An AI integration can access the WordPress data and actions exposed to it by the site’s APIs. Public content is generally available without a login; access to private information or the ability to edit settings and content depends on the credential, the WordPress account’s capabilities, and the permissions on each API endpoint or action. To reduce risk, use HTTPS, a separate revocable Application Password for external connections, an account with only the capabilities the integration needs, and a review of the site’s exposed API routes and AI-callable abilities.
What can an AI integration access in WordPress?
WordPress’s REST API is a JSON interface to site resources. Its documented endpoint families include content, users, settings, themes, and plugins, among others. A site can also expose resources or fields through plugins, custom post types, metadata settings, and custom code. The REST API Handbook describes it as providing “public data accessible to any client anonymously, as well as private data only available after authentication.”
As an Amazon Associate I earn from qualifying purchases.
That does not mean every connected integration receives a copy of the site’s database. An endpoint’s existence does not establish that a particular integration can access every record or field. The request’s authentication, the account’s capabilities, the endpoint’s permission checks, and the site’s configuration determine what is available.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →| Data or action | What determines access |
|---|---|
| Published public content, such as posts and pages | Generally available anonymously through public API routes; individual fields and site configuration can affect what is returned. |
| Private or password-protected content | Requires authentication or specific API configuration; the authenticated user and endpoint permissions still matter. |
| User information, settings, themes, plugins, and other administrative resources | Access depends on the route’s permission checks and the account’s capabilities; the existence of a resource family does not grant access to it. |
| Custom post types, taxonomies, metadata, or plugin-specific data | Depends on whether the site or extension exposes them, and on the permissions implemented for the relevant route or field. |
| Content-management or administrative actions | Require an authenticated request and the capabilities and endpoint permissions needed for the particular action. |
The precise routes and returned fields vary by installation. WordPress’s REST API reference and handbook describe the standard interface, but they cannot establish what a specific site’s plugins and custom code expose.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Can an AI integration read private posts or user data?
It may be able to, but not simply because it is labelled “AI” or connected to WordPress. Public content is generally available anonymously. Private posts, password-protected content, internal user information, and non-public metadata require authentication or explicit exposure through site or API configuration. Even with authentication, access depends on the account and the permission checks in the relevant endpoint or plugin.
WordPress permissions are capability-based. Roles group capabilities, but a role label alone is not a complete account of access: site owners can customize roles, and plugins can add their own permissions or checks. For example, WordPress documents manage_options as allowing a user to view, edit, and save site options; Editors do not have that capability by default. The site’s actual account configuration and code determine the effective permissions.
Rank #2
- HARDWARE 2FA AND MFA: FIDO Alliance Certified FIDO2 v2.1 with CTAP2 plus legacy U2F and CTAP1 for strong two-factor login and passwordless sign-in on services that support security keys
- BUILDING ACCESS ON ONE CARD: MIFARE DESFire EV2 4K applet with AES encryption adds office door and physical access control alongside digital authentication
- CERTIFIED SECURE ELEMENT: An NXP Common Criteria EAL6+ certified secure controller and Java Card platform protects your keys on a tamper-resistant chip
- DUAL INTERFACE SMART CARD: Contactless NFC ISO 14443 plus ISO 7816 contact reader support in an ISO 7810 ID-1 format that is passive and needs no battery
- SWISS ENGINEERED DESIGN: Built by Cryptnox as a single card for authentication and access control and backed by a 2 year warranty
How do authentication methods affect access?
Application Passwords for external integrations
WordPress Application Passwords are per-application credentials intended for API authentication rather than interactive sign-in. They are stored hashed, shown only when created, and can be revoked separately. WordPress introduced the feature in version 5.6; a site may disable it through filters, plugins, or custom code, so availability varies by installation.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsUse Application Passwords over HTTPS. Basic Authentication sends the credential in an Authorization header, so without encrypted transport it could be intercepted. Give each external integration its own credential and associate it with an account that has only the capabilities needed for the task. Keep the credential in protected secret storage—not browser-side code or a public repository—and revoke it when the integration is no longer needed.
Rank #3
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Cookies and nonces for requests within WordPress
For requests made from a logged-in WordPress session, cookie authentication is the standard approach, with REST nonces helping prevent cross-site request forgery. The REST API Handbook says a request without the nonce is treated as unauthenticated even if the browser user is logged in. This is intended for same-origin use within WordPress, not as the general credential for an external service.
How can you limit what an AI integration can change?
- Create a dedicated account. Assign only the capabilities needed for the integration’s specific task. Do not assume that a role name guarantees a particular permission set; review the account’s effective capabilities and any plugin-specific permissions.
- Create a separate Application Password for the connection. Use it over HTTPS and store it as a protected secret. Separate credentials make it possible to revoke this connection without changing the user’s main password or disrupting unrelated integrations.
- Inspect the API routes and exposed fields. Review the site’s REST API index and the routes registered by plugins or custom code. Check whether custom post types and metadata are exposed, and what permissions apply. The API is specific to each site.
- Review permission checks for actions. For each route that accepts data or performs an action, confirm that its permission callback checks the necessary capabilities. WordPress’s Roles and Capabilities guidance says: “If your plugin allows users to submit data—be it on the Admin or the Public side—it should check for User Capabilities.”
- Revoke access that is no longer required. Remove the integration’s Application Password when the connection is retired, and review the remaining account and API access as part of the site’s access maintenance.
What does the WordPress Abilities API change?
The Abilities API, documented for WordPress 6.9 and above, provides a registry of distinct site functions with descriptions, input and output definitions, categories, and permissions. WordPress describes it as “a standardized way to register and discover distinct units of functionality within a WordPress site.” It is intended to support discovery and execution by external systems, including AI agents, but that does not mean every AI integration uses it or that sites on earlier WordPress versions have it.
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
For an ability to appear in REST API listings and be executable over REST, the site must enable its show_in_rest setting; it is off by default. The Abilities API REST endpoints require an authenticated user, and each ability’s permission callback controls whether that user may execute it. If the site uses this API, review both which abilities are exposed and what each permission callback allows.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →What should you verify about a particular integration?
WordPress’s general documentation cannot tell you exactly what a specific connection can access or what happens to data after it leaves your site. Before enabling an integration, check the following against the actual installation and the integration provider’s documentation:
- The site’s WordPress version and whether the integration requires particular plugins or APIs.
- The routes and fields the integration requests, including private content, user information, settings, custom post types, and metadata.
- Whether it only reads data or can create, edit, delete, or administer resources.
- The authentication method, the account’s minimum required capabilities, and how credentials can be revoked.
- Any plugin or custom-route permission checks, plus the abilities exposed through the Abilities API if the site uses it.
- The provider’s stated practices for retention, onward processing, and deletion of data.
Do not infer a vendor’s storage, training, transmission, or deletion practices from WordPress permissions alone; verify those claims in the vendor’s own privacy and security documentation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
