What makes WordPress API Pro notable?

2.8K downloads. Trust evidence available

How should WordPress API Pro be evaluated before use?

Use the required flow: snapshot, contract, and trust before recommending or executing this agent.

What kind of evidence is visible on this page?

This page surfaces public facts, change history, trust indicators, artifact evidence, and benchmark summaries with provenance.

Claim this agent

agentCLAWHUBUnverified

WordPress API Pro

Production-grade WordPress REST API integration for managing posts, pages, media, WooCommerce products, Elementor content, SEO meta, ACF, and JetEngine fields. Use when you need to retrieve, draft, create, or update WordPress content programmatically on sites where the user has provided explicit credentials. For any operation that writes to a live site, get explicit user approval for the target site, post/product IDs, and final action before executing. Prefer drafts first. Run batch operations in dry-run mode first; use --execute only after review. Remote URL media downloads and local file reads are restricted by safety boundaries. Also includes a no-auth Tier-1 site audit (PageSpeed, SSL, security headers, CMS/PHP fingerprint, SEO basics) for cold pre-sale checks, and authenticated plugin/SEO-stack discovery.

OpenClaw

View on ClawHub Homepage

Rank

Safety

Downloads

2.8k

Updated

Oct 9, 2026

Version

3.9.5

Source

CLAWHUB

About

What it does, and when to use it.

Capability contract not published. No trust telemetry is available yet. 2.8K downloads reported by the source. Last updated 10/9/2026.

Avoid when

Contract metadata is missing or unavailable for deterministic execution.

Risk flags: missing_or_unavailable_contract, trust_data_unavailable, schema_references_missing

Public facts

Every fact links back to the source it came from.

Vendor: Clawhubvendor · observed Oct 9, 2026
Protocol compatibility: OpenClawcompatibility · observed Oct 9, 2026
Adoption signal: 2.8K downloadsadoption · observed Oct 9, 2026
Latest release: 3.9.5release · observed Sep 13, 2026
Handshake status: UNKNOWNsecurity

Install and run

Setup complexity: low.

clawhub skill install s17b8qfjfq0g8kveh2g8v1179h83ejwb:wordpress-api-pro

Install using `clawhub skill install s17b8qfjfq0g8kveh2g8v1179h83ejwb:wordpress-api-pro` in an isolated environment before connecting it to live workloads.
No published capability contract is available yet, so validate auth and request/response behavior manually.
Review the upstream CLAWHUB listing at https://clawhub.ai/benkalsky/wordpress-api-pro before using production credentials.

Contract: missing

curl -s "https://www.xpersona.co/api/v1/agents/clawhub-benkalsky-wordpress-api-pro/snapshot"

Documentation

CLAWHUB

158,317 characters of source documentation, loaded on request.

Extracted files

5 files captured from the source.

SKILL.md

---
name: wordpress-api-pro
version: 3.9.5
license: MIT-0
description: |
  Production-grade WordPress REST API integration for managing posts, pages, media, WooCommerce products, Elementor content, SEO meta, ACF, and JetEngine fields.
  Use when you need to retrieve, draft, create, or update WordPress content programmatically on sites where the user has provided explicit credentials.
  For any operation that writes to a live site, get explicit user approval for the target site, post/product IDs, and final action before executing.
  Prefer drafts first. Run batch operations in dry-run mode first; use --execute only after review. Remote URL media downloads and local file reads are restricted by safety boundaries.
  Also includes a no-auth Tier-1 site audit (PageSpeed, SSL, security headers, CMS/PHP fingerprint, SEO basics) for cold pre-sale checks, and authenticated plugin/SEO-stack discovery.
permissions:
  env:
    - "WP_URL / WP_SITE_URL, WP_USERNAME / WP_USER, WP_APP_PASSWORD (auth)"
    - "WP_CONFIG (optional sites.json path), WP_ALLOWED_FILE_ROOTS (file-read scope)"
    - "WP_ALLOW_REMOTE_URLS, WP_REQUIRE_HTTPS, WP_REQUIRE_ALLOWLIST, PAGESPEED_API_KEY"
    - "WP_ALLOW_HTTP (comma-separated HOST LIST, never a blanket value), WP_ALLOW_RAW_META"
    - "WP_ALLOW_PROXY (use a configured HTTP(S) proxy for audit/media fetches; off by default because the proxy, not this skill, then decides what it connects to — with it on, URLs and redirect targets are still validated but addresses are not)"
  network:
    - "Outbound HTTPS to the configured WordPress site(s) /wp-json/ REST API — plaintext http:// to a non-local host is refused unless that exact host is named in WP_ALLOW_HTTP"
    - "https://www.googleapis.com/pagespeedonline (site_audit only)"
    - "site_audit reaches the audited site over http:// or https://; every address it connects to, redirects included, must be globally reachable (is_global) and none of loopback, private, link-local, multicast, reserved or unspecified — CGNAT/shared address space (100.64.0.0/10) is refused too. The validated address is the one dialled, so a name cannot resolve differently between the check and the connection; TLS is still verified against the hostname. HTTP(S)_PROXY is ignored for these fetches unless WP_ALLOW_PROXY=1, since a proxy resolves the target itself. Response bodies are capped at 5 MB"
  filesystem:
    - "Read-only, scoped to WP_ALLOWED_FILE_ROOTS (default: cwd)"
  shell: "wp_cli.py spawns python3 <script> subprocesses (subprocess.run with an argv list; no shell interpreter, never shell=True). wp.sh is a bash wrapper around it."
---

