Sorank

Sorank is the official WordPress connector for the Sorank SEO platform. It connects your site to Sorank so you can generate, schedule, publish, and update SEO-focused articles without copying content between tools.

Connect in one click from your WordPress admin. No WordPress password, Application Password, or API key needs to be copied into Sorank.

A Sorank account is required. Content generation and planning happen in Sorank. This plugin securely delivers the finished content to your WordPress site.

Features

• AI-powered SEO content – Generate articles in Sorank from target keywords, search intent, competitor research, and your business context.
• Automatic or draft publishing – Publish directly to WordPress or send articles as drafts for review before they go live.
• Content scheduling – Plan your editorial calendar in Sorank and let scheduled articles reach WordPress at the right time.
• Complete article delivery – Send the title, slug, formatted body, inline images, featured image, and WordPress category in one workflow.
• SEO metadata – Write SEO titles, meta descriptions, and focus keywords for Yoast SEO and Rank Math.
• Update existing articles – Push Sorank edits to an already published WordPress article without creating a duplicate or changing its URL.
• Publish status control – Move connected articles between draft and published status from Sorank.
• Theme and builder compatibility – Preserve rendering for Elementor, Elementor Pro Theme Builder, OceanWP, and standard WordPress themes.
• Secure one-click connection – Pair your site without sharing your WordPress credentials or manually creating an API key.

How It Works

1. Install and activate the Sorank plugin from WordPress.org.
2. Open the new Sorank menu in your WordPress admin and click Connect to Sorank.
3. Authorize the site in your Sorank account. No API key needs to be copied.
4. Generate or schedule an article in Sorank and choose whether it should be published immediately or saved as a draft.
5. Sorank sends the article, images, category, and SEO metadata directly to your site. Future edits can update the same WordPress post.

Built for Reliable WordPress Publishing

Sorank publishes through a dedicated /wp-json/sorank/v1/* REST namespace instead of relying on the standard post endpoints. This keeps the integration isolated and avoids common conflicts with security layers that heavily restrict /wp-json/wp/v2/*.

Each publishing request is authenticated with an encrypted bearer token created during pairing. The plugin can receive an article and its images in a single request, reducing partial publications and synchronization errors.

Security

• Connection and settings actions require a WordPress administrator and are protected by WordPress nonces.
• Pairing uses a state value and PKCE-style code verification to prevent intercepted authorization codes from being reused.
• The Sorank access token is encrypted with AES-256-CBC using a random secret generated for this WordPress installation.
• Every Sorank REST request must present the valid bearer token, which is compared using hash_equals.
• Disconnecting removes the local token. Uninstalling removes all Sorank plugin options and temporary pairing data.

External Services

This plugin connects to Sorank (https://www.sorank.com), an SEO SaaS that publishes articles to your site. The connection is required for the plugin to function: without it, the Connect button cannot pair your site and no articles can be published.

Sorank pairing exchange

When you click Connect to Sorank in the WordPress admin, your browser is redirected to https://app.sorank.com/integrations/wordpress/pair with the following query parameters: your site URL, a random state nonce, a PKCE code_challenge, the plugin version, and a return_url pointing back to your WordPress admin.

After you authorize the pairing in Sorank, your browser is redirected back to your WordPress admin with a pairing_code and state. The plugin then makes a server-to-server POST request to https://app.sorank.com/api/v1/cms-integrations/wordpress-plugin/exchange containing your site URL, the pairing code, the state nonce, the PKCE code verifier, and the plugin version. Sorank responds with a long-lived bearer token and the email address of the Sorank account that authorized the pairing.

Sorank disconnect notification

When you click Disconnect in the WordPress admin, the plugin makes a best-effort POST request to https://app.sorank.com/api/v1/cms-integrations/wordpress-plugin/notify-disconnect containing your site URL and the bearer token. The plugin then deletes the local copy of the token regardless of whether Sorank could be reached.

No other outbound calls

The plugin does not send analytics, telemetry, error reports, or any other data to Sorank or to any third party. All other Sorank communications are inbound (Sorank calling your site’s /wp-json/sorank/v1/* routes with a bearer token).

Terms and privacy

Sorank Terms of Use: https://www.sorank.com/terms-of-use
Sorank Privacy Policy: https://www.sorank.com/privacy-policy

Privacy

The plugin stores the following on your WordPress site:

• sorank_access_token: the bearer token issued by Sorank during pairing, encrypted at rest.
• sorank_encryption_secret: a random 256-bit secret generated at first pairing and used to encrypt the access token. Never leaves the site.
• sorank_authkey_fingerprint: a one-way SHA-256 fingerprint of AUTH_KEY taken at install time. Used to detect (and report anonymously to Sorank) whether a security plugin rotated your salts, since salt rotation was the leading cause of disconnections before 2.0.5. The first 8 hex characters of the fingerprint are anonymized for the diagnostic.
• sorank_connected_email: the email address of the Sorank account that authorized the pairing.
• sorank_connected_site_url: the site URL recorded at pairing time.
• sorank_connected_at: the Unix timestamp of the pairing.
• sorank_theme_builder_compat: the on/off value of the Elementor Theme Builder compatibility option.
• Short-lived transients prefixed with sorank_pairing_ containing the PKCE verifier during an in-progress pairing (auto-expire after 10 minutes).

All of these are removed when the plugin is uninstalled through the standard WordPress uninstall flow.

The plugin does not set cookies and does not track site visitors.