Application passwords

Why it matters for WordPress

Mobile apps, CLI tools, and automations often need API access. Application passwords give them a revocable secret instead of storing the real admin password in a third-party service. They still carry the user’s capabilities. An app password on an Administrator is still administrator-level power if it leaks.

How it shows up in practice

• “Application Passwords” section on a user profile in wp-admin
• REST or XML-RPC style basic auth using username + app password
• Leftover app passwords for tools nobody uses anymore
• Sites that disable the feature entirely when they have no integrations

What to do

1. Create app passwords only for users who need the integration, preferably not shared god-accounts.
2. Revoke passwords when a tool is retired or a freelancer leaves.
3. Prefer the least privileged role that still works for the integration.
4. If you do not use any app integrations, disabling application passwords is a fair hardening choice.
5. 2FA on the human login still matters; app passwords are a separate secret to protect.