Fix: WordPress MCP connector returns 401 or 403

401 Unauthorized - it's the credentials

• Use an Application Password, not your login password. Create one at Users → Profile → Application Passwords.
• If it says application passwords are disabled, re-enable them here.
• Copy the password with the spaces, exactly as shown.

403 Forbidden - it's a firewall or the REST API

• A security plugin (Wordfence, Solid Security) or a host WAF may block the REST API or the Authorization header. Allowlist /wp-json/ and the wptaskify IPs.
• Some servers strip the Authorization header - add the SetEnvIf Authorization rule to .htaccess.
• Confirm the REST API works: open https://yoursite.com/wp-json/ in a browser.

Quick checklist

1. Plugin installed & activated.
2. Application password created (not disabled).
3. REST API reachable at /wp-json/.
4. Firewall/security plugin allowlists the connection.