Lyzerslab AI Blog Automation

v2.0.0

A WordPress plugin that lets humans and automated agents publish posts via a Markdown form or REST API — with API key authentication, featured images, tags, excerpts, SEO meta, and post status control.

WordPress.org Plugin Contact Author

Overview

Lyzerslab AI Blog Automation bridges the gap between AI agents and your WordPress blog. Posts can be submitted through a clean frontend form or directly via the REST API — both paths support Markdown, categories, tags, excerpts, featured images, and SEO meta. The admin dashboard offers API key management, post status control, and a full audit log with source tracking and IP recording.

What's New in v2.0.0

API Key Authentication

Phase 1

Generate named API keys. Every REST submission requires a valid active key via header or query param.

Post Status Control

Phase 1

Choose Publish, Draft, or Pending Review as the default status for all submissions.

Enhanced Logging

Phase 1

Every log entry now records the submission source (form vs API) and request IP address.

Featured Image

Phase 2

Auto-detected from the first Markdown image, or provide an explicit URL. Sideloaded into the media library.

Tags & Excerpt

Phase 2

Pass comma-separated tags and a custom excerpt via the form or API.

SEO Meta

Phase 2

SEO title and meta description written to Yoast, Rank Math, and a native fallback key.

Playground Live Preview

New

Ships with blueprint.json so the WordPress.org Live Preview button works out of the box.

Extended Markdown

Improved

Fenced code blocks, strikethrough, H4-H6, horizontal rules, and inline images added.

Goals

Allow automated agents to publish posts without CAPTCHAs or manual steps.
Accept Markdown content via a simple frontend form or a REST API endpoint.
Support rich content: categories, tags, excerpts, featured images, and SEO meta.
Provide a full audit trail of every submission attempt with source and IP.
Let admins control which posts auto-publish vs go to draft/pending.

Features

Frontend submission form via shortcode [lyzerslab_post_submission].
REST API endpoint at /wp-json/lyzerslab/v1/submit (POST, JSON body).
API Key management: generate, enable/disable, copy, and delete named keys.
Post status control: Publish immediately / Save as Draft / Pending Review.
Extended Markdown: H1–H6, bold, italic, bold+italic, strikethrough, UL/OL, fenced code blocks, inline code, blockquotes, links, images, horizontal rules.
Tags (comma-separated), excerpt, and featured image URL fields on form and API.
Featured image auto-detected from first ![alt](url) in Markdown body.
SEO meta written to Yoast, Rank Math, and native fallback keys.
Multi-category support: admin controls which categories appear on the form.
Enhanced logs: source (form/api), IP, status, and data — with stats dashboard.
WordPress Playground Live Preview via blueprint.json.
Fully i18n-ready with proper text domain.

Requirements

WordPress 5.5 or newer (tested up to 7.0).
PHP 7.4 or newer.
A theme that styles standard HTML tags (h1–h6, p, ul/ol, strong, em, blockquote, code, pre).
REST API enabled (default on all standard WordPress installs).

Installation

Upload the folder lyzerslab-ai-blog-automation to wp-content/plugins/.
Activate "Lyzerslab AI Blog Automation" via WordPress Admin → Plugins.
On activation, the plugin auto-creates the "Agent Submission" page with the shortcode.
Go to Lyzer Automations → API Keys and generate a key for your agent.
Configure author, post status, and categories under Lyzer Automations → Settings.

ℹ️The form can also be embedded on any page using the shortcode [lyzerslab_post_submission].

API Keys

Go to Lyzer Automations → API Keys to manage authentication keys for your agents.

Click + Generate Key, enter a label (e.g. "My AI Agent"), and copy the generated key immediately.
Keys are prefixed llk_ and are 48 hex characters long.
You can Enable / Disable a key without deleting it.
Deleted keys are immediately revoked — all future requests using them return 401.

⚠️Copy the key when it is generated. It is stored hashed and cannot be retrieved again.

Sending the key:

HTTP Header (recommended)

X-Lyzerslab-Key: llk_your_key_here

Query parameter (alternative)

POST /wp-json/lyzerslab/v1/submit?api_key=llk_your_key_here

REST API

The REST endpoint accepts a JSON body and returns a JSON response. All fields except title and body are optional.

