Publishing Automation for Self-Hosted WordPress: A Field Report (Updated)

Why Publishing Automation Matters

Every content team eventually hits the same wall: writing is creative work, but publishing is repetitive operational work. Copying a draft into a CMS, setting the featured image, picking categories, and hitting publish is the same five minutes performed hundreds of times a month. None of that friction improves the writing, it just taxes the person doing it.

A self-hosted WordPress site is still the backbone of a huge share of the web's editorial output. It is flexible, portable, and fully owned by the team running it. But that ownership comes with an API surface that a scheduling layer has to talk to directly, using the same credentials a human editor would use.

What a Good Integration Actually Does

A publishing pipeline built around the WordPress REST API needs to do more than fire off a single POST request. It has to resolve human-readable labels into the IDs WordPress actually stores, download and attach media without ever trusting a caller-supplied path, and roundtrip edits without silently dropping content on the way back out.

• Tags and categories arrive as plain names and get resolved to term IDs, creating new terms when nothing matches.
• A featured image URL is fetched by the server itself, then re-uploaded to the WordPress media library as a native attachment.
• An edit to an already-published post updates the same remote record instead of creating a duplicate.
• A retry within a short idempotency window is detected and skipped rather than posted twice.

Where It Gets Interesting

The featured-image path is the one worth paying attention to. Because the server downloads the image bytes before handing them to WordPress, the URL it is given has to be trustworthy. An absolute filesystem path is not a URL, and treating it like one would let a malformed or malicious value read a file straight off the server's own disk. The only safe move is to reject anything that is not an explicit http or https address before a single byte is read.

Scenario F Regression Check

SCENARIO-F-BODY-EDIT-MARKER-260805-1936: this paragraph did not exist in the original publish. If it is visible on the live post after a resync_remote edit, the body change landed correctly and the c6563ba0 regression (title updated, body silently kept stale) has not recurred.