Agent connection issues

If Hydrogen AI won't connect to your site — or connected once and stopped working — the cause is almost always one of four things: your site isn't served over HTTPS, a security plugin has disabled WordPress application passwords, the "Hydrogen SEO Agent" credential was revoked or replaced, or the AI Abilities toggle is off. This guide works through each, in the order you should check them.

For how the connection is designed to work, read connect Hydrogen AI first; this page is for when it doesn't.

First, understand what the connection is

When you connect Hydrogen AI, the plugin creates exactly one WordPress application password, named "Hydrogen SEO Agent". Only one ever exists — re-connecting replaces the previous credential rather than adding a second. The credential is verified by a callback before it is stored, and it is stored encrypted (AES-256-GCM) server-side. It is revocable by you at any time, from the plugin or from WordPress itself.

That design gives you a short, reliable checklist when things go wrong.

1. HTTPS is required

Hydrogen AI refuses to connect over plain HTTP — credentials are never sent over an unencrypted connection. The single exception is local development environments, where HTTP is tolerated so you can test.

Check your site URL under Settings → General. Both the WordPress Address and Site Address must start with https://.
If your site has a certificate but WordPress still uses http:// URLs, update both fields (and your redirects) so everything is HTTPS end to end.
If you have no certificate, get one first — most hosts issue free certificates — then retry the connection.

A site behind a proxy that terminates SSL can also confuse WordPress into thinking it is on HTTP; ask your host about forwarding the HTTPS headers correctly.

2. Application passwords are disabled

The agent authenticates with a WordPress application password, so application passwords must be available on your site. Many security plugins disable them by default.

Go to Users → Profile and scroll down. If there is no Application Passwords section, they are disabled.
Check your security plugin (Wordfence, Solid Security, and similar) for a setting that disables application passwords or REST API authentication, and allow them.
Note that WordPress itself disables application passwords on non-HTTPS sites — which loops back to check #1.
Retry the connection from the plugin.

3. The "Hydrogen SEO Agent" credential is missing, revoked, or stale

If the connection worked before and stopped, the credential is the likely culprit.

Go to Users → Profile → Application Passwords and look for "Hydrogen SEO Agent".
If it is gone, someone (or a security cleanup) revoked it. Simply re-connect from the plugin — a fresh credential is created and verified by callback before it is stored.
If it is present but the agent still fails, re-connect anyway: because only one "Hydrogen SEO Agent" credential ever exists, re-connecting cleanly replaces it. You never need to delete the old one first, and you can never end up with two.

4. The AI Abilities toggle is off

The AI Abilities toggle is the master gate: when it is off, the agent cannot act on your site at all, regardless of the connection status. If the agent connects but refuses to do anything, check the toggle in the plugin's settings and turn it on. The full permission model — the toggle, domain-locked abilities, and the manage_options requirement — is explained in AI abilities and safety.

Related: only users with the manage_options capability (administrators) can drive the agent. If you are testing with an editor-level account, that is the whole problem.

Revoking access deliberately

You can cut the agent off at any time, two ways:

From the plugin — disconnect the agent from its settings.
From WordPress — go to Users → Profile → Application Passwords and revoke "Hydrogen SEO Agent".

Either way, access ends immediately. Reconnect later whenever you like; the replacement credential goes through the same callback verification and encrypted storage.

Still stuck?

If HTTPS is confirmed, application passwords are available, the credential exists, and AI Abilities is on, the remaining suspects are a firewall or bot-protection layer blocking the REST API callback, or an aggressive security rule filtering authenticated REST requests. Temporarily relax those rules, retry, then re-tighten with an exception. Failing that, contact support with your host, security plugin, and the exact error shown.

FAQ

Why does the agent refuse to connect to my http:// site?

By design. Credentials are never transmitted over unencrypted HTTP; the only exception is local development. Move the site to HTTPS and reconnect.

Is it safe to have an application password for an AI agent?

The credential is created only when you connect, verified by callback before storage, stored encrypted with AES-256-GCM, and revocable at any time. On top of that, the agent is policy-driven — by default it asks before anything destructive, shows every change, and can be stopped anytime — and gated by the AI Abilities toggle. See AI abilities and safety.

I see "Hydrogen SEO Agent" in my application passwords — should I worry?

No, that is the expected credential, and there is only ever one. If you did not intend to connect Hydrogen AI, revoke it there and the connection is dead immediately.

Does reconnecting create duplicate credentials?

No. Reconnecting always replaces the single "Hydrogen SEO Agent" credential. You will never see two.