How to Connect Cursor to WordPress Using the Secure MCP Server

Overview

You can connect Cursor to your WordPress site using the Model Context Protocol (MCP), which lets Cursor work with your website. To get started, install and activate a compatible MCP server plugin, register an AI agent, and choose what it can do on your site.

Next, connect the MCP server to Cursor, approve access to your WordPress site, and test the connection. Once connected, Cursor can perform the tasks you allow.

Prerequisites

Before you begin, make sure you have the following in place:

• A self-hosted WordPress site running WordPress 6.9 or above, as the WordPress Abilities API required for this integration is available from WordPress 6.9 onward.
• A publicly accessible HTTPS URL for your WordPress site. AI clients connect to your site over the internet, so localhost or private network URLs are not supported.
• The miniOrange Secure MCP Connector plugin installed and activated on your WordPress site.

Configuration Steps

Step 2: Connect Your WordPress Site to Cursor

• In the previous step, after clicking the Cursor AI Client, a panel opens on the right.
• Click the MCP Server For WordPress on the Cursor Marketplace link. You can also run /add-plugin mcp-server-for-wordpress in Cursor's chat.

• You'll be redirected to the WordPress plugin page on the Cursor Marketplace. Click Add to Cursor, then click Add Plugin.

• Click the View in Cursor button.

• In Cursor, click the installed WordPress plugin.

• Click the Authenticate button.

• Enter Your Site URL and click the Continue button.

• Click the Allow Access button.

Once the connection is complete, you can start interacting with your WordPress site directly from Cursor.

Step 3: AI Agent Activity Logs (Optional)

• Navigate to the Activity tab of the plugin to view ability executions across every agent.

• Click on an activity row to view the event information in detail.

Step 4: AI Agent Debug Log (Optional)

• Navigate to the Debug Log tab of the plugin and click on the Start capture button to begin recording diagnostic events.

• Once capture is on, every prompt sent from your AI Agent is recorded from start to end, including authenticated MCP requests and tool calls.

• Click on a log record to view the event information in detail.

What You Can Do Once Connected

After connecting your WordPress site, you can use natural-language prompts to complete everyday WordPress tasks without switching between different dashboard pages. The available actions depend on the abilities registered through the WordPress Abilities API.

You can:

• View WordPress site and environment information.
• Check your account details.
• Create new posts and pages.
• Update existing posts and pages.
• Use other abilities exposed through the WordPress Abilities API.

Every request passes through the Secure MCP Connector, which validates the request before allowing the action to run on your WordPress site.

How to Troubleshoot Cursor and WordPress Connection Issues

If Cursor cannot connect to WordPress or access its tools, check your MCP configuration, firewall, authentication, cache, and agent permissions. The following steps cover common connection problems and explain how to resolve them.

1. Cursor Cannot Connect to WordPress

Issue: Cursor fails to connect, or you receive a 403 or 429 error even though your website loads normally.

Why it happens: Your hosting firewall, Cloudflare, or ModSecurity may block MCP requests.

How to resolve it: If you use Cloudflare, configure a Web Application Firewall (WAF) rule to skip the relevant security checks for these paths, where applicable:

• /wp-json/mosmcp/*
• /index.php?rest_route=/mosmcp/*
• /.well-known/oauth-*

If your hosting provider manages the firewall, ask them to allow legitimate POST requests to the required endpoints. Also, check whether overseas access restrictions affect your connection.

Tip: Check your firewall logs before changing security rules. Allow only the required endpoints instead of disabling security protections across your website.

2. Cursor Reports a Missing Token

Issue: The plugin's debug log shows missing_token, or Cursor cannot complete authentication.

Why it happens: Your server may remove the Authorization header before WordPress receives it.

How to resolve it: Ask your hosting provider to preserve the Authorization header for WordPress REST API requests under /wp-json/. Then, try connecting Cursor again.

3. Cursor Cannot Find Your Agent

Issue: Your agent appears enabled in WordPress, but Cursor cannot detect it.

Why it happens: Your website, caching plugin, or hosting server may serve outdated agent registration details.

How to resolve it: Clear your website, plugin, and hosting caches. Exclude /wp-json/mosmcp/ from caching rules. If you use LiteSpeed Cache, add the path under Do Not Cache URIs. Then, reconnect Cursor.

4. Cursor Cannot Find All WordPress Tools

Issue: Cursor connects successfully, but some tools or actions are missing.

Why it happens: Your agent may lack the required WordPress abilities, or Cursor may not have refreshed its tool list.

How to resolve it: Open the miniOrange Secure MCP Server plugin in WordPress and select Agents. Edit your agent, review its assigned role, and enable the required abilities. Save your changes, then refresh or reconnect Cursor.

If some tools remain unavailable, check the plugin's debug logs and confirm that the server exposes the required abilities.

If you still cannot connect Cursor to WordPress, email aisupport@xecurify.com for help. Include the error message and relevant debug logs, but remove passwords, access tokens, and other sensitive information before sharing them.

Related Articles

• MCP Server Plugin for WordPress
• Documentation for MCP Server Plugin for WordPress
• Setup Guide to Connect WordPress Site with ChatGPT
• Setup Guide to Connect WordPress Site with Claude AI
• Create Pages with AI Using MCP Server and Page Builders
• Secure WooCommerce AI Agents with Role-Based Access Control