What are WordPress Application Passwords?
WordPress Application Passwords were introduced in WordPress 5.6 (December 2020) as a secure way for third-party applications to access your site without using your main password.
Why are they more secure?
- Unique per application: Each app gets its own password
- Revocable: Delete an app password without changing your main password
- Limited scope: App passwords can't change your main account password
- Activity tracking: See which apps are accessing your site
Step-by-Step: Generate Application Password
Step 1: Log into WordPress Admin
Visit yourdomain.com/wp-admin and log in with your administrator account.
Step 2: Navigate to Your Profile
- Click on Users in the left sidebar
- Click Profile (or click your name in the top-right corner)
Step 3: Scroll to Application Passwords Section
Scroll down the page until you see "Application Passwords". This section is typically near the bottom of the profile page.
Step 4: Create New Application Password
- In the "New Application Password Name" field, enter a descriptive name (e.g., "BlogFlux")
- Click "Add New Application Password" button
- IMPORTANT: A new password will appear. Copy it immediately - it will only be shown once!
⚠️ Important: Copy the Password Immediately!
The application password is displayed only once. If you don't copy it, you'll need to delete it and create a new one.
Step 5: Paste into BlogFlux
Return to BlogFlux, navigate to Blog Connections, and paste the application password into the password field when setting up your WordPress connection.
Common Issues
Application Passwords Section is Missing
Cause: Your WordPress version is older than 5.6.
Solution: Update WordPress to version 5.6 or later. Contact your hosting provider if you can't update.
Add New Button is Grayed Out
Possible causes:
- Your site doesn't use HTTPS (Application Passwords require SSL)
- A plugin is blocking the feature
- Your hosting provider disabled the feature
Solution: Enable HTTPS on your site, or contact your hosting provider for assistance.
Can't Find Application Passwords in Profile
Cause: You're not logged in as an administrator.
Solution: Only administrator and editor users can create application passwords. Log in with an admin account.
Managing Application Passwords
View Active Application Passwords
In the Application Passwords section, you'll see a list of all active app passwords with their names and creation dates.
Revoke an Application Password
- Find the app password you want to revoke in the list
- Click the "Revoke" button next to it
- The app will immediately lose access to your site
Security Best Practices
- Use descriptive names: "BlogFlux Production" is better than "App1"
- Revoke unused passwords: Delete app passwords you no longer use
- One per service: Don't reuse the same password across multiple services
- Audit regularly: Review your active app passwords monthly
Testing Your Application Password
You can test if your application password works using this curl command:
curl -u 'yourusername:your_application_password' \
https://yoursite.com/wp-json/wp/v2/postsReplace yourusername, your_application_password, and yoursite.com with your actual values.
If successful, you'll see a JSON response with your posts. If you get a 401 error, the credentials are incorrect.