WordPress integration: Pilotiko reads your existing site
Read-only, no credentials, so your new site starts from what you already published.
Pilotiko reads the published pages, posts, categories, Yoast SEO tags and public WooCommerce products of your WordPress site through the public REST API. No password is asked for and nothing is written. Status: Being commissioned: the connector is written and tested against a test server; it has not yet been verified with a real account, nor a real site.
In short
- Reads your site's public /wp-json address: no credentials requested.
- Up to 500 pages and 500 posts are read; anything beyond that is flagged.
- Yoast titles, descriptions and canonical URLs are carried over as they are.
- Nothing is ever written to WordPress.
What does the WordPress connection do?
It reads the public content of your WordPress site so that Pilotiko builds your new site from your actual pages rather than from guesswork.
Every WordPress site exposes a programming interface, the REST API, under /wp-json [1]. The /wp/v2/pages route lists pages, and the default status filter for that list is publish [2]. Pilotiko relies on those public routes only. You don't hand over a username, a password or a plugin licence.
The data feeds the "Read and analyse the current site" step of the move to Pilotiko. The exact URLs of your WordPress pages become the starting list for the site analysis, which covers up to 40 pages. That beats crawling menu links: a published page that nothing links to still shows up.
The connector is read-only. Creating or editing content in WordPress would need site-level authentication such as an application password, available since WordPress 5.6 [3]. Pilotiko does not ask for one and cannot use one today.
- Read: published pages and posts (title, excerpt, body, URL, last-modified date, parent page) and categories.
- Read when Yoast is installed: SEO title, meta description, canonical URL and the robots index setting.
- Read when WooCommerce publishes them: product name, short description, price, currency and stock status.
- Never read: drafts, private content, menus, user accounts or orders.
- Never written: anything. Reading needs no approval; publishing the new site waits for a person's sign-off.
How do you connect WordPress to Pilotiko?
There is no Connect button as such. Pilotiko recognizes WordPress from your web address.
- 1
Enter your site address
During onboarding or in the transition flow, type your domain, for example yourbusiness.ca.
- 2
Let Pilotiko detect WordPress
Pilotiko queries /wp-json/. When the answer confirms WordPress, it also notes whether WooCommerce is present.
- 3
Check that the REST API is open
Some security plugins close /wp-json to the public. Pilotiko tells you, and the analysis falls back to following links.
- 4
Review the summary
You see how many pages, posts and products were read, plus any limits hit (private content, more than 500 items).
- 5
Approve what comes next
The new site generated from this reading goes through the "Preview and approval by a person" step before anything goes live.
What is available, being commissioned or coming soon?
| Feature | Status | Detail |
|---|---|---|
| Detecting WordPress and WooCommerce | Being commissioned | Tested against a faithful fake WordPress site, never a live one |
| Reading published pages, posts and categories | Being commissioned | At most 5 batches of 100 items per type |
| Carrying over Yoast tags | Being commissioned | Only when Yoast exposes them in the API |
| Reading public WooCommerce products | Being commissioned | Price and stock, if the store makes them public |
| Writing to WordPress | Coming soon | Would need an application password; not built |
| Reading drafts and private content | Coming soon | Would need authentication; not built |
What does a WordPress read look like in numbers?
What happens to your data, and how do you stop the reading?
The reading only touches what your site already shows the public, but that can include personal information, such as staff names on a team page. Quebec's private-sector privacy act makes the business responsible for the personal information it holds and assigns that role to the person with the highest authority (s. 3.1) [4]. It also lets people obtain a copy of the information held about them (s. 27) [4].
The Act requires a privacy impact assessment before personal information is communicated outside Quebec (s. 17) [4]. Our privacy page and subprocessor list explain where your data is processed.
To stop: remove the site from the transition flow in Pilotiko. On the WordPress side there is nothing to revoke, because no access was ever granted. If you want to close public reading entirely, a security plugin can restrict /wp-json, at the cost of other tools that rely on it.
What are the limits of the WordPress reader?
The domain itself goes through another integration: Cloudflare or GoDaddy, depending on where your DNS lives. Past bookings come over through Acuity Scheduling. The full list is on the integrations page.
- Content rendered by JavaScript after page load (some page builders) is not imported.
- Menus are not readable without authentication, so navigation is rebuilt from the pages themselves.
- Reading stops at 500 pages or 500 posts per type, and the summary says so.
- A WooCommerce store that keeps products out of its public Store API is not read; Pilotiko flags it.
- Other platforms (Wix, Squarespace, Shopify) are recognized but have no equivalent reader.
Frequently asked questions
Do I have to give Pilotiko my WordPress password?
No. Pilotiko only reads your site's public REST API. No credentials are requested or stored.
Can Pilotiko publish to my WordPress site?
Not today. Writing would need an application password and has not been built. Instead, Pilotiko builds a new site that it hosts itself, once you approve it.
What if my security plugin blocks /wp-json?
Pilotiko detects it and tells you. The analysis carries on by following links, but it can miss pages that nothing links to.
Are my Yoast settings kept?
Pilotiko reads the SEO title, meta description, canonical URL and robots setting that Yoast exposes in the API. They are a starting point, and you approve the result before it goes live.
Why isn't the status "available"?
The connector was tested against a fake WordPress server that mimics the API. It has not yet read a real production site, so the status stays at being commissioned until that first real run.
Will my WooCommerce products be imported?
If the store exposes them publicly, Pilotiko reads name, short description, price, currency and stock. If not, the summary says so, and a CSV export is another route.
Sources
- WordPress Developer Resources, REST API Handbook (accessed on October 15, 2026).
- WordPress Developer Resources, REST API Reference: Pages (accessed on October 15, 2026).
- WordPress Developer Resources, REST API Handbook: Authentication (accessed on October 15, 2026).
- LégisQuébec, Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) (accessed on October 15, 2026).
Read next
Pilotiko integrations
Google Calendar, Outlook, Zoom, Stripe, LinkedIn, Cloudflare, Twilio and more: what each Pilotiko connection does today, with its status read from the code.
Cloudflare integration: your DNS, handled with a scoped token
Connect your Cloudflare zone to Pilotiko with a token limited to one domain's DNS: snapshot first, email safety checks and an exact rollback plan built in.
GoDaddy integration: your domain's DNS, without guesswork
Domain registered at GoDaddy? Pilotiko reads and updates its DNS with an API key and secret, protects your email records and keeps a full rollback plan.