# WordPress API Pro

Manage WordPress sites through the REST API. Runs as an OpenClaw skill or in Claude Code.

## Running in Claude Code

This skill runs the `scripts/*.py` directly, from wherever the skill is installed
(`~/.claude/plugins/` for a plugin install, `~/.claude/skills/wordpress-api-pro/`
for the repo's `bash INSTALL.sh` — that installer lives in the git r

_meta.json

{
  "ownerId": "kn7afv05r120atbc75whrv1zkx825tt5",
  "slug": "wordpress-api-pro",
  "version": "3.9.5",
  "publishedAt": 1789261303489
}

references/api-reference.md

# WordPress REST API Reference

## Base URL

```
https://yoursite.com/wp-json/wp/v2/
```

## Common Endpoints

### Posts

- `GET /posts` - List posts
- `GET /posts/{id}` - Get single post
- `POST /posts` - Create post
- `POST /posts/{id}` - Update post
- `DELETE /posts/{id}` - Delete post

### Pages

- `GET /pages` - List pages
- `GET /pages/{id}` - Get single page
- `POST /pages` - Create page
- `POST /pages/{id}` - Update page

### Media

- `GET /media` - List media
- `POST /media` - Upload media
- `GET /media/{id}` - Get media item

### Users

- `GET /users` - List users (requires auth)
- `GET /users/{id}` - Get user

### Taxonomies

- `GET /categories` - List categories
- `GET /tags` - List tags

## Post Fields

- `title` - Post title (string or object: `{raw, rendered}`)
- `content` - Post content (string or object)
- `status` - Post status (`publish`, `draft`, `pending`, `private`)
- `author` - Author ID (integer)
- `featured_media` - Featured image ID (integer)
- `excerpt` - Post excerpt
- `meta` - Custom fields (object)
- `categories` - Array of category IDs
- `tags` - Array of tag IDs

## Query Parameters

- `per_page` - Posts per page (max 100)
- `page` - Page number
- `status` - Filter by status
- `author` - Filter by author ID
- `order` - Sort order (`asc`, `desc`)
- `orderby` - Sort field (`date`, `title`, `author`)

## Authentication

WordPress REST API requires authentication for most write operations.

**Methods:**
1. Application Passwords (recommended)
2. OAuth 1.0a
3. Basic Authentication (requires plugin)

## Error Responses

```json
{
  "code": "rest_post_invalid_id",
  "message": "Invalid post ID.",
  "data": {"status": 404}
}
```

## Rate Limiting

Rate limiting depends on hosting provider. Most hosts allow 60-120 requests/minute.

## More Info

Official docs: https://developer.wordpress.org/rest-api/

references/gutenberg-blocks.md

# Gutenberg Block Format

WordPress Gutenberg uses HTML comments to define blocks.

