How to connect your WordPress site to n8n
Want an n8n workflow to run your WordPress site, not just post to it? Install one free plugin on your self-hosted site, add an MCP Client Tool node to your AI Agent workflow, and point it at your site with an API key or one-click sign-in. No custom code, no HTTP Request nodes to hand-build — a few minutes, on n8n Cloud or self-hosted n8n. New to MCP? Start with the WordPress MCP server guide.
What can an n8n agent do on your WordPress site once it's connected?
Once connected, the AI Agent in your workflow acts on your live WordPress site with real tools — on a schedule, on a webhook, or whenever a trigger fires. Give it an instruction in plain English and it can publish the week's drafts, follow up on WooCommerce orders, keep plugins updated, or read the error log and alert you when something breaks. Cowboy MCP exposes 203 WordPress tools that the node calls directly over HTTPS.
How do you connect n8n to WordPress in three steps?
Connecting takes three steps and no code. Install the free Cowboy MCP plugin, open the n8n panel on the Connections tab under Settings → Cowboy MCP, and add an MCP Client Tool node to your workflow with the fields the panel shows you. Authenticate with an API key (Bearer Auth) or with one-click sign-in (OAuth2) — either way, nothing is allowed until an administrator approves it on your own site.
- 1
Install the free plugin
In WordPress, go to Plugins → Add New, search for Cowboy MCP, and click Install then Activate.
- 2
Open the n8n panel
Open Settings → Cowboy MCP, pick n8n on the Connections tab. The panel shows your endpoint — the /wp-json/cowboy-mcp/v1/endpoint URL — ready to copy, and lets you create an API key with full, read-only, or custom-scope access. Click Copy on the endpoint: it also opens a 30-minute window for new OAuth2 connections.
- 3
Add the MCP Client Tool node
In n8n, attach an MCP Client Tool node to your AI Agent. Set Endpoint to the URL you copied, Server Transport to HTTP Streamable, and Authentication to Bearer Auth with your API key — or to OAuth2, create a new credential, and approve the sign-in that opens on your site. Execute the node once: its Tools output lists cowboy_discover and cowboy_run.
Under Tools to include, leave All for the agent to discover tools on demand, or pick Selected to pin a short list. Self-hosted n8n using OAuth2: add your n8n host under Settings → Browser sign-in → Additional allowed hosts first; n8n Cloud is already allowed.
Does n8n need a public site, or does a local one work?
It depends on where n8n runs. Cowboy MCP publishes a Streamable HTTP endpoint as an ordinary WordPress REST route at /wp-json/cowboy-mcp/v1/endpoint, so the MCP Client Tool node reaches your site directly over HTTPS — no proxy, no relay, and no third-party service in between. n8n Cloud connects from n8n's servers, so it needs a site it can reach on public HTTPS. The plugin is itself the MCP server; n8n is the MCP client.
Running self-hosted n8n on the same machine as a local development site? That works with no public address: the node talks to the local endpoint directly, and Bearer Auth needs no browser redirect at all. The same endpoint serves every client — Claude, ChatGPT, Claude Code — so an n8n workflow and a human in a chat can work the same site side by side.
Is it safe to let an unattended workflow change your live site?
Yes, with guardrails that matter more when nobody is watching. Give each workflow its own API key scoped to read-only or to the handful of tools it needs, so a prompt-injection or a bad loop can't reach anything else. Safe mode is on by default, so destructive tools ask before they run; any write can be previewed as a dry run; every change lands in an undo journal you can roll back from the Activity tab; and requests are rate-limited to 120 per minute per key. Every call is written to the audit log, and a key can be revoked in one click — it all runs on your own server. More on security →
Questions, answered.
Which n8n plan do I need?
Any. The MCP Client Tool node is built into n8n, so it works on every n8n Cloud plan and on self-hosted n8n, including the free Community Edition. n8n Cloud connects from n8n's servers, so your site must be on public HTTPS; a self-hosted n8n running on the same machine can reach a local site too.
Should I use Bearer Auth or OAuth2?
Bearer Auth with an API key is the simplest and works everywhere, including unattended workflows that run while you're asleep. OAuth2 lets n8n register itself with your site and sign in through your browser, with no key to store in n8n. For scheduled automations, create a dedicated key with a read-only or custom scope so the workflow can do its job and nothing more.
Does my content get sent to n8n?
Just what the workflow's agent needs to read to do the task you gave it. Cowboy MCP adds no cloud, proxy, or tracking of its own — n8n talks directly to your site's endpoint, and everything else runs on your own server. With self-hosted n8n, nothing leaves your infrastructure at all.
n8n says "Not an allowed redirect host" — what's wrong?
You're using OAuth2 from a self-hosted n8n. Cowboy MCP returns sign-in approvals to known AI apps and localhost by default, and n8n Cloud is already on that list — your own n8n host isn't. In WordPress, open Settings → Cowboy MCP → Settings → Browser sign-in and add your n8n host under Additional allowed hosts, then connect again. Or switch the node to Bearer Auth with an API key, which needs no redirect.
The node connected but shows just two tools — why?
That's normal: Cowboy MCP exposes two gateway tools, cowboy_discover and cowboy_run, instead of loading every schema into the agent's context — tell the agent to “discover tools for WooCommerce” and it finds the rest on demand. If even those two are missing, the key's scope is probably empty: check it under Connected apps on the Connections tab. Still nothing? Ask in the support forum (opens in new tab).
I get a 401, 403 or “registration is closed” when connecting — what's wrong?
“Registration is closed” means OAuth2 tried to register while new connections were off: click Copy on the endpoint in the n8n panel (it opens a 30-minute window), then connect again. For the rest, run the Connection Doctor on the Connections tab. A 401 with a Basic Auth prompt means server-level password protection answers before WordPress — exclude /wp-json/cowboy-mcp/ and /.well-known/ from it. A 403 or 503 from Cloudflare is a bot challenge; a 403 or 406 mentioning ModSecurity is a firewall blocking JSON POSTs. Still stuck? Paste the report into the support forum (opens in new tab).
Ready to connect n8n to your WordPress site?
Install the free plugin, copy the endpoint from the n8n panel, add the MCP Client Tool node, and your workflow is working on your site minutes later. It works on any self-hosted WordPress site running version 6.2 or newer on PHP 8.0+. The same site also connects to Claude, ChatGPT, and VS Code.