Fondoo
GitHubStart your 7-day trial for $0Start trial
Docs

Connect WordPress to Fondoo

Live5 min readUpdated

This guide is for self-hosted WordPress: WordPress.org software running on your own host or managed hosting. For a site hosted on WordPress.com, see the WordPress.com guide. Connecting lets your AI agent draft, update, schedule and publish posts and pages, upload images, and fix SEO problems on the site you already have, with your approval where it matters.

What Fondoo can do with it

With an application password, Fondoo uses the standard WordPress REST API (/wp-json/wp/v2) to:

  • Posts, pages, media, categories, tags and comments: list, read, create and update. Media uploads accept JPEG, PNG, WebP or PDF, up to about 3 MB.
  • Menus and menu items: list, read, create and update. These need WordPress 5.9 or later and a user who can edit theme options.
  • Authors and revisions: list authors, and list the revisions of a post or page.
  • Delete any of the items above. This is a destructive action and needs your approval. Posts and pages go to the Trash, not straight to permanent deletion.

With the optional Fondoo WordPress plugin and its key (pluginKey), Fondoo can also:

  • Read and write SEO fields per post: title, description, canonical, robots and Open Graph. These are also written into Yoast or Rank Math when present.
  • Manage redirects.
  • Manage JSON-LD schema.
  • Submit URLs to IndexNow.
  • Turn on Fondoo analytics, optionally with a validated Google Tag Manager ID.
  • Read a basic health report.

After you bind the connection to your Fondoo site with connect_cms, Fondoo's shared page tools work on WordPress:

  • update_page saves drafts.
  • publish_connected_page publishes, or schedules a future post.
  • map_cms_page links an existing post.
  • apply_seo_fixes corrects missing titles, descriptions and canonicals.

Approval rules:

  • Publishing goes through Fondoo's quality and publication gates. An agent needs your approval to publish unless you have turned on auto-publish.
  • Deleting content needs your approval.
  • Re-pointing an already bound site to a different CMS connection needs your approval.

Before you start

  • WordPress 5.6 or newer, served over HTTPS. Application passwords are only available over HTTPS, or on a site marked as a local environment (integration guide).
  • A dedicated WordPress user for Fondoo, with the lowest role that covers what you want:
    • Editor covers posts, pages, media, categories and comments.
    • Administrator is needed for menus, which require edit_theme_options (roles).
    • Author cannot edit pages.
  • No conflicting plugin. Some security plugins and hosts switch application passwords off. Sites that already use HTTP Basic Authentication are "not currently compatible" with them.
  • Optional plugin requirements: PHP 8.1 or newer, plus a Fondoo API key to act as pluginKey. The plugin is version 0.1.0 and is not in the WordPress.org plugin directory. You install it from the Fondoo source (apps/wordpress-plugin).
  • There is no WordPress cost. Your host's normal limits apply.

Step by step: get your credentials

  1. Sign in to WordPress as the Fondoo user, or as an administrator editing that user.
  2. Go to Users → Profile (or Users → All Users → Edit) and scroll to Application Passwords.
  3. In New Application Password Name, type Fondoo. Click Add Application Password.
  4. Copy the password. WordPress says "You will not be able to retrieve it." The spaces in it are optional.If the section says "The application password feature requires HTTPS", fix HTTPS first.
  5. Note your site URL exactly as visitors see it after any redirects, for example https://www.example.com rather than https://example.com if the bare domain redirects. Fondoo does not follow redirects. It also rejects URLs with ports, localhost or IP addresses.
  6. Note the username of that user (the login name, not the display name).
  7. Optional plugin:
    1. Copy apps/wordpress-plugin to wp-content/plugins/fondoo and activate it.
    2. Ask your agent to create a dedicated Fondoo API key with create_api_key. Agents need your approval for this. Give the key only the contacts:write scope if you want form forwarding.
    3. In wp-config.php, set FONDOO_SITE_KEY to that key and FONDOO_API_ORIGIN to https://api.getfondoo.com.
    4. Use the same key as pluginKey.

Connect it in Fondoo

In the dashboard:

  1. Open Connections. Under Available → Content, find WordPress and click Use a key, then Open secure key entry.
  2. Fill in siteUrl, username, applicationPassword and, if you installed the plugin, pluginKey.
  3. Click Save connection securely. The link lasts 15 minutes and can be used once.
  4. Click Check connection on the WordPress card.

By asking your agent. For example:

"Connect my WordPress blog at https://www.example.com and use it for my Fondoo site."

The agent calls add_connection_key({provider:"wordpress", siteId}) without fields and sends you the secure link. Never paste the password into chat: credentials sent in fields carry a chat-log warning. A signed 15-minute instruction link is also available via connect_service({provider:"wordpress", siteId}). After saving, the agent runs:

test_connection({connectionId})
connect_cms({siteId, connectionId})

REST: POST https://api.getfondoo.com/v1/ops/add_connection_key with Authorization: Bearer <your Fondoo key> and {"provider":"wordpress","siteId":"<site UUID>"}. The other operations are the same pattern, for example POST /v1/ops/connect_cms.

When you cross-post content that first appeared elsewhere, set the original URL as canonicalUrl so the copy points back to the source.

Test that it works

  1. test_connection reads /wp-json/wp/v2/users/me?context=edit. When it succeeds, the connection lists the capabilities WordPress reports for that user under confirmed, such as edit_posts.
  2. Plugin and SEO actions stay unknown until first used.
  3. Ask your agent to list your five latest posts, then to create a draft. Check Posts → Drafts in WordPress.

Troubleshooting

  • Status invalid or "Provider request failed (401)". The username or application password is wrong, or application passwords are disabled. Open https://your-site/wp-json/: if authentication is empty there, a plugin or host has turned the feature off.
  • "Use a public HTTPS site URL" or "Connector request failed". siteUrl must be the final HTTPS address, with no redirect, port or path tricks. Use the exact URL your browser ends up on.
  • "Provider request failed (403)" on menus or pages. The user's role is too low. Menus need Administrator.
  • "Install the Fondoo plugin and configure pluginKey…". SEO and plugin actions were requested without the plugin. Install it, or edit SEO fields your SEO plugin exposes in the REST API.
  • SEO changes do not show. A page cache or theme may override them. Clear caches and run a Fondoo SEO audit again.
  • "Provider request failed (429)" or "Connector rate budget exhausted". Your host is rate limiting, or you exceeded Fondoo's budget of about 60 actions per minute for this connection.

Limits, data and security

  • What Fondoo stores: encrypted credentials, connection status, last test, last use, and snapshots of pages it publishes or fixes (used for undo). list_connections shows every field as [redacted].
  • Rotate: add a new application password, call rotate_connection_key({connectionId}) without fields, paste the new one, then revoke the old one. Revoking the application password and rotating the plugin key are separate steps.
  • Disconnect: delete_connection({connectionId}) removes the stored credentials. Agents need your approval. Then click Revoke next to "Fondoo" under Application Passwords in WordPress.