Connecting WordPress with n8n: Setting Up Application Passwords Correctly

n8n connects to WordPress via its own node for posts, pages, and users, while authentication usually runs via Application Password, a native WordPress feature for machine access without exposing the main password. A second method, OAuth2, works exclusively with WordPress.com and not with self-hosted installations. This article shows how to set up both methods, what the WordPress node can do, and where users most commonly run into credential trouble in practice. As of: August 2026.

How do you set up Application Passwords for n8n?

Application Passwords are the standard method for self-hosted WordPress installations and require, according to the n8n credentials for WordPress, three steps: enable two-factor authentication, generate an Application Password, and create the n8n credentials. Specifically, first enable two-factor authentication in the WordPress security settings, for example via an authenticator app or SMS. Then open the Security section, then Two-Step Authentication, and select "+ Add new application password". Give it a descriptive name such as "n8n-integration" so that you can recognize the password later and revoke it specifically if needed. Enter the generated password together with your WordPress username and the WordPress URL into the n8n credentials; optionally, you can also ignore SSL checks there, which is intended for staging environments without a valid certificate and remains not recommended in production.

When is OAuth2 worthwhile instead of Application Password?

OAuth2 is only worthwhile if your site is actually hosted on WordPress.com, since according to n8n documentation this method works exclusively with WordPress.com sites. To set it up, create an application in the WordPress.com developer portal, copy the OAuth redirect URL from the n8n credentials form into the application settings, and then transfer the Client ID and Client Secret back to n8n. Anyone running a classic self-hosted installation with their own server won't get further here and should stick directly with Application Passwords.

What can the WordPress node do, and where are its limits?

The WordPress node covers three areas: posts, pages, and users. For posts and pages, you can create new entries, retrieve them individually or as a list, and update existing entries; for users, creating, retrieving, and updating are possible. For anything beyond these standard operations, the n8n documentation itself points to the HTTP Request node, which can reuse the same WordPress credentials, for example for comments or custom post types that the node does not directly cover.

Why do WordPress credentials in n8n fail most often?

Three recurring error patterns show up in the n8n community. Most common are "Forbidden" or "Unauthorized" messages on the first connection attempt, often because a security plugin or hosting provider blocks Application Passwords server-side, even though WordPress itself displays them. A second group reports that previously working credentials suddenly stop working, which usually points to a reset or expired Application Password or a WordPress update. A third group simply receives the message that the password is wrong, even though it was copied correctly; in practice, a completely freshly generated Application Password instead of a reused one often helps here. A look at the n8n community before troubleshooting yourself usually shows whether a problem is already known. Anyone who doesn't want to run WordPress automations themselves can hand that off as part of n8n automation by NordFlux as a fixed-price project.

Frequently asked questions about WordPress in n8n

Does OAuth2 also work with self-hosted WordPress sites?

No, according to n8n documentation, OAuth2 for the WordPress node is intended exclusively for WordPress.com sites. Self-hosted installations use Application Passwords as a Basic Auth method instead.

Why did my Application Password suddenly stop working?

Most likely, the password was reset in WordPress, has expired, or is being blocked by a security plugin, a pattern repeatedly reported in the n8n community. A freshly generated Application Password under a unique name resolves the problem in most reported cases.

Can I also manage comments with the WordPress node?

Not directly; the node only covers posts, pages, and users. For comments and other operations not covered, the n8n documentation names the HTTP Request node with the same credentials as a way to do it.

Do I have to enable two-factor authentication just to connect n8n?

Yes, according to n8n documentation, enabling two-factor authentication in WordPress is a prerequisite for the option to generate Application Passwords to appear at all. This only affects the login protection of your WordPress account, not the later n8n connection itself.