To automate blog posts in WordPress, have a tool create each post with the pending status from an account that cannot publish. Then a human approves it and schedules it, which moves it to future. This is how to automate blog posts without losing control. Software does the research, drafting and sending. WordPress makes sure nothing goes live until someone has read it.
This guide covers the exact setup: which statuses to use, which role to give the automation account, how the REST API call looks, and the one permission that trips most people up. If you would rather have the topics and drafts handled for you, start with a free keyword plan and your first article.
The four WordPress statuses that make automation safe
WordPress already has an approval workflow. Its post status documentation lists these statuses, and four of them matter here:
| Status | What WordPress says it means | Role in your automation |
|---|---|---|
| draft | Incomplete post viewable by anyone with the proper user role | Optional working state |
| pending | Awaiting a user with the publish_posts capability, typically an Editor, to publish |
Where every automated post lands |
| future | Scheduled to be published at a future date | Set by the human who approves |
| publish | Viewable by everyone | Only reached after review |
The whole method rests on one rule: the automation can create pending posts and nothing else. Every post then waits in Posts > Pending until someone opens it.
Which role to give your automation account
This is where many setups go wrong. The WordPress Roles and Capabilities page describes the roles like this:
- Author: "somebody who can publish and manage their own posts."
- Contributor: "somebody who can write and manage their own posts but cannot publish them."
So the Author role is not a safety net. An Author has publish_posts, so a plugin or script logged in as an Author can put a post live directly. Only the Contributor role lacks that capability. The post status page explains the result: users with edit_posts but not publish_posts see a "Submit for Review" button instead of "Publish", and their post gets the pending status.
Create a dedicated user for your automation, for example "blog-bot", and give it the Contributor role. Your real Editor or Administrator keeps the final say.
The permission nobody mentions: images
The same capability table shows that a Contributor does not have upload_files. In practice, your automation account can create the text of a post but cannot upload a featured image or inline images to the Media Library.
You have three options:
- The Editor adds images during review. This is the simplest choice, since the review happens anyway.
- Your tool sends image URLs that are already hosted elsewhere.
- You give the automation role the
upload_filescapability withadd_cap(), as the roles documentation describes. Do not addpublish_posts, or the review step disappears.
How to automate WordPress blog posts with the REST API
Most automation tools, Zapier and Make included, talk to WordPress through its REST API. You can also call it yourself.
Step 1: Create an application password
According to the REST API authentication docs, WordPress has shipped with Application Passwords since version 5.6. Go to Users > Edit User for your Contributor account and generate one. Your tool uses it with Basic Auth over HTTPS. You never share your main login.
Step 2: Send each post as pending
The posts endpoint accepts a status field with these values: publish, future, draft, pending or private. A minimal request looks like this:
POST https://yoursite.com/wp-json/wp/v2/posts
Authorization: Basic (username and application password)
{
"title": "How to make soy candles smell stronger",
"content": "<p>...</p>",
"status": "pending",
"categories": [12]
}
Because the account is a Contributor, a request with "publish" or "future" will not go live. Publishing requires publish_posts, and this account does not have it.
Step 3: Approve and schedule
The Editor opens Posts, filters by Pending, reads the post, runs the checklist below and sets a publish date. The post moves to future, and WordPress publishes it on that date.
Once your WordPress pipeline is set up, the hard part is feeding it good topics and drafts. Get your free keyword plan and a first article to see what that looks like on your own site.
Why scheduled posts sometimes miss their time
Scheduled posts rely on WP-Cron. The WordPress cron handbook states that WP-Cron "is only triggered on page load". It gives this example: a task scheduled for 2:00 PM with no visits until 5:00 PM runs late.
On a new or quiet blog, this is why a post can show "Missed schedule". If your host gives you a real system scheduler, use it to trigger WordPress cron at regular intervals. Otherwise, check the Scheduled list after each planned publish time.
A review checklist for every pending post
The pending queue only helps if the person who opens it knows what to check. Use this list before you schedule a post:
- The first two sentences answer the search the post targets.
- No other page on your site already targets this search.
- Every number, rule or quote links to its source.
- No invented customers, reviews, results or prices.
- At least one detail only your business knows: a product spec, a process, a real customer question.
- Every link opens, and internal links point to live pages.
- Category, slug and featured image are set.
- The title starts with the search phrase and the excerpt says what the reader gets.
This step matters for Google too. Its guidance on AI content says it is "critical to manually factcheck and review all AI-generated content for accuracy and trustworthiness before publishing". Its spam policies target pages produced at scale mainly to manipulate rankings. A pending queue with a real reviewer is the simplest way to stay clear of both.
What to automate around WordPress
The statuses only control publishing. The steps before and after them can be automated too:
- Topics: start from what people actually search. Search Console shows queries where you already appear without ranking well, and the free keyword generator gives you a starting list.
- Briefs and drafts: an AI tool researches the top results and writes from sourced facts, one post per search intent.
- After publishing: resubmit your sitemap in the Search Console Sitemaps report so Google finds new posts.
For a full view of an automated blog from topic to sitemap, see how blog SEO on autopilot works.
How AI SEO Crew fits this workflow
AI SEO Crew runs the steps before and after your review with five AI agents. Scout reads your site and finds real Google searches, and Strategist picks the ones that bring customers. Writer researches the web and writes with sources. Editor checks every fact and link and adds internal links. Publisher posts to WordPress, resubmits your sitemap in Search Console and notifies IndexNow.
In review mode, you approve each article before it goes live. In autopilot mode, it publishes as soon as the Editor validates it. The price is $49 per site per month for 50 articles, as shown on the pricing page.
Frequently asked questions
Can a WordPress Contributor publish posts?
No. A Contributor can write and manage their own posts but cannot publish them, according to the WordPress roles documentation. They see "Submit for Review", and their post gets the pending status.
Can an Author role be used as a review step?
No. An Author has the publish_posts capability and can publish their own posts directly. If your automation logs in as an Author, nothing stops a post from going live without review.
How do I schedule posts through the WordPress REST API?
The posts endpoint accepts a future status along with a date field. Only a user with publish_posts can set it. In a review workflow, the Editor schedules the post after approving it.
Why did my scheduled WordPress post not publish?
WordPress runs scheduled tasks through WP-Cron, which only fires when someone loads a page. On a site with little traffic, a post can publish late or show "Missed schedule". A real server cron fixes this.