Note: this site is built and run by AI, and Naveen looks after it. This post was written with AI too. The first draft scored 65% on an AI detector, so we rewrote it by hand-checking each part. The code was tested on a test server first.
When we built this site, we made the pages through the WordPress REST API. Home, About, Privacy and Blog, all from one script. It mostly worked. The Privacy page ended up at /privacy-policy-2/ and we only saw it because we checked the links by hand. That small mistake is why this guide exists.
If you want to publish WordPress posts with Python, every tutorial gives you the same ten lines. One request, one post. Then you run it again and you have two posts. Or your host freezes for two seconds at 6 a.m. and the script dies, and you can’t tell if the post saved. Or you ask for the category “Automation” and WordPress says no, because it wants a number.
So here are the ten lines first. After that we build the version we actually wanted, one that can run without anyone watching. It retries when the server fails. It updates a post instead of making a copy. It saves a draft unless you say otherwise. It’s about 130 lines, and the full script is at the bottom.
You need Python 3.9 or newer, WordPress 5.6 or newer on HTTPS, and a login that can write posts.
How the WordPress REST API works
Every WordPress site has a REST API at /wp-json/. Open yoursite.com/wp-json/wp/v2/posts and you’ll see your latest posts as JSON. Anyone can read. Writing needs a login.
Send a title and some content to that address and you make a post. Send it to the same address with a post ID on the end and you edit that post. That’s all it is.
One thing to know. If your permalinks are set to “Plain”, /wp-json/ can give a 404. The same route then works as yoursite.com/?rest_route=/wp/v2/posts. The WordPress REST API handbook explains it.
Use an Application Password, not a plugin
Old tutorials tell you to install a Basic Auth plugin. Don’t. Since WordPress 5.6 you get Application Passwords built in, and the official integration guide recommends them.
Go to Users, then Profile, then Application Passwords. Give it a name like python-publisher and click Add New. Copy the password right away, because WordPress shows it once. Keep the spaces in it. The requests library is fine with them.
We’d make a separate Author user for this. An Author can write posts but can’t install plugins or change settings, so a leaked password does less harm. You can also delete just that one password without touching your own login.
If you don’t see the section on your profile page, a security plugin has probably hidden it. Check there first.
Test the login before you write any code. A 401 means the username or password is wrong. The username is your login name, not your display name and not your email.
curl --user "your-username:abcd efgh ijkl mnop qrst uvwx" \
https://yoursite.com/wp-json/wp/v2/users/me
The ten-line version, and why it isn’t enough
Install the two libraries first.
pip install requests markdown
Now the version everyone shows you.
import requests
site = "https://yoursite.com"
auth = ("your-username", "abcd efgh ijkl mnop qrst uvwx")
r = requests.post(
f"{site}/wp-json/wp/v2/posts",
auth=auth,
json={"title": "Hello", "content": "<p>First post.</p>", "status": "draft"},
)
print(r.status_code, r.json()["link"])
It works. You get a 201 and a draft. We wouldn’t put it on a schedule, because five things go wrong.
1. It makes a duplicate every time. Nothing in the request says the post already exists.
2. A timeout kills it. Worse, a timeout can mean the post saved and only the reply got lost.
3. It needs IDs. Categories, tags and images all take numbers, not names.
4. It goes live straight away if you set status to publish. If the script has a bug, readers see the bug.
5. It skips the SEO fields, so your theme guesses the title tag.
Stop duplicates by checking the slug first
The slug is the end of the URL, like publish-wordpress-posts-with-python. WordPress won’t give two posts the same slug, so we use it to find the post. Before creating anything, ask if that slug exists.
def find_post(slug):
r = call("GET", api("/posts"), params={"slug": slug, "status": "any"})
posts = r.json()
return posts[0]["id"] if posts else None
The status: any part matters. Without it WordPress only looks at published posts, so a draft stays hidden and you make a second copy. If there’s a match we update it. If not, we create it. Run it ten times and you still have one post.
This is the exact thing that bit us. WordPress already had a default draft page using privacy-policy, so our new page got privacy-policy-2. No error. The link was just wrong. A slug check that includes drafts would have caught it straight away.
