What Application passwords means
Added in WordPress 5.6, they let tools connect through the REST API and can be revoked one at a time. Give integrations their own user with the least access they need.
Why it matters for your website
Handing your real admin password to a plugin, app or contractor's tool is risky, because if it leaks the attacker has full control. Application passwords let each integration have its own credential that you can cancel on its own, which keeps your main login private and limits the damage from a leak.
Example
A shop owner connects an inventory app to WordPress using an application password tied to a dedicated 'inventory-sync' user. When she stops using the app, she revokes that password in one click.
Tips
- Create a separate user for each integration with only the role it needs.
- Name each application password clearly so you know which tool uses it.
- Revoke passwords for tools you no longer use.
Common mistakes
- Creating application passwords on a full administrator account for every integration.
- Sharing one application password across several different tools.
Questions about Application passwords
What is Application passwords?
WordPress passwords made for apps and integrations, separate from your login password.
Are WordPress application passwords safe?
They are safer than sharing your main password, because they work only for API access and can be revoked individually. They should still be treated like secrets and given to trusted tools only.
Why can't I see the application passwords section in WordPress?
It usually requires the site to use HTTPS, and some security plugins or hosts turn the feature off. Check your security plugin settings or ask your host.