## Basic Blocks

### Paragraph

```html
<!-- wp:paragraph -->
<p>This is a paragraph.</p>
<!-- /wp:paragraph -->
```

### Heading

```html
<!-- wp:heading -->
<h2 class="wp-block-heading">Heading Text</h2>
<!-- /wp:heading -->

<!-- wp:heading {"level":3} -->
<h3 class="wp-block-heading">H3 Heading</h3>
<!-- /wp:heading -->
```

### List

```html
<!-- wp:list -->
<ul>
<li>Item 1</li>
<li>Item 2</li>
</ul>
<!-- /wp:list -->
```

### Link/Button

```html
<!-- wp:paragraph -->
<p><a href="https://example.com">Link text</a></p>
<!-- /wp:paragraph -->
```

### Separator

```html
<!-- wp:separator -->
<hr class="wp-block-separator has-alpha-channel-opacity"/>
<!-- /wp:separator -->
```

### Table

```html
<!-- wp:table -->
<figure class="wp-block-table">
<table>
<thead><tr><th>Header 1</th><th>Header 2</th></tr></thead>
<tbody>
<tr><td>Cell 1</td><td>Cell 2</td></tr>
</tbody>
</table>
</figure>
<!-- /wp:table -->
```

## Formatting

**Bold:** `<strong>text</strong>`  
**Italic:** `<em>text</em>`  
**Link:** `<a href="url">text</a>`

## Best Practices

- Always wrap content in appropriate blocks
- Use proper HTML encoding
- Test with WordPress block editor
- Validate block syntax

skill-card.md

## Description:

WordPress API Pro helps agents manage WordPress and WooCommerce content through REST APIs, including posts, pages, media, Elementor content, SEO metadata, ACF, JetEngine fields, and site audits.

This skill is ready for commercial/non-commercial use.

## Publisher:

[benkalsky](https://clawhub.ai/user/benkalsky)

### License/Terms of Use:

MIT-0

## Use Case:

Developers, site operators, and content teams use this skill to inspect, draft, create, update, and audit WordPress or WooCommerce sites after supplying explicit credentials and approval for live writes.

### Deployment Geography for Use:

Global

## Known Risks and Mitigations:

Risk: Configured WordPress or WooCommerce credentials can permit live content changes.

Mitigation: Use dedicated least-privileged credentials, confirm target site, IDs, fields, status, and final action before writes, prefer drafts, and review dry-run output before batch or seed execution.

Risk: Local configuration files may contain production credentials.

Mitigation: Keep config/sites.json local and locked down, prefer environment variables or a secret manager, and avoid committing production credentials.

Risk: PageSpeed audits may disclose private or confidential URLs to Google.

Mitigation: Run PageSpeed audits only for public URLs or omit PageSpeed checks for confidential sites.

Risk: Remote media fetches and local file reads can expose unintended resources if allowed too broadly.

Mitigation: Keep remote media URLs opt-in, use HTTPS public URLs, and scope local file reads with WP_ALLOWED_FILE_ROOTS.

Risk: Dependency installation can introduce environment or patch-management risk.

Mitigation: Install dependencies in a virtual environment and keep the requests dependency within the documented secure version range.

## Reference(s):

- [ClawHub Skill Page](https://clawhub.ai/benkalsky/skills/wordpress-api-pro)
- [WordPress REST API Reference](references/api-reference.md)
- [Gutenberg Block Format](references/gutenberg-blocks.md)
- [Official WordPress REST API Documentation](https://developer.wordpress.org/rest-api/)
- [Google PageSpeed Online API Endpoint](https://www.googleapis.com/pagespeedonline)

## Skill Output:

**Output Type(s):** [text, markdown, code, shell commands, configuration, guidance]

**Output Format:** [Markdown, JSON, shell command examples, and configuration guidance]

**Output Parameters:** [1D]

**Other Properties Related to Output:** [May propose or run WordPress REST API operations, audits, and dry-run plans depending on user approval and configured credentials.]

## Skill Version(s):

3.9.5 (source: frontmatter and server release evidence)

## Ethical Considerations:

Users should evaluate whether this skill is appropriate for their environment, review any generated or modified files before relying on them, and apply their organization's safety, security, and compliance requirements before deployment.

Github ReposUpdated 6mo agoRank 70

activepieces

AI Agents & MCPs & AI Workflow Automation • (~400 MCP servers for AI agents) • AI Automation / AI Agent with MCPs • AI Workflows & AI Agents • MCPs for AI Agents

OPENCLAW

Github ReposUpdated 6mo agoRank 70

cherry-studio

AI productivity studio with smart chat, autonomous agents, and 300+ assistants.

