WordPress API Pro

WordPress API Pro

Manage WordPress sites through the REST API from an OpenClaw 技能.

Safety rules Never publish or 更新 live content without explicit user 应用roval. Confirm tar获取 site, IDs, fields, and 状态. Use least-privilege 凭证s. Prefer a dedicated WordPress user/应用 password scoped to the required 角色. Do not store production 凭证s in the repo. Use 环境 variables when possible. 保护 config files. If you 创建 config/sites.json, keep it local, un追踪ed, and chmod 600 config/sites.json. Batch changes are dry-运行 by default. 添加 --执行 only after reviewing the dry-运行 输出. Tar获取ing every site is blocked by default. 添加 --allow-all only when the user explicitly 应用roved all 配置d sites. Local file reads are restricted. --content-file and media 上传s can read only from the current working directory by default. 设置 WP_ALLOWED_FILE_ROOTS to opt into another safe directory. Remote media URLs are opt-in. 上传_media.py requires --allow-remote-url or WP_ALLOW_REMOTE_URLS=1, allows HTTPS only, and blocks private/local network hosts. Authentication

Recommended 环境 variables:

导出 WP_URL="https://example.com" 导出 WP_USERNAME="wp-API-user" read -rs WP_应用_PASSWORD 导出 WP_应用_PASSWORD

应用 Password 设置up:

Open https://your-site.example/wp-admin/性能分析.php. 创建 a new 应用 Password for a dedicated API user. Copy it once and store it in a secret 管理器 or 环境 variable. Rotate/revoke it when no longer needed. Quick 启动 Read/列出 posts python3 scripts/获取_post.py --post-id 123 python3 scripts/列出_posts.py --per-page 10 --状态 publish

创建 a draft python3 scripts/创建_post.py \ --title "Draft title" \ --content "Draft content" \ --状态 draft

更新 a post after 应用roval python3 scripts/更新_post.py \ --post-id 123 \ --title "应用roved title" \ --content "应用roved content" \ --状态 draft

Read content from a local file safely

By default the file must be under the current working directory:

python3 scripts/更新_post.py \ --post-id 123 \ --content-file ./content/post-123.html \ --状态 draft

To opt into another safe folder:

导出 WP_ALLOWED_FILE_ROOTS="/absolute/path/to/应用roved-content" python3 scripts/更新_post.py --post-id 123 --content-file /absolute/path/to/应用roved-content/post.html

Multi-site configuration

Copy the template locally:

cp config/sites.example.json config/sites.json chmod 600 config/sites.json

Use a dedicated user per site and keep 应用_password values local only.

{ "sites": { "sample-site": { "url": "https://example.com", "username": "wp-API-user", "应用_password": "", "description": "Sample site; put the real 凭证 only in local config/sites.json" } }, "groups": { "sample": ["sample-site"] } }

命令行工具 wr应用er ./wp.sh --列出-sites ./wp.sh sample-site 获取-post --id 123 ./wp.sh sample-site 更新-post --id 123 --状态 draft

Group operations require an explicit flag:

./wp.sh sample --执行-group 更新-post --id 123 --状态 draft

If the group is named all, 添加 --allow-all only after explicit 应用roval:

./wp.sh all --执行-group --allow-all 更新-post --id 123 --状态 draft

Batch operations

Batch mode is dry-运行 unless --执行 is present:

python3 scripts/batch_更新.py \ --group sample \ --post-ids 123,456 \ --状态 draft

应用ly after review:

python3 scripts/batch_更新.py \ --group sample \ --post-ids 123,456 \ --状态 draft \ --执行

Tar获取ing every site requires explicit opt-in:

python3 scripts/batch_更新.py \ --group all \ --allow-all \ --post-ids 123 \ --状态 draft

Media 上传

Local file 上传, restricted to allowed file roots:

python3 scripts/上传_media.py \ --file ./media/image.jpg \ --title "Image title"

Remote URL 上传, explicit opt-in and HTTPS-only:

python3 scripts/上传_media.py \ --file https://cdn.example.com/image.jpg \ --allow-remote-url \ --title "Image title"

插件 integrations scripts/检测_插件s.py — 检测 ACF, Rank Math, Yoast, JetEngine. scripts/acf_fields.py — read/write ACF fields. scripts/seo_meta.py — read/write Rank Math and Yoast SEO metadata. scripts/jetengine_fields.py — read/write JetEngine custom fields. scripts/elementor_content.py — read/更新 Elementor _elementor_data. scripts/woo_products.py — manage WooCommerce products. Verification before live writes

Before any live mutation:

Confirm the site URL. Confirm post/page/product IDs. Confirm fields and 状态. Prefer draft unless the user explicitly 应用roves publish. 运行 dry-运行 for batch operations. Keep a 备份/导出 for critical content.