How to Auto-Post an RSS Feed to WordPress (Without a Plugin)

Updated: 2026-09-27

Short answer: you can auto-post an RSS feed to WordPress without installing any plugin. In PostRSS, open Accounts → Add new WordPress account: for a self-hosted site, enter its address, your username and an application password generated in WordPress; for a WordPress.com site, connect it with a single button. Then open Cibles → Add feed, choose WordPress in Target settings and add your feed under Add source (Type = RSS feed, Link = your feed address). Each new item becomes a post — title, content and featured image — published, or held as a draft or pending review. WordPress is included from the Professional plan ($10/month).

Almost every guide about WordPress and RSS assumes WordPress is the source: your site publishes a feed, and something else consumes it. This is the other direction. Here WordPress is the destination, and the point of interest is that it does not need a plugin to get there.

Why no plugin is the interesting part

The traditional way to pull a feed into WordPress is an importer plugin. That works, and it also means: another plugin to keep updated, another thing that can break on a core upgrade, another consumer of your site’s WP-Cron, and another piece of code running on the same server as your site. On shared hosting, an importer that wakes up and fetches a dozen feeds is a real load.

PostRSS does the fetching, parsing and de-duplication on its own infrastructure and then talks to your site over the WordPress REST API, which is built into WordPress core and has been since version 4.7. Nothing new runs on your server. If you ever disconnect PostRSS, there is nothing to uninstall and no leftover database tables — only the posts that were created, which are ordinary WordPress posts.

Two ways to connect, depending on where your site lives

A self-hosted WordPress site: application passwords

Application passwords have been part of WordPress core since version 5.6. They are credentials scoped to one application, revocable on their own, and they never expose your real login password. To create one:

1. Sign in to your WordPress admin as a user who can publish posts.
2. Go to Users → Profile (ou Users → the user you want, if you are creating it for someone else).
3. Scroll to Application Passwords, type a name you will recognise later — "PostRSS" does the job — and click Add New Application Password.
4. Copy the generated password immediately. WordPress shows it once and never again.

Then, in PostRSS, open Accounts → Add new WordPress account and enter your site address, the username and that application password. Two requirements are worth checking first: your site must be served over HTTPS, because WordPress disables application passwords on plain HTTP, and the REST API must not be blocked. Some security plugins and a few hosts disable REST API authentication by default; if the connection is refused, that is the first place to look.

Revoking access later is a single click on the same profile screen, and it affects nothing else about the account.

A WordPress.com site: one button

If your site is hosted on WordPress.com, there is no application password to create. Connecting it is a single button in PostRSS: you authorise the connection on WordPress.com’s side and the account appears in your list.

What arrives on your site

Each new feed item becomes one WordPress post:

• The title becomes the post title.
• The item’s content becomes the post body.
• The item’s image is set as the post’s featured image, which is what your theme uses for the archive thumbnail and for social previews.
• The status is yours to choose: publish immediately, save as a draft, or hold as pending review.

That last option is the one most people underuse. Setting incoming items to draft ou pending turns the automation into a queue rather than a publisher: the material arrives, is formatted, and waits for a human to look at it before anything goes live. For curated or licensed content, that is usually the right setting.

As with every other destination, PostRSS publishes items that appear in the feed after the Target starts running — connecting a feed does not import its back catalogue.

Setting it up, step by step

1. Create an application password in your WordPress profile (self-hosted), or have the WordPress.com login ready.
2. In PostRSS, open Accounts and choose Add new WordPress account. Enter the site address, username and application password, or connect WordPress.com with the button.
3. Open Targets and click Add feed.
4. In Target settings, choose WordPress and the site you just connected, and set the post status you want: published, draft or pending.
5. Click Add source. Set Type to RSS feed, paste the feed address into Link, and save.
6. Check the first post that arrives — title, body formatting and featured image — before leaving it unattended.

Which plan includes WordPress

WordPress is part of the Professional plan at $10/month, together with a Facebook Page, VKontakte, Pinterest boards, Discord, Tumblr, Nostr and Blogger. Free and Start cover a Facebook Page only; Professional Plus at $20/month adds LinkedIn, LINE and WeChat; Ultimate at $40/month adds X, Telegram, Bluesky, Mastodon, Threads, Matrix, Webhook, Instapaper and Reddit. An annual subscription is 20% cheaper. Per-tier limits are on the pricing page and the complete list is on the supported networks page.

Note that this is the opposite direction from the PostRSS WordPress plugin, which takes your WordPress site’s content out to social networks. The two solve different problems and can run side by side: the plugin distributes what you publish, while this setup fills your site from a feed.

