When ChatGPT or Claude can’t connect to your WordPress site, the cause is usually something between the AI app and the plugin, not the plugin itself. The usual three are a host that strips the Authorization header, a CDN or firewall that blocks the /mcp path, and a certificate the client will not accept. The fastest first move is the check that runs from your own server: open the Agent Abilities for MCP Connection tab and click Check my connection, the Connection Doctor added in 1.8.0.
The Doctor covers the first cause and several smaller ones. The other two need a look outside WordPress, and this guide walks through each.
Why can’t ChatGPT or Claude connect to my WordPress site?
Open the Connection tab and click Check my connection. It tests from your own server and names the fix. If everything passes and the agent still does nothing, the likely causes are a CDN or firewall blocking /mcp, or, on a local site, a self-signed certificate.
Which symptom do you have?
Match what you see to the likely cause before changing anything.
| What you see | Likely cause | Where to look |
|---|---|---|
| An error while adding the connector, or a discovery failure | /.well-known/ blocked at the server, dynamic client registration off, or plain HTTP |
Connection Doctor, then troubleshooting |
| Sign-in or authentication fails, even with correct credentials | The server removes the Authorization header before PHP sees it | Connection Doctor |
| Sign-in completes, then no ability calls ever appear | A CDN or firewall blocks the request at the edge | Activity Log and your CDN’s event log |
| A local site never connects | A self-signed certificate, or a site the AI vendor cannot reach | Step 3 below |
| Claude connects, then says content does not match the tool’s output schema | A bridged tool from an older plugin version, such as WooCommerce orders | The fix |
Step 1: run the Connection Doctor
Open the Connection tab, click Check my connection, and wait a few seconds. You need to be an administrator. The checks run from your site’s own server, and the card says nothing is sent to anyone else.
Each result is a Pass, a Warning, a Fail or “Could not test”, and each failing row says who can fix it: you, your host, or a security plugin that may be the cause.
| Check | What it tells you |
|---|---|
| The MCP endpoint answers | Whether the endpoint responds, and what a 403, 404, 406, 429 or server error means if it does not |
| Authorization header test request | Whether PHP receives the Authorization header, which Application Passwords and OAuth tokens both need |
| Application Passwords | Whether something switched them off, and which plugin or filter did it |
| HTTPS | Whether the site address is HTTPS, which hosted apps such as ChatGPT and Claude.ai need |
| Permalinks | Whether Plain permalinks put ?rest_route= in the endpoint address |
| Security plugins | Whether Wordfence, Solid Security or a similar plugin that can restrict the REST API is active |
| OAuth discovery | Whether the two /.well-known/ documents come back from WordPress (only when OAuth is on) |
One fix it can name is the Authorization header. Some hosts remove it before PHP runs, and then neither Application Passwords nor OAuth tokens can work. The Doctor shows the lines for your web server and never applies them. On Apache they look like this:
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1On Nginx with FastCGI, the line goes inside the location block that passes PHP on:
fastcgi_param HTTP_AUTHORIZATION $http_authorization;If the Doctor will not run a check, it says “Could not test”. That is common behind some firewalls, and it does not mean agents cannot connect. A Copy report for support button gives you plain text with versions, your site host and the active plugin names, plus each check’s result. It holds no keys, passwords, cookies or user names.
What the Doctor cannot see
Because every check is a request your site makes to itself, it cannot reproduce how a CDN treats traffic from an AI vendor’s servers. A rule aimed at AI user agents is unlikely to trigger on your own server’s request, so a clean run does not rule a CDN out. That is an inference from how the checks work, not something we have tested against each CDN. A block that also hits your server’s own request does show up, as a 403, 406 or 429 row. A clean Doctor run followed by silence from the agent is the cue to move on to step 2.
Step 2: a CDN or firewall blocking the /mcp path
The pattern is a sign-in that completes and then no ability calls at all. Your browser does the sign-in and looks like an ordinary visitor. The MCP request that follows comes from the AI client’s servers with an AI user agent, and a bot filter can stop it before WordPress sees it. The full diagnosis, including how to read the Activity Log, is in your agent signs in, then nothing happens.
The case we have seen confirmed is Cloudflare’s bot settings. Cloudflare’s own page for Block AI Bots marks that setting as deprecated from September 15, 2026, and points to a Configure AI bot policies option in Security Settings, with separate Search, Agent and Training presets. That date has passed, so your dashboard may show either name. The principle is the same: look for an AI bot setting that covers your /mcp path.
There are two ways out:
- Exempt only the endpoint, where your plan allows it. Cloudflare’s Skip action can skip Super Bot Fight Mode rules, and its page says Bot Fight Mode, the Free plan feature, cannot be skipped. The Cloudflare pages we checked do not say whether Skip also covers the AI bot policies, so add the rule, then retry the connection to confirm it worked. If it still fails, change the setting itself.
- Change the setting. Turn off the AI bot blocking, or set the relevant policy to Allow. It works, and it applies to the whole site.
Exempting /mcp is not a hole in your governance. The endpoint sits behind OAuth or an Application Password, acts as one scoped WordPress user, and re-checks every call against that user’s capabilities before this plugin’s tools run. Each call to this plugin’s tools is logged.
On WP Engine, look at Global Edge Security first. In the User Portal, open the environment’s Insights menu, go to Traffic and Security, then the Settings tab, and check Edge traffic rules. According to WP Engine’s support page, a rule for a bot category blocks traffic from bots in that category at the Cloudflare level, so remove the one that covers your AI client. If the agent’s calls fail with HTTP 429 on WP Engine, the plugin’s FAQ says the platform rate-limits some AI bots and you cannot turn that off yourself, so ask WP Engine support to review the limit for your site.
Step 3: a local site with a self-signed certificate
Two different things get mixed up here, so separate them first. ChatGPT, Claude.ai and Claude Desktop connect from the vendor’s side, so your site has to answer on the public internet. According to the plugin’s client docs, a site on localhost or behind a VPN will not connect that way, and Claude Desktop is no exception despite running on your own computer.
The certificate problem hits local clients that reach your site through the mcp-remote bridge. Local stacks such as DDEV, Local and Valet serve a self-signed certificate that Node rejects, so the bridge never reaches WordPress. For local testing only, add this to the env block of the client config:
"env": { "NODE_TLS_REJECT_UNAUTHORIZED": "0" }The Connection tab adds it for you when it detects a local site. Never ship it to production: it turns off certificate checking, and a public site has a trusted certificate and does not need it.
When the failure is not your site
Sometimes everything on your side checks out. In a May 2026 OpenAI Developer Community thread, a user tunnelling a local MCP server through ngrok got “Error creating connector” even though curl tests passed both locally and through the tunnel. OpenAI Support said the server and tunnel looked fine and asked for a support case so it could investigate why connector creation was failing on the platform side. That is one thread, not a diagnosis, but it is a reason to stop debugging your server once the Doctor and the edge log are clean.
Also confirm the client side. ChatGPT custom connectors need Developer Mode and are a beta feature on paid plans, and the setup steps are on the ChatGPT and Claude.ai client pages.
Questions people ask
Does the Connection Doctor send anything outside my site? No. The checks run from your own server, and the card says nothing is sent to anyone else.
Who can run it?
An administrator, meaning a user with the manage_options capability.
Do I need 1.8.0? Yes. The Connection Doctor is new in 1.8.0. The other two causes in this guide apply on any version.
Which method should I use, OAuth or an Application Password? Hosted apps such as ChatGPT and Claude.ai connect over OAuth. The trade-offs are in OAuth or Application Password.