Field	Type	Required	Description
title	string	✅ Yes	Post title
body	string	✅ Yes	Post body in Markdown
excerpt	string	No	Custom post excerpt
tags	string	No	Comma-separated tag names
categories	int[]	No	Array of category IDs
image_url	string	No	Featured image URL (sideloaded)
seo_title	string	No	SEO title (Yoast / Rank Math)
seo_description	string	No	Meta description (Yoast / Rank Math)

Success response (201):

JSON

{ "success": true, "post_id": 42, "post_url": "https://yoursite.com/post-title" }

Error response (401 / 422):

JSON

{ "success": false, "message": "Unauthorized" }

Post Status Control

Under Lyzer Automations → Settings, the Default Post Status dropdown controls what happens to every submitted post:

Publish immediately — post goes live right away (default).
Save as Draft — post saved privately for review before publishing.
Pending Review — post queued in the editorial workflow.

💡Use "Pending Review" when AI-generated content should be checked by a human editor before going live.

Featured Image

Featured images are set automatically — no manual upload required.

Explicit URL field — fill in the "Featured Image URL" field on the form, or pass image_url in the API body.
Auto-detection — if no URL is provided, the plugin scans the Markdown body for the first ![alt](url) and uses that image.
The image is sideloaded into your Media Library via WordPress's native media_sideload_image() and attached as the post thumbnail.

Tags & Excerpt

Both are available on the frontend form and via the REST API.

Tags — enter a comma-separated list (e.g. ai, automation, wordpress). Tags are created automatically if they don't exist.
Excerpt — a short summary shown in post listings and used by SEO plugins as the default meta description fallback.

SEO Meta

SEO fields are available as a collapsible section on the form (labelled "🔍 SEO Settings") and as optional API fields.

Field	Yoast key	Rank Math key	Native fallback
SEO Title	_yoast_wpseo_title	rank_math_title	_lyzerslab_seo_title
Meta Description	_yoast_wpseo_metadesc	rank_math_description	_lyzerslab_seo_desc

ℹ️Both Yoast and Rank Math keys are written simultaneously, so the correct plugin picks up the values regardless of which SEO plugin is active.

How To Use (Admin)

Go to Lyzer Automations → Settings to set Default Author, Post Status, Fallback Category, and which categories appear on the form.
Go to Lyzer Automations → API Keys to generate keys for your agents.
Go to Lyzer Automations → Logs to review all submission attempts — date, status, message, source, and IP are all recorded.

How It Works (Human Use)

Visit the "Agent Submission" page (auto-created on activation).
Fill in Post Title, Post Body (Markdown), optional Excerpt, Tags, Categories, Featured Image URL.
Expand "🔍 SEO Settings" to optionally fill in SEO Title and Meta Description.
Click 🚀 Publish Post.
On success, a green confirmation banner appears with a "View Post" link.

Agent Workflow (Form-based)

GET the submission page URL, e.g. https://your-site.com/agent-submission/
Parse the HTML to extract the nonce value from _smp_nonce.
POST back with Content-Type: application/x-www-form-urlencoded including all fields.
Check response HTML for the green success banner with a "View Post" permalink.

💡The REST API is simpler for agents — no nonce scraping required. Use the form workflow only if you need to avoid REST API access.

Agent Workflow (REST API)

Generate an API key under Lyzer Automations → API Keys.
Send a POST request to /wp-json/lyzerslab/v1/submit with Content-Type: application/json.
Include the key in the X-Lyzerslab-Key header.
Send the JSON body with title, body, and any optional fields.
On success, receive a 201 JSON response with post_id and post_url.

Example cURL (Form submission)

bash

# Step 1: scrape the nonce
NONCE=$(curl -s https://your-site.com/agent-submission/ | grep -oP '(?<=_smp_nonce" value=")[^"]+')

# Step 2: submit
curl 'https://your-site.com/agent-submission/' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode "post_title=Example Title" \
  --data-urlencode "post_body=# Heading\n\nThis is **bold**." \
  --data-urlencode "post_tags=ai, automation" \
  --data-urlencode "post_excerpt=A short summary." \
  --data-urlencode "_smp_nonce=$NONCE" \
  --data-urlencode "smp_submit=Publish Post"

Example cURL (REST API)

bash

curl -X POST 'https://your-site.com/wp-json/lyzerslab/v1/submit' \
  -H 'Content-Type: application/json' \
  -H 'X-Lyzerslab-Key: llk_your_key_here' \
  -d '{
    "title": "AI-Generated Post",
    "body": "# Intro\n\nThis is **bold** and *italic*.\n\n![Hero](https://example.com/hero.jpg)",
    "excerpt": "A short summary for listings.",
    "tags": "ai, automation, blog",
    "categories": [1, 3],
    "image_url": "https://example.com/hero.jpg",
    "seo_title": "AI-Generated Post | My Blog",
    "seo_description": "A meta description under 155 characters."
  }'

Response (201 Created)

{ "success": true, "post_id": 42, "post_url": "https://your-site.com/ai-generated-post" }

Author Handling

Under Lyzer Automations → Settings → Default Author, choose the WordPress user assigned to all submitted posts. Select "Current user on submission" to attribute posts to whoever is logged in at submission time (useful for multi-author workflows where agents authenticate as specific users).

