Send GEO Writer Drafts to WordPress

The WordPress connection sends finished GEO Writer articles and content updates to your WordPress site as drafts. You review, edit and publish them in WordPress as usual. LLM Pulse never publishes a post, never edits an existing one and never deletes anything.

The same connection lets the REST API and AI assistants connected through MCP read your site's posts and pages, for example to compare a GEO Writer update with the page it revises.

Before you start

You need:

A WordPress site on WordPress 5.6 or later, served over HTTPS, with application passwords turned on. They are on by default; some security plugins turn them off.
A WordPress user who can write posts, such as an Author or Editor. An Administrator also works, but we show a warning: LLM Pulse only creates drafts, so a user with fewer rights limits what its application password can do.

The connection has no plan requirement of its own: if you can use GEO Writer, you can send its drafts. Each project connects to one WordPress site.

The WordPress connection is not available in white-label portals or embeds.

Connect your site

Open Project Settings, select the Connections tab and find the WordPress card.
Enter your site address, for example blog.example.com, and select Continue. If the address redirects somewhere else (for example from example.com to www.example.com), we suggest connecting the address the site really uses.
Select Approve in WordPress. WordPress asks you to sign in and approve LLM Pulse, then creates an application password for it and sends you back to LLM Pulse.

If WordPress runs on another address than your public pages (for example WordPress on wp.example.com and pages on www.example.com), enter the WordPress address. Links to your public pages are recognized as your site's when they are served over HTTPS.

If you cannot use the approval screen, paste an application password instead. In WordPress, open Users > Profile > Application Passwords, add one named LLM Pulse, and paste it under Or paste an application password with your WordPress username. Never paste your WordPress login password: we refuse anything that does not look like an application password.

Once connected, the WordPress card shows the site, the WordPress user and its role. Connecting the project to a different site later clears the WordPress drafts panel of the drafts sent to the old one; they stay in that site's WordPress.

Send a draft

Open a completed article or content update in GEO Writer. Briefs and other task types cannot be sent.
Open the export menu and select Send to WordPress as draft.

The draft is created in the background, usually within a few seconds. The WordPress drafts panel on the task page shows each draft with its status and an Edit in WordPress link once WordPress confirms it.

What the draft contains:

The title, a readable slug and the article body as HTML, the same content Copy as HTML gives you.
The meta description, as the post excerpt.
An HTML comment at the top of the body that marks the text as AI generated. It is not visible on the page.

Images, scripts, forms and embeds are left out. Headings, paragraphs, lists, tables, quotes, code and links are kept.

A content update becomes a new draft, and the WordPress drafts panel names the page it revises. The live page stays as it is: compare the two in WordPress and copy over what you want to keep.

Sending the same version of a task again does not create a second draft. If you edit the task in GEO Writer, the new version can be sent as a new draft. Each site accepts up to 50 drafts from LLM Pulse in 24 hours.

Read your site through the API and MCP

With a site connected, the REST API and MCP can read it and send drafts to it:

What	REST API	MCP tool
List posts or pages	`GET /api/v1/cms/content`	`list_cms_content`
Read one post or page	`GET /api/v1/cms/content/:id`	`get_cms_content`
Send a task as a draft	`POST /api/v1/intelligence_tasks/:id/send_to_cms`	`send_intelligence_task_to_cms`

MCP over OAuth works on every plan; the REST API and MCP with an API key need the Scale plan or above, like the rest of the API. The site answers live and nothing it returns is stored. Sending a draft through the API needs a key with Read & write access. Connecting and disconnecting a site is only possible in Project Settings. See REST API overview and Connect your AI via MCP.

Team members

Team members need the WordPress permission:

Permission	What it allows
Read	List and read site content through the API and MCP
Create	Send GEO Writer drafts
Update	Connect or reconnect a site
Delete	Disconnect a site

Disconnect

Open Project Settings > Connections, find the WordPress card and select Disconnect. We revoke the application password LLM Pulse uses on the site. Drafts already in WordPress stay there, but the WordPress drafts panel on your GEO Writer tasks no longer lists them.

Deleting the project or your account revokes it the same way. If we cannot reach the site to revoke it, the project is disconnected anyway and we tell you. Remove the password yourself in WordPress under Users > Profile > Application Passwords.

Troubleshooting

When a connection fails, the WordPress card says what went wrong and links to the matching section below. Open Details for your developer to see what the site answered: the address, the step that failed, the HTTP status, the WordPress error code and a few response headers. Copy them and send them to whoever manages your site. They never include a username or password.

If the failure happened after you approved the connection, WordPress may have created an application password named LLM Pulse that we cannot use. Delete it under Users > Profile > Application Passwords before you try again.

Our requests use the user agent LLMPulse-WordPress/1.0 and come from servers in Germany.

The server removes the login header

WordPress reads the application password from the Authorization header. Some servers drop that header before WordPress runs, so WordPress treats our request as anonymous. Your developer or host can pass it through.

On Apache, add this line to .htaccess, above the WordPress block:

SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1

If that is not enough, add RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] right after RewriteEngine On.

On nginx with PHP-FPM, add this to the block that passes requests to PHP:

fastcgi_param HTTP_AUTHORIZATION $http_authorization;

Behind a reverse proxy or on LiteSpeed, forward the Authorization header to WordPress. On managed hosting, ask support to allow Basic authentication on /wp-json/.

