Yes, n8n can connect directly to WordPress. Use n8n’s built-in WordPress node for standard post and user operations; switch to the HTTP Request node when you need a custom post type, taxonomy, media route, plugin endpoint, or another REST resource. The reliable setup is: enable HTTPS and the REST API, create a dedicated WordPress automation user with an Application Password, add those credentials in n8n, test with a draft, then add validation, permissions, logging, and retries before publishing automatically.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What an n8n–WordPress integration can do
n8n is a workflow automation platform. It receives an event, transforms data, calls another service, and records the result. WordPress exposes site content through its REST API, so n8n can create, read, update, and route WordPress data without relying on browser clicks.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Typical workflows include:
- A form or webhook submission is validated, converted into a post, saved as a WordPress draft, and sent to an editor for review.
- An RSS feed or spreadsheet row is transformed into a title, body, category, and status, then created or updated in WordPress.
- An existing post is retrieved, enriched or translated, and written back to the same post.
- A scheduled synchronization fetches changed records, upserts WordPress content, and logs failed records for retry.
- A WordPress-related event starts n8n, which then routes the information to email, a CRM, analytics, or social channels.
WordPress’s REST API follows familiar HTTP methods and response codes. Public content is generally readable without authentication, while private, password-protected, internal-user, custom-post-type, and metadata data requires authentication or explicit exposure. That distinction determines both your credentials and the endpoint you can use.
Choose the right connection method
| Approach | Best for | What you configure | Trade-offs |
|---|---|---|---|
| n8n WordPress node | Common post and user operations documented by n8n | WordPress URL, username, Application Password, operation and mapped fields | Fastest to maintain, but coverage is limited to the node’s supported resources and fields |
| n8n HTTP Request node | Custom post types, taxonomies, media, metadata, plugin routes, or any REST endpoint not exposed by the node | HTTP method, exact WordPress REST URL, authentication, headers, query parameters, and JSON body | More flexible, but you must understand the endpoint schema and handle more validation yourself |
| Webhook-triggered workflow | An external event should start processing immediately | n8n webhook URL, sender configuration, request validation, and a WordPress action | Near-real-time behavior; requires a reachable n8n webhook and careful duplicate-event handling |
| Schedule or polling workflow | Recurring imports, content queues, and synchronization jobs | Schedule, query window, pagination, and a checkpoint such as a modified timestamp or source ID | Simple and resilient, but updates arrive on the schedule and repeated reads must be controlled |
Start with the built-in node when it supports the operation. Use HTTP Request rather than forcing a workaround when the resource is missing. A mixed design is normal: the WordPress node can handle ordinary posts while HTTP Request handles a custom taxonomy or media upload in the same workflow.
#1 Best Overall
Prerequisites and a safe account design
Confirm the WordPress site is reachable
Use an HTTPS WordPress URL that n8n can reach from its execution environment. A site that works in your browser may still be inaccessible to a cloud or self-hosted n8n instance because of a firewall, private network, IP allowlist, reverse proxy, or DNS problem.
Check that the REST API is enabled and that the site responds to its REST index. In a browser or an HTTP Request node, request the site’s REST base followed by /wp-json/. A successful response should describe available namespaces and routes. An OPTIONS request to a specific route can also reveal supported methods where the server permits it.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsCreate a dedicated automation user
Do not use a personal administrator account for a long-lived workflow. Create a separate WordPress user whose role and capabilities match the automation. For example, a workflow that only creates drafts needs less access than one that publishes, edits existing posts, uploads media, or changes users.
WordPress has shipped Application Passwords since version 5.6. In the dashboard, open Users → Edit User, find the Application Passwords section, enter a recognizable name such as n8n-production, and generate the password. Copy it when displayed; it is intended for API authentication rather than interactive dashboard login.
Application Passwords are sent with Basic Authentication over HTTPS. Treat the generated value like a password: keep it out of workflow data, screenshots, logs, source control, and chat messages. If it is exposed or revoked, delete it in the user profile and generate a replacement.
Separate environments
Use different WordPress users or Application Passwords for development, staging, and production. Point a test workflow at a staging site or restrict it to draft status and noncritical records. Promote the workflow only after the request, response, permissions, and failure paths have been checked.
Connect WordPress with n8n’s built-in node
The following sequence creates a controlled post workflow. Labels can vary slightly by n8n release, but the required values are the same.
- Add a trigger. Start with a Manual Trigger while building. Replace it later with a Webhook, Schedule Trigger, form trigger, RSS feed, spreadsheet trigger, or another source.
- Add the WordPress node. Create a new WordPress credential from the node’s credential selector.
- Enter the credential values. Supply the WordPress base URL, the automation username, and the user’s Application Password. Use the site base, not an individual post URL.
- Select the operation. Choose the supported resource and action, such as getting, creating, or updating a post. The node also documents user operations.