Logs & Audit Trail

Every submission (success or error) is recorded under Lyzer Automations → Logs.

Stats bar — total, successful, and error counts at a glance.
Source — whether the submission came from the form or the REST API.
IP address — Cloudflare and reverse-proxy aware (HTTP_CF_CONNECTING_IP, HTTP_X_FORWARDED_FOR).
Up to 300 entries are retained; oldest entries are pruned automatically.
Use the Clear Logs button to reset the log store (requires confirmation).

Live Preview (WordPress Playground)

The plugin ships with a blueprint.json that powers the WordPress.org Live Preview button.

Spins up PHP 7.4 + latest WordPress in the browser.
Installs and activates the plugin automatically.
Logs in as admin and redirects to the Settings page.

💡On the plugin's WordPress.org page, go to Advanced Options → Toggle Live Preview to enable it. No setup required — blueprint.json is already included in the plugin zip.

Implementation Notes

Option keys: lyzerslab_selected_author_id, lyzerslab_selected_category_id, lyzerslab_allowed_category_ids, lyzerslab_agent_logs, lyzerslab_api_keys, lyzerslab_default_post_status.
All options are cleaned up on uninstall via uninstall.php.
Logs capped at 300 entries; pruned automatically (oldest first).
API keys are stored with an active boolean — disabling a key takes effect immediately without deletion.
Featured image sideloading requires media_sideload_image() — WP admin includes are loaded on demand.
Admin and frontend styles are loaded as external CSS files (assets/admin.css, assets/frontend.css), not inline.

Styling & Layout

Published posts render using your theme's standard HTML tags and styles. Headings, lists, bold/italic, inline code, fenced code blocks, blockquotes, and images all map to semantic HTML and inherit your blog's styling. The frontend submission form uses scoped ll- prefixed CSS classes and will not conflict with your theme.

Security

REST API — protected by API key authentication. Invalid/missing keys return 401 and are logged with IP.
Frontend form — protected by a standard WordPress nonce (_smp_nonce). Failed nonce checks are logged.
All user input is sanitized (sanitize_text_field, sanitize_textarea_field, esc_url_raw) before processing.
Markdown is parsed to a controlled HTML subset — no arbitrary HTML passthrough.
Admin pages are gated by manage_options capability checks with nonce verification on every form action.

Troubleshooting

If the form submission does nothing, ensure the current _smp_nonce from the page is included.
If the REST API returns 401, check that the API key is active and the header name is exactly X-Lyzerslab-Key.
If no featured image appears, confirm the image URL is publicly accessible and your server can make outbound HTTP requests.
If SEO fields aren't picked up by Yoast/Rank Math, ensure the respective plugin is active — the meta keys are written regardless.
Check Lyzer Automations → Logs for detailed error messages, source, and IP on every failed attempt.

Code Reference

lyzerslab-ai-blog-automation.php — main plugin class, all logic.
assets/admin.css — admin UI styles (enqueued only on plugin pages).
assets/frontend.css — frontend form styles (enqueued only when shortcode is present).
uninstall.php — cleans all plugin options on uninstall.
blueprint.json — WordPress Playground Live Preview configuration.

Lyzerslab AI Blog Automation

Overview

What's New in v2.0.0

API Key Authentication

Post Status Control

Enhanced Logging

Featured Image

Tags & Excerpt

SEO Meta

Playground Live Preview

Extended Markdown

Goals

Features

Requirements

Installation

API Keys

REST API

Post Status Control

Featured Image

Tags & Excerpt

SEO Meta

How To Use (Admin)

How It Works (Human Use)

Agent Workflow (Form-based)

Agent Workflow (REST API)

Example cURL (Form submission)

Example cURL (REST API)

Author Handling

Logs & Audit Trail

Live Preview (WordPress Playground)

Implementation Notes

Styling & Layout

Security

Troubleshooting

Code Reference

Links

FAQs