Start by identifying which WordPress MCP connection is failing: the WordPress.org MCP server for Plugin Directory tasks, or a self-hosted WordPress MCP Adapter that exposes a site’s registered Abilities. They use different endpoints, credentials, and launch methods, so changing a WordPress password is not a universal fix.
Once you know which setup you use, follow the checks for its transport—local STDIO or HTTP—before rotating credentials or changing server settings.
Identify the MCP server and connection method
“WordPress MCP” can refer to two separate setups. The WordPress.org MCP server is for WordPress.org account and Plugin Directory workflows. A self-hosted WordPress MCP Adapter exposes Abilities registered on a WordPress site.
The self-hosted Adapter can be launched locally through WP-CLI and STDIO, or accessed over HTTP through the @automattic/mcp-wordpress-remote proxy. Check the MCP client’s server entry to see which endpoint or launch command it uses. Do not apply WordPress.org authorization steps to a self-hosted Adapter, or vice versa.
Recommended Free Tools
#1 Best Overall
Fix WordPress.org MCP authentication errors
The official WordPress.org troubleshooting guidance says an application password may have expired or been revoked. If your client reports an authentication error for the WordPress.org MCP server, repeat the server’s authorization flow and update the credential saved in the client.
- Run the authorization flow described in the WordPress.org MCP Server guide.
- Copy the newly generated application password when it is displayed; it is shown only once.
- Replace the old password in the MCP client’s configuration, then reload or restart the client if required.
Authorizing again replaces the existing application password. Any client still using the old value will continue to fail.
Troubleshoot a self-hosted Adapter over HTTP
For an HTTP connection, check the full configuration rather than just the password: the MCP REST endpoint, username, and authentication method must match the site. The Adapter documentation describes application-password authentication and custom OAuth setups; use the method actually configured for your site.
- Confirm the client points to the correct site’s MCP REST endpoint.
- Check that the configured username and application password—or custom OAuth credentials—are current and belong together.
- Verify that the saved configuration is in the location your client reads, then reload or restart the client.
Check whether the Authorization header reaches WordPress
A credential can be correct in the client yet fail if the web server removes the Authorization header before WordPress receives the request. WordPress’s REST API FAQ documents this issue in CGI environments and provides Apache and Nginx forwarding examples.
Ask the site administrator to check the applicable server configuration and confirm that the header is forwarded. The documented examples are guidance, not a reason to edit a production server blindly; hosting, proxy, and security-plugin setups differ.
Check Node.js and local SSL for the HTTP proxy
For a local HTTP proxy setup, the WordPress Developer Blog identifies multiple Node.js installations and local SSL certificate problems as possible causes. Verify which Node.js executable the client or proxy actually uses and whether the local certificate is trusted. If the site cannot connect back to itself, also investigate DNS resolution, SSL, firewall rules, and HTTP authentication.
Troubleshoot a local WP-CLI and STDIO connection
In a local STDIO setup, the MCP client launches the Adapter through WP-CLI rather than contacting a remote HTTP endpoint. Check the command and environment used to launch it:
- Confirm WP-CLI is installed and available to the process running the MCP client.
- Check that the configured
--pathpoints to the intended WordPress installation. - Verify that the configured MCP server name exists.
- Confirm the selected WordPress user is valid and has appropriate permissions for the Abilities the site exposes.
The Adapter’s exposed Abilities and their authorization depend on the site. Use a least-privilege user and review which operations those Abilities permit.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Keep cookie and nonce authentication separate
WordPress REST cookie authentication is intended for requests made in the context of a logged-in user. It requires a nonce on each request, sent in the X-WP-Nonce header. See the WordPress REST API authentication documentation.
This browser-oriented cookie flow is distinct from an MCP client configured with an application password or OAuth. Do not substitute login cookies and nonces for the credentials expected by your MCP connection.
Quick Recap
Quick checks by connection path
| Connection path | First checks |
|---|---|
| WordPress.org MCP server | Complete authorization; use the current application password; update the client configuration. See the WordPress.org guide. |
| Self-hosted Adapter with STDIO | WP-CLI is available; the WordPress path and server name are correct; the selected user is valid for the intended Abilities. See the Adapter documentation. |
| Self-hosted Adapter with HTTP | Check the MCP REST endpoint and authentication method, Authorization-header forwarding, and—where relevant—Node.js, local SSL, DNS, and firewall configuration. See the Adapter documentation and REST API FAQ. |
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
