of the page, choose the file, then press Install Now followed by Activate Plugin.

3. Copy the token

A new item appears at Settings → YoDon. Open it and copy the token shown there.

4. Paste it into YoDon

Sites → Connect a site → WordPress → Connector plugin, then enter the site URL and the token. No username is needed — the plugin already knows which user to publish as.

When it doesn't work

There is no Application Passwords section on my profile page

WordPress hides the whole section rather than explaining why, which is why this trips people up. In order of likelihood:

• The site is not fully on HTTPS. Check Settings → General: both WordPress Address and Site Address must start with https://. A site that merely redirects to HTTPS while those fields still say http:// counts as insecure, and the section stays hidden. If it is hidden for this reason WordPress says so: “The application password feature requires HTTPS, which is not enabled on this site.”
• A security plugin turned it off. In Wordfence: Login Security → Settings → untick “Disable WordPress application passwords”. In Solid Security (formerly iThemes): Settings → Advanced → untick “Disable Application Passwords”. All In One WP Security has a similar REST API restriction.
• WordPress is older than 5.6. Update it, or use the connector plugin.
• Your host already uses HTTP Basic auth — common on password-protected staging sites. WordPress tells you: “Your website appears to use Basic Authentication, which is not currently compatible with Application Passwords.” Remove that protection, or use the connector plugin.
• A developer disabled it in code, with a filter on wp_is_application_passwords_available. Whoever maintains the site will know.

Any of those unfixable? Method B works on sites where Application Passwords do not.

It says the credentials are wrong, but I am sure they are right

• Use the username, not the display name and not the email address — unless you actually sign in with the email.
• Make sure you pasted the application password, not your login password. The login password never works here.
• Some hosts and Apache configurations drop the header that carries the credential before it reaches WordPress. Nothing you can set in the dashboard fixes that — use the connector plugin.

It connects, but publishing fails

That is a permissions problem rather than a login problem. The user needs to be able to publish posts, upload files and manage categories; an Administrator has all three. A security plugin that blocks REST API writes will also do this.

We could not reach the site at all

Check that the URL opens in a browser exactly as you typed it, including www or its absence. Firewalls and “under construction” plugins that require a login will also block us. If a site is genuinely reachable and still fails, open a support ticket with the site address — some hosts need a specific fix and we would rather tell you than have you guess.

What access this gives us

With the credential you create, we can:

• create posts and save drafts;
• upload the featured image for each article;
• read your existing posts, so new articles can link to them;
• read and, if you allow it, create categories and tags;
• write SEO metadata into Yoast or Rank Math.

And what happens to the credential itself:

• it is encrypted before it is stored, and never shown back to you;
• it is never sent to any AI provider — those receive the writing task, not the keys to your site;
• deleting the site here deletes the stored credential;
• revoking it in Users → Profile cuts our access immediately, without touching your own login.

The privacy policy sets all of this out in full.

Questions