What Are Application Passwords in WordPress?
An application password in WordPress is a site-specific password created to let external applications and automated services interact with a WordPress website securely, without using the primary user login password. These passwords work with the permissions of the user account they are linked to and are most often used with the REST API and XML-RPC API.
Generation and Format
Application passwords are generated from the user profile page in the WordPress dashboard, found at Users then Profile. Each password created in this way is 24 characters long and does not use special characters. The WordPress core uses the wp_generate_password() function to produce these passwords. Every password created is connected to a specific user and site, and it reflects the permissions given to that user.
Purpose and Typical Use
The main reason for using application passwords is to allow API requests and automation scripts to interact with the site’s data. This avoids the need to use a user’s main login details, reducing the risk of those details being exposed.
A few use cases include:
- Connecting workflow automation tools like Zapier, where automation sequences need to fetch or send updates to a WordPress site.
- Allowing custom customer management tools to sync or pull information from the site.
- Letting mobile apps access specific site data for functions like retrieving posts or publishing drafts.
These passwords are often required when integrating site management platforms, synchronizing custom systems, or building mobile applications that connect with a WordPress website.
Security Features
Using application passwords can help secure a site in several ways:
- You can make many different passwords for different apps or services. If you need to block an app’s access, you revoke that password only.
- Revoking an application password does not affect any others in use for separate tools or integrations.
- Both two-factor authentication and ReCaptcha protection remain active on user accounts when using application passwords for external tools.
- Application passwords stay valid if a user changes their main password, so running scripts and services continue to work unless specifically revoked.
Management
Users create or remove application passwords in their individual profile pages on the WordPress dashboard. All user roles can create passwords linked to their account unless an administrator blocks this feature.
If your site policy does not require application passwords, you can stop users from generating new ones. Plugins such as Really Simple SSL offer a way to disable this feature.
Remember, application passwords do not expire when the main login password changes. Each one must be manually revoked if access should be removed.
Function with APIs
Application passwords are used most with the REST API and XML-RPC API. When a service tries to connect, it uses the username and the application password for authentication. The level of access is determined by the permissions of the user who created the password.
Common Scenarios
Automation tools: Tools like Zapier can automate actions on your site, such as posting new content based on site activity. To do this securely, you provide Zapier with an application password instead of your login details.
Custom CRM: If your business uses a custom system for managing clients or customers, you can create an application password so the tool can access and update data in WordPress.
Mobile Applications: Opening access for a mobile app to retrieve or add content to a WordPress site is possible by generating a password for use with app requests, which keeps your main credentials safe.
Introduction in WordPress
Application passwords were added to WordPress in version 5.6 as a solution for safely allowing third-party integrations without sending full login credentials.
Troubleshooting and User Concerns
Users often run into issues like trouble linking application passwords with certain services, trouble with failed authentications, or confusion about how to manage passwords for multiple integrations. After deciding a connected service is no longer required, users need to remember to revoke the associated password to prevent unwanted continued access.
Application passwords are not affected by resetting the main user password. To remove access, a site owner or user must manually delete each password.
On platforms like Stackoverflow and Reddit, users share practical tips for safe handling, such as labeling passwords clearly for each use and revoking them when no longer needed.
Disabling and Control
Administrators who do not need this feature can disable password creation using security plugins. This helps keep tighter control over what services can connect to the site.
Best Practice
Each integration should use a unique application password linked to a user account with only the permissions needed for that task. Regularly review and remove passwords that are not necessary to reduce the risk of unwanted access.
Application passwords provide a way for secure API authentication and access management for WordPress sites. Each password can be created, reviewed, or revoked directly from the user profile, supporting better control over what external tools and services can access the site.