Secure a WordPress MCP Server with Least Privilege

This guide walks you through securing a WordPress MCP (Model Context Protocol) server by granting it only the permissions it absolutely needs. You’ll learn to create a dedicated, restricted user, configure the server to operate under that identity, and enforce least privilege at every layer—WordPress, filesystem, and network. By the end, your MCP server will be able to do its job without exposing your site to unnecessary risk.

What You’ll Need

• A WordPress site (self-hosted, not WordPress.com) with admin access.
• SSH or terminal access to your server.
• Your MCP server software installed (e.g., a Node.js or Python-based MCP server).
• Basic familiarity with the command line and WordPress user roles.

Step-by-Step

1. Identify the MCP server’s required capabilities. Before touching anything, list exactly what your MCP server needs to do. For example, does it need to read posts, create drafts, or update options? Write these down—they’ll guide every permission decision.
2. Create a dedicated WordPress user with the minimum role. Log into your WordPress admin dashboard, go to Users → Add New, and create a new user. Assign the lowest role that still covers the server’s needs. For read-only tasks, use Subscriber. If it must create or edit posts, use Author (but never Administrator unless absolutely required). Avoid using your personal admin account for the server.
3. Generate an application password for that user. In the WordPress admin, go to Users → Profile for the new user. Scroll to Application Passwords and generate a new one. Copy it immediately—you won’t see it again. This password is tied to that user and can be revoked independently.
4. Configure the MCP server to authenticate with that user. Edit your MCP server’s configuration file (often .env or config.json). Set the WordPress username and application password. Never hardcode these in source code; use environment variables or a secrets manager.
5. Restrict the MCP server’s filesystem access. If your MCP server can read or write files, create a dedicated directory (e.g., /var/www/mcp-server/) and give it read/write access only there. Set the directory owner to a non-root user (e.g., www-data) and set permissions to 750 or 700. Use a chroot or container if your server software supports it.
6. Run the MCP server under a dedicated system user. Create a system user (e.g., mcpuser) with no login shell: sudo useradd -r -s /usr/sbin/nologin mcpuser. Then run the MCP server process as that user. If using systemd, set User=mcpuser in the service file.
7. Limit WordPress API permissions via a plugin or code. Even with a low-role user, the WordPress REST API may expose more than needed. Use a plugin like “WP REST API Controller” or add custom code to your theme’s functions.php to disable specific endpoints. For example, if the server only needs to read posts, disable all write endpoints.
8. Set network-level restrictions. If your MCP server only needs to talk to WordPress from a specific IP, add a firewall rule (e.g., using ufw or iptables) to allow only that IP to access the WordPress admin and REST API. Similarly, restrict outbound connections from the MCP server to only the WordPress host and any necessary APIs.
9. Encrypt credentials in transit. Ensure your MCP server uses HTTPS when communicating with WordPress. If the server is on the same host, consider using a local Unix socket instead of TCP to avoid network exposure.
10. Enable logging and monitoring. Turn on logging for both WordPress and the MCP server. Monitor for unusual activity, such as failed authentication attempts or unexpected file access. Use tools like auditd on Linux to track file access by the MCP user.
11. Test thoroughly. After configuration, test every function your MCP server is supposed to perform. Verify it works, then attempt to perform actions it shouldn’t be able to do (e.g., deleting a post) and confirm those are denied.
12. Document and review regularly. Write down the exact permissions granted and why. Review them every few months or whenever you change the server’s functionality. Remove any permissions that are no longer needed.

Common Mistakes

• Using an admin account for the MCP server. This gives the server full control over your site. If compromised, an attacker can do anything. Always use a dedicated low-privilege user.
• Storing passwords in plain text. Hardcoding credentials in configuration files that are committed to version control is a common oversight. Use environment variables or a secrets manager.
• Granting filesystem access to the entire WordPress directory. The MCP server likely only needs a small directory. Giving it access to /var/www/html allows it to modify core files, themes, or plugins.
• Overlooking the REST API. Even a Subscriber role can access certain endpoints. Disable endpoints you don’t need.
• Skipping network restrictions. Leaving the MCP server open to the internet invites attacks. Restrict by IP and protocol.

Tips

• Use a separate WordPress instance for testing. If possible, test the MCP server on a staging site before applying to production.
• Rotate application passwords periodically. Set a reminder to regenerate the application password every 90 days.
• Run the MCP server in a container. Docker or similar can add an extra layer of isolation, making it harder for an attacker to pivot to the host.
• Use a reverse proxy for the WordPress API. This allows you to add rate limiting and additional authentication checks.
• Keep your MCP server software updated. Security patches often fix vulnerabilities that could be exploited.

Troubleshooting

• Authentication fails. Double-check the username and application password. Ensure the application password was generated for the correct user. If you’re using environment variables, confirm they are loaded correctly.
• Server can’t write files. Check the ownership and permissions of the designated directory. The user running the MCP server must have write access. Use ls -la to inspect.
• REST API returns 403. This often means the user role doesn’t have permission. Revisit the required capabilities and either adjust the role or add custom permissions via code.
• Server times out. If you’ve added firewall rules, ensure the MCP server’s IP is allowed. Also check that the WordPress site is reachable over HTTPS.
• Changes not taking effect. Clear any caches (WordPress, opcache, or MCP server cache) after modifying permissions.
• Can’t revoke access. If you lose the application password, you can regenerate it in the user’s profile. This immediately invalidates the old one.

Frequently Asked Questions

What is least privilege access?

Least privilege means giving a user or process only the minimum permissions needed to perform its function, nothing more. For an MCP server, this limits the damage if it’s compromised.

Can I use an API key instead of an application password?

Yes, if you’re using a plugin that provides API keys, but application passwords are built into WordPress and work with the REST API. They’re simpler and can be revoked per-user.

What if my MCP server needs to create users?

That’s a high-privilege action. You’ll need to grant the user a role that can create users (like Editor or Administrator), but consider whether it’s truly necessary. If it is, restrict the endpoints to only user creation via custom code.

How do I know which REST endpoints my server uses?

Check your MCP server’s logs or documentation. You can also enable WordPress debugging to see which endpoints are being called. Then disable everything else.

Is it safe to run the MCP server on the same machine as WordPress?

It can be, if you isolate the processes and filesystem. Running as a separate user with limited access reduces risk. A container or VM is even better.

What should I do if I suspect the MCP server has been compromised?

Immediately revoke the application password, stop the server process, and review logs. Change any other credentials that might be exposed. Restore from a clean backup if necessary.

Related

• Filter and Exclude Columns: How-To Guide
• Are Lenovo Laptops Good? Honest Guide
• SpaceX Public-Private Deep Space Program Plans