WP Rocket MCP Adds OAuth for Claude — and Quietly Removes a Password From Your Laptop

When WP Rocket shipped its MCP server earlier this month, connecting it to Claude meant generating a WordPress application password and pasting it, along with your username and domain, into a JSON config file on your machine. It worked. It also asked non-developers to hand-edit a config file and left a permanent credential sitting in plain text on a laptop.

That step is now gone. WP Rocket has launched OAuth support for its MCP server, and the setup is four clicks: add the site as a custom connector in Claude, click Connect, sign in to WordPress, approve the access request.

The convenience is the headline. The more interesting part is that the easier option is also the safer one — and that anyone who set this up the old way has a small cleanup job.

What the new setup looks like

1. In Claude, go to Settings → Connectors and choose Add custom connector.
2. Enter your site's OAuth MCP endpoint: https://your-domain.com/wp-json/mcp/mcp-oauth-server
3. Click Connect. Your browser opens your WordPress login.
4. Sign in, review the access request — this screen shows what Claude will be able to do on your site — and approve.

No application password. No config file. Nothing to regenerate when it expires. You need WP Rocket 3.23 or later with MCP enabled, and MCP access is included in every WP Rocket license at no extra cost.

For comparison, the old endpoint was …/wp-json/mcp/mcp-adapter-default-server and required the username-plus-application-password pair in your client config. Both routes still exist; OAuth is simply the one most people should use now.

Why OAuth is a security upgrade, not just a convenience one

This deserves more attention than a setup tutorial usually gets, because the two methods are not equivalent in risk.

A WordPress application password is a long-lived credential that acts as the user who created it. It doesn't expire on its own. It carries that user's full capabilities — you can't scope it to "read performance data only." And in this workflow it lived in a plaintext file on your computer, which means it also lived in whatever backups, sync folders, and screen-shares that computer participates in.

An OAuth grant behaves differently: it's issued through an explicit consent screen that tells you what's being granted, and it's revocable from the WordPress side without touching any other credential. If you stop using the connector, or a laptop goes missing, you revoke the grant and you're done.

So the practical takeaway for existing users is concrete: if you connected WP Rocket MCP before this launch, go into your WordPress profile and revoke the application password you generated for it. Switching to OAuth doesn't invalidate the old credential — it just stops using it. A forgotten application password is exactly the kind of thing that turns up in the aftermath of a credential leak long after everyone forgot it existed.

The two conditions the announcement doesn't spell out

It authorizes as a WordPress administrator. WP Rocket's own guide calls for an administrator account. So while the plugin's approval gate means nothing changes on your site without you clicking yes, the underlying grant is not a narrow, read-only, performance-data-shaped permission — it's issued against an admin login. That's a reasonable design for a tool that edits plugin settings, but it's worth knowing before you approve it on a client's production store. Read the access screen instead of clicking through it; it's the one moment in the flow where the details are actually shown to you.

"Managing multiple websites" needs a paid Claude plan. The pitch here is portfolio management — check thirty client sites from one conversation. But a free Claude account is limited to a single custom connector, which means one site. Multi-site management requires Pro or Max. And on Team or Enterprise plans, only organization Owners can add a custom connector in the first place; members connect to it afterwards. If you're an agency planning to roll this out, that's a five-minute admin conversation you'd rather have before the demo, not during it.

What you can actually ask it

Once connected, the value is that the assistant works from live data instead of a screenshot you pasted:

• "What's my speed score?"
• "What should I optimize first?"
• "Generate a performance report for my client."
• "Enable this WP Rocket feature."

It reads real Rocket Insights performance data and proposes changes you approve. We went through the full capability list — cross-site monitoring, replicating a proven configuration, branded client reports — in our coverage of the MCP launch, and the settings it surfaces are the ones described in WP Rocket 3.22's built-in CDN update.

The standing caveats for any MCP connector

Anthropic publishes its own guidance for custom connectors, and it applies here as much as anywhere:

• Connect only to servers from organizations you trust. WP Rocket is a known vendor shipping a server for its own plugin, which is about as favourable as this gets — but the rule matters more as you add connectors.
• Malicious or compromised MCP servers can carry hidden instructions designed to make the assistant take actions you didn't ask for. Claude has protections against this, but Anthropic still advises watching tool inputs and outputs rather than assuming.
• Tool behaviour can change in an update. A server you approved months ago is not necessarily doing the same things today.
• Limit scopes where you can, and deny anything that looks unnecessary.

None of this is a reason to avoid the feature. It's a reason to treat a connector to a production website like production access — because that's what it is. The same discipline applies to any automation with write access to live systems, as we've argued about self-hosted n8n workflows.

Who this is actually for

• Agencies and freelancers on maintenance retainers — the repeat-work case is the strong one. Thirty sites, the same checks, one conversation, a branded report at the end. Budget for Claude Pro or Max.
• Anyone running a handful of sites — genuinely useful, and free on the WP Rocket side. One site fits inside a free Claude account.
• Single-site owners who rarely touch performance settings — the setup is now easy enough that there's no real barrier, but the payoff scales with how often you do this work. If you tune your cache twice a year, the dashboard is fine.

If you're still deciding on the underlying stack rather than the tooling around it, our WordPress page builder comparison and our look at why AI crawlers skip badly-built WordPress sites cover the layer beneath this one.

▶ Get WP Rocket

Bottom line

OAuth turns WP Rocket MCP from a developer-flavoured setup into something a non-technical site owner can complete in a couple of minutes — and along the way removes a plaintext credential from your hard drive, which is the quieter and better half of the story. Two things to do with it: if you connected before today, revoke the old application password, and check your Claude plan before promising a client you'll manage their whole portfolio this way — free accounts get one connector, and one connector is one site.

Sources

• WP Rocket — Connect WP Rocket MCP to Claude with OAuth wp-rocket.me
• WP Rocket — WordPress Performance & AI (MCP overview) wp-rocket.me
• WP Rocket 3.23 release announcement wp-rocket.me
• Claude Help Center — Get started with custom connectors using remote MCP support.claude.com