How to Connect Claude to Your WordPress Site (Step by Step)

GripMCP is now live. It’s a WordPress plugin that lets Claude, and other AI assistants that speak MCP, work on the site you already have. You ask in plain language (“draft a post about our spring sale”, “why is the contact page throwing an error?”) and the assistant does the work inside your WordPress, using your WordPress permissions.

This guide takes you from nothing to a connected assistant in five steps. Most people finish in a few minutes.

What GripMCP actually does

MCP (Model Context Protocol) is an open standard that lets an AI assistant use outside tools. GripMCP turns your WordPress site into an MCP server. Once it’s connected, your assistant can read and change your site through WordPress itself, the same way you would in wp-admin.

It doesn’t build sites and it doesn’t replace WordPress. It’s the bridge between an assistant you already use and a site you already run. Every action is checked against the real role and capabilities of the WordPress user who connected, so the assistant never gets more power than that person has.

Before you start

• A WordPress site running WordPress 6.2 or later and PHP 7.4 or later.
• HTTPS on the site. GripMCP requires it by default.
• An administrator account. By default only administrators can connect, and you can allow other roles later.
• Claude on the web, desktop or mobile, with access to custom connectors.

Step 1: Install the free plugin

Download the free GripMCP zip from the pricing page. In wp-admin, go to Plugins → Add New → Upload Plugin, choose the zip, then click Activate.

Step 2: Switch the endpoint on

Open GripMCP in the admin menu. The endpoint starts switched off, so nothing can connect until you allow it. Turn it on with the switch at the top right. It saves the moment you change it.

Step 3: Copy your site’s address

On the Setup tab, copy the endpoint address. On most sites it looks like this:

https://your-site.com/mcp

The short /mcp address needs pretty permalinks (anything except “Plain” under Settings → Permalinks). If your site uses plain permalinks, the Setup tab shows a longer address instead. It works just as well, so copy whichever one you see.

Step 4: Add GripMCP to Claude

1. In Claude, open Settings → Connectors.
2. Choose Add custom connector and paste your address.
3. Claude sends you to your own WordPress login. Sign in and approve the connection.

That’s it. There are no tokens to copy and no config files to edit. Behind the scenes this uses the standard MCP sign-in flow, so other MCP apps that support it connect the same way.

Using an app that reads a config file instead? Create an access token on the Access tab and use that. Tokens are stored hashed, expire after 90 days unless you choose otherwise, and you can revoke them at any time.

Step 5: Review your GripMCP settings

Once Claude is connected, go back to GripMCP in wp-admin and open the Permissions tab. GripMCP starts on the careful side, so a few things are switched off until you decide you want them. Take a minute to check each one:

• Who can connect. Only administrators can connect an app at first. Tick a role, such as Editor, if someone else on your team should connect their own assistant. They can still only do what their role allows.
• Destructive actions. Set to Ask me first, so deletes, refunds and admin-access changes wait for your approval. You can also choose Off or Allow, but we suggest keeping it on Ask me first: you stay in control of anything that can’t easily be undone, and approving takes one click.
• Advanced capabilities. These stay off until you switch them on, even on a paid plan: Install and remove plugins or themes (Creator and up), Make changes through the REST API (Operator and up) and Edit theme and plugin files (Fleet). Turn on only the ones you plan to use.

Tip: if you ask your assistant for something and it says it can’t, check here first. The switch for it is probably still off.

Your first things to ask

Start a new chat with the connector turned on and just ask. A few ideas that work on the free plugin:

• “Draft a blog post about our new opening hours and save it as a draft.”
• “Upload this photo and set it as the featured image on the About page.”
• “Tidy up my categories and merge the duplicates.”
• “Add a Contact link to the main menu.”
• “Show me comments waiting for moderation and approve the genuine ones.”
• “Run a site health check and tell me what needs fixing.”
• “Check the error log. Why is the checkout page showing a blank screen?”

For requests that take several steps, assistants that show in-chat panels, such as Claude, display one live progress card with each step and the outcome.

How you stay in control

Letting an assistant into your site should feel safe, so GripMCP starts locked down:

• Your permissions, nothing more. Every request runs as the WordPress user who connected. If you couldn’t do it in wp-admin, the assistant can’t either.
• Deletes wait for you. Destructive actions are set to Ask me first on a new install. That covers deleting content, users, plugins or themes, refunds, and changes to who has admin-level access. Each one waits for you to approve it in your own WordPress admin, and an assistant can never approve its own request.
• It checks what would break. Before a delete goes up for approval, GripMCP looks for knock-on effects, such as an image used as your logo, a page in a menu, or the last administrator account. It shows you what it found with the request.
• Everything is logged. An activity log records every tool call, so you can see exactly what happened and when.
• Revisions undo edits. If you don’t like a change, roll the post back to an earlier revision.

You can change these under Permissions. Destructive actions can be set to Off, Ask me first, or Allow. We recommend leaving it on Ask me first.

If it won’t connect

• Look at the diagnostics first. Go to GripMCP → Activity → Connection diagnostics. It lists every refused request and the reason.
• Is the site in a subfolder? One-click connect needs HTTPS and a site at the root of its domain. Sites in a subdirectory can connect with an access token instead.
• Is a security plugin blocking it? One-click connect relies on /.well-known/ addresses. If a security plugin blocks those, allow them.
• Does your host drop the Authorization header? Some hosts do. The Setup tab warns you when that happens, and our docs show the fix.

Where to go next

The free plugin covers everyday site care: content, media, users, menus, comments, settings, revisions, approvals and site health. When you want your assistant to do more, the paid plans add plugin and theme management, WooCommerce, Elementor, WPBakery and Divi editing, WP-CLI, and developer tools for running a whole fleet of sites.

Compare the plans, browse the docs, or get in touch if you get stuck.