# WordPress Credential Handoff

Last updated: 2026-05-25

## Do not paste app passwords into chat

WordPress application passwords should not be pasted into the conversation.

## Preferred storage location

Store them in the active Hermes profile `.env` file:

```text
/Users/bertmahoney/.hermes/profiles/wunderbar/.env
```

If you want to confirm the active profile env path yourself, run:

```bash
hermes config env-path
```

## Environment variable names

Add lines like this, replacing usernames/passwords with the actual values:

```bash
BERTMAHONEY_WP_URL=https://bertmahoney.com
BERTMAHONEY_WP_USER=YOUR_USERNAME
BERTMAHONEY_WP_APP_PASSWORD='xxxx xxxx xxxx xxxx xxxx xxxx'

BERCHMAN_WP_URL=https://berchman.com
BERCHMAN_WP_USER=YOUR_USERNAME
BERCHMAN_WP_APP_PASSWORD='xxxx xxxx xxxx xxxx xxxx xxxx'

BERT_FORSALE_WP_URL=https://bert.forsale
BERT_FORSALE_WP_USER=YOUR_USERNAME
BERT_FORSALE_WP_APP_PASSWORD='xxxx xxxx xxxx xxxx xxxx xxxx'
```

Application passwords often contain spaces. Keep the value quoted.

## File permissions

After editing the `.env`, run:

```bash
chmod 600 /Users/bertmahoney/.hermes/profiles/wunderbar/.env
```

## Trigger phrase

When credentials are saved, type exactly:

```text
WP_KEYS_READY
```

Meaning of this phrase:

- Check that the environment variables exist.
- Test read-only WordPress REST API connectivity.
- Do not publish.
- Do not update posts/pages/products.
- Do not change plugin/theme/site settings.
- Do not touch WooCommerce or Stripe settings.

## First connectivity checks

When triggered, the maintenance agent should perform read-only checks such as:

```bash
curl -s -u "$BERTMAHONEY_WP_USER:$BERTMAHONEY_WP_APP_PASSWORD" \
  "$BERTMAHONEY_WP_URL/wp-json/wp/v2/users/me"
```

Equivalent checks should be run for each site.

## Future secret phrases

Potential future phrases:

- `WP_KEYS_READY` — read-only credential/connectivity check
- `WP_DRAFT_OK` — create/update drafts only, no publishing
- `WP_MAINTENANCE_REPORT` — run report-only site maintenance scan
- `WP_PUBLISH_OK` — publish only the specific approved post/page named in the current chat

Do not infer permission from similar phrases. Require exact phrase + clear scope.