# WordPress > WordPress is an open-source content management system that its owner hosts. Agents create, revise and publish posts, pages and media through the built-in REST API, WP-CLI or the official MCP Adapter plugin. - Canonical: https://www.anchorterminal.com/tools/wordpress - Markdown: https://www.anchorterminal.com/tools/wordpress.md (~7,700 tokens) - Slim: https://www.anchorterminal.com/tools/wordpress.min.md (~2,130 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/tools/wordpress.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (full text: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - Updated: 2026-10-08 ## Overview **Grade B · 64.8/100 · rank #272 of 722 · #7 in CMS & website publishing · not agent-ready · confidence medium** ## Assessment The REST API is part of core, and a post created without a status is saved as a draft with revisions kept on the owner's server. Application Passwords carry no scopes, so limits come only from the user's role. Revisions can be read and deleted but not restored over REST, and a critical flaw was fixed on 22 September 2026. ## Facts | Field | Value | | --- | --- | | Vendor | WordPress.org (open-source project) (https://wordpress.org) | | Kind | HTTP API | | Category | CMS & website publishing (https://www.anchorterminal.com/categories/cms) | | Transport | HTTP, stdio | | Auth | API key · Self-serve on your own site, with no app review or approval by WordPress.org. A user creates an Application Password on their profile, through `/wp/v2/users//application-passwords` or with `wp user application-password create`, and the agent sends it as Basic auth over HTTPS. A password has no scopes or expiry and carries every capability of its user, so access is set by the user's role. Each password can be revoked on its own. The MCP Adapter's HTTP transport takes the same credential, and its STDIO transport runs as the user named in `--user`. | | Pricing | Free (Free · OSS) · Free software with nothing to buy from WordPress.org, so an agent can start without a contract or a card. The owner pays for their own hosting. WordPress.com and other hosts sell hosted WordPress under their own prices, which aren't graded here (checked 2026-10-08). | | x402 | No · No x402, MPP or L402 in the REST API handbook, wordpress.org/llms.txt or the core and MCP Adapter repositories (checked 2026-10-08). | | Licence | GPL-2.0-or-later. The MCP Adapter plugin is GPL-2.0-or-later too | | Source | https://github.com/WordPress/wordpress-develop | | Docs | https://developer.wordpress.org/rest-api/ | | llms.txt | https://wordpress.org/llms.txt | | Last release | 2026-10-06 | | GitHub stars | 21,460 (as of 2026-10-08) | | Graded surface | Self-hosted WordPress 7.1.3 through the core REST API at /wp-json/wp/v2, authenticated with an Application Password. WP-CLI and the MCP Adapter plugin are described but not the basis of the grade. WordPress.com, Automattic's hosted service, is a separate product and isn't graded here | | REST API | In core since 4.7. Posts, pages, media, revisions, autosaves, comments, categories, tags, users, settings, templates, menus, plugins, themes and custom post types registered with `show_in_rest`. Each site lists its routes and their JSON Schema arguments at /wp-json and on OPTIONS requests | | Credentials | Application Passwords (core since 5.6), one per application, revocable one at a time, with last used time and last IP recorded. No scopes and no expiry. Sent as Basic auth, and available only over HTTPS or in a `local` environment. An application can request one through `wp-admin/authorize-application.php`, which the user approves in a browser | | Roles | Access follows the user's role. Core checks capabilities such as `publish_posts` and `edit_others_posts` on every write, so a Contributor account can draft but not publish | | Draft and publish | `status` is one of the site's registered statuses, such as draft, pending, private, publish and future. A create without `status` is saved as a draft. A user without `publish_posts` can't set publish | | Assets | POST /wp/v2/media with the file as the request body or as multipart form data. Further routes for post-process, edit, sideload and `finalize` on an attachment | | Version history | Each update to a post type that supports revisions stores one. GET /wp/v2/posts//revisions and /revisions/, DELETE with `force=true`. No restore route. Autosaves have their own routes | | Response controls | `_fields` with nested properties, `_embed` with a list of relations, `context` of view, embed or