What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The right GitHub–WordPress integration depends on what you are moving. Use WordPress.com GitHub Deployments when WordPress.com manages the site; use GitHub Actions with SSH, rsync, or Deployer when you control a server; use the 10up WordPress Plugin Deploy action for tagged releases to WordPress.org; and use the WordPress REST API when the workflow needs to create or update content. Put every credential in encrypted GitHub secrets, limit deployments to reviewed branches or tags, and make staging the normal destination before production.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Choose the integration boundary first
“Connect GitHub to WordPress” can describe four different jobs. A theme or plugin deployment copies code to a site. A WordPress.org release publishes a version to the public plugin directory. A REST API workflow changes posts, media, settings, or custom resources without copying a complete codebase. WordPress.com GitHub Deployments is a managed hosting feature with its own plan and release controls.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Use case | Best-fit architecture | Typical trigger | Authentication | Where it runs |
|---|---|---|---|---|
| Managed WordPress.com site, theme, plugin, or complete site repository | WordPress.com GitHub Deployments | Manual production release or automatic staging release | Repository connection configured in WordPress.com | WordPress.com infrastructure |
| Private self-hosted WordPress code | GitHub Actions with SSH/rsync or Deployer | Push, pull-request merge, tag, or manual dispatch | SSH private key stored as a GitHub secret | Your server or hosting account |
| Public plugin directory release | 10up WordPress Plugin Deploy action | Git tag or release workflow | SVN_USERNAME and SVN_PASSWORD secrets |
GitHub runner publishing to WordPress.org SVN |
| Posts, metadata, media, or custom endpoint automation | GitHub Actions calling the WordPress REST API | Build completion, schedule, push, or manual dispatch | Site-specific API credentials, such as an application password where appropriate | GitHub runner making HTTPS requests to WordPress |
These boundaries are not interchangeable. A successful GitHub deployment event does not by itself copy files to a server, and publishing a plugin to WordPress.org does not update a private production installation.
Connect a WordPress.com site with GitHub Deployments
WordPress.com documents a workflow for connecting a repository containing a plugin, theme, or complete site, configuring deployment, and starting the first deployment manually or automatically. The feature is available on Business and Commerce plans. Free, Personal, and Premium sites must upgrade before the GitHub Deployments feature can be used.
Set up the repository connection
- Put the deployable WordPress code in a GitHub repository. Decide whether the repository root represents the whole site or whether only a theme or plugin directory should be released.
- In the WordPress.com administration area, open the GitHub Deployments feature for the site and authorize the repository connection. Select the repository and the branch that represents the target environment.
- Review the deployment path and included files before starting. Keep development-only files, local configuration, tests, and generated caches out of the production package.
- Run the first deployment manually. Confirm that the theme or plugin is present, activated only when intended, and compatible with the site’s PHP and WordPress versions.
Use separate release policies for staging and production
WordPress.com Developer Resources recommends manual deployments for production sites and automatic deployments for staging sites. That arrangement lets a push to the staging branch provide fast feedback while requiring a deliberate human action before production changes. Protect the production branch in GitHub so a review is required before a merge can trigger a release.
A practical branch layout is staging for the automatically deployed test site and main for the manually released production site. Keep the branch names and environment mapping explicit; an accidental push to the wrong branch should not be able to alter production.
Free tools Windows power users keep installed
One-click scans. No signup required.
Deploy a self-hosted WordPress site with GitHub Actions
Self-hosted deployment gives you control over the server, filesystem layout, PHP workers, and rollback process, but you must supply the secure connection and the workflow policy. The rtCamp Deploy WordPress action uses Deployer.org and documents a setup with a workflow file, an SSH key secret, and a branch map in .github/hosts.yml. Only branches mapped in that hosts file are deployable.
Prepare the server and repository
- Create a non-root deployment account with write access only to the WordPress code directories it must update.
- Add the account’s public key to the server’s
authorized_keysfile and test an SSH login from a controlled machine. - Identify the release directory, the shared
wp-content/uploadsdirectory, and any server-managed configuration such aswp-config.php. Do not overwrite shared uploads or secrets with every code release. - Protect the deployment branches and require pull-request review. Keep production and staging targets separate in the host configuration.
Store the SSH key as a GitHub secret
In the repository, open Settings → Secrets and variables → Actions, choose New repository secret, and add the private key under the name SSH_PRIVATE_KEY. Store the complete key, including its begin and end lines. Never commit the private key, a server password, or a production wp-config.php file.
