WordPress Application Passwords let external apps authenticate to your site without your main login password. That is useful for integrations. If you do not use them, disabling the feature reduces one more credential type attackers can abuse.
Disable with Security Ninja Pro
- Go to Security Ninja → Fixes.
- Enable the option to disable Application Passwords.
- Confirm Application Passwords no longer appear under user profile screens for creating new app passwords.
Keep the feature enabled if a tool you rely on (mobile apps, CI, or APIs) needs Application Passwords.
Related: Fixes overview.