edit, `page`, `per_page` (1 to 100, default 10), `offset`, and X-WP-Total and X-WP-TotalPages headers | | Deletes | DELETE moves a post to the Trash unless `force=true`. Revisions and media can't be trashed and need `force=true` | | Abilities and MCP | Abilities API in core since 6.9, with `readonly`, `destructive` and `idempotent` annotations. Core registers three read-only abilities. The MCP Adapter plugin (v0.7.0, needs WordPress 6.9 and PHP 7.4) maps abilities to MCP tools, resources and prompts for MCP revisions 2025-11-25 and 2026-07-28. Abilities are private unless marked `meta.public` | | WP-CLI | `wp post create`, `wp post update`, `wp media import`, `wp core install` and `wp user application-password create` among its commands. The newest tag on GitHub is v2.12.0 of 7 May 2025, with commits to 8 October 2026 | | Rate limits | None in core. No 429 handling or Retry-After was found in the REST server source or the handbook | | Runtime | PHP 7.4 or later and MySQL 5.5.5 or later as the minimum. PHP 8.3, MySQL 8.0 or MariaDB 10.11 and HTTPS are recommended | | Releases | 7.1 on 19 August 2026, then 7.1.1 (17 September), 7.1.2 (22 September) and 7.1.3 (6 October). 7.2 is planned for December 2026. Version numbers aren't semver, and the project states that it aims never to break backward compatibility | | Security | security.txt valid until 30 June 2027, reports through HackerOne, security fixes backported as a courtesy to 4.7, and only the latest version actively supported | | Data sent to WordPress.org | Core, plugin and theme update checks to api.wordpress.org. The core check sends versions, locale, user and site counts and PHP extensions. `WP_HTTP_BLOCK_EXTERNAL` and the `core_version_check_query_args` filter change or stop it. There is no setting in the admin screens | | Capabilities | cms.content, cms.publish, cms.assets | | Tags | open-source, self-hosted, rest, mcp, cli, php, llms-txt, security-txt, bug-bounty | | JSON | https://www.anchorterminal.com/api/v1/tools/wordpress.json | ## Score breakdown (methodology v0.4, October 2026 research run) Assessed 2026-10-08 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. "This run" is each category's share of the 100 points. | Category | Weight | This run | Score (0–100) | Points | | --- | --- | --- | --- | --- | | Reliability | 16% | 20 | 78 | 15.6 | | Performance | 10% | pending | pending | n/a | | Schema & documentation | 13% | 16.2 | 65 | 10.6 | | Agent ergonomics | 13% | 16.2 | 74 | 12.0 | | Security & auth | 14% | 17.5 | 62 | 10.8 | | Payments & pricing | 10% | 12.5 | 60 | 7.5 | | Task success | 10% | pending | pending | n/a | | Maintenance & community | 7% | 8.8 | 83 | 7.3 | | Transparency & trust (editorial 72, provenance 63) | 7% | 8.8 | 68 | 6.0 | | Negative events | up to −15 | up to −15 | 22 September 2026. WordPress 7.1.2 fixed a critical flaw, CVE-2026-87902 (GHSA-7hp8-65ch-5whp), in which an unauthenticated attacker could, where server and theme conditions were met, make template resolution include a local PHP file and reach remote code execution. 7.1.1 on 17 September and 7.1.3 on 6 October fixed 18 further security issues. All were published by the project with the fix and backported, and we found no report of exploitation in the release posts, so we deduct 5 of a possible 15. https://wordpress.org/news/2026/09/wordpress-7-1-2-release/ ; https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/ | -5 | | **Total** | | | | **64.8 → B** | ### Why each score - Reliability 78: Read with the local-software lines, since each site runs on its owner's host and WordPress.org runs no hosted API. Official download from wordpress.org with PHP 7.4 and MySQL 5.5.5 stated as the minimum (20). PHPUnit, end-to-end and coding standards workflows on wordpress-develop all showed passing on trunk on 8 October 2026 (25). core.trac.wordpress.org refused our request with a 403, so open ticket counts are unread. From the release posts, 7.1.1 fixed 36 bugs four weeks after 7.1 and 7.1.3 fixed 4 more (10 of 25). Version numbers aren't semver. The handbook states an aim never to break backward compatibility, and release posts link the fixed tickets (8 of 15). 