CMS integrations

WordPress

GrowGanic publishes each finished article to your WordPress blog, hero image sideloaded into your own media library.

A primary destination. Your article lives here and the canonical URL points at it, so this is the site Google credits. About 1 minute in one click, or 2 minutes by hand.

#What connecting does

Every article GrowGanic finishes is created as a post on your WordPress site and published. Nothing waits for approval and nothing needs copying across.

The one-click path uses the authorize-application handshake built into WordPress core, so the approval happens inside your own wp-admin and WordPress mints a private application password for us. We never see your login password, and there is nothing to register on either side.

GrowGanic reads what your install can do before it writes anything: whether the REST API answers, whether application passwords are enabled, whether Yoast or Rank Math is present, and whether the account can publish. That is why a connection either works or tells you exactly what is in the way.

#Before you start

Your site must be served over https. WordPress refuses to issue application passwords on plain http, and the one-click path is hidden when it cannot work.
An Administrator or Editor account. Author and Contributor cannot publish through the REST API.
A security plugin or CDN that allows /wp-json/ requests with the Authorization header. Wordfence, Sucuri and iThemes all block it by default, and most managed hosts have a REST API toggle that has to be on once.

#Connect

In one click

Check your site address and click Connect WordPress. Your own WordPress admin opens and asks you to sign in if you are not already.
Click Yes, I approve on that screen. WordPress creates a private Application Password for us; we never see your login password.

That is it. You land back in GrowGanic connected, and articles publish to WordPress on their own from then on.

Or connect by hand

Open your profile page in WordPress, or hover Users in the wp-admin sidebar and click Profile.
Scroll down to Application Passwords. Type any name (e.g. GrowGanic) and click Add New Application Password.
Copy the password that appears (it is shown once). Paste it into the Application password field below with the spaces left in. WordPress strips them automatically.
Use an Administrator or Editor account. Author and Contributor roles cannot publish through the REST API.

What you paste

Field	Required	Where to find it
Site URL	Yes	Your blog's own address. Any /wp-admin, /wp-login.php or /wp-json suffix is trimmed for you.
Username	Yes	Your WordPress username, not your email.
Application password	Yes	wp-admin, Users, Profile, then Application Passwords. Not your login password. Paste it with the spaces left in; WordPress strips them itself.

If it will not connect

No Application Passwords section? Your site must be served over https://. WordPress refuses to issue Application Passwords on plain http; contact your host if needed.
If you use Wordfence, Sucuri, or iThemes Security: allowlist /wp-json/ with the Authorization header. Most managed hosts (WP Engine, Kinsta, SiteGround) also need the REST API toggle turned on once.

#Permissions we ask for

Every permission below is used by a call GrowGanic actually makes. We ask for nothing we do not use.

Permission	Used for	Why
publish_posts	Creating and publishing the post	Checked at connect time by reading your account's own capability list, so a Contributor account is refused with a sentence rather than on the first article.
Media upload	Sideloading the hero image into your media library	So the image on your post is hosted by you and attached as the post's featured image.
Post meta	Writing the SEO title and description	Only when Yoast or Rank Math is detected. Stock WordPress silently drops unregistered meta, so we do not pretend to write it.

An application password carries whatever your own account can do and nothing more, and it can be revoked from your profile page at any time without changing your login password. GrowGanic reads posts, media and your own capability list. It touches no users, no settings, no plugins and no themes.

#What we write

Field	What goes in it
title	The article title.
content	The article body as HTML.
excerpt	The excerpt.
slug	The article slug.
status	publish, or draft when you have asked for drafts.
featured_media	The sideloaded hero image.
SEO title and description	Yoast (_yoast_wpseo_title, _yoast_wpseo_metadesc) or Rank Math (rank_math_title, rank_math_description), whichever your site runs. Neither present means neither is written.

Fields your setup does not have are skipped rather than guessed at, and the article publishes with the ones it does have.

The hero image

The hero is uploaded into your own media library and attached to the post as its featured image, so your theme renders it exactly as it renders any other post's image.

Re-publishing an article does not sideload the image again. GrowGanic checks the media already attached first, so a refreshed article does not fill your library with copies of the same picture.

If the upload fails, the post still publishes without a featured image and the next publish tries again. A hero image never holds an article back.

#Publishing behaviour

The status we report back is the one WordPress reports, not the one we asked for. A post WordPress kept as a draft is recorded as a draft, because recording it as published would give you a live URL that answers 404.

Editing an article in GrowGanic updates the same post. It never creates a second one.

Before creating a post, GrowGanic checks whether your site already holds this article, whoever put it there, so importing an existing catalogue cannot produce a duplicate of a post you copied across by hand.

You can set articles to arrive as drafts instead of publishing live, from Settings in GrowGanic.

If this destination is ever unreachable, the article is not held. It publishes to your GrowGanic blog and moves here on its own once the connection is healthy again. GrowGanic never holds a finished article back waiting for you.

#Disconnect

Disconnecting stops publishing to WordPress. Posts already on your site stay published and stay yours.

You can also revoke the application password from wp-admin, Users, Profile. GrowGanic finds out on the next call: it is refused, the connection is switched off, and you get an email saying it needs reconnecting.

A password WordPress issued through the one-click approval is deleted from our database at that moment, because your own site refusing it is your site telling us the approval is over. A password you pasted by hand is kept instead: a refused call on a self-hosted site is very often a security plugin or a stripped Authorization header rather than a revoked password, and clicking Test is how the connection repairs itself with nothing re-entered. Disconnect if you want a pasted password removed.

Open Integrations in GrowGanic, find this destination and click Disconnect. The stored credential is deleted from our database in the same step, not marked inactive. Articles already published stay exactly where they are, and they are yours.

#Troubleshooting

What you see	Why	Fix
Cloudflare stopped our request before it reached your site.	A WAF rule is blocking the REST API.	In Cloudflare open Security, then WAF, and add a rule that allows /wp-json/.
SiteGround's anti-bot protection stopped our request.	SiteGround blocks unfamiliar server IPs before WordPress sees them.	In Site Tools open Security, then Blocked IPs, and allow GrowGanic. Or connect with a username and application password instead.
WordPress accepted the request but rejected the password.	Application passwords are turned off, usually by a security plugin or a host-level rule.	Re-enable application passwords, then generate and paste a fresh one.
Your hosting strips the login header before it reaches WordPress.	The Authorization header is dropped in transit, so the password can never arrive.	Ask your host to pass Authorization through, or add the standard Authorization RewriteRule to your .htaccess.
This account does not have permission to publish posts.	The account is an Author or Contributor.	Use an Administrator or Editor account.
Your WordPress answers at a different address.	The address you gave redirects, and we never carry credentials across a redirect.	Use the address your site actually answers on, exactly as the message names it.
This WordPress.com site runs without its own plugins.	WordPress.com Simple sites cannot accept an application password.	Move to a WordPress.com plan that allows plugins, or connect a self-hosted install.

Still stuck? Email [email protected] and tell us the sentence you are seeing. Or read the other destinations.