WordPress MCP Connection Not Working? Fix 401 / 403 and Application Password Errors

A WordPress MCP connection usually fails for one of four reasons: a wrong or revoked Application Password (401), a user without administrator capabilities (403), the REST API disabled by a security plugin, or the site not being served over HTTPS. Identify the matching cause, fix that one thing, and the connection succeeds.

First, read the error code

MCP connection failures almost always come with a status code, and the code tells you where to look. A 401 is an authentication problem, meaning your credentials were rejected. A 403 is a permission problem, meaning the credentials were accepted but the user is not allowed to do that action. Anything else usually points at the REST API being blocked or the site not being reachable over HTTPS.

Work through the four causes below in order. Most failures are fixed by the first two. If you have not connected yet, start with our step-by-step guide to connecting WordPress to Claude or ChatGPT.

401 error: wrong or expired Application Password

A 401 Unauthorized almost always means the Application Password is incorrect, expired or revoked. Fix it like this:

• Regenerate it. In WordPress go to Users, then Profile, then Application Passwords. Revoke the old one and create a fresh one.
• Copy it exactly, including the spaces. Paste it as-is without trimming anything.
• Use the correct username. It is case-sensitive, and it is your WordPress username, not your email address.
• Check the user still exists and is not suspended. A disabled user will return 401 even with a valid password.

Regenerating the Application Password fixes the large majority of 401 errors.

403 error: the user is missing capabilities

A 403 Forbidden means the credentials are valid but the user role is not allowed to perform that action. Connect with an Administrator account. Editor and lower roles cannot manage plugins, users or some settings, so any tool that touches those areas returns a 403 for them.

If you must use a limited role for security reasons, expect that some tools will not be available to it, and grant admin only when you need the full tool set.

REST API blocked by a security plugin or firewall

This is the sneakiest cause. Security plugins, and some hosts' firewalls, often switch off or restrict the WordPress REST API for external requests, which is exactly the channel MCP uses. If your password and role are correct but the connection still fails, this is the likely culprit.

• Open your security plugin and look for a REST API setting, often worded as "disable REST API for non-logged-in users". Allow authenticated REST access.
• If your host has a firewall or bot filter, whitelist the connector so its requests are not blocked as unknown traffic.
• To confirm the plugin is the cause, temporarily deactivate security plugins one at a time and retry the connection.

HTTPS is mandatory

MCP authentication requires HTTPS. A site on plain HTTP, a broken or self-signed certificate, or a mixed-content redirect loop will fail to connect. Confirm your site loads on https:// with a valid certificate, and that http:// redirects cleanly to https:// without looping.

Still failing? Isolate the problem step by step

If none of the four causes above is obvious, narrow it down methodically:

1. Run a read-only command first, such as listing posts. It is low risk and tells you whether authentication itself works.
2. Temporarily deactivate security plugins to rule out a REST API block.
3. Check Settings, then Permalinks. If it is set to "Plain", switch to "Post name" and save, because the REST API needs pretty permalinks on some setups.
4. Confirm the site URL you entered matches the site's real address, including www or no-www.
5. Re-authorize the connector after any change, since old sessions can cache the failure.

Permalinks, www and other quiet culprits

A few settings cause failures that look mysterious because they have nothing to do with your password. Check these when the obvious causes are ruled out:

• Plain permalinks. If Settings, then Permalinks is set to "Plain", the REST API can misbehave. Switch to "Post name" and save.
• www mismatch. If your site canonical is https://www.example.com but you entered https://example.com, redirects can break the auth handshake. Use the exact canonical URL.
• Caching or CDN rules that strip the Authorization header. Some CDNs remove auth headers on cached routes, which causes intermittent 401s.
• Multiple redirects. A chain of redirects, such as HTTP to HTTPS to www, can drop credentials along the way. Aim for a single clean redirect.

A quick diagnostic order that saves time

When a connection fails, follow this order and you will find the cause fast:

1. Read the status code. 401 is auth, 403 is permission, anything else points to REST or HTTPS.
2. Regenerate the Application Password and confirm the username and admin role.
3. Deactivate security plugins one at a time and retry.
4. Confirm HTTPS is valid and redirects are clean.
5. Fix permalinks and the www or no-www URL.
6. Re-authorize the connector after each change so you are not testing a cached failure.

Ninety percent of failures are solved by steps one to three.

How the right connector prevents these errors

Many of these headaches come from a connector that fails silently and leaves you guessing. A well-built connector validates your URL, username and Application Password at connect time and tells you exactly what went wrong, so you fix the real cause instead of retrying blindly. It also keeps credentials encrypted and lets you disconnect cleanly, so you are never left with a half-broken connection. That single design choice removes most of the trial and error described in this guide.

When to ask for help

If you have worked through every cause here and the connection still fails, the problem is usually specific to your host or a custom security setup. At that point, gather a few details before reaching out for support: the exact status code you see, whether a read-only command works, which security plugins are active, and whether your site loads cleanly over HTTPS.

With those details, support can pinpoint the issue quickly instead of guessing. Most stubborn cases come down to a firewall rule, a caching layer stripping the Authorization header, or a host that restricts the REST API by default. All of these are fixable once you know which one you are dealing with. The key is to isolate the single cause rather than changing many things at once, because that is what turns a mysterious failure into a simple fix.

Frequently asked questions

What does a 401 error mean when connecting WordPress to AI?

A 401 means the Application Password is wrong, expired or revoked. Regenerate the Application Password and reconnect, using the exact username, which is case-sensitive.

Why do I get a 403 error after connecting?

A 403 means the credentials are valid but the user lacks permission. Connect with an Administrator account so every tool has the capabilities it needs.

Can a security plugin block the WordPress MCP connection?

Yes. Many security plugins disable or restrict the REST API for external requests. Allow authenticated REST access, or whitelist the connector, then reconnect.

Does my WordPress site need HTTPS for MCP?

Yes. MCP authentication requires HTTPS with a valid certificate. Plain HTTP or a broken certificate will fail to connect.

Related guides

← All guides