561 Media Remote Publisher

WordPress plugin and companion API app for remotely generating, publishing, and updating WordPress content.

The project has two parts:

• 561-media-remote-publisher.php - WordPress plugin installed on each client site.
• wp-content-api/ - Next.js API app deployed to Vercel from GitHub.

The current media upload flow is designed for sites behind Sucuri. Featured image generation uses a JSON/base64 upload endpoint instead of the standard WordPress media endpoint, avoiding multipart uploads, custom auth headers, and query-string auth workarounds.

1. Install The WordPress Plugin

1. Upload 561-media-remote-publisher.php to the WordPress site as a plugin.
2. Activate 561 Media Remote Publisher in WordPress.
3. Go to Settings > 561 Media Remote Publisher.
4. Copy the generated Shared Secret.

The shared secret is used by the Vercel API app. It is stored in WordPress and sent by the API in the JSON request body as smrpSecret.

Do not add SMRP_SHARED_SECRET to wp-config.php for normal installs. That constant is only an advanced override. If it exists, it overrides the plugin-stored shared secret.

2. Confirm WordPress User Access

Each site needs a WordPress user that can:

• Upload media: upload_files
• Edit posts/pages: edit_posts or the relevant post type capability
• Edit the target post when setting a featured image

Usually this should be an Administrator or Editor account.

Create a WordPress Application Password for that user. The API still keeps the username and app password in SITES_CONFIG for standard WordPress REST calls and fallback behavior.

3. GitHub Repository

The API app in wp-content-api/ is connected to:

https://github.com/bcordoves/561-wp-contentgen

The deployed branch is main.

To push API app updates:

cd wp-content-api
git status
git add .
git commit -m "Describe the change"
git push origin wp-content-api-updates:main

Pushing to remote main triggers Vercel deployment.

4. Deploy The API To Vercel

1. In Vercel, create or open the project connected to bcordoves/561-wp-contentgen.
2. Confirm the production branch is main.
3. Add required environment variables.
4. Save changes.
5. Redeploy the project after changing environment variables.

Required environment variables depend on the image/content providers in use, but SITES_CONFIG is required for WordPress site access.

5. Create SITES_CONFIG

SITES_CONFIG must be valid JSON and should be pasted into Vercel as a single line to avoid whitespace/return-character warnings.

Each site entry should include:

• url - WordPress site URL
• username - WordPress username/email
• appPassword - WordPress Application Password
• smrpSecret - Shared Secret copied from the plugin settings page
• customPostRoute - /smrp/v1/posts
• customYoastRoute - /smrp/v1/yoast
• customMediaRoute - /smrp/v1/media

Example:

{"example":{"url":"https://example.com","username":"user@example.com","appPassword":"xxxx xxxx xxxx xxxx xxxx xxxx","smrpSecret":"PASTE_PLUGIN_SHARED_SECRET_HERE","customPostRoute":"/smrp/v1/posts","customYoastRoute":"/smrp/v1/yoast","customMediaRoute":"/smrp/v1/media"}}

The API automatically converts customMediaRoute from /smrp/v1/media to /smrp/v1/media-base64 for Sucuri-safe featured image uploads.

6. Add A New Site

Follow this order for each new site:

1. Install and activate the plugin on the WordPress site.
2. Go to Settings > 561 Media Remote Publisher.
3. Copy the Shared Secret.
4. Create or confirm the WordPress Application Password.
5. Add a new site entry to Vercel SITES_CONFIG.
6. Keep SITES_CONFIG as one-line JSON.
7. Redeploy Vercel.
8. Test listing posts.
9. Test generating a featured image.

7. Troubleshooting

smrp_secret_missing

The API did not send smrpSecret. Check the site entry in Vercel SITES_CONFIG, then redeploy Vercel.

smrp_secret_mismatch

The smrpSecret in Vercel does not match the Shared Secret in WordPress plugin settings. Copy the value again from WordPress, update Vercel, and redeploy.

smrp_secret_not_configured

The WordPress plugin has no stored shared secret. Visit Settings > 561 Media Remote Publisher to generate one.

smrp_user_not_found

The username in Vercel does not match a WordPress user on that site.

smrp_forbidden

Authentication worked, but the WordPress user lacks the required capability. Confirm the user can upload files and edit the target post.

Generic Vercel 500

The API wraps upstream WordPress errors. Read the response body for the real WordPress error code/message.

8. Security Notes

• Treat appPassword and smrpSecret as secrets.
• Store them only in Vercel environment variables and WordPress plugin settings.
• Do not commit real site secrets to GitHub.
• If a secret is exposed, generate a new one in WordPress, update Vercel, and redeploy.
• Remove SMRP_SHARED_SECRET from wp-config.php unless intentionally using it as an override.