Production-grade WordPress REST API integration for managing posts, pages, media, WooCommerce products, Elementor content, SEO meta, ACF, and JetEngine fields. Use when you need to retrieve, draft, create, or update WordPress content programmatically on sites where the user has provided explicit credentials. For any operation that writes to a live site, get explicit user approval for the target site, post/product IDs, and final action before executing. Prefer drafts first. Run batch operations in dry-run mode first; use --execute only after review. Remote URL media downloads and local file reads are restricted by safety boundaries. Also includes a no-auth Tier-1 site audit (PageSpeed, SSL, security headers, CMS/PHP fingerprint, SEO basics) for cold pre-sale checks, and authenticated plugin/SEO-stack discovery.
**Security update: Restricts http:// access to named hosts only; dependency instructions clarified for better patching.** - HTTP API access to non-local hosts now requires explicit host naming in WP_ALLOW_HTTP; blanket WP_ALLOW_HTTP=1 is no longer accepted. - Permission fields and setup docs updated to reflect this variable change, preventing accidental plaintext credential exposure. - Dependency instructions now prescribe a secure version range for requests, explaining the reasoning for patch flexibility vs. reproducibility. - Removed legacy skill-card.md file.