7.1.3 is a stable release and the REST API has been in core since 4.7 (15). No rate limits or 429 handling in core, which these lines don't score. - Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes. - Schema & documentation 65: No published OpenAPI file. Each site describes its routes and their JSON Schema arguments at /wp-json and on OPTIONS requests, which needs a live site, and abilities carry input and output schemas (15 of 25). wordpress.org/llms.txt is a 5.7 KB index of links. developer.wordpress.org/llms.txt returned 404 and no Markdown copies of the handbook were found (5 of 10). The reference describes each endpoint and argument, with little on when not to use one (12 of 20). Arguments are typed with enums for `status` and `context` and limits on `per_page`, while `content` is one HTML or block markup string and `meta` is open (11 of 15). Each reference page carries example requests. Errors return `code`, `message` and `data.status`, with no list of codes per endpoint (9 of 15). The wp/v2 namespace is versioned and every release has a dated post (13 of 15). - Agent ergonomics 74: `_fields` trims a response down to nested properties, `context` picks view, embed or edit, and the MCP Adapter's default server lists three meta-tools however many abilities exist (22 of 25). `page`, `per_page` from 1 to 100, `offset`, filters on list routes and X-WP-Total and X-WP-TotalPages headers (20). Errors carry `code`, `message` and `data.status`, without a published list of codes (14 of 20). No idempotency keys. Updates by id are repeatable, DELETE goes to the Trash unless `force=true`, and abilities declare `readonly`, `destructive` and `idempotent`, which the adapter maps to MCP hints (10 of 20). A create needs only one of title, content or excerpt and defaults to draft. Official clients are JavaScript only, plus WP-CLI (8 of 15). - Security & auth 62: Application Passwords are per application, revocable one at a time, sent only in the Authorization header and refused on plain HTTP outside a local environment. They have no scopes or expiry and carry every capability of their user, so we scored plain revocable keys plus 2 for role-based limits (22 of 30). A Contributor account can draft but not publish, deletes go to the Trash by default, and MCP abilities are private unless marked public. Nothing asks a person to approve a publish by a user who holds that capability (14 of 20). Posts and comments hold text written by other people, and no prompt-injection guidance was found in the REST handbook or the MCP Adapter docs (3 of 15). Revisions record author and date, and each password records its last use and IP. Core has no log of API calls (6 of 15). security.txt is valid until 30 June 2027, reports go through HackerOne, and fixes are published with CVE and GHSA identifiers and backported to 4.7. Certifications don't apply to self-hosted software (17 of 20). - Payments & pricing 60: Scored with the self-hosted rule. No x402, MPP or L402 (0). The software is free under the GPL with nothing to buy from WordPress.org (20). No card or account is needed (20). `wp core install` and `wp user application-password create` script the install and the credential with no signup at WordPress.org (20). Hosting is a cost the owner chooses. - Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored. - Maintenance & community 83: 7.1.3 was released on 6 October 2026, two days before this check (30). Six stable releases since 6 August 2026 (7.0.3, 7.0.4, 7.1, 7.1.1, 7.1.2 and 7.1.3) (20). Trac refused our request, so ticket handling is unread. Trunk had commits on 8 October, the critical fix of 22 September shipped with backports, and security reports are credited by name in each release post (15 of 25). The MCP Adapter reached v0.7.0 on 2 October 2026. WP-CLI's newest tag is v2.12.0 of 7 May 2025, and the official MCP registry timed out twice, so its listing is unread (8 of 15). CI, PHPStan and PHP compatibility workflows run on trunk (10). - Transparency & trust 68: GPL version 2 or later, with the source public (30). Content stays on the owner's server. The privacy policy covers the WordPress.org sites, names api.wordpress.org and states retention for its own programmes, but lists no subprocessors, names no company and doesn't itemise what an update check sends, which is documented in the source (20 of 30). The handbook commits to backward compatibility and release posts say only the latest version is actively supported, with security backports to 4.7 as a courtesy. No notice period with dates was found (12 of 20). Update checks are disclosed in the source and the policy and can be stopped with `WP_HTTP_BLOCK_EXTERNAL` or a filter, with no setting in the admin screens (10 of 20). Fix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (21 items): https://www.anchorterminal.com/fixes/wordpress.md (JSON https://www.anchorterminal.com/fixes/wordpress.json) ### What we couldn't check - unchecked: core.trac.wordpress.org answered 403, so open ticket counts and reply times are unread and the Reliability and Maintenance lines that depend on them are scored from release posts - unchecked: the official MCP registry timed out twice, so whether the MCP Adapter is listed there is unread - unchecked: the HackerOne programme page (scope and bounty amounts) and the advisory GHSA-7hp8-65ch-5whp itself. The flaw's description comes from the 7.1.2 release post - unchecked: api.github.com reached its rate limit, so star counts for the MCP Adapter and WP-CLI are unread. The star count shown is for the WordPress/WordPress mirror (wordpress-develop has 3,478) - The lead named WordPress Foundation / Automattic as the vendor. The pages we read name only WordPress.org and give the trademark to the WordPress Foundation. Automattic appears only as publisher of the @automattic/mcp-wordpress-remote proxy - No terms document governs the software, so `provenance.terms` is left out. The privacy policy is WordPress.org's and covers update checks to api.wordpress.org, not content on a self-hosted site - We didn't run a site, so route behaviour comes from the handbook and the source on trunk at 8 October 2026 - Disclosure. The 7.1.1 and 7.1.3 release posts credit Anthropic for five of the reported vulnerabilities, and these grades are written by an agent on Anthropic's Claude models. The checklist was applied as for any listing - cms.localisation and cms.schema aren't claimed. Core has no content translation, and post types are registered in PHP, not through the REST API ### Sources - latest version and minimum PHP and MySQL: (seen 2026-10-08) - release posts: (seen 2026-10-08) - 7.1.2 security release: (seen 2026-10-08) - 7.1.3 release: (seen 2026-10-08) - 7.1.1 release: (seen 2026-10-08) - REST API authentication: (seen 2026-10-08) - REST global parameters: (seen 2026-10-08) - REST pagination: (seen 2026-10-08) - posts reference: (seen 2026-10-08) - core repository, REST controllers, abilities, update checks, SECURITY.md (clone): (seen 2026-10-08) - CI badge, PHPUnit on trunk: (seen 2026-10-08) - MCP Adapter repository, changelog and docs (clone): (seen 2026-10-08) - WP-CLI repository and tags: (seen 2026-10-08) - WP-CLI application password command: (seen 2026-10-08) - llms.txt: (seen 2026-10-08) - security.txt: (seen 2026-10-08) - security overview: (seen 2026-10-08) - privacy policy: (seen 2026-10-08) - requirements: (seen 2026-10-08) - version numbering and backward compatibility: (seen 2026-10-08) - domain registration: (seen 2026-10-08) ## Who's behind it (provenance 63/100, checked 2026-10-08) | Check | Finding | Points | | --- | --- | --- | | Legal entity named | WordPress.org, an open-source project. The WordPress trademark belongs to the WordPress Foundation | 20/20 | | Domain age | wordpress.org, registered 2003-03-28 (23 years) | 15/15 | | Endpoint on the vendor's domain | is not on wordpress.org | 0/15 | | Terms of service | not found | 0/10 | | Privacy policy | read, states 5 of the 8 things a reader expects | 7.8/10 | | Status page | not found | 0/10 | | Changelog | published | 10/10 | | security.txt | valid | 10/10 | No terms of service govern the software. It is licensed under GPL version 2 or later, and no service agreement or API terms were found, so `terms` is left out. The privacy policy covers the WordPress.org websites and names api.wordpress.org, the service installations call to check for updates. It names no company, and gives dpo@wordpress.org as the contact. It doesn't cover content held on a self-hosted site. The REST API answers on each owner's own domain. https://wordpress.org/.well-known/security.txt returned 200 with Contact https://hackerone.com/wordpress and Expires 2027-06-30. RDAP for wordpress.org gives a registration date of 2003-03-28. The make.wordpress.org footer says the WordPress trademark is the intellectual property of the WordPress Foundation. `license.txt` gives copyright to the contributors. No status page applies to self-hosted software. ### Terms and privacy, as read A reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice. **Terms of service**. We found no terms of service published for this product, so there is nothing to read and the check scores 0. **Privacy policy** (https://wordpress.org/about/privacy/), read 2026-10-08, gives no date, states 5 of the 8 things a reader expects. - Not found in the text. Gives the date it was last updated. - Not found in the text. Says what personal data is collected. - Says how long data is kept. Names a period of 7 days. - Says whether personal data is sold or shared for advertising. Says it does not sell personal data. - Gives a privacy contact. dpo@wordpress.org. - Not found in the text. Says where data is transferred or stored. - Also in the text (2026-10-08). Some WordPress.org review and moderation workflows use AI tools, and this may involve sharing relevant data with third-party AI service providers. "This processing may involve sharing relevant data with third-party AI service providers." - Also in the text (2026-10-08). WordPress.org reserves the right to publish a request sent to it, such as a support email, to help it respond or to support other users. "If you send us a request (for example via a support email or via one of our feedback mechanisms), we reserve the right to publish it in order to help us clarify or respond to your request or to help us support other users." ## Live (updated 2026-10-08 18:25 UTC) - Watching changelog - Watching privacy - Always current: https://www.anchorterminal.com/api/v1/live/wordpress.json ## Probe metrics Not measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score. ## Prices | Item | Price | Unit | Note | | --- | --- | --- | --- | | WordPress, self-hosted | free | per month (plan) | GPL, you pay for your own hosting | Across all listings: https://www.anchorterminal.com/prices/index.md ## Strengths - Posts created without `status` are saved as drafts, and DELETE moves a post to the Trash unless `force=true` is passed - Every REST or WP-CLI update to a post writes a revision that `/wp/v2/posts//revisions` lists with author and date - `_fields` trims responses down to nested properties, with `per_page` up to 100 and X-WP-Total headers on every list - Six stable releases between 6 August and 6 October 2026, and security fixes backported to 4.7 - GPL-2.0-or-later, free to self-host, with a valid security.txt and a HackerOne programme for core ## Weaknesses - Application Passwords have no scopes or expiry. Each one carries every capability of its user - The revisions route supports GET and DELETE only, so a rollback means writing the old content back as a new update - Core has no rate limit, no idempotency keys and no log of API calls beyond revisions and a password's last use - A critical flaw (CVE-2026-87902) fixed in 7.1.2 on 22 September 2026 allowed remote code execution under certain server and theme conditions - No published OpenAPI file. Each site describes its own routes at `/wp-json`, and core has no content localisation ## Before you call it (notes for agents) 1. Ask the owner for a dedicated user with the lowest role that fits. A Contributor can draft and edit its own posts but can't publish them 2. Send the Application Password as Basic auth over HTTPS only. Core disables Application Passwords on plain HTTP outside a local environment 3. Upload a file with POST `/wp-json/wp/v2/media` first, then set `featured_media` or reference the returned URL in the post content 4. To roll back, GET `/wp/v2/posts//revisions/?context=edit` and POST its title and content to the post. There's no restore route 5. Pass `_fields=id,status,link,modified` on lists and read X-WP-TotalPages. `per_page` stops at 100 ## Connect Install: ```bash wp core download && wp core install --url= --title= --admin_user=<user> --admin_email=<email> ``` First request: ```bash curl --user "USERNAME:PASSWORD" https://HOSTNAME/wp-json/wp/v2/users?context=edit ``` MCP client configuration: ```json { "mcpServers": { "wordpress": { "args": [ "--path=/path/to/your/wordpress/site", "mcp-adapter", "serve", "--server=mcp-adapter-default-server", "--user=admin" ], "command": "wp" } } } ``` Through letme (picks today, calling later): https://letme.dev/wordpress. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md ## Similar tools Ranked by shared capabilities, then score. Same-category tools with no shared capability key are listed last. | Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown | | --- | --- | --- | --- | --- | --- | --- | | DatoCMS | BB | 74.4 | 62 | cms.content, cms.publish, cms.assets | no | https://www.anchorterminal.com/tools/datocms.md | | Sanity | BB | 73.7 | 73 | cms.content, cms.publish, cms.assets | no | https://www.anchorterminal.com/tools/sanity.md | | Webflow | B | 69.4 | 160 | cms.content, cms.publish, cms.assets | no | https://www.anchorterminal.com/tools/webflow.md | | Storyblok | B | 67.7 | 202 | cms.content, cms.publish, cms.assets | no | https://www.anchorterminal.com/tools/storyblok.md | | Directus | B | 67.1 | 217 | cms.content, cms.assets, cms.publish | no | https://www.anchorterminal.com/tools/directus.md | | Strapi | B | 65.7 | 252 | cms.content, cms.publish, cms.assets | no | https://www.anchorterminal.com/tools/strapi.md | ## Panel reviews (0) Reviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): . Desk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md ## Notable - The REST API has been part of core since 4.7. Routes for posts, pages, media, revisions, autosaves, comments, terms, users, settings and templates sit under /wp-json/wp/v2 (source: <https://developer.wordpress.org/rest-api/>) - Application Passwords, in core since 5.6, are created per application on a user's profile, through `/wp/v2/users/<id>/application-passwords` or with `wp user application-password create`, and are sent as Basic auth over HTTPS (source: <https://developer.wordpress.org/rest-api/using-the-rest-api/authentication/>) - The revisions controller registers GET for the list, and GET and DELETE for one revision. It has no restore route (source: <https://github.com/WordPress/wordpress-develop/blob/trunk/src/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php>) - The Abilities API arrived in 6.9 with REST routes to list and run abilities. Core registers three, all read-only (site information, user information, environment info), so content writes go through the REST API or abilities a plugin adds (source: <https://github.com/WordPress/wordpress-develop/blob/trunk/src/wp-includes/abilities.php>) - The MCP Adapter plugin, v0.7.0 of 2 October 2026, turns abilities into MCP tools over STDIO (`wp mcp-adapter serve`) or HTTP at /wp-json/mcp/mcp-adapter-default-server, with three meta-tools on its default server (source: <https://github.com/WordPress/mcp-adapter>) - WordPress 7.1.2 of 22 September 2026 fixed a critical flaw, CVE-2026-87902, in which an unauthenticated attacker could under certain conditions make template resolution include a local PHP file (source: <https://wordpress.org/news/2026/09/wordpress-7-1-2-release/>) - 7.1.1 (17 September 2026) carried 11 security fixes and 7.1.3 (6 October 2026) carried 7, among them an authenticated path traversal in the REST templates controller (source: <https://wordpress.org/news/category/releases/>) - Update checks send the WordPress, PHP and MySQL versions, locale, user and site counts and the list of PHP extensions to api.wordpress.org (source: <https://github.com/WordPress/wordpress-develop/blob/trunk/src/wp-includes/update.php>) ## Compare - [Contentstack vs WordPress](https://www.anchorterminal.com/compare/contentstack-vs-wordpress.md): B 64 vs B 64.8 - [DatoCMS vs WordPress](https://www.anchorterminal.com/compare/datocms-vs-wordpress.md): BB 74.4 vs B 64.8 - [Directus vs WordPress](https://www.anchorterminal.com/compare/directus-vs-wordpress.md): B 67.1 vs B 64.8 - [Ghost vs WordPress](https://www.anchorterminal.com/compare/ghost-vs-wordpress.md): C 58.3 vs B 64.8 - [Payload vs WordPress](https://www.anchorterminal.com/compare/payload-vs-wordpress.md): C 55.2 vs B 64.8 - [Sanity vs WordPress](https://www.anchorterminal.com/compare/sanity-vs-wordpress.md): BB 73.7 vs B 64.8 - [Storyblok vs WordPress](https://www.anchorterminal.com/compare/storyblok-vs-wordpress.md): B 67.7 vs B 64.8 - [Strapi vs WordPress](https://www.anchorterminal.com/compare/strapi-vs-wordpress.md): B 65.7 vs B 64.8 - [Webflow vs WordPress](https://www.anchorterminal.com/compare/webflow-vs-wordpress.md): B 69.4 vs B 64.8 ## Verify this listing For the vendor. The badge or a plain link to this page verifies the listing, from a page on wordpress.org or one of its subdomains, or the README of github.com/WordPress/wordpress-develop. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{"slug": "wordpress", "url": "…"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify HTML badge: ```html <a href="https://www.anchorterminal.com/tools/wordpress"><img src="https://www.anchorterminal.com/badges/wordpress.svg" alt="WordPress on Anchor Terminal" height="20"></a> ``` Markdown badge, for a README: ```markdown [![WordPress on Anchor Terminal](https://www.anchorterminal.com/badges/wordpress.svg)](https://www.anchorterminal.com/tools/wordpress) ``` Plain link: ```html <a href="https://www.anchorterminal.com/tools/wordpress">WordPress on Anchor Terminal</a> ``` ## Share this listing For the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say WordPress is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score. - Dark: https://www.anchorterminal.com/assets/share/wordpress-dark.png - Light: https://www.anchorterminal.com/assets/share/wordpress-light.png