- Map incoming fields. Map the trigger’s title and content into the WordPress title and content fields. Map a known category, tag, author, excerpt, featured-media ID, or status only when the destination account can use it.
- Set a safe status first. During testing, select
draftrather than publishing. A draft proves authentication, field mapping, and permissions without putting unfinished material on the public site. - Execute with one controlled item. Inspect both the n8n item and the WordPress response. Confirm the returned post ID, status, link, and any server messages.
- Add downstream actions. Notify an editor, write the post ID to a tracking table, or send a success event only after the WordPress request has succeeded.
- Activate after review. Replace the manual trigger, set the production credential, and document the workflow’s owner, schedule, destination, and rollback procedure.
For updates, retrieve or identify the target post ID before calling the update operation. A title is not a reliable unique key: two posts can share one, and a changed title can cause a duplicate. Store the WordPress ID alongside the source record whenever possible.
Use HTTP Request for the full WordPress REST API
The HTTP Request node is the escape hatch for resources the built-in node does not expose. It is also useful when you need an endpoint-specific query, custom headers, a plugin route, or precise control over the request body.
Construct the request
WordPress REST routes normally sit below /wp-json/. Posts use a route such as /wp-json/wp/v2/posts; a custom post type is available only when that type is registered for REST exposure. Use the exact route shown by the site’s REST index or the relevant plugin documentation.
- Set the HTTP method to match the operation:
GETfor retrieval,POSTfor creation, andPUTorPATCHwhere the route supports updates. - Set the URL to the WordPress base plus the route. Keep the base URL in a credential or environment variable rather than hard-coding different hosts throughout a workflow.
- Configure Basic Authentication with the automation username and Application Password, or select the equivalent n8n credential option. Send it only over HTTPS.
- For a JSON write, set the request body to JSON and include only fields accepted by that route. A post creation body might contain
title,content,status,excerpt,categories, andtags. - Add query parameters for filtering, pagination, ordering, or an update lookup. Preserve the response headers and body while testing.
- Use n8n’s error behavior deliberately. Let the workflow stop on an authentication or permission failure, while routing a transient network or server error to a retry branch.
Do not assume that a field accepted by one route is accepted by another. A custom post type, taxonomy, or plugin may use different names, permissions, and response shapes. Read the response body before changing the workflow; WordPress commonly returns a machine-readable error code and message that identifies the rejected field or missing capability.
Media, taxonomies, and metadata
Media uploads are a two-stage operation in many workflows: upload the file to the media route, capture the returned media ID, then include that ID when creating or updating the post. Taxonomy terms must exist or be created with the correct taxonomy route before their IDs can be attached. Custom fields and metadata may require the field to be explicitly exposed to REST and the user to have permission to edit it.
Build useful workflow patterns
Form or webhook to an editorial draft
- Receive the request with a Webhook node.
- Validate required fields, length limits, allowed HTML, URLs, and any signature or shared secret.
- Normalize whitespace, map the sender’s category name to a WordPress term ID, and reject unknown values rather than silently creating incorrect taxonomy terms.
- Create a WordPress post with status
draft. - Save the returned post ID and source submission ID in a tracking store.
- Notify an editor with the draft link and the original submission identifier.
Use an idempotency key based on the source submission ID. If the sender retries the webhook, look up that key before creating another post.
RSS feed or spreadsheet to WordPress
Read the source, then use a Set or Code node to produce a consistent object: title, sanitized content, source URL, publication date, category, and a stable external ID. Search existing records by that ID, not by a mutable title. Create a post when no match exists; update the stored WordPress ID when the source changed. Keep imported items as drafts if editorial review is required.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Enrich or translate an existing post
Retrieve the post, preserve its ID and status, send only the intended content to the transformation step, and update the same ID. Keep the original content in a separate field or revision-friendly store so a bad transformation can be reversed. Do not overwrite author, taxonomy, featured media, or custom metadata unless the workflow explicitly owns those fields.
Rank #4
Scheduled synchronization
Run on a schedule, query only records changed since the last successful checkpoint, and process pages rather than attempting an unbounded import. Record the checkpoint after a page succeeds. A failed page should be retried without advancing the checkpoint, otherwise records can be skipped permanently.
WordPress event to other systems
Use an n8n Webhook when another WordPress component can send an event. If no event sender is available, poll a REST route on a schedule using a modified-time filter and a stored cursor. Route the normalized event to email, analytics, a CRM, or social publishing, and log the original WordPress ID so downstream actions remain traceable.