If the site worked before and now asks you to reconnect, either the application password was revoked or a server change started dropping the header. Reconnect first, and check the header if that fails.

WordPress does not accept the application password

The application password was mistyped, revoked, or belongs to another user. Create a new one under Users > Profile > Application Passwords and connect again. Never use your WordPress login password.

The username does not exist

When you paste an application password, enter the WordPress username or the email address of the user who created it. A display name does not work.

Application passwords are turned off

WordPress offers application passwords only on sites it sees running on HTTPS, and plugins can turn them off. Check:

Security plugins such as Wordfence or Solid Security, which have a setting to disable application passwords, sometimes per role or per user.
Code in the theme or a custom plugin that uses the wp_is_application_passwords_available or wp_is_application_passwords_available_for_user filters.
HTTPS detection. Behind a proxy, load balancer or CDN, WordPress may not see that the site runs on HTTPS. Make the proxy send X-Forwarded-Proto and add the snippet below to wp-config.php, above the line that says to stop editing.
The environment type. A site whose WP_ENVIRONMENT_TYPE is local offers application passwords without HTTPS. Set it to production on the public site.

if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO'] ) {
    $_SERVER['HTTPS'] = 'on';
}

A plugin blocks the REST API

Some security plugins turn the REST API off, allow it only for some users, or block the users endpoint to stop user enumeration. We need the site index at /wp-json/, and for the connected user /wp-json/wp/v2/users/me and the wp/v2 posts and pages endpoints. Allow those in the plugin's settings.

If the site answers with a web page instead of the REST API, a cache or maintenance plugin may also be serving pages at /wp-json/. Exclude that path from it.

A firewall blocks our requests

A firewall, CDN or security service in front of your site refused our request before WordPress saw it: Cloudflare, Sucuri, a Wordfence firewall rule, your host's firewall or a country block. Allow requests with the user agent LLMPulse-WordPress/1.0 to /wp-json/. Challenge pages, such as a Cloudflare managed challenge, block us too, because our servers cannot solve them. In Cloudflare, add a WAF custom rule with the Skip action for /wp-json/, and do the same for /wp-admin/authorize-application.php if the approval page is challenged.

The site asks for a separate password

Staging sites are often protected with HTTP authentication: the browser asks for a username and password before WordPress loads. That protection uses the same header as application passwords, so the two cannot work together. Connect the public site, or remove the protection for /wp-json/.

We could not find the REST API

Check that the address is your WordPress site. We look for the REST API at /wp-json/ and at /?rest_route=/.
Open Settings > Permalinks and select Save Changes. Broken rewrite rules make /wp-json/ return a 404.
In a headless setup, WordPress runs on another domain than your pages. Connect the WordPress domain.

The site address does not match

WordPress keeps two addresses in Settings > General: WordPress Address (URL) and Site Address (URL). Both must be the public HTTPS address of your site, with or without www exactly as the site uses it. When they say http://, or example.com while the site lives on www.example.com, WordPress points us to another address, and we never send a password to an address you did not enter. Fix both addresses, or ask your developer to set WP_HOME and WP_SITEURL in wp-config.php, then connect the address the site uses.

When your address redirects to another one, the WordPress card offers to connect the address the site uses. We only follow redirects to HTTPS addresses.

WordPress is too old

Application passwords arrived in WordPress 5.6. Update WordPress, then connect again.

The SSL certificate is not valid

We only connect over HTTPS with a valid certificate. The details say what is wrong: it expired, it is self-signed, or it was issued for another address. Renew or replace the certificate (most hosts offer free ones) and make sure it covers the exact address you connect, with or without www.

We could not reach the site

The address does not point to a server. Check the spelling and the DNS records of the domain.
The server refused the connection. Port 443 may be closed, or a firewall may block our servers in Germany.
The site took too long. While you connect, we wait about 10 seconds for each answer. Ask your developer why /wp-json/ is slow: a heavy plugin or an overloaded server is the usual cause.
The address is private. It points to a private or internal network, such as an intranet staging site. We only connect to sites reachable from the internet.

The site had a server error

WordPress or the server failed while answering, with an HTTP status between 500 and 599. Try again later. If it keeps happening, the server error log names the cause. A site in maintenance mode answers the same way: wait until it is back online.

The site limits our requests

The site or its host answered that we sent too many requests (HTTP 429). Try again in a few minutes, or ask your host to allow our user agent. Separately, each site accepts up to 50 drafts from LLM Pulse in 24 hours; past that, send again the next day.

WordPress sent an unreadable answer

The site printed text before the REST API answer: usually PHP warnings or notices, or a plugin or theme that outputs a stray character. Ask your developer to set WP_DEBUG_DISPLAY to false in wp-config.php and to check recently installed or updated plugins. If the site answers with a whole web page instead, a cache or maintenance plugin is serving pages at /wp-json/: exclude that path from it.

The approval did not finish

If you selected No, I do not approve of this connection, select Approve in WordPress again and approve it.
If WordPress sent you back without an application password, a security plugin or your host interrupted the approval page at /wp-admin/authorize-application.php. Allow that page, or create an application password yourself and paste it on the WordPress card.

The WordPress user cannot create drafts

Drafts need a user who can write posts, such as an Author or Editor. An Administrator also works. Change the role under Users, or reconnect with another user.