# WordPress integration: Pilotiko reads your existing site

> Pilotiko reads the pages, posts and Yoast tags of your WordPress site through its public REST API, with no password, to start your new site from real content.

Updated on October 15, 2026 · https://app.pilotiko.com/en/integrations/wordpress

Pilotiko reads the published pages, posts, categories, Yoast SEO tags and public WooCommerce products of your WordPress site through the public REST API. No password is asked for and nothing is written. Status: Being commissioned: the connector is written and tested against a test server; it has not yet been verified with a real account, nor a real site.

## In short
- Reads your site's public /wp-json address: no credentials requested.
- Up to 500 pages and 500 posts are read; anything beyond that is flagged.
- Yoast titles, descriptions and canonical URLs are carried over as they are.
- Nothing is ever written to WordPress.

## What does the WordPress connection do?

It reads the public content of your WordPress site so that Pilotiko builds your new site from your actual pages rather than from guesswork.

Every WordPress site exposes a programming interface, the REST API, under /wp-json [1]. The /wp/v2/pages route lists pages, and the default status filter for that list is publish [2]. Pilotiko relies on those public routes only. You don't hand over a username, a password or a plugin licence.

The data feeds the "Read and analyse the current site" step of the move to Pilotiko. The exact URLs of your WordPress pages become the starting list for the site analysis, which covers up to 40 pages. That beats crawling menu links: a published page that nothing links to still shows up.

The connector is read-only. Creating or editing content in WordPress would need site-level authentication such as an application password, available since WordPress 5.6 [3]. Pilotiko does not ask for one and cannot use one today.

- **Read**: published pages and posts (title, excerpt, body, URL, last-modified date, parent page) and categories.
- **Read when Yoast is installed**: SEO title, meta description, canonical URL and the robots index setting.
- **Read when WooCommerce publishes them**: product name, short description, price, currency and stock status.
- **Never read**: drafts, private content, menus, user accounts or orders.
- **Never written**: anything. Reading needs no approval; publishing the new site waits for a person's sign-off.

## How do you connect WordPress to Pilotiko?

There is no Connect button as such. Pilotiko recognizes WordPress from your web address.

1. **Enter your site address** — During onboarding or in the transition flow, type your domain, for example yourbusiness.ca.
2. **Let Pilotiko detect WordPress** — Pilotiko queries /wp-json/. When the answer confirms WordPress, it also notes whether WooCommerce is present.
3. **Check that the REST API is open** — Some security plugins close /wp-json to the public. Pilotiko tells you, and the analysis falls back to following links.
4. **Review the summary** — You see how many pages, posts and products were read, plus any limits hit (private content, more than 500 items).
5. **Approve what comes next** — The new site generated from this reading goes through the "Preview and approval by a person" step before anything goes live.

## What is available, being commissioned or coming soon?

| Feature | Status | Detail |
|---|---|---|
| Detecting WordPress and WooCommerce | Being commissioned | Tested against a faithful fake WordPress site, never a live one |
| Reading published pages, posts and categories | Being commissioned | At most 5 batches of 100 items per type |
| Carrying over Yoast tags | Being commissioned | Only when Yoast exposes them in the API |
| Reading public WooCommerce products | Being commissioned | Price and stock, if the store makes them public |
| Writing to WordPress | Coming soon | Would need an application password; not built |
| Reading drafts and private content | Coming soon | Would need authentication; not built |

## What does a WordPress read look like in numbers?

**Example: a Calgary accounting firm with a 9-year-old WordPress site**

The site has 54 published pages, 140 blog posts, 6 categories and Yoast. Three service pages are not linked from any menu.

- Published pages read : 54 (1 batch of 100)
- Posts read : 140 (2 batches of 100)
- Unlinked pages found through the API : 3
- URLs passed to the analysis : 40 at most
- Yoast tags carried over : 54 SEO titles, 46 meta descriptions
- Pages missing a meta description : 8
- **= The new site starts from 54 known pages instead of only what the menu shows, and 8 missing descriptions are flagged for you.**

## What happens to your data, and how do you stop the reading?

The reading only touches what your site already shows the public, but that can include personal information, such as staff names on a team page. Quebec's private-sector privacy act makes the business responsible for the personal information it holds and assigns that role to the person with the highest authority (s. 3.1) [4]. It also lets people obtain a copy of the information held about them (s. 27) [4].

The Act requires a privacy impact assessment before personal information is communicated outside Quebec (s. 17) [4]. Our [privacy page](/en/privacy) and [subprocessor list](/en/subprocessors) explain where your data is processed.

To stop: remove the site from the transition flow in Pilotiko. On the WordPress side there is nothing to revoke, because no access was ever granted. If you want to close public reading entirely, a security plugin can restrict /wp-json, at the cost of other tools that rely on it.

## What are the limits of the WordPress reader?

The domain itself goes through another integration: [Cloudflare](https://app.pilotiko.com/en/integrations/cloudflare) or [GoDaddy](https://app.pilotiko.com/en/integrations/godaddy), depending on where your DNS lives. Past bookings come over through [Acuity Scheduling](https://app.pilotiko.com/en/integrations/acuity-scheduling). The full list is on the [integrations page](https://app.pilotiko.com/en/integrations).

- Content rendered by JavaScript after page load (some page builders) is not imported.
- Menus are not readable without authentication, so navigation is rebuilt from the pages themselves.
- Reading stops at 500 pages or 500 posts per type, and the summary says so.
- A WooCommerce store that keeps products out of its public Store API is not read; Pilotiko flags it.
- Other platforms (Wix, Squarespace, Shopify) are recognized but have no equivalent reader.

## Frequently asked questions

### Do I have to give Pilotiko my WordPress password?

No. Pilotiko only reads your site's public REST API. No credentials are requested or stored.

### Can Pilotiko publish to my WordPress site?

Not today. Writing would need an application password and has not been built. Instead, Pilotiko builds a new site that it hosts itself, once you approve it.

### What if my security plugin blocks /wp-json?

Pilotiko detects it and tells you. The analysis carries on by following links, but it can miss pages that nothing links to.

### Are my Yoast settings kept?

Pilotiko reads the SEO title, meta description, canonical URL and robots setting that Yoast exposes in the API. They are a starting point, and you approve the result before it goes live.

### Why isn't the status "available"?

The connector was tested against a fake WordPress server that mimics the API. It has not yet read a real production site, so the status stays at being commissioned until that first real run.

### Will my WooCommerce products be imported?

If the store exposes them publicly, Pilotiko reads name, short description, price, currency and stock. If not, the summary says so, and a CSV export is another route.

## Sources

1. WordPress Developer Resources, « REST API Handbook », https://developer.wordpress.org/rest-api/ (accessed on 2026-10-15)
2. WordPress Developer Resources, « REST API Reference: Pages », https://developer.wordpress.org/rest-api/reference/pages/ (accessed on 2026-10-15)
3. WordPress Developer Resources, « REST API Handbook: Authentication », https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/ (accessed on 2026-10-15)
4. LégisQuébec, « Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1) », https://www.legisquebec.gouv.qc.ca/en/document/cs/P-39.1 (accessed on 2026-10-15)