Data mapping, duplicates, and pagination
Design the data contract before connecting nodes. Decide which system owns each field, how empty values are treated, and whether updates are one-way or bidirectional.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →| Concern | Recommended decision |
|---|---|
| Identity | Store WordPress post ID plus a stable source ID; never depend on title matching alone |
| Status | Use draft for review, scheduled for controlled release, and publish only when validation and permissions are intentional |
| HTML | Sanitize or allowlist incoming markup; do not pass arbitrary user HTML directly into a public post |
| Dates | Convert source timestamps to an agreed timezone and preserve the original timestamp for audit |
| Taxonomy | Map names to known term IDs and define what happens when a term is missing |
| Large collections | Use pagination, process bounded batches, and checkpoint after successful pages |
WordPress responses include IDs and status information that should be passed to later nodes. Keep a compact execution log containing source ID, WordPress ID, action, timestamp, status code, and error message. Avoid storing full passwords or unnecessary personal data in that log.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Permissions and security controls
- Least privilege: assign only the WordPress capabilities the workflow needs. Publishing, editing other authors’ posts, uploading media, managing users, and editing custom fields are different powers.
- HTTPS everywhere: Application Passwords use Basic Authentication, so an unencrypted connection can expose credentials.
- Credential isolation: keep credentials in n8n’s credential store, use separate development and production credentials, and restrict who can edit or execute the workflow.
- Webhook verification: require a secret, signature, or allowlisted sender where the source supports it. Validate payload size and content before writing to WordPress.
- Input sanitization: treat titles, HTML, URLs, taxonomy names, and metadata as untrusted input. Reject unexpected fields and dangerous markup.
- Infrastructure review: check security plugins, reverse proxies, CDNs, host firewalls, and rate controls. Any of them can block requests or remove authentication headers.
- Auditability: record who or what initiated a change, the source identifier, destination ID, result, and retry count without logging secrets.
Public read access is not evidence that a write will work. WordPress applies authentication and capability checks to private content and modifications, and a custom type must also be exposed to the REST API.
Error handling, retries, and recovery
Classify before retrying
| Symptom | Likely cause | Action |
|---|---|---|
| 401 Unauthorized | Wrong username, Application Password, base URL, or authentication header removed by a proxy | Regenerate the Application Password, re-enter it without formatting characters, verify HTTPS, and inspect proxy behavior |
| 403 Forbidden | The user lacks a required capability or a security layer blocks the request | Check the automation user’s role, endpoint permissions, security-plugin logs, and host rules |
| 404 Not Found | Wrong site base, route, post ID, or an unexposed custom resource | Check the REST index and exact route; confirm the post or custom type exists |
| 400 or 422-style validation response | Missing, malformed, or unsupported field | Read the response body, remove or correct the rejected field, and test with the smallest valid payload |
| 5xx or timeout | WordPress host, PHP process, proxy, plugin, or network instability | Retry with backoff, limit concurrency, inspect server logs, and avoid creating duplicates by using an idempotency key |
| Successful response but duplicate post | Source retried after a timeout or workflow ran twice | Search by the stored source ID before creating; persist the destination ID immediately after success |
Do not retry every error. Authentication, permission, and validation failures will not be fixed by repetition. Retry transient network and server failures with a bounded number of attempts and increasing delays. Route exhausted items to a review queue that includes the original payload’s safe identifiers and the response body.
Debug in the right order
- Confirm the WordPress base URL resolves from the machine running n8n.
- Call the REST index or a harmless read endpoint.
- Test the credential with a single, noncritical request.
- Confirm the automation user can perform the exact operation in WordPress.
- Send the smallest valid request body.
- Add fields one at a time until the failing field is identified.
- Compare the HTTP status and response body before changing unrelated workflow logic.
Operating the integration in production
Document the workflow’s trigger, destination site, credential owner, capabilities, schedule, data fields, retry policy, and rollback method. Add an alert for failed executions and monitor the size of the retry or dead-letter queue. Test after WordPress, n8n, security-plugin, proxy, or custom-plugin changes because any of them can alter routes, fields, or authentication handling.
For high-volume imports, there is no universal throughput, latency, or rate-limit number that applies to every WordPress installation. Capacity depends on the host, database, PHP workers, plugins, proxy, n8n execution mode, request size, and workflow concurrency. Measure your own staging environment, then set a conservative batch size and concurrency level. A slower queue with reliable checkpoints is safer than parallel writes that overload the site or create duplicates.
Use a staging or draft-only test to verify four things independently: authentication, authorization, data correctness, and recovery. A request that returns success but writes the wrong author, taxonomy, status, or media is still a failed integration.
Recommended implementation path
- Start with one manually triggered draft-creation workflow using the built-in WordPress node.
- Verify the Application Password, response post ID, field mapping, and editor notification.
- Add source IDs, duplicate protection, validation, and an execution log.
- Move to HTTP Request only for resources or fields the node cannot handle.
- Choose a webhook for event-driven work or a schedule for imports and synchronization.
- Separate staging and production credentials, then test failure branches with invalid credentials, missing capabilities, malformed data, and a simulated timeout.
- Activate publishing only after a human-reviewed draft and a documented rollback path have passed.
This approach keeps routine WordPress automation simple while preserving a direct route to every REST API capability your site intentionally exposes.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
