How to Use WordPress REST API to Publish Posts Programmatically

Introduction

In modern web development, automating content workflows is a game-changer. Whether you are building a mobile app, connecting a cross-platform service, or setting up an automated content pipeline, publishing content remotely is a crucial skill. In this tutorial, we will explore how to use the WordPress REST API to create and publish posts programmatically using PHP.

By the end of this guide, you will understand how to authenticate your requests securely and send data to your WordPress site without ever touching the admin dashboard.

—

Prerequisites

Before diving into the code, ensure you have the following setup ready:

  • A running WordPress website (version 4.7 or higher).
  • Access to the WordPress admin dashboard to generate Application Passwords.
  • A local development environment with PHP installed.

—

Step 1: Generate WordPress Application Passwords

To interact with the WordPress REST API securely, you need to authenticate your requests. WordPress provides a built-in feature called Application Passwords.

  1. Navigate to your WordPress Dashboard -> Users -> Profile.
  2. Scroll down to the Application Passwords section.
  3. Enter a name for your application (e.g., “AutomationScript”) and click Add New Application Password.
  4. Copy the generated password immediately. (Note: You won’t be able to see it again).

—

Step 2: The PHP Script to Publish a Post

Now, let’s write a clean PHP script using cURL to send a POST request to the WordPress API endpoint.

The Code Structure

Create a file named publish.php and paste the following code:

<?php
// Configuration
$website_url = 'https://your-domain.com/wp-json/wp/v2/posts';
$username    = 'your_admin_username';
$app_password = 'your_generated_app_password'; // XXXX XXXX XXXX XXXX

// Post Data Payload
$post_data = [
    'title'   => 'Automated Post via REST API',
    'content' => 'This is the body content of our automated post built with PHP and cURL.',
    'status'  => 'publish', // Use 'draft' if you want to review it first
    'categories' => [1]    // Array of category IDs
];

// Initialize cURL
$ch = curl_init($website_url);

// Set cURL options
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($post_data));
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'Authorization: Basic ' . base64_encode($username . ':' . $app_password)
]);

// Execute and capture response
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Output Verdict
if ($http_code === 201) {
    echo "Success: Post published successfully!";
} else {
    echo "Error: Failed to publish post. HTTP Status Code: " . $http_code;
    echo "\nResponse: " . $response;
}

—

Step 3: Testing and Technical Verdict

When you run this script via your terminal or browser, it sends a payload directly to WordPress. If the setup is correct, the API returns a 201 Created status code, which confirms your article is live.

Security Best Practices

  • Never hardcode credentials: In production enviornments, use environment variables (.env) to secure your application passwords.
  • Monitor Logs: Keep an eye on your security logs (like Wordfence) to ensure only your specific IPs are hitting the /wp-json/ endpoints for sensitive operations.

Conclusion

Using the WordPress REST API opens up endless possibilities for web automation, syndication, and content scaling. It reduces the overhead of manual publishing and allows seamless integration with backend frameworks like Symfony or Node.js.