> ## Documentation Index
> Fetch the complete documentation index at: https://docs.iru.com/llms.txt
> Use this file to discover all available pages before exploring further.

# WordPress

> Connect WordPress to Iru Compliance over the REST API using HTTP Basic Auth with an Application Password to collect site, user, role, and plugin evidence.

### About WordPress

**WordPress 5.6+** supports **Application Passwords** for REST clients. Iru calls **`https://YOUR_HOST/wp-json/...`** with **HTTP Basic** (**username** + **application password**). **HTTPS** is required - Application Passwords are rejected over plain HTTP.

### How It Works

```http theme={null}
Authorization: Basic base64(username:application_password)
```

| Detail             | Value                        |
| ------------------ | ---------------------------- |
| **Category**       | CMS                          |
| **Authentication** | Basic (Application Password) |

Self-hosted **5.6+** or **WordPress.com** **Personal+** (Free tier does not expose Application Passwords per product limits).

Official references: [Application Passwords](https://developer.wordpress.org/advanced-administration/security/application-passwords/), [REST API](https://developer.wordpress.org/rest-api/reference/).

### Prerequisites

* **Administrator** (or role that may issue Application Passwords).
* **`/wp-json`** reachable and not blocked by security plugins.

### Connect WordPress to Iru

<Tabs>
  <Tab title="WordPress">
    <Note>
      Complete this tab before you connect the source in Compliance.
    </Note>

    <Steps>
      <Step title="Sign in to WordPress admin">
        Open **`https://YOUR_HOST/wp-admin`** and sign in with a user who can edit **Users** and create **Application Passwords** (often an **Administrator**).
      </Step>

      <Step title="Open Users">
        In the left admin menu, select **Users** → **All Users**, then click the user Iru will authenticate as (often a dedicated service account).
      </Step>

      <Step title="Open Profile">
        Select **Edit** (or **Profile**) for that user to open the profile screen.
      </Step>

      <Step title="Open Application Passwords">
        Scroll to the **Application Passwords** section (WordPress **5.6+**). If it is missing, confirm the site allows Application Passwords and is served over **HTTPS**.
      </Step>

      <Step title="Create a new Application Password">
        Enter a name such as **Iru Compliance**, then select **Add New Application Password** (or **Add**). WordPress generates a spaced token.
      </Step>

      <Step title="Copy the token once">
        Copy the full application password string once. You may paste it into Iru **with or without spaces**; WordPress accepts both forms.
      </Step>
    </Steps>

    <Note>
      Continue on the [**Iru Compliance**](#iru-compliance) tab.
    </Note>
  </Tab>

  <Tab title="Iru Compliance">
    <Note>
      Finish the [**WordPress**](#wordpress) tab first.
    </Note>

    <Steps>
      <Step title="Open Sources">
        In Iru Compliance, on the left navigation bar, expand **Compliance** and select **Sources**.

        <Frame>
          <img src="https://mintcdn.com/iru/7HsGH7lnQ8GpVmI0/assets/media/images/iru-navigation-compliance-sources.png?fit=max&auto=format&n=7HsGH7lnQ8GpVmI0&q=85&s=595982441fd777b333b3ecfea24adc24" alt="Left navigation: Compliance expanded, Sources selected" width="424" height="1056" data-path="assets/media/images/iru-navigation-compliance-sources.png" />
        </Frame>
      </Step>

      <Step title="Turn on WordPress">
        Find **WordPress** (use **Category** or **Search by name or description**). On that card, turn on the **toggle**. A browser tab or window may open for the connector wizard.
      </Step>

      <Step title="Enter hostname">
        Enter **hostname** only (for example `blog.example.com`). Confirm server variables if prompted.
      </Step>

      <Step title="Enter WordPress credentials">
        Enter **username** and **application password** for the integration account.
      </Step>

      <Step title="Finish the connection">
        Click **Submit Credentials**. When the connection succeeds, the wizard shows **Connection Configured**.
      </Step>

      <Step title="Confirm the source is Active">
        Close the **Iru is requesting access to external services** browser tab, then return to **Compliance** → **Sources** and confirm the **WordPress** card is **Active**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

### Troubleshooting

<AccordionGroup>
  <Accordion title="Nothing opens when you turn the source on">
    Check **pop-up blocker** settings for the Iru site and try again.
  </Accordion>

  <Accordion title="401">
    Correct password; plugin not blocking REST.
  </Accordion>

  <Accordion title="REST disabled">
    Security plugins - allow **`wp-json`**.
  </Accordion>

  <Accordion title="HTTP site">
    Enable **TLS**.
  </Accordion>
</AccordionGroup>

### Related Articles

<CardGroup cols={2}>
  <Card title="Sources Management" icon="plug" href="/en/compliance/sources-management">
    Browse and manage every Compliance source.
  </Card>

  <Card title="Getting Started With Compliance" icon="rocket" href="/en/compliance/getting-started-with-compliance">
    Frameworks, actions, and **Artifacts**.
  </Card>

  <Card title="Iru Overview" icon="layer-group" href="/en/iru/platform-overview/iru-overview">
    How Endpoint, Compliance, and Identity fit together.
  </Card>

  <Card title="Artifacts Management" icon="folder-open" href="/en/compliance/artifacts-management">
    Upload, review, and organize evidence from sources and actions.
  </Card>
</CardGroup>