WordPress Application Passwords: App Access Without Sharing wp-admin

A WordPress application password is a named token for an app. It is not the password you type on the login screen, and it is not two-factor. Mixing those three is how people either share wp-admin with every plugin vendor—or disable REST and break their own tools.

This page is App-Then-Revoke. It is not WordPress two-factor login. It is not password managers for freelancer logins. Staging copies stay on WordPress staging. HTTPS basics: SSL mixed content.

Create a named application password for each integration, store it in a vault, and revoke it when the app is gone. Do not paste your main password into REST clients.

Official: Application Passwords and REST API authentication.

Table of contents

1. App-Then-Revoke
2. When you actually need one
3. Create, name, store, revoke
4. What this is not
5. Least privilege and HTTPS
6. FAQ
7. Revoke the leftover

App-Then-Revoke

        APP-THEN-REVOKE
  Need REST/app access?  named token
  Human login?           real password + 2FA (other URL)
  Job over?              revoke that token only

If the Profile screen has no Application Passwords block, the host or a security plugin may have turned the feature off. Ask them. Do not enable XML-RPC “because a 2014 blog said so” without knowing why.

When you actually need one

• A backup or deploy tool that talks to REST
• A mobile or desktop editor that is not the browser
• A freelancer’s script that should not know your real password

You do not need one to write posts in wp-admin. You do not need one as a substitute for 2FA.

Create, name, store, revoke

1. Sign in, open Users → Profile (your profile).
2. Find Application Passwords, give a name you will recognize in six months.
3. Generate, copy once, put it in the vault (password manager seat).
4. When the agency or plugin is gone, Revoke.

Name tokens like “SiteGround backup 2026,” not “app1.” Future you will not remember app1.

What this is not

Not a client vault for Netflix logins. Not comment spam. Not “hide /wp-admin” folklore.

If a plugin asks for your main password to “connect,” treat that as a smell. Prefer tokens or official OAuth where the vendor supports it.

Least privilege and HTTPS

The token inherits that user’s capabilities. Do not generate application passwords on an Administrator account for a tool that only needs to read posts. Create a weaker user (Editor or a custom role) when the integration allows it, then issue the token on that user. Revoke is still one click; blast radius is smaller if the token leaks.

Always use HTTPS on wp-admin and REST. A token on plain HTTP is a password in transit. Mixed content is the padlock pass; this page assumes the admin URL is already https.

If you handed a freelancer a token for a two-week build, calendar a revoke on their last day. Waiting until “next security mood” is how old tokens stay valid for years.

FAQ

What is a WordPress application password?

It is a generated token for a specific application to authenticate against WordPress (often the REST API) without using your main account password. WordPress.org documents Application Passwords in the handbook. You can revoke one token without changing the password you type at /wp-admin.

Is this two-factor login?

No. Two-factor is a second step when a human signs into wp-admin. Application passwords are for apps and scripts. The 2FA owner is a different CashPilot URL.

Where do I create one?

When the feature is enabled, signed-in users see Application Passwords on their Profile screen (Users → Profile). Some hosts disable it. If the section is missing, check with your host or WordPress version docs—do not paste random “enable XML-RPC” folklore.

Should I give an agency my main password?

Prefer an application password with a clear name (e.g. “Backup plugin 2026”) and revoke it when the job ends. A shared main password is how you lose the site after a freelancer leaves.

Is this a password manager guide?

No. Vault vs spreadsheet for client logins is the password-manager post. This URL is only WordPress’s app-token feature.

What if I see the token only once?

WordPress shows the application password at creation time. Store it in a vault immediately. If you lose it, revoke and generate a new one. Do not reuse the main password in the app field.

Does this replace HTTPS?

No. Tokens over HTTP can leak. Use HTTPS on the admin host. Mixed-content cleanup is a different post.

Where is official documentation?

Application Passwords and REST API authentication. Confirm against your installed version; hosts can disable the feature.

Revoke the leftover

Open Profile. If you see a token named after a plugin you deleted last year, revoke it now. That is the whole security win for this page.