Two ways to connect WordPress
Most integrations (GSC, GA4, Slack, WordPress.com-hosted) go through OAuth. Self-hosted WordPress — the common case for client sites — uses an application password instead:POST /integrations/wordpress/connect with the site URL and an
application password generated in that site’s wp-admin, no OAuth app
registration needed per client site.
Webhooks
Both verify their signature with a timing-safe comparison before
processing — see Security.