MCPOPENCLAW

Github ReposUpdated 6mo agoRank 70

AionUi

Free, local, open-source 24/7 Cowork app and OpenClaw for Gemini CLI, Claude Code, Codex, OpenCode, Qwen Code, Goose CLI, Auggie, and more | 🌟 Star if you like it!

MCPOPENCLAW

Github ReposUpdated 7mo agoRank 70

CopilotKit

The Frontend for Agents & Generative UI. React + Angular

OPENCLAW

Machine-readable data

The same record, as JSON, for agents and crawlers.

{
  "facts": [
    {
      "factKey": "vendor",
      "category": "vendor",
      "label": "Vendor",
      "value": "Clawhub",
      "href": "https://clawhub.ai/benkalsky/skills/wordpress-api-pro",
      "sourceUrl": "https://clawhub.ai/benkalsky/skills/wordpress-api-pro",
      "sourceType": "profile",
      "confidence": "medium",
      "observedAt": "2026-10-09T11:37:02.776Z",
      "isPublic": true
    },
    {
      "factKey": "protocols",
      "category": "compatibility",
      "label": "Protocol compatibility",
      "value": "OpenClaw",
      "href": "https://www.xpersona.co/api/v1/agents/clawhub-benkalsky-wordpress-api-pro/contract",
      "sourceUrl": "https://www.xpersona.co/api/v1/agents/clawhub-benkalsky-wordpress-api-pro/contract",
      "sourceType": "contract",
      "confidence": "medium",
      "observedAt": "2026-10-09T11:37:02.776Z",
      "isPublic": true
    },
    {
      "factKey": "traction",
      "category": "adoption",
      "label": "Adoption signal",
      "value": "2.8K downloads",
      "href": "https://clawhub.ai/benkalsky/wordpress-api-pro",
      "sourceUrl": "https://clawhub.ai/benkalsky/wordpress-api-pro",
      "sourceType": "profile",
      "confidence": "medium",
      "observedAt": "2026-10-09T11:37:02.776Z",
      "isPublic": true
    },
    {
      "factKey": "latest_release",
      "category": "release",
      "label": "Latest release",
      "value": "3.9.5",
      "href": "https://clawhub.ai/benkalsky/wordpress-api-pro",
      "sourceUrl": "https://clawhub.ai/benkalsky/wordpress-api-pro",
      "sourceType": "release",
      "confidence": "medium",
      "observedAt": "2026-09-13T01:01:43.489Z",
      "isPublic": true
    },
    {
      "factKey": "handshake_status",
      "category": "security",
      "label": "Handshake status",
      "value": "UNKNOWN",
      "href": "https://www.xpersona.co/api/v1/agents/clawhub-benkalsky-wordpress-api-pro/trust",
      "sourceUrl": "https://www.xpersona.co/api/v1/agents/clawhub-benkalsky-wordpress-api-pro/trust",
      "sourceType": "trust",
      "confidence": "medium",
      "observedAt": null,
      "isPublic": true
    }
  ],
  "events": [
    {
      "eventType": "release",
      "title": "Release 3.9.5",
      "description": "**Security update: Restricts http:// access to named hosts only; dependency instructions clarified for better patching.** - HTTP API access to non-local hosts now requires explicit host naming in WP_ALLOW_HTTP; blanket WP_ALLOW_HTTP=1 is no longer accepted. - Permission fields and setup docs updated to reflect this variable change, preventing accidental plaintext credential exposure. - Dependency instructions now prescribe a secure version range for requests, explaining the reasoning for patch flexibility vs. reproducibility. - Removed legacy skill-card.md file.",
      "href": "https://clawhub.ai/benkalsky/wordpress-api-pro",
      "sourceUrl": "https://clawhub.ai/benkalsky/wordpress-api-pro",
      "sourceType": "release",
      "confidence": "medium",
      "observedAt": "2026-09-13T01:01:43.489Z",
      "isPublic": true
    }
  ]
}

Record generated Oct 9, 2026.

About

Avoid when

Public facts

Install and run

Documentation

Extracted files

SKILL.md

_meta.json

references/api-reference.md

references/gutenberg-blocks.md

skill-card.md

Related agents

activepieces

cherry-studio

AionUi

CopilotKit

Machine-readable data