Private WordPress MCP
Connect ChatGPT to Private WordPress Without Exposing the Server
Use an outbound-only MCP tunnel when the WordPress origin should stay private and no new inbound endpoint should be opened.
Short answer A private WordPress server does not need a public inbound MCP endpoint for ChatGPT. Use an outbound-only MCP tunnel from the private environment to the hosted connector endpoint. Keep authentication and authorization enforced by the dedicated WordPress agent identity and Composer tool catalog.
The network problem
Hosted AI clients cannot directly reach a private WordPress origin
Private admin environments often sit behind network controls that should not be weakened just to add an AI client.
Problem 1
Opening inbound access changes the threat surface
Publishing a new public endpoint or firewall rule can expose a private WordPress environment that was intentionally isolated.
Problem 2
A tunnel can be mistaken for an authorization layer
Network reachability alone does not decide what the connected agent may read, create, update, or publish inside WordPress.
Problem 3
Broad MCP tools remain broad through a private link
A private transport does not reduce the impact of an over-privileged WordPress identity or an unrestricted tool catalog.
Operational implication Use outbound-only connectivity for reachability, then enforce least privilege separately inside WordPress with a dedicated identity and bounded Composer abilities.
Recommended architecture
Change reachability without moving the trust boundary
The tunnel makes a private MCP endpoint reachable to the hosted client. WordPress remains responsible for authorization.
Private WordPress environment
|
| outbound connection only
v
Secure MCP tunnel / connector
|
v
Hosted ChatGPT MCP client
Authorization path:
ChatGPT -> dedicated agent identity -> Composer abilities
|
+--> validate
+--> create/update owned drafts
+--> preview
X--> publish / admin operations
Architecture recommendation Use an outbound-only tunnel when the WordPress origin should remain private. The tunnel should target the intended Composer MCP server, while WordPress-side permissions and the Composer tool catalog continue to enforce the content boundary.
Verification path
Test both network and WordPress boundaries
A private connection is useful only when the discovered capabilities are also appropriately narrow.
- Establish the outbound tunnel — Start the connection from the private environment so no new inbound route to the WordPress origin is required.
- Authenticate a dedicated agent identity — Do not use a general Administrator account for a bounded content workflow.
- Review the discovered tool catalog — Confirm that the available operations match the intended Blueprint and do not include unrelated publishing, deletion, plugin, theme, user, or settings administration.
- Run a bounded draft test — Create a draft and preview, then verify that the same workflow cannot publish or perform unrelated site-management actions.
When an outbound MCP tunnel is useful
Best fit
Private WordPress origins with hosted AI clients
- Private admin environments behind network controls.
- Source WordPress installations that should not expose a public MCP origin.
- Staging or editorial environments where outbound connectivity is allowed but new inbound firewall access is not.
A direct endpoint may be simpler when
The MCP origin is intentionally public
- The WordPress MCP endpoint is already publicly reachable and independently secured.
- Network policy does not require origin isolation.
- The team does not need the additional tunnel layer.
Common questions
Private MCP connectivity
Does the tunnel make the WordPress server public?
The recommended pattern starts the connection outbound from the private environment, so the private WordPress origin does not need a new public inbound endpoint.
Does the tunnel replace WordPress authentication?
No. The tunnel solves reachability. WordPress should still authenticate the dedicated agent identity and enforce its capabilities.
Should I still review the MCP tools?
Yes. Confirm that the client discovers only the operations required for the intended workflow before using the connection with real content.
Can publication remain disabled?
Yes. In the governed Composer workflow, draft creation and preview can be exposed without adding publishing to the tool catalog.
Keep the origin private
Connect the agent without widening WordPress authority
Use the private MCP connection pattern together with Agent Composer's governed draft tools so network access and content authorization remain separate controls.