- Article
- Intermediate
- 2 minutes read
- Reviewed August 4, 2026
- Advanced WordPress and integrations
Application Passwords are revocable credentials for programmatic access to WordPress.
They were designed so an application does not need a user's primary interactive-login password.
How They Work
An Application Password belongs to a WordPress user.
The external client sends the username and generated credential through HTTP Basic Authentication over HTTPS.
WordPress authenticates the request as that user, so authorization is still controlled by the user's capabilities.
Creating a Credential
A user can create named Application Passwords from their profile when the feature is available.
Use a name that identifies the integration, environment and owner.
The plain credential is displayed once. Store it securely at creation time.
Revocation
Individual credentials can be revoked without changing the user's normal password or disrupting other applications.
Revoke them when:
- The integration is retired.
- A secret is exposed.
- A team member leaves.
- The client is replaced.
- The user's role changes.
- A security incident occurs.
Monitoring
WordPress stores information such as last use and last IP for Application Passwords.
Review active credentials during account and security audits.
Limitations
Application Passwords do not provide independent fine-grained scopes.
The integration can act with the capabilities of the associated user. Create a dedicated least-privileged user when appropriate.
Transport Security
Use HTTPS.
Basic Authentication encodes credentials but does not encrypt them. TLS protects them in transit.
Frequently Asked Questions
Can an Application Password sign in to wp-admin?
It is intended for programmatic authentication, not normal interactive login.
Should every integration share one credential?
No. Use separate named credentials so each integration can be audited and revoked independently.
Continue Learning
Previous: REST API Authentication