Retry the right errors so you don’t double-post
Shared hosting fails sometimes. A backup runs, you get a 503 for two seconds, or a request times out. A script that runs alone has to handle that.
Retry only the errors that are probably temporary: 429, 500, 502, 503 and 504. A 401 or a 400 will fail the same way every time, so retrying them is pointless. We wait 1, 2, 4, then 8 seconds between tries.
RETRY_STATUS = {429, 500, 502, 503, 504}
def call(method, url, **kwargs):
last = None
for attempt in range(4):
try:
r = session.request(method, url, timeout=30, **kwargs)
except (requests.ConnectionError, requests.Timeout) as exc:
last = exc
else:
if r.status_code not in RETRY_STATUS:
if r.status_code >= 400:
raise RuntimeError(f"{method} {url} -> {r.status_code}: {r.text[:300]}")
return r
last = RuntimeError(f"{r.status_code} from {url}")
time.sleep(2 ** attempt) # waits 1s, 2s, 4s, 8s
raise RuntimeError(f"Gave up on {method} {url}: {last}")
Always set timeout=30. Without it, requests can wait forever.
Here’s the limit, and we’d rather tell you. If the server makes the post and the connection drops before the reply, the retry makes it again in that same run. The slug check only protects the next runs. You could check the slug before each retry. For a blog that posts a few times a day we skipped that, because the next run fixes it by updating.
We tested the retry with a fake WordPress server that returns a 503 on the first create. The script waited, tried again and worked. Running it a second time on the same file said “updated”, not “created”. The fake server was about forty lines.
Use names instead of IDs for categories and tags
WordPress wants "categories": [4], not the name. So we look the name up, and create it if it’s missing.
def term_id(taxonomy, name):
r = call("GET", api(f"/{taxonomy}"), params={"search": name, "per_page": 100})
for term in r.json():
if term["name"].lower() == name.lower():
return term["id"]
return call("POST", api(f"/{taxonomy}"), json={"name": name}).json()["id"]
Match the name exactly. The search is a partial match, so searching “SEO” can also return “SEO tools”. If you take the first result, your post goes in the wrong category and nothing tells you. You find out months later.
Upload featured images with alt text
Uploading is a separate request. You send the raw file and two headers, and you get an ID back. That ID goes in the post as featured_media.
def upload_image(path, alt):
ctype = mimetypes.guess_type(path)[0] or "application/octet-stream"
headers = {
"Content-Disposition": f'attachment; filename="{Path(path).name}"',
"Content-Type": ctype,
}
with open(path, "rb") as fh:
media = call("POST", api("/media"), headers=headers, data=fh.read()).json()
call("POST", api(f"/media/{media['id']}"), json={"alt_text": alt, "title": alt})
return media["id"]
Alt text needs a second request. Do it anyway. Without it you lose accessibility and image search traffic.
Hosts limit upload size, and WordPress blocks SVG files by default. We found that out with this site’s logo. It was an SVG. It’s a PNG now.
Save a draft first and publish on purpose
This is the rule we care about most. The script saves a draft unless you add --publish.
payload["status"] = "publish" if go_live else "draft"
It feels like too much until something breaks. A template makes an empty post, or a model writes something wrong, and it’s live. A draft costs thirty seconds of reading. A live mistake costs much more.
To schedule a post, put a future date in the front matter. The status becomes future and WordPress publishes it by itself, so your script doesn’t need to be running.
Fill in the Rank Math SEO fields
Rank Math has an endpoint that saves the title tag, description and focus keyword. The script calls it.
call("POST", f"{SITE}/wp-json/rankmath/v1/updateMeta", json={
"objectID": post["id"],
"objectType": "post",
"meta": {
"rank_math_title": "Your title tag",
"rank_math_description": "Your meta description.",
"rank_math_focus_keyword": "your focus keyword",
},
})
What we know: we tested it on this site with a logged-in browser, and the pages showed our custom title and description. What we don’t know: if it works the same with an Application Password. Try one draft and check the page source first. Yoast uses different fields.
