SearchFIT

SearchFIT gives you two ways to get content into WordPress. Webhook mode exposes a REST endpoint that lets you create, update, and list posts using an API key — accepting an incoming payload as-is. Import mode lets an administrator bulk-import a SearchFIT content-export CSV straight from the admin screen.

Designed for AI content workflows (ChatGPT, Claude, Perplexity), no-code automation (Zapier, Make, n8n), and headless setups.

Features

• Two ingestion modes: accept an incoming webhook payload as-is, or bulk-import a SearchFIT content-export CSV

• Bulk CSV import with Markdown-to-HTML conversion, processed in batches with a live progress bar

• Slug-matched import — re-importing the same CSV updates existing posts instead of duplicating

• Auto-generated cryptographic API key with one-click regeneration

• Create, list, read, and update posts via REST

• Slug-based upsert — re-publishing the same slug updates the existing post instead of duplicating

• Featured images and inline content images downloaded from URLs you supply

• Category and tag management (creates missing categories on the fly)

• Custom post meta with a denylist for WordPress-internal keys

• SEO meta sync to Yoast SEO, Rank Math, SEOPress, and All in One SEO

• Multilingual support via Polylang and WPML

• JSON-LD <script> blocks extracted, validated, and re-emitted in <head>

• Optional embed allowlist for YouTube / Vimeo / SoundCloud / Spotify / Loom / TikTok / Apple Podcasts / Dailymotion

• Settings UI for default post status, author, category, tags, embeds, hero deduplication

• Health check endpoint and activity log

Security

• Cryptographic API key ( random_bytes ) with timing-safe comparison

• SSRF guard — outbound URL fetches reject private, loopback, link-local, and reserved IPs (IPv4 and IPv6)

• Custom-meta denylist blocks attempts to write _edit_lock, _thumbnail_id, _wp_* and other WP internals

• Iframes are off by default; when enabled, restricted to a strict host allowlist and src forced to https

• JSON-LD payloads are JSON-validated and re-encoded with JSON_HEX_TAG flags before storage

• Settings save flows through the WordPress Settings API (CSRF nonce + sanitize callbacks)

• WAF-friendly: auth runs inside handlers (so failed requests don’t trigger Wordfence/Sucuri lockout heuristics); POST-only methods (no PUT/PATCH); public health endpoint

API Reference

ai/docs. Quick example:

jpg" }'

Privacy Policy

SearchFIT does not collect or transmit any personal data. API keys and the webhook activity log are stored in the WordPress database and never sent to external servers.