Connection Settings

Wash links your WordPress site and your Shopify store over a secure, authenticated connection. You set it up once and manage it from either side.

How connection works

flowchart TD
    A[Connect code from Shopify] --> B[WordPress Plugin]
    B --> C[API Key Authentication]
    C --> D[Secure HTTPS Connection]
    D --> E[Shopify App - Wash]

To connect a WordPress site:

  1. Install the Wash app on your Shopify store.
  2. Install and activate the Wash plugin in WordPress.
  3. In Shopify, open Apps > Wash > Connections, click Add Connection, then Generate connect code.
  4. In WordPress, open Settings > Wash Connector, tick the data processing consent box, paste the code and click Connect to Shopify.

The code looks like ABCD-EFGH-JKMN. It works once and expires after 15 minutes; generate a new one if it runs out. You never type your store's address in WordPress, because the code tells the plugin which store to connect.

Accessing connection settings

In Shopify

  1. Open your Shopify admin
  2. Go to Apps > Wash
  3. Click Connections in the sidebar
  4. Find your WordPress connection

Each connection card shows the WordPress URL, the API key, the Basic Auth settings and links to the connection's Settings, Blog Mappings and Redirections.

The WordPress Connections page in the Wash app in Shopify, with one active connection

In WordPress

  1. Open WordPress admin
  2. Go to Settings > Wash Connector
  3. Select the Connection tab

Wash Connection Settings in WordPress

Connection parameters

Connect code

A one-time code generated in Wash in your Shopify admin. WordPress exchanges it with the Wash service for the connection's API key and the store it belongs to. Only a hash of the code is stored, and a used or expired code is rejected.

If you connect a site that was connected before, Wash reuses its existing connection and restores the settings it backed up.

API key

The connect code hands WordPress an API key, so you never copy the key by hand. The key:

  • Is unique to your store-WordPress connection pair
  • Goes with every request WordPress sends to Wash, together with a timestamp
  • Signs every callback Wash sends back to WordPress (HMAC-SHA256), so WordPress can reject forged calls
  • Can be regenerated if compromised
  • Should never be shared publicly or committed to version control

Regenerating the API key

  1. Go to Shopify > Apps > Wash > Connections
  2. Find your connection
  3. Click Regenerate Key, then Regenerate to confirm. The old key stops working immediately.
  4. Generate a connect code and reconnect WordPress with it (Settings > Wash Connector). The site picks up the new key.

WordPress site URL

The URL where your WordPress site is accessible:

FormatExample
Root domainhttps://example.com
Subdomainhttps://blog.example.com
Subdirectoryhttps://example.com/blog

Connection status

In Shopify, each connection card has a badge:

BadgeMeaning
ActiveWash accepts content from this WordPress site
InactiveThe connection is paused. Click Activate to resume, or Deactivate to pause an active one
Connector update availableThe WordPress plugin on that site is older than the latest release

In WordPress, the Connection tab shows one of three states:

StateMeaning
Connected to store.myshopify.comThe connection works. Disconnect removes it from this site
Connect formThe site isn't connected yet. Paste a connect code
This store no longer has Wash installedThe store uninstalled Wash or deactivated this connection, so posts no longer sync. See below

Testing the connection

On the connection card in Shopify, click Test next to the WordPress URL. Wash calls your site and shows either WordPress connection OK or Cannot reach WordPress with the reason. If the test fails, check the firewall and Cloudflare steps in the Installation Guide.

Sync history for every connection is under Apps > Wash > Logs.

When the store uninstalls Wash

If the connected store uninstalls the Wash app, or deactivates the connection, WordPress says so on the Connection tab: "This store no longer has Wash installed." Posts stop syncing until you act. You have two options:

  • Reinstall Wash in the same store within 48 hours. The connection comes back on its own, with its mappings and settings.
  • Connect a different store with a connect code from that store's Wash app.

After 48 hours Shopify removes the app's data for the store. On the connection card in Shopify you can also tick Delete this connection's data when I uninstall the app if you want it gone at once. It's off by default, so a reinstall restores your mappings and settings.

Moving a site to a different store

Connecting the site to another store with a connect code starts it clean. The old store's sync status is cleared from every post: article IDs, blog, CDN images, redirects and the last sync time. The Posts list then shows nothing as synced until you sync to the new store. Reconnecting the same store keeps everything.

Security

Authentication flow

1. WordPress builds the request
2. Adds the X-Wash-Key header (API key)
3. Adds the X-Wash-Timestamp header (current time)
4. Sends it over HTTPS to the Wash app
5. Wash checks the key and the timestamp
6. If both are valid, Wash processes the request

Callbacks from Wash to WordPress carry an X-Wash-Signature header,
an HMAC-SHA256 of the timestamp and body, keyed with the API key.

HTTPS requirement

All connections require HTTPS. If your WordPress site uses HTTP:

  1. Install an SSL certificate (Let's Encrypt is free)
  2. Update WordPress URL in Settings > General
  3. Click Test on the connection card in Shopify

HTTP Basic Authentication

If your WordPress site is behind HTTP Basic Authentication (e.g., staging/dev), enter the username and password under Basic Auth on the connection card in Shopify, so callbacks can reach WordPress. For an additional store, WordPress also has HTTP Basic user and HTTP Basic password fields under Advanced (optional) in the connect form.

The HTTP Basic Auth fields on a connection card in Shopify

Firewalls

Your WordPress server must reach app-wash.tradik.com over HTTPS (port 443), and Wash must reach /wp-json/wash/v1/callback on your site. Allow both if a firewall or security plugin filters traffic.

Multiple connections

There are two ways to use more than one connection.

Several WordPress sites, one Shopify store

Each site gets its own connection in Apps > Wash > Connections. The number of connections depends on the store's plan:

PlanMax connections
Free1
Pro5
Business10
Enterprise20

One WordPress site, several Shopify stores

On the Business and Enterprise plans, one site can publish to more than one store. On the Settings > Wash Connector page, the Store Connections list shows each store. Click New connection and paste a connect code generated in the other store's Wash app. Published content syncs to every enabled connection. Each added store gets its own page under Settings in WordPress, and its settings apply only to that store.

You can only add a store while the primary (first) store is working. If the primary store has uninstalled Wash or its key is rejected, fix that first. A short outage of the Wash service never blocks this, and existing connections keep working if you later drop to a lower plan.

Troubleshooting

Connection failed

  • Generate a new connect code if the old one was used or is more than 15 minutes old
  • Paste the whole code, with no extra spaces
  • Tick the data processing consent box; the Connect to Shopify button stays disabled until you do
  • Check that the WordPress site is accessible via HTTPS
  • Check for firewall rules blocking the connection

Frequent disconnections

  • Check WordPress hosting uptime
  • Verify SSL certificate is valid and not expired
  • Check for caching plugins blocking API requests
  • Review server error logs for PHP errors

API key not working

  • Check the connection is Active in Shopify
  • Regenerate the key in Shopify, then reconnect WordPress with a new connect code
  • Click Test on the connection card to confirm Wash can reach WordPress