Create a Deployer-based workflow
The exact inputs vary by action version, so follow the selected action’s documented interface. The structure below shows the important controls: checkout, a protected branch trigger, the SSH secret, and a host map that decides where a branch may go.
name: Deploy WordPress
on:
push:
branches:
- staging
- main
workflow_dispatch:
jobs:
deploy:
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@v4
- name: Deploy with Deployer
uses: rtCamp/action-deploy-wordpress@master
env:
SSH_PRIVATE_KEY: ${{ secrets.SSH_PRIVATE_KEY }}Pair the workflow with a committed .github/hosts.yml that maps only the intended branches to known environments. Keep the production host out of mappings that are used for pull-request previews or routine feature testing. Pin an action to a reviewed release or commit rather than allowing an unexpected change to alter deployment behavior.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteRank #2
Use direct SSH and rsync when you need a simpler copy
An alternative Marketplace action can deploy directly to hosting accounts such as Pressable or WP Engine with an SSH private key and rsync. It can copy the repository root or a selected theme or plugin directory by setting SRC_PATH and REMOTE_PATH. This is useful when the server already has its own release process and you only need a controlled file synchronization.
For rsync, define an exclude list for .git, local environment files, tests, node modules, and cache directories. If the destination contains uploads, point REMOTE_PATH at the code directory rather than the entire WordPress document root. A dry run against staging is the safest way to verify that the source and destination paths are correct.
Deploy only the code that belongs in the target
A WordPress repository and a running site have different lifecycles. Themes and plugins belong in version control; user uploads, object-cache files, backups, and generated logs generally do not. Keep those directories on persistent storage with their own backup policy. If a project deliberately tracks generated assets, document the build step and make the generated output reproducible before it is copied to a server.
Publish a plugin to WordPress.org from a Git tag
Publishing to the public WordPress.org plugin repository is a release operation, not a private-server deployment. The 10up WordPress Plugin Deploy action takes the contents of a Git tag and commits them to the WordPress.org plugin repository using the same tag name. It supports .distignore or .gitattributes export-ignore rules and can run optional build directories before publishing.
Prepare the release package
- Keep the plugin’s stable version in its main plugin header and use a matching Git tag, such as
1.4.0, according to the project’s release convention. - Create a
.distignorefile or addexport-ignorerules in.gitattributesfor tests, local tooling, development configuration, documentation that should not ship, and other files not required by users. - If the plugin requires a build, define the build directory and make the workflow install dependencies and produce the distributable files before the deploy action runs.
- Check that the package contains the plugin entry file, required assets, translations, and the readme information expected by WordPress.org.
Configure credentials and a tag-triggered workflow
Add SVN_USERNAME and SVN_PASSWORD under Settings → Secrets and variables → Actions. These credentials must belong to an account authorized to publish the plugin. Keep the workflow restricted to reviewed tags or manually approved releases.
name: Publish plugin
on:
push:
tags:
- '*.*.*'
workflow_dispatch:
jobs:
release:
runs-on: ubuntu-latest
steps:
- name: Check out tagged source
uses: actions/checkout@v4
- name: Install and build
run: |
npm ci
npm run build
- name: Publish to WordPress.org
uses: 10up/action-wordpress-plugin-deploy@stable
env:
SVN_USERNAME: ${{ secrets.SVN_USERNAME }}
SVN_PASSWORD: ${{ secrets.SVN_PASSWORD }}Use the action’s current documented inputs for the plugin slug, build directory, and release behavior. After publication, inspect the WordPress.org repository and plugin page, then install the tagged version on staging before announcing it. A WordPress.org release should never include production database content or server credentials.
Rank #3
Automate WordPress content with the REST API
The WordPress Plugin Handbook describes the REST API as the interface for getting data into and out of WordPress. Its basic method semantics are GET to retrieve data, POST to create resources, PUT to update them, and DELETE to remove them. The REST API infrastructure was introduced in WordPress 4.4 and is now used by core and extensions for structured requests.
Choose the resource and endpoint
Use the standard endpoints for posts, pages, media, users, taxonomies, and settings when they meet the need. A custom plugin can register its own endpoint for operations that should not be exposed as a generic post update. Keep the workflow’s payload deterministic so rerunning a failed job does not create duplicate content; for example, look up an external identifier before creating a post.
Design authentication for the specific site
The handbook establishes the HTTP method model, not one universal authentication scheme. Select the credential mechanism supported by the site and endpoint, such as an application password for a dedicated WordPress user or a token validated by a custom plugin. Give that account only the capabilities required by the workflow, protect the credential as a GitHub secret, and use HTTPS. Nonces are appropriate for authenticated browser requests, but a server-to-server GitHub runner needs an authentication design intended for remote automation.
Call an endpoint from a workflow
The following example creates a post with an application-password-style credential stored in secrets. Replace the endpoint and payload with the resource your project owns, and test against staging first.
name: Sync content
on:
workflow_dispatch:
push:
branches:
- staging
jobs:
sync:
runs-on: ubuntu-latest
steps:
- name: Create a post
env:
WP_URL: https://example.com
WP_USER: ${{ secrets.WP_USER }}
WP_APP_PASSWORD: ${{ secrets.WP_APP_PASSWORD }}
run: |
curl --fail-with-body
--user "$WP_USER:$WP_APP_PASSWORD"
-H "Content-Type: application/json"
-X POST "$WP_URL/wp-json/wp/v2/posts"
-d '{"title":"Release notes","status":"draft","content":"Generated by the deployment workflow."}'Use --fail-with-body or equivalent error handling so a 4xx or 5xx response fails the job. Log request identifiers and response summaries, but never print the authorization header or the secret value. For updates, store the WordPress resource ID and send a PUT request; for deletion, require an explicit approval gate because a successful DELETE is destructive.
