WordsPost Content Publisher

WordsPost Content Publisher adds a REST API (content-publisher/v1) that lets an external system create, update, delete and search posts, upload and manage media, manage categories and tags, set SEO fields and, when WPML is active, manage post languages and translation links. It can also read the rest of the site — pages, WooCommerce products, product categories and menus — so the external system can see what the site is about and link to it, and list the whole site’s content in a light inventory, so the external system can keep its own copy in sync. Every request is authenticated with an API key. Each client gets its own key — created on the plugin’s settings page, or obtained by a service through a confirmation screen — and every key can be renamed, reissued or revoked on its own.

Everything works without any external service. Optionally, the settings page has a “Connect to WordsPost” button for the WordsPost content service (https://wordspost.com): it gives WordsPost its own revocable key after you approve it on a confirmation screen, instead of copying the key by hand. Nothing is sent to WordsPost unless you start the connection and press “Allow” — see External services below.

Features

• Posts: create / read / update / delete / search, with configurable status (including scheduled publishing via date + future), comments, auto excerpt, auto table of contents (from H2/H3 headings), mobile-friendly table wrapping with an optional card layout on narrow screens, and Cyrillic-to-Latin slug transliteration (Russian and Ukrainian)
• Safe retries: send a request_key with POST /posts or POST /media and a repeated request returns the item created the first time instead of a duplicate, even when two copies arrive at once or the first one was interrupted halfway
• Media: upload by URL or as inline base64 data, with optional WebP conversion, automatic downscaling of oversized images, a custom filename, alt/title/caption/description, attaching to a post, and lookup by file URL (including generated size variants)
• Categories & tags: full CRUD, with slug transliteration and find-or-create by name when attaching to a post; with WPML, per-language terms and translation links
• Site reading (read only): pages and WooCommerce products with their own fields, the visible text of any page — including pages built with Elementor or WPBakery — product categories, menus, the site tagline, and whether search engines are told not to index each item
• Site inventory: every post of every public type, every term and every menu, thousands per request at a fixed, small database cost — with WPML language and translation group, page builder, WPML duplicate flag, former slugs and a content fingerprint that changes with the text, SEO fields and categories
• SEO: one set of fields for Rank Math and Yoast SEO (whichever is active) — title, description, focus keyword, canonical, robots, Open Graph, Twitter Card — kept with their template variables (%date%, %%title%%), plus the title and description a search engine actually gets after the templates are applied
• Faithful writes: text is stored exactly as sent, backslashes included, so block attributes survive a round trip
• Repairs: raw texts in the inventory, posts looked up by ID (trash included), WPML duplicates turned into ordinary translations, posts restored from the trash into their previous status, terms named by ID and linked into translation groups
• Safe rewrites: a write that goes through only if the post hasn’t changed since it was read and nobody has it open in the editor, writes without pingbacks, per-field fingerprints in the inventory, and a version of a post in another language made by WPML itself
• Cache flush: one call clears the cached pages of the given posts (or of the whole site) in W3 Total Cache, WP Rocket, LiteSpeed Cache, WP Super Cache or WP Fastest Cache, and in WordPress’s object cache
• Languages: a /languages endpoint listing what the site speaks; with WPML, post language and translation-group linking via lang / translation_of, a translations map on every post, filters to find posts that still need translating, and a clear 409 instead of a duplicate when a language in the group is already taken; translations keep their original’s slug, change language within their group, and can take the place of a WPML duplicate
• Keys: a separate API key per client, each revocable on its own, with label, creation date and last use; create one by hand on the settings page (shown once, reissue it if lost), or let a service obtain one through the “Allow” screen
• Optional connection to WordsPost: a button on the settings page and an approval screen that states exactly what the service will be able to do; disconnect at any time
• Rate limiting: a configurable per-key requests-per-minute safety net against a runaway integration (60 by default), reported in X-RateLimit-* headers
• Activity log: every action the plugin takes, filterable and searchable, kept for 30 days
• Debug Mode: optional full request/response logging for troubleshooting an integration

The full REST API reference, curl examples and a Postman collection are in the plugin’s docs/ folder (API.md, openapi.yaml, postman_collection.json).

External services

The plugin itself never sends a request to any external service. Two things involve other sites:

Image downloads requested by your API client

When an authenticated API caller passes an address in the url field of POST /media, the file at that address is fetched once with WordPress’s own download_url() and stored in the media library. Which addresses are fetched is entirely up to the site’s own API client; nothing about the site or its visitors is sent. Uploads sent as inline data involve no outgoing request at all.

Cache plugins, when your API client asks for a flush

POST /cache/flush asks the cache plugin installed on the site to clear its cache, through that plugin's own functions. The plugin sends nothing anywhere itself; if the cache plugin is set up to purge a CDN as well, it does so on its own, as it would when you clear the cache from its screen.

WordsPost (optional, only when you connect it)

WordsPost (https://wordspost.com) is a content service that writes and publishes posts to connected sites through this plugin’s API. Connecting it is optional and happens only when a site administrator starts it:

1. “Connect to WordsPost” on the settings page opens the WordsPost panel (panel.wordspost.com) in your browser, with this site’s address in the link.
2. WordsPost sends your browser back to a confirmation screen on your own site. Only after you press “Allow” does your browser return to WordsPost carrying a one-time code (valid for 5 minutes), the request’s state value and this site’s address.
3. WordsPost’s server exchanges that code at this site’s REST API for its own API key. The site answers with the key and basic facts about itself: site name, home address, an installation ID, the REST address, the plugin and WordPress versions, the rate limit and whether the site is multilingual.

From then on WordsPost uses that key to create, edit and delete posts and media, as the confirmation screen states. You can revoke it at any time with “Disconnect” on the settings page. “Cancel” on the confirmation screen sends WordsPost only a refusal.

WordsPost terms of use: https://wordspost.com/terms/
WordsPost privacy policy: https://wordspost.com/privacy-policy/