Security boundaries are part of the publishing workflow.
Rank Titan separates planning and AI operations from the WordPress destination, authenticates connector requests, preserves site-owner permissions, and keeps consequential actions reviewable.
AI keys stay in the SaaS
The WordPress connector does not need OpenAI, Gemini, or other model-provider credentials. Strategy, prompts, generation, and QA remain outside the destination CMS.
Connector requests are signed
Rank Titan signs the timestamp, unique request ID, and raw request body with HMAC SHA-256. The plugin verifies the signature before a protected operation can run.
Replays and stale requests are rejected
The connector rejects reused request IDs and timestamps outside its accepted window, and it enforces body-size and request-rate boundaries.
WordPress keeps destination control
Draft creation, immediate publishing, scheduling, updates, media uploads, and builder-sensitive actions are capabilities the site owner can enable, disable, or revoke.
Builder pages are protected
The connector detects editor conditions and blocks generic overwrites of protected builder-managed pages unless the destination explicitly permits the operation.
Actions remain auditable
Accepted and rejected connector actions record status and diagnostic context. Secrets are masked in the interface and must never be copied into public logs or content.
Approval in Rank Titan does not override WordPress permissions.
The application can prepare a page and record editorial approval, but the connector still checks its unique secret, signature, timestamp, request ID, site identity, requested post type, requested status, and destination capabilities.
If immediate publishing is disabled in WordPress, a publish request cannot silently bypass that boundary. If updates or media are disabled, those actions do not become available merely because another system requested them.
- Use a unique provisioned connector secret; insecure defaults are rejected.
- Keep production WordPress endpoints on HTTPS.
- Enable only the capabilities required for the approved workflow.
- Rotate or revoke the connection when access changes.
- Verify the WordPress record and rendered route after important actions.
Security controls reduce risk; they do not replace review.
Teams remain responsible for accurate site configuration, user access, credential handling, approved claims, backups, plugin and platform updates, and verification after release. A successful connector response proves an operation completed, not that a page is correct, indexed, or ranking.