How this compares to RSS importer plugins

Plugins such as WP RSS Aggregator and RSS to Post Generator solve the same surface problem from inside WordPress, and for some setups they are the better answer. The honest comparison:

• Where the work happens. A plugin fetches and parses feeds on your server, on your hosting plan’s CPU, usually triggered by WP-Cron — which on a low-traffic site fires only when somebody visits. PostRSS does that work elsewhere and checks feeds on a fixed 5-minute schedule regardless of traffic.
• What you maintain. A plugin is code on your site: updates, compatibility with your theme and your other plugins, and a security surface. The REST API route adds nothing to the site.
• Depth of import features. This is where importer plugins win. Mature aggregators offer per-feed keyword filters, category and author mapping, custom field mapping, full-text scraping of truncated feeds and template control over the generated post. If you are building a large curated aggregation site, that toolbox matters.
• Breadth of destinations. This is where a general tool wins. An importer plugin puts a feed into WordPress and stops there. PostRSS treats WordPress as one destination among many, so the same feed can also reach your social accounts without a second system.
• Cost shape. Plugins are often free at the basic tier with paid add-ons for filtering and full-text. PostRSS is a flat subscription that includes every destination on the plan.

A reasonable rule of thumb: if your goal is a content aggregation site with fine-grained import rules, use an importer plugin. If your goal is to move published items between places you own — and to keep your WordPress install lean — the plugin-free route is simpler.

A word about republishing other people’s feeds

Technically, any public feed can be pointed at your site. Legally and editorially, a feed being public is not permission to republish it in full. Syndicating your own content across sites you own is uncontroversial; filling a site with other publishers’ full articles is a copyright problem and, for search, a thin-content problem. If you are aggregating third parties, use excerpts with attribution and a link, keep the volume of original commentary high, and get permission where the relationship allows it.

Troubleshooting

• The connection is refused. Check HTTPS first — application passwords are disabled on plain HTTP. Then check whether a security plugin or your host is blocking REST API authentication, which is the usual second cause.
• "Invalid username or password" with the right details. Make sure you are using the application password, not your login password, and that you copied it in full. Some servers strip the Authorization header; if yours does, the host’s support can re-enable it.
• Posts arrive but the featured image is missing. The source item probably has no usable image. Check the raw feed before assuming the connection is at fault.
• Posts arrive truncated. The source feed publishes summaries only. That is a setting at the source, not something the destination can restore.
• The user was deleted or its role changed. An application password belongs to a user; if that user loses publishing rights, posting stops. Create a new one under a user who can publish.

Frequently Asked Questions

Do I need a plugin to auto-post an RSS feed to WordPress?

No. WordPress has had a REST API in core since version 4.7 and application passwords since 5.6, which together let an external service create posts without any plugin installed. PostRSS uses exactly that route, so nothing extra runs on your server.

Is an application password safe to give to an external service?

It is considerably safer than sharing your login password. An application password is a separate credential that can be revoked on its own without changing your password or affecting any other integration, and it cannot be used to sign in to wp-admin interactively.

Can incoming items be held for review instead of published?

Yes. The Target’s status setting lets you publish immediately, save each item as a draft, or hold it as pending review, which turns the feed into a queue that a human approves.

Does the featured image come across automatically?

Yes, when the source item has one. The item’s image is set as the post’s featured image, so your theme’s archive thumbnails and social previews work as they normally would. If the feed carries no image, there is nothing to import.

Will connecting a feed import all of its old posts?

No. PostRSS publishes items that appear in the feed after the Target starts running, so an established feed does not backfill its archive into your site.

Does this work on WordPress.com as well as self-hosted sites?

Yes. Self-hosted sites connect with an application password; WordPress.com sites connect with a single authorisation button, with no password to generate.

Can I send one feed to WordPress and to social networks at the same time?

Yes. Add the same feed as a source on several Targets — one for WordPress, one for a Facebook Page, one for Pinterest — and each new item goes to all of them. That is the main practical difference from an importer plugin, which only ever fills WordPress.

Which WordPress version do I need?

Version 5.6 or later for application passwords, and the site must be served over HTTPS. Any currently supported WordPress release is well past that.

The bottom line

Auto-posting an RSS feed into WordPress does not require a plugin, and avoiding one keeps the work — fetching, parsing, de-duplicating — off your server entirely. Generate an application password, connect the site in PostRSS, point a Target at your feed, and choose whether items publish straight away or wait as drafts. It is on the Professional plan at $10/month, and the same feed can reach your other networks from the same place.