WordPress Application Passwords: The UK Guide for 2026
17 August 2026
Learn how to use WordPress application passwords securely for REST API, plugins, and integrations. A practical UK guide for 2026.
What Are WordPress Application Passwords?
Application passwords are long, randomly generated strings that let external services and third-party tools authenticate with your WordPress site without using your personal login credentials. Introduced in WordPress 5.6, they work with the built-in REST API, making them ideal for automation, integrations, and content management tasks. Each password is tied to a specific app or service, so you never share your main admin password. For UK site owners, this means safer integrations with services like Mailchimp, Zapier, or even automated reporting tools. They are not intended for logging into your WordPress admin dashboard—they are purpose-built for API access and machine-to-machine communication.
How to Create and Revoke Application Passwords
Creating an application password in WordPress is straightforward. Go to your Dashboard, navigate to Users > Profile, and scroll down to the 'Application Passwords' section. Enter a name for the service you are connecting, click 'Add New Application Password', and WordPress will generate a fresh password for you. Copy it immediately—you won't see it again. To revoke access, simply return to the same section and click 'Revoke' next to the password you no longer need. This is especially important for UK businesses that regularly onboard and offboard third-party agencies or freelancers, as revoking an application password instantly blocks that service without affecting your main account.
Security Best Practices for UK Site Owners
When using application passwords, always prioritise security. Only generate passwords for services you genuinely trust, and use HTTPS on your WordPress site to encrypt data in transit. Because these passwords grant API access, treat them like your admin password—never store them in plain text or share them via unsecured email. In the UK, GDPR compliance also matters: if an application involves processing personal data, ensure your privacy policy reflects it. Regularly review your active application passwords and revoke any that are unused. Some UK site owners also set up activity logging to track API requests, which helps detect suspicious behaviour early and keeps your site compliant with data protection principles.
Common Use Cases: REST API, Integrations, and Automation
Application passwords shine when you need to connect WordPress to external systems. Common use cases include syncing content to a headless CMS, enabling mobile app publishing, running automated backups, or integrating with marketing platforms like Klaviyo or Shopify. UK ecommerce developers often use them to link a WooCommerce store with a custom inventory system or a cloud accounting tool like Xero. They’re also handy for WordPress maintenance teams that use remote management plugins or command-line tools. Because each integration gets its own unique password, you can revoke access for one service without disrupting others—an essential feature for growing UK businesses that rely on many connected apps.
Troubleshooting and Limitations
While application passwords are useful, they have limitations. They do not work with XML-RPC by default, so if you’re using legacy tools that require XML-RPC, you’ll need a separate solution. Also, some security plugins disable application passwords entirely to reduce attack surface—check your settings if connections fail. If you experience authentication issues, confirm your site is using HTTPS and that you’re including the password in the standard REST API authentication header. Caching plugins can sometimes interfere, so purging cache after creating a new password may help. Remember, these passwords are for API access only; they will not work for logging into wp-admin. For UK users, ensure your server time and WordPress configuration are correct to avoid token-related errors.
FAQ
Not automatically. Standard REST API usage works out of the box, but individual plugins and services must explicitly use WordPress authentication to accept application passwords. Some plugins may require a separate plugin or custom code to support them. Always check the plugin documentation to confirm compatibility.