How to connect your WordPress site to OpenClaw
Want your OpenClaw agent to run a WordPress site, not just talk about it? Install one free plugin on your self-hosted site, paste one message into your OpenClaw chat, and approve the sign-in in your browser. No API key to copy, no config file to hand-edit — a few minutes, on a live site or a local one. New to MCP? Start with the WordPress MCP server guide.
What can OpenClaw do on your WordPress site once it's connected?
Once connected, your agent acts on your live WordPress site with real tools — it does the work itself instead of handing back text you paste in. Ask in plain English, in the chat you already use to drive OpenClaw, and it can draft and schedule posts, put a WooCommerce collection on sale, keep plugins updated, or read the error log to explain what broke. Cowboy MCP exposes 203 WordPress tools that OpenClaw calls directly over HTTPS.
How do you connect OpenClaw to WordPress in three steps?
Connecting takes three steps and no code. Install the free Cowboy MCP plugin, copy the message from the OpenClaw panel on the Connections tab under Settings → Cowboy MCP, and paste it into your OpenClaw chat. The agent adds your site to its own config and starts the one-click sign-in. There's no key to copy or keep safe, and nothing is allowed until you click Approve on your own site.
- 1
Install the free plugin
In WordPress, go to Plugins → Add New, search for Cowboy MCP, and click Install then Activate.
- 2
Copy the message
Open Settings → Cowboy MCP, pick OpenClaw under Automation & developers on the Connections tab, and click Copy message. The message tells the agent to add your site's /wp-json/cowboy-mcp/v1/endpoint URL to its config with OAuth sign-in; copying it turns on browser sign-in and opens a 30-minute window for new connections.
- 3
Paste it and approve
Paste the message into your OpenClaw chat. OpenClaw proposes the config change and waits for your approval, runs the login, and sends you the sign-in link. Open it: the page is on your site — pick full access, read-only, or a custom list of tools, and click Approve. Ask OpenClaw what the server can do, or run openclaw mcp probe your-site: it reports two tools.
Prefer the terminal? Open Use the terminal instead on the same panel and run the two pre-filled lines where OpenClaw is installed: openclaw mcp add … --transport streamable-http --auth oauth, then openclaw mcp login …, which prints the sign-in link. OpenClaw on another machine? Open the link in a local browser, copy the code from the address your browser ends on, and run openclaw mcp login your-site --code <code>. The config-file block and an API-key setup are on the panel too.
Does OpenClaw need a public site, or does a local one work?
Both work, because OpenClaw connects from wherever you run it. Cowboy MCP publishes a Streamable HTTP endpoint as an ordinary WordPress REST route at /wp-json/cowboy-mcp/v1/endpoint, so OpenClaw reaches your site directly over HTTPS — no proxy, no relay, and no third-party service in between. An OpenClaw on your laptop reaches a site on Local, Studio, MAMP or Docker with no public address; an OpenClaw on a server reaches any site that server can see. The plugin is itself the MCP server; OpenClaw is the MCP client.
The same endpoint serves every client — Claude, ChatGPT, n8n — so an OpenClaw agent and a human in a chat can work the same site side by side, each with its own connection and its own scope. The local WordPress MCP guide covers the local-site details.
Is it safe to let an agent change your live site?
Yes, with guardrails that matter more when an agent works on its own. Approve the connection with read-only or a custom list of tools if the agent only needs some of them, so a prompt injection or a bad loop can't reach the rest. Safe mode is on by default, so destructive tools ask before they run; any write can be previewed as a dry run; every change lands in an undo journal you can roll back from the Activity tab; and requests are rate-limited to 120 per minute. Every call is written to the audit log, and a connection can be revoked in one click — it all runs on your own server. More on security →
Questions, answered.
What is OpenClaw, and what do I need before I start?
OpenClaw is a self-hosted agent gateway: you run it on your own machine or server and talk to it from a chat, and it uses whichever model account you give it. You need a running OpenClaw — the setup was verified with OpenClaw 2026.10.4 — and a WordPress site with Cowboy MCP installed. Because OpenClaw runs where you install it, a local development site works as well as a live one.
Should I paste the message or run the commands?
They do the same thing. The message is for people who drive OpenClaw from a chat: the agent proposes the config change, waits for your approval, runs the login and sends you the sign-in link. The two terminal commands — openclaw mcp add with --auth oauth, then openclaw mcp login — are for people at the keyboard where OpenClaw is installed. Either way the sign-in page is on your own site, and the access you approve there is what OpenClaw gets.
OpenClaw runs on a server — how does the browser sign-in get back to it?
Open the printed sign-in link in a browser on your own computer and approve it. If the browser then lands on an address that will not load, copy the code from that address and run openclaw mcp login your-site --code <code> on the server, or send the code to OpenClaw in the chat; it finishes the sign-in from there.
Does my content get sent anywhere?
OpenClaw talks to your site directly from wherever it runs, and what it reads goes to the model account you connected it to — nothing else. Cowboy MCP adds no cloud, proxy, or tracking of its own, and everything else runs on your own server.
The probe reports only two tools — is that right?
Yes. Cowboy MCP exposes two gateway tools, cowboy_discover and cowboy_run, instead of loading every schema into the agent's context — ask OpenClaw to “discover tools for WooCommerce” and it finds the rest on demand. If even those two are missing, the connection's scope is probably empty: check it under Connected apps on the Connections tab. Still nothing? Ask in the support forum (opens in new tab).
I get a 401, 403 or “registration is closed” when connecting — what's wrong?
“Registration is closed” means OpenClaw tried to register while new connections were off: click Copy on the message or command in the OpenClaw panel (it opens a 30-minute window), then run the login again. For the rest, run the Connection Doctor on the Connections tab. A 401 with a Basic Auth prompt means server-level password protection answers before WordPress — exclude /wp-json/cowboy-mcp/ and /.well-known/ from it. A 403 or 503 from Cloudflare is a bot challenge; a 403 or 406 mentioning ModSecurity is a firewall blocking JSON POSTs. Still stuck? Paste the report into the support forum (opens in new tab).
Ready to connect OpenClaw to your WordPress site?
Install the free plugin, copy the message, paste it into OpenClaw, and approve the sign-in — your agent is working on your site minutes later. It works on any self-hosted WordPress site running version 6.2 or newer on PHP 8.0+. The same site also connects to Hermes Agent, n8n, and Claude Code.