Secure a WordPress MCP server by giving its client a dedicated, non-administrator account, exposing only the abilities it needs, and enforcing permission checks at both the server transport and ability level. The exact defaults depend on which MCP implementation you installed: WordPress’s MCP Adapter and Automattic’s separate wordpress-mcp plugin do not document the same access model.
First identify which WordPress MCP implementation you use
“WordPress MCP server” can refer to different software, so do not apply one plugin’s defaults to another. Check the installed plugin or service name, version, endpoint, and transport before changing access. The MCP Adapter documentation lists /wp-json/mcp/mcp-adapter-default-server as its default server endpoint; confirm that it matches your installed release and configuration.
As an Amazon Associate I earn from qualifying purchases.
| Deployment | Documented access model | Security implication |
|---|---|---|
| WordPress MCP Adapter default server | Requires an authenticated user with read by default. An ability must opt into public MCP access through its metadata, and the server and abilities can have permission checks. |
Configure the transport gate and each ability’s permission callback; do not assume that MCP-visible means authorized for every operation. WordPress Developer Blog and MCP Adapter documentation |
| WordPress.com MCP | Documents browser-based OAuth 2.1 authorization with PKCE, rotating and expiring tokens, and revocable connected-app access. Eligibility and setup conditions apply. | Check current plan availability and which tools are enabled. OAuth establishes authorization, but you still need to review the tools being authorized. WordPress.com MCP documentation |
Automattic wordpress-mcp plugin |
Its README says operations require administrator privileges by default and use normal WordPress capabilities. | This is a separate implementation; do not assume it has the MCP Adapter’s configurable fine-grained defaults. Automattic wordpress-mcp README |
Compare the implementation’s identity model, transport-wide gate, ability-level checks, default exposed tools, revocation and logging, and maintenance or version compatibility. The documented behavior may change, particularly in live repository documentation.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteCan an AI agent use WordPress without being an administrator?
Yes, when the MCP implementation and the requested operations support narrower access. WordPress roles and capabilities let you separate tasks such as reading content, editing posts, managing plugins, and managing users. Create a dedicated account for the MCP client and grant only the capabilities required for its task. Do not use an administrator account just to avoid configuring permissions.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The MCP Adapter’s default server requires an authenticated user with the read capability by default. That is a baseline server check, not proof that every ability is read-only: the server’s checks can be customized, and individual abilities may perform more consequential actions. Set each ability’s permission callback to the minimum capability that action requires.
How the MCP Adapter’s two permission layers work
The MCP Adapter describes two security layers: a transport permission and an ability permission. The transport callback is the server-wide gate; an ability’s own callback decides whether the user may perform that specific operation. Passing the transport gate should not be treated as authorization to run every ability.
Rank #2
- HARDWARE 2FA AND MFA: FIDO Alliance Certified FIDO2 v2.1 with CTAP2 plus legacy U2F and CTAP1 for strong two-factor login and passwordless sign-in on services that support security keys
- BUILDING ACCESS ON ONE CARD: MIFARE DESFire EV2 4K applet with AES encryption adds office door and physical access control alongside digital authentication
- CERTIFIED SECURE ELEMENT: An NXP Common Criteria EAL6+ certified secure controller and Java Card platform protects your keys on a tamper-resistant chip
- DUAL INTERFACE SMART CARD: Contactless NFC ISO 14443 plus ISO 7816 contact reader support in an ISO 7810 ID-1 format that is passive and needs no battery
- SWISS ENGINEERED DESIGN: Built by Cryptnox as a single card for authentication and access control and backed by a 2 year warranty
Transport permission: control entry to the server
Where the implementation supports it, configure the transport permission callback to restrict which authenticated users or requests can reach the MCP server. This is a broad gate, useful for limiting access to the server as a whole. It does not replace checks on individual abilities. See the MCP server permission documentation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Ability permission: authorize each operation
Give each ability its own permission callback, checking the capability appropriate to that operation. Perform the check when the ability executes, not only when tools are listed or discovered. A user who may read posts, for example, should not gain the ability to edit or delete them merely because those tools are visible to the client. See the Abilities API documentation.
Rank #3
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Limit which tools the MCP client can discover and use
In the MCP Adapter, abilities are not exposed through the default server unless their metadata opts them into public MCP access. An MCP-specific setting can also opt an otherwise public ability out. Treat this visibility setting as exposure control: it determines what the server makes available, but it does not waive the executing WordPress user’s permission checks.
- Review registered abilities and expose only those the client actually needs.
- Keep destructive or sensitive abilities private unless there is a defined need and an explicit review.
- Prefer read-only abilities for public HTTP endpoints, as the WordPress Developer Blog recommends.
- For state-changing abilities, use narrow capabilities and validate the structured inputs.
Publicly discoverable tools are not automatically safe for anonymous or unrestricted use. Confirm the transport’s access settings and the executing user’s authorization separately.
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
A practical least-privilege setup sequence
- Identify the implementation. Record the plugin or service name, installed version or release, endpoint, and transport. Verify the endpoint against the documentation for that release; the MCP Adapter’s documented default is
/wp-json/mcp/mcp-adapter-default-server. - Create a dedicated WordPress account. Assign a role or individual capabilities suited to the client’s narrow task, rather than reusing an administrator’s credentials.
- Audit ability registration. Enable MCP visibility only for necessary abilities. Leave sensitive or destructive abilities private unless there is a reviewed requirement.
- Add per-ability permission callbacks. Check the minimum relevant capability when each operation executes.
- Configure the transport gate. Restrict which authenticated users or requests can reach the server, where supported. Keep this check separate from ability-level authorization.
- Validate inputs and document purpose. Ensure each state-changing ability validates its structured inputs and has a clear, narrow purpose.
- Monitor use and denials. Add logging or observability so an administrator can review requests, activity, and blocked operations.
If you use WordPress.com MCP
WordPress.com documents browser-based OAuth 2.1 authorization with PKCE, rotating and expiring tokens, and connected-app access that can be revoked. Authorize only the intended client. When it no longer needs access, review and revoke connected apps in your account’s security settings. The service documentation says OAuth credentials are not shared with the client; this does not remove the need to review which tools are enabled. Consult the current WordPress.com MCP documentation for plan and setup eligibility, which can change.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Is the WordPress MCP Adapter read-only by default?
Do not interpret its default server permission as a read-only guarantee. The documented default requires an authenticated user with read, while abilities separately determine what operations are exposed and what permissions they require. Review the registered abilities, their MCP visibility, and their permission callbacks for the installed version. A different implementation, such as Automattic’s wordpress-mcp plugin, documents administrator privileges for operations by default.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
