The WAC POST plugin provides a robust integration between the WeAreContent platform and WordPress sites. It registers two specialized REST API endpoints designed for secure, high-performance content delivery.

These endpoints are strictly protected by a three-layer security model:
1. IP Whitelisting: Access is only granted to authorized IP addresses (local and remote dynamic lists).
2. Application Key: Every request must include a valid X-WACPO-App-Key header, compared using a timing-safe check.
3. Author Capability Check: The configured Default Content Author must have permission to publish posts, verified server-side on every request.

No WordPress username, password, or native Application Password is required to authorize the connection. Content received through the API is attributed to the Administrator or Editor selected in Default Content Author.

Security design note (v4.2.0)

Earlier versions additionally required a native WordPress Application Password tied to a specific user account. That requirement has been intentionally removed: it did not add meaningful security on top of the Application Key, but it forced every site owner to create a WordPress user and generate an application password by hand, which was the leading cause of failed/abandoned setups. The security boundary has not weakened — it moved from “a WordPress user session plus a key” to “two independent, site-owner-controlled secrets that must both match” (Application Key + IP address), plus a real server-side capability check against the configured Default Content Author (fails closed if that user cannot publish posts). Author attribution, which used to be inferred implicitly from the WordPress user session, is now an explicit, admin-only setting that can only ever resolve to a real local user, never to caller-supplied data.

Available Endpoints:
* POST /wp-json/wac/v2/create-and-seo-post: Create new posts including featured images, secondary media, and full SEO metadata.
* POST /wp-json/wac/v2/postsys: Update SEO metadata and keywords for existing posts.
* GET /wp-json/wac/v2/ping: Lightweight, read-only connectivity check to verify the Application Key and see the configured default author, without creating any content.

External Services

This plugin relies on external services provided by WeAreContent to ensure secure integration and media processing. By using this plugin, you acknowledge and agree to the terms of these third-party services:

WeAreContent Auth-IP List:
- Service: A remote security list hosted at app.wearecontent.com.
- Purpose: Provides a dynamic list of authorized MD5 IP hashes to secure REST API endpoints via IP Whitelisting.
- Data processed: The plugin only fetches security hashes from the server; no user or website data is transmitted to WeAreContent during this process.
- Terms of Service: https://www.wearecontent.com/terminos-y-condiciones
- Privacy Policy: https://www.wearecontent.com/tratamiento-de-datos
WeAreContent Media Server:
- Service: A dedicated media hosting platform (files.wearecontent.com).
- Purpose: Allows the plugin to download and sideload featured images and extra media assets directly into the WordPress library.
- Data processed: The plugin performs a secure download of media files to the local server; no personal user data is sent to the external host.
- Terms of Service: https://www.wearecontent.com/terminos-y-condiciones
- Privacy Policy: https://www.wearecontent.com/tratamiento-de-datos

Features

Secure REST Endpoints: Dedicated points for content creation and metadata updates.
IP Security & Proxy Support: Advanced detection of real client IPs behind Cloudflare, Nginx, or other proxies.
Custom Authentication: Secure header-based validation via a unique Application Key.
SEO Integration: Automatic mapping of metadata for both Yoast SEO and RankMath SEO.
Automated Media Management: Downloads and attaches featured images and in-content media from authorized hosts.
Smart Taxonomy Handling: Automatically creates categories and tags if they do not exist on the site.
Privacy Ready: Includes suggested text for the site’s privacy policy regarding technical data processing.
Translation Ready: Fully internationalized with support for multiple locales.