schakl.
All integrations

Websites & monitoring Available

WordPress

The ask was two things: read Rank Math's AI Visibility into the marketing module, and hold a WordPress login per website so the site can be driven other ways later. Those turned out to be the same credential against the same host, which is why this is one integration rather than two.

What you need

  • A WordPress site on 6.9 or newer for the Abilities API (older works fine, only that one door stays shut)
  • An Application Password from a user with administrator rights on that site
  • For AI Visibility: the Rank Math plugin with its AI Visibility module active, and a site connected to a Rank Math account with Content AI
  • The wordpress.site.manage permission to connect a site; admin only by default

How to connect it

  1. 1 In WordPress, create an Application Password under Users → Profile, at the bottom. Give it a name you will recognise later. Note what this is: every Rank Math AI Visibility route requires manage_options, so this password belongs to an administrator. There is no read-only shape to ask for.
  2. 2 Switch WordPress on under Instellingen → Integraties (Settings → Integrations). It needs the Websites module, because that is what the connection hangs off.
  3. 3 Open the website in schakl. and fill in the site address, the username and the application password on the WordPress card. The password is stored encrypted and never comes back out of the API, a log line or the activity trail.
  4. 4 Press Controleren (Verify). Five independent probes run: does the password reach the REST API, is the user an administrator, does this site know the Abilities API, does Rank Math answer on AI Visibility, and is the MCP plugin installed. Every outcome is kept, carrying the site's own error text untranslated, because it is a quote.
  5. 5 For AI Visibility on the dashboard, link a source of type Rank Math to this website under Marketing on the client. Without a connected website it is refused straight away, rather than turning up as a red line the next morning.
  6. 6 From then on the nightly sync takes one snapshot a day and the trend line grows by itself.

Four doors, one key

Rank Math registers its AI Visibility features as WordPress Abilities, with two lines of metadata: show in REST, and expose over MCP. Those two lines are the whole story. They put the same functions on WordPress core's REST route and on the MCP Adapter plugin's MCP server, and both authenticate the way any REST caller does, which for us means an Application Password. So one login opens four surfaces on the same host, and that is why this is an integration of its own rather than a hidden field on a marketing source: more things are queuing up for that key.

  • The ordinary REST API: posts, media, users, plugins
  • WordPress 6.9's Abilities API, opt-in per ability
  • The MCP server, where the MCP Adapter plugin is installed
  • Rank Math's own AI Visibility route

A probe is evidence, never the gate

None of the five probes gates another, because in reality those states are independent: Rank Math is routinely absent from a site whose posts API is perfectly healthy, and MCP from a site where Rank Math works fine. A read that succeeds outranks a probe that refuses: a credential that reached the ordinary REST API is active even if the other four failed, and only one refused by every probe is called refused. Unreachable and not-WordPress are separate from refused as well, because neither says anything about the password, and reporting them as auth failures sends somebody off to re-mint a credential that was never wrong. Every ✗ carries the site's own error text, because a ✗ with no explanation is the one state nobody can act on.

A newer surface is not automatically the right one

Rank Math has two ways to hand over the same figures, and only one of them measures anything. The ability reads a twelve-hour cache and cannot force an upstream fetch: its own refresh input is telemetry. The REST route can. Anyone who reached for the ability because it is the newer surface would have built a chart that moves only when a human opens the WordPress dashboard: a chart of when somebody last logged in, drawn as a chart of a client's AI visibility. So the nightly sync calls the REST route with refresh on, and a test pins it.

Five figures nobody already knew

The other marketing sources speak a vocabulary a marketeer already owns: everyone knows what a session is. These five are new to the agency and to the client alike, and the labels are as short as a tile allows. So "Citations 6" sat next to "Mentions 18" with nothing on the screen saying that the first is the subset of the second that carried a link. The agency could not explain the dashboard it had built and the client could not read the one it had been given. So every figure carries its own sentence: written out where there is room, as a tooltip where there is not, and in exactly the same component for the agency and for the portal, so no version exists that explains the numbers to one audience and not the other.

  • AI visibility score: rank, mentions, citations and sentiment folded into one figure from 0 to 100
  • Mentions: how often the brand was named in the answers to the tracked prompts
  • Citations: the subset of those that also linked to the brand's site
  • Average sentiment: how positively the brand is described, as a percentage
  • Average rank: the brand's mean place among the brands an answer names, where 1 is best

Permissions

Grant these to the role that manages this integration (Settings → Roles). Admin-only by default, and never to the client role.

  • wordpress.site.manage Connect a site, change the password, verify and disconnect. Admin only by default, and deliberately not folded into the website write permission.
  • wordpress.site.read See whether this client's site is connected and what the last verify found. Members too, because that is a question an account manager asks while doing ordinary work.

What it deliberately does not do

  • This is a table of administrator credentials for client sites. That is a bigger blast radius than a Cloudflare token scoped to DNS reads, so the manage permission is admin only and neither permission ever goes to the Client role.
  • Disconnecting forgets the password here but does not revoke it at WordPress. That is the owner's act on their own profile screen, and doing it as a side effect of tidying a list would break whatever else that password was minted for.
  • Rank Math keeps no history. Every upstream path answers "latest" only, so the trend line exists because we store snapshots. One row is written per day rather than a range of identical rows, because a flat line that looks like measurement is worse than no line.
  • Analyses run on the cadence of the Rank Math plan, weekly by default. Two consecutive snapshots may legitimately carry the same number; when it was last analysed travels with the figures so a report can say what it is actually comparing.
  • Mentions and citations look like counts and are not: they are running totals as at the last analysis. So they are averaged and never summed.
  • Writing to WordPress is not included yet: no creating a brand, no editing prompts. Reading only.

Where to find it The WordPress card on a website's detail page. There is deliberately no menu item: WordPress is not a place you go.

Read the guide

More in this category

Uptime Kuma

Other integrations

Mollie Stripe Adyen Exact Online SnelStart Cloudflare