WordPress Integration Passwords: The 2026 UK Guide
17 August 2026
Learn how to use WordPress integration passwords for secure API access. A UK guide to setup, best practices, and GDPR compliance.
What Are WordPress Integration Passwords?
WordPress integration passwords (officially called Application Passwords) are a secure authentication method introduced in WordPress 5.6. They allow third-party services, plugins, or custom scripts to connect to your WordPress site's REST API without exposing your main login credentials. Instead of entering your username and password, you generate a separate, revocable token specifically for the integration. This is particularly valuable for UK site owners who use tools like Zapier, Mailchimp, or bespoke internal systems. Because each integration gets its own unique password, you can grant and revoke access independently, significantly reducing security risks. For UK businesses subject to GDPR, this also helps you maintain better control over who accesses personal data.
How to Create an Integration Password in WordPress
Creating an integration password is straightforward. Log in to your WordPress admin dashboard and navigate to Users > Profile. Scroll down to the 'Application Passwords' section (if you don't see it, ensure your site is using WordPress 5.6 or later and that a secure connection like HTTPS is active). Enter a name for the integration, such as 'Newsletter Sync' or 'CRM Connector', and click 'Add New Application Password'. WordPress will generate a 24-character password in a single row. Copy it immediately – you won't be able to see it again. Use this password in conjunction with your username when configuring the external service. Once saved, the integration can authenticate against your site's REST API securely, using standard Basic Auth or OAuth mechanisms.
Best Practices for Managing Integration Passwords
Treat integration passwords with the same caution as your main login credentials. Only generate as many as strictly necessