We just open-sourced a ~60-line Python script that publishes WordPress posts through the REST API. It’s MIT-licensed, three files, and it ran our storm lane overnight before we released it.
Repository: https://github.com/TygartMedia/wp-direct-publish
Why it exists
We publish a lot of WordPress posts. For a while, the publishing path went through a browser — a real Chromium session, clicking through the editor, waiting on page loads, recovering from the inevitable flaky step. Around 65 steps per post.
Then we measured it. Same job, two lanes: the browser lane used roughly 10x the tokens and took roughly 2x the wall-clock time of going straight to the WordPress REST API. The API lane is also byte-exact and diffable — what you send is what lands, and you can see it in a diff instead of squinting at screenshots.
So we burned in a standing rule: publish via the API first. The browser lane stays as the fallback for jobs the API genuinely can’t do, not the default.
The security design
The interesting part of the script isn’t the publishing — it’s what it refuses to do with your credentials.
An application password never travels through argv, environment variables, or disk. It’s piped in through stdin, used once for the Basic-auth header, and forgotten. The Python standard library does everything; there are no third-party dependencies and nothing to install.
The workflow that goes with it is just as deliberate: when a fresh application password is needed, Will pastes one into chat, it goes straight into the pipe, and it’s never stored — not in files, not in memory, not in chat logs, not in the vault. Transient use is the feature, not a limitation.
Generate app passwords at wp-admin → Users → Profile → Application Passwords (bottom of profile.php), and you can revoke them in one click whenever you want.
Dogfooded, then released
This is our standing build flow: every internal tool gets dogfooded on our own operation first, then open-sourced with the invitation — take it, make it better, and if you build something better, we’ll be customer number one.
wp-direct-publish.py ran the storm lane — real overnight storm-warning posts, real publishing pressure — before a single line went public. The README tells that story honestly, including the measurements. We don’t ship what we haven’t lived with.
Take it
Three files. Standard library only. MIT.
https://github.com/TygartMedia/wp-direct-publish
If it saves you from driving a browser through 65 steps to publish a post, it did its job.
Leave a Reply