WordPress MCP Server Cursor IDE Setup (2026)

How do you connect WordPress to Cursor IDE? Generate an Application Password from your WordPress user profile, add a wordpress block to ~/.cursor/mcp.json with your site URL, username, and that password, then restart Cursor. The server talks to WordPress's built-in REST API, so there's no separate API to enable on most self-hosted sites — just an admin-side password to generate and a config block to add.

The trade-off worth understanding first: an Application Password inherits every capability of the WordPress user it's tied to. Generate it under your main admin account and the AI can publish posts, edit any page, and manage users — the same as if it were logged into /wp-admin as you. More on scoping that down below.

What This Is Actually Useful For

Where This Falls Short

If your content lives in Advanced Custom Fields (ACF) or another fields plugin, the core WordPress REST API doesn't expose those fields by default — ACF has its own optional "Show in REST API" setting per field group, and older ACF setups often don't have it enabled at all. Don't assume the AI can see your custom fields just because it can see the post; verify with a read-only query first; if the response is missing fields you know exist, that's a REST-API-exposure setting on the ACF side, not a broken MCP connection.

This also isn't the right tool for bulk destructive operations. "Delete all posts in the Uncategorized category" run through a chat prompt has no undo the way a database backup restore does — test any bulk or delete workflow against a staging site first.

Prerequisites

Step 1: Generate an Application Password

1. Log into /wp-admin and go to Users → Profile (or Users → All Users → [your name])
2. Scroll to the Application Passwords section near the bottom
3. Enter a name like cursor-mcp and click Add New Application Password
4. Copy the generated password immediately — WordPress shows it once and won't display it again

If you don't see an Application Passwords section at all, the site is either not served over HTTPS, is running a version older than 5.6, or has the feature disabled by a security plugin (Wordfence and similar plugins commonly ship a toggle for this).

Before you generate it under your main account: consider creating a dedicated WordPress user with the Editor role (or a custom role with only the capabilities you need) instead. An Editor can create and publish posts and manage most content but can't install plugins, change themes, or manage other users — a meaningfully smaller blast radius than an Administrator account if a prompt goes sideways.

Step 2: Configure Cursor's MCP Settings

Add the server to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "wordpress": {
      "command": "npx",
      "args": ["-y", "@automattic/mcp-server-wordpress"],
      "env": {
        "WP_SITE_URL": "https://yourdomain.com",
        "WP_USERNAME": "your-wp-username",
        "WP_APP_PASSWORD": "xxxx xxxx xxxx xxxx xxxx xxxx"
      }
    }
  }
}

Package names for WordPress-focused MCP servers are still consolidating as of 2026 — check the specific package's README for its exact env var names before assuming the ones above match. WP_SITE_URL should be the site root (no trailing /wp-json), since most of these servers append the REST API path themselves.

Step 3: Restart Cursor and Verify

Quit and reopen Cursor, then check View → Output → MCP for a clean startup. Test with something read-only:

List my 5 most recent WordPress posts

If you get real titles and dates back, the connection and the account's read permissions are both working.

Practical Workflows

Draft a post without publishing it

Draft a WordPress post titled "2026 Elasticsearch Setup Tips" in the "Engineering" category, save it as a draft, don't publish

Always specify draft status explicitly in the prompt — don't rely on it being the default, since that depends on the account's role and the specific MCP server's behavior.

Check for existing coverage before writing something new

Search my WordPress posts for anything already covering "Application Passwords" so I don't duplicate it

Verify a custom post type's structure before an import

What fields and taxonomies are registered on the "product" custom post type? I'm writing a CSV import script and need to match the schema exactly.

Audit content gaps

List all published posts in the "Tutorials" category that don't have a featured image set

Troubleshooting

401 error on every request, even with a correct password
Some security plugins (Wordfence, iThemes Security, and similar) block or rate-limit REST API and XML-RPC traffic by default. Check the plugin's firewall/API settings for a REST API allowlist entry before assuming the credentials are wrong.

"rest_cannot_create" or similar permission errors
The WordPress user's role doesn't have the capability for that action. This is a WordPress roles issue, not an MCP config issue — check Users → [that user] → Role and confirm it matches what you're asking the AI to do.

Application Passwords section is missing from the profile page
Almost always one of: the site isn't served over HTTPS, WordPress is older than 5.6, or a security plugin has explicitly disabled the feature. Check the plugin's settings before assuming a WordPress bug.

Custom fields (ACF, Pods, etc.) don't show up in responses
The core REST API doesn't expose third-party custom fields automatically. For ACF specifically, each field group needs "Show in REST API" enabled, or you need the ACF to REST API add-on depending on your ACF version — this is a WordPress-side setting, not something the MCP config can work around.

Server doesn't appear in Cursor
Run the npx command from Step 2 directly in a terminal. If it throws an auth error there, fix the WordPress side (password, HTTPS, security plugin) first.

Frequently Asked Questions

Q: Does this work with WordPress.com, or only self-hosted WordPress.org sites?
A: Self-hosted (.org) sites are the primary target — they run the full core REST API with Application Password support. WordPress.com's managed hosting has its own separate REST API and authentication system with more restrictions depending on your plan tier, so a config built for self-hosted sites generally won't work there without adjustment.

Q: Can the AI install plugins or change my theme through this connection?
A: Only if the WordPress account behind the Application Password has Administrator capabilities. An Editor-role account (the recommended setup above) can't install plugins or switch themes even if asked — those actions require install_plugins and switch_themes capabilities that Editors don't have.

Q: My security plugin blocks the REST API — do I have to disable it entirely?
A: No, most security plugins (Wordfence included) let you allowlist specific REST API routes or your server's IP rather than disabling API protection site-wide. Check the plugin's firewall or REST API settings for a scoped exception before turning off protection entirely.

Q: Is an Application Password the same as my actual WordPress login password?
A: No — it's a separate, revocable credential scoped to API/HTTP authentication. You can generate several of them (one per tool or integration) and revoke any single one from your profile without changing your actual account password or affecting other integrations.

Q: Should I use a dedicated WordPress user for this instead of my own admin account?
A: Yes, if you want the AI's permissions to be meaningfully smaller than "everything an admin can do." An Editor role (or a custom role scoped even tighter) can handle most content workflows — drafting, editing, categorizing — without the ability to install plugins, manage users, or change site-wide settings.

Related Guides

---