Understand GitHub deployment events and statuses
GitHub models a deployment as a request for a branch, commit SHA, or tag. A deployment can report queued, in_progress, success, failure, error, or cancelled, with a description and log URL. GitHub dispatches the event but does not log in to your server or copy files; a GitHub Actions job, external integration, webhook receiver, or deployment service performs that work.
Recommended Free Tools
This separation is why a repository can show a deployment request even when no WordPress files changed. Check the workflow run, the action’s output, the SSH or API response, and the destination server logs. Set the environment URL and a concise status description when your workflow supports them so reviewers can move from a commit to the exact staging page or failure log.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Build staging, rollback, and release controls into the workflow
Make staging the default target
- Deploy pull-request or staging-branch changes to a non-production site.
- Run PHP linting, JavaScript and CSS builds, plugin activation checks, and a smoke request against the staging URL before production approval.
- Use GitHub environments to require reviewers for production and to scope production-only secrets away from ordinary jobs.
Keep rollback possible
Tag every production release and retain the previous known-good artifact or commit. A rollback should redeploy that exact artifact, not rebuild from a moving branch. Database migrations need their own backward-compatibility plan; reverting PHP files cannot automatically undo a schema or content change. Take a database backup before migrations and verify that uploads remain available after a code rollback.
Exclude sensitive and transient files
- Never commit SSH keys, SVN passwords, application passwords, API tokens, or production configuration.
- Exclude
.git, test fixtures, local environment files, debug logs, and caches from release packages. - Keep uploads and generated data outside the code repository unless a deliberate dependency and backup strategy requires versioning them.
- Review the final archive or rsync file list in a staging run before allowing production deployment.
Troubleshoot the common failure modes
The workflow never starts
Check the event filter first. A workflow restricted to main will not run for a feature branch, and a tag pattern that expects semantic versions will not match an unversioned tag. Confirm that the workflow file exists on the default branch and that the repository’s Actions policy permits the referenced action.
SSH authentication fails
Verify that the secret contains the complete private key, the matching public key is installed for the intended server account, and the server accepts the key algorithm. Check the hostname, port, known-host handling, and filesystem permissions. Do not solve a host-key warning by disabling verification globally; add the expected host key through the action’s documented mechanism.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The deployment succeeds but the site is unchanged
Inspect the source and destination paths. An rsync job may have copied a plugin directory into the wrong parent directory, or a Deployer host map may have selected staging instead of production. Clear or version the relevant opcode, object, or page cache only after confirming the new files are present.
The WordPress.org package is rejected or incomplete
Compare the tag name with the plugin version, inspect the archive produced after .distignore processing, and confirm that the build step ran before publication. Missing assets often result from a build directory that was created locally but not generated in the runner.
The REST API returns 401, 403, or 404
A 401 response indicates missing or invalid credentials; 403 usually means the authenticated user lacks the required capability or a security layer blocked the request; 404 can mean the route is not registered, the site URL is wrong, or a custom post type is not exposed. Test the same request against staging with a least-privilege account and inspect the response body without exposing secrets in logs.
A practical selection checklist
- Choose WordPress.com GitHub Deployments when WordPress.com hosts the site and your plan is Business or Commerce.
- Choose SSH/rsync or Deployer when you control the server and need repository-defined release paths, branch mapping, and rollback artifacts.
- Choose the 10up action when the deliverable is a tagged public plugin release to WordPress.org.
- Choose REST API calls when the deliverable is structured content or metadata rather than a filesystem copy.
- Use protected branches, reviewed tags, encrypted secrets, staging tests, deployment logs, and a documented rollback target in every model.
Start with the smallest boundary that solves the problem. A theme-only deployment is easier to secure than copying an entire document root, and an idempotent REST request is safer for content synchronization than rebuilding a site for every data change.
Frequently Asked Questions
Does a GitHub deployment replace WordPress backups?
No. GitHub preserves versioned code, while WordPress backups must cover the database, uploads, and other persistent site data. Keep those backup schedules independent of code deployment.
Can one repository deploy to both staging and production?
Yes. Map separate protected branches or tags to separate environments, give production its own approval gate and secrets, and keep the staging target as the default for routine changes.
Should the WordPress uploads directory be committed to GitHub?
Usually not. Uploads and generated files are persistent site data; store them on the server or managed storage with backups unless the project has a specific, documented reason to version them.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
