Reconnecting external services through the WordPress REST API
AI sites often talk directly to CRMs, newsletters and spreadsheets. An IT expert explains how to rebuild those integrations safely in WordPress.
Convert2WP – convert your AI website to WordPressClick here
The integrations you did not notice
A typical AI-built website does more than show pages. The contact form sends data to a CRM, the newsletter box talks to an email platform, a booking widget writes to a spreadsheet and a chatbot calls an AI API. These connections live in serverless functions or in the builder's cloud, and none of them are copied when you convert the site.
This is completely normal: converters move what visitors see, not the backend. But it means you need a list of every integration before launch, otherwise you discover a missing one when a customer asks why nobody replied.
Making the inventory
Open the original project and search for API keys, webhook URLs and fetch calls. Check the environment variables in the builder's settings. Then ask the business owner which emails and notifications they receive every day. Combine both lists; each one usually finds something the other missed.
For every integration note what triggers it, what data it sends, where it goes and who depends on it. That small table becomes your test plan later.
Plugin first, code second
For common services there is almost always a maintained plugin: form plugins with CRM add-ons, official newsletter plugins, booking plugins with calendar sync. Use them. They handle authentication, retries and updates, and they will still work when the person who set them up has moved on.
Only when no plugin fits do I write custom code. Even then, I keep it in a small dedicated site plugin, never in the theme, so the integration survives a redesign.
Building a custom endpoint
WordPress has a REST API that lets you register your own endpoints. A custom route can receive webhook calls from an external service or act as a safe proxy between your front end and a third-party API. Register the route with a permission callback, validate every incoming field and return clear status codes.
Never put secret API keys in JavaScript that runs in the browser. Store them in the server configuration or in protected options and call the external service from PHP. Many AI sites I have reviewed exposed keys in the browser; the move to WordPress is the perfect moment to fix that.
Security and reliability
Public endpoints are open to the internet, so treat them carefully. Verify webhook signatures when the service provides them, use nonces for requests coming from your own pages and limit the rate of requests where possible. Log failures somewhere you will actually look.
External services go down from time to time. Queue important tasks, such as sending a lead to the CRM, so they can be retried later instead of being lost. A simple background job plugin or the built-in scheduled tasks are enough for most small sites.
Testing before launch
Walk through your inventory table on the staging site and trigger every integration once. Check that the data arrives in the right place, with the right fields and without duplicates. Then switch the integrations to production credentials on launch day and test again.
After launch, keep an eye on the logs for a week. Small glitches are normal and are usually fixed quickly. What matters is that you know every connection exists, where it lives and how to repair it.