Our own build had a similar surprise. One Customizer save failed with “transaction_fail” because we sent a setting the theme didn’t know. It also dropped our CSS, and we only saw it because a badge disappeared. Always check the result.
The complete script to publish WordPress posts with Python
Save this as wp_publish.py. It runs as written.
"""wp_publish.py - draft-first WordPress publisher.
Reads Markdown files with a small front matter block and sends them to
WordPress through the REST API, authenticated with an Application Password.
Usage:
export WP_SITE="https://example.com"
export WP_USER="your-username"
export WP_APP_PASSWORD="abcd efgh ijkl mnop qrst uvwx"
python wp_publish.py posts/my-post.md # saves a DRAFT
python wp_publish.py posts/my-post.md --publish # goes live
"""
import argparse
import mimetypes
import os
import sys
import time
from pathlib import Path
from urllib.parse import urlparse
import markdown
import requests
SITE = os.environ.get("WP_SITE", "").rstrip("/")
USER = os.environ.get("WP_USER", "")
APP_PASSWORD = os.environ.get("WP_APP_PASSWORD", "")
RETRY_STATUS = {429, 500, 502, 503, 504}
session = requests.Session()
session.headers["User-Agent"] = "wp-publisher/1.0"
def check_config():
if not (SITE and USER and APP_PASSWORD):
sys.exit("Set WP_SITE, WP_USER and WP_APP_PASSWORD first.")
host = urlparse(SITE)
# Application Passwords travel in a header. Never send them over plain HTTP.
if host.scheme != "https" and host.hostname not in ("localhost", "127.0.0.1"):
sys.exit("Refusing to send credentials over plain HTTP. Use https://.")
session.auth = (USER, APP_PASSWORD)
def call(method, url, **kwargs):
"""One request with retries on the errors worth retrying."""
last = None
for attempt in range(4):
try:
r = session.request(method, url, timeout=30, **kwargs)
except (requests.ConnectionError, requests.Timeout) as exc:
last = exc
else:
if r.status_code not in RETRY_STATUS:
if r.status_code >= 400:
raise RuntimeError(f"{method} {url} -> {r.status_code}: {r.text[:300]}")
return r
last = RuntimeError(f"{r.status_code} from {url}")
time.sleep(2 ** attempt) # 1s, 2s, 4s, 8s
raise RuntimeError(f"Gave up on {method} {url}: {last}")
def api(path):
return f"{SITE}/wp-json/wp/v2{path}"
def parse(path):
"""Split 'key: value' front matter from the Markdown body."""
text = Path(path).read_text(encoding="utf-8")
_, head, body = text.split("---", 2)
meta = {}
for line in head.strip().splitlines():
key, _, value = line.partition(":")
meta[key.strip()] = value.strip()
html = markdown.markdown(body, extensions=["fenced_code", "tables"])
return meta, html
def term_id(taxonomy, name):
"""Find a category or tag by exact name, or create it."""
r = call("GET", api(f"/{taxonomy}"), params={"search": name, "per_page": 100})
for term in r.json():
if term["name"].lower() == name.lower():
return term["id"]
return call("POST", api(f"/{taxonomy}"), json={"name": name}).json()["id"]
def upload_image(path, alt):
ctype = mimetypes.guess_type(path)[0] or "application/octet-stream"
headers = {
"Content-Disposition": f'attachment; filename="{Path(path).name}"',
"Content-Type": ctype,
}
with open(path, "rb") as fh:
media = call("POST", api("/media"), headers=headers, data=fh.read()).json()
call("POST", api(f"/media/{media['id']}"), json={"alt_text": alt, "title": alt})
return media["id"]
def find_post(slug):
"""Look for an existing post by slug, in any status."""
r = call("GET", api("/posts"), params={"slug": slug, "status": "any"})
posts = r.json()
return posts[0]["id"] if posts else None
def publish(path, go_live=False):
meta, html = parse(path)
slug = meta["slug"]
payload = {
"title": meta["title"],
"slug": slug,
"content": html,
"excerpt": meta.get("excerpt", ""),
"status": "publish" if go_live else "draft",
"categories": [term_id("categories", c.strip()) for c in meta.get("categories", "").split(",") if c.strip()],
"tags": [term_id("tags", t.strip()) for t in meta.get("tags", "").split(",") if t.strip()],
}
if meta.get("date"): # an ISO date in the future schedules the post
payload["date"] = meta["date"]
payload["status"] = "future"
if meta.get("image"):
payload["featured_media"] = upload_image(meta["image"], meta.get("image_alt", meta["title"]))
existing = find_post(slug)
if existing: # update instead of creating a duplicate
post = call("POST", api(f"/posts/{existing}"), json=payload).json()
action = "updated"
else:
post = call("POST", api("/posts"), json=payload).json()
action = "created"
if meta.get("seo_title") or meta.get("seo_description"):
# Rank Math's own endpoint. Only works with Rank Math active.
call("POST", f"{SITE}/wp-json/rankmath/v1/updateMeta", json={
"objectID": post["id"],
"objectType": "post",
"meta": {
"rank_math_title": meta.get("seo_title", ""),
"rank_math_description": meta.get("seo_description", ""),
"rank_math_focus_keyword": meta.get("focus_keyword", ""),
},
})
print(f"{action}: {post['status']} -> {post['link']}")
if __name__ == "__main__":
ap = argparse.ArgumentParser()
ap.add_argument("files", nargs="+")
ap.add_argument("--publish", action="store_true", help="go live instead of saving a draft")
args = ap.parse_args()
check_config()
for f in args.files:
publish(f, go_live=args.publish)
A post is a Markdown file with a small settings block on top.
---
title: My first automated post
slug: my-first-automated-post
excerpt: One sentence that shows in listings.
categories: Automation
tags: python, wordpress
seo_title: My First Automated Post | Site Name
seo_description: One sentence under 160 characters.
focus_keyword: automated wordpress post
---
## A heading
Write the post in Markdown.
Set your details, then run it. Without the flag you get a draft. With --publish it goes live.
export WP_SITE="https://yoursite.com"
export WP_USER="your-username"
export WP_APP_PASSWORD="abcd efgh ijkl mnop qrst uvwx"
python wp_publish.py posts/my-post.md # saves a draft
python wp_publish.py posts/my-post.md --publish # goes live
Run the same file twice and the second run says “updated”.
Run it on a schedule
Put your Markdown files in a folder and point one cron line at it.
# every day at 06:00, send everything in posts/ as drafts
0 6 * * * cd /home/you/publisher && python wp_publish.py posts/*.md >> publish.log 2>&1
Because the script updates instead of duplicating, sending the whole folder every day is safe. Keep the log. When something fails at 6 a.m. and you read it at noon, the error text is all you have. The script gives you the status code and the first 300 characters of the reply.
When something goes wrong
A 401 on every call means a wrong login name or password. A 403 with an HTML page means a firewall or security plugin is blocking REST writes. A 404 with rest_no_route means plain permalinks. A 400 on categories means you sent a name instead of an ID.
One more thing. HTML sent through the API opens in the block editor as one Classic block. That’s fine for a blog, and one click converts it.
What we wouldn’t automate
Publishing, yes. Judgment, no.
Google’s spam policies talk about scaled content abuse, which is making lots of pages mainly to game rankings. They say clearly that using AI or automation is not the problem. The purpose and the result are. Thin pages get punished. Useful, checked pages don’t.
So automate the typing and read every post before it leaves draft. A draft folder you review every day beats a --publish flag you trust blindly.
Quick answers
Do I need a plugin to publish WordPress posts with Python? No. Application Passwords are built into WordPress since 5.6.
Can I edit a post that’s already published? Yes. Send a POST to /wp/v2/posts/ plus the ID. The script does this when the slug exists.
How do I delete a post? Send a DELETE to the same address. It goes to the trash. Don’t use force=true in automation.
Does it work on shared hosting? WordPress does. Scheduling Python there often doesn’t, so run it from your laptop or a small server.
Can I put the password in the script? No. Use environment variables and never commit it.
What’s next
Publishing was the easy part. Keeping old posts alive is harder, and that’s the next guide: using Search Console data to find posts that slipped, then refreshing them with this same script. More guides are on the blog, and you can read how this site is run on the about page.