WordPress permissions and authentication

Content Uploader never asks for your WordPress password and does not use an application password. This page explains what it uses instead, because "what can it do on my site?" is a fair question to ask before you connect one.

How the connection is made#

1. An administrator selects Connect to Content Uploader in WordPress. The plugin creates a one-time pairing code that is valid for ten minutes. Only a hash of the code is kept on your site.
2. The administrator's browser carries the code to Content Uploader. The administrator signs in there and approves the connection for one workspace. Only a workspace owner can approve.
3. Content Uploader and your site then exchange a long random access key directly, server to server. Your site keeps only a fingerprint (a hash) of the key; Content Uploader keeps the key itself, encrypted.

From then on, every request Content Uploader makes carries the key, a timestamp and a single-use number. Your site rejects a request with a wrong key, an old timestamp or a number it has seen before, so a copied request cannot be played again.

Whose permissions it works within#

Content Uploader is never signed in to your site. Each request is checked against the permissions of the administrator who approved the connection, limited to content, and your site checks them again on every operation:

• A content type is only offered if that account may create and edit it.
• Statuses, authors, categories, tags and custom fields are only offered, or only accepted, if that account may set them. Choosing a status such as Published needs the permission to publish.
• Creating categories and tags needs the permission to create terms.
• Images need the permission to upload files.
• Everything else that administrator may do is out of reach. While a request from Content Uploader runs, the plugin switches off that account's permissions to install or change plugins and themes, manage users, change settings or edit files, so a request can never do any of it. Content that only a theme editor may change (templates, template parts, navigation menus, global styles and fonts) is not offered.

If you later demote or delete that account, Content Uploader loses those permissions at once: publishing fails with an error such as The connection expired or permission was revoked. Reconnect in WordPress. Reconnect with an administrator account. If you want a dedicated account, create an administrator, sign in as that user and connect from there.

What the key cannot do#

The key works only with the plugin's own addresses: reading what your site offers, reading the state of items Content Uploader created, and creating or updating items. It does not sign anyone in to WordPress, it does not work with any other part of the WordPress REST API, and it cannot read or change plugins, themes, users, settings or files other than the images it is delivering. It cannot delete anything either.

Taking access away#

• Disconnect in Settings → Content Uploader (WordPress) ends access at once, from your side.
• Deactivating the plugin has the same effect: the plugin revokes the key.
• Disconnect on the Sites page in Content Uploader clears Content Uploader's copy of the key and tries to revoke it on your site. If your site cannot be reached at that moment, also disconnect it in WordPress.
• Access also expires after 90 days unless it is renewed. See renewing or reconnecting.

For the full picture of what is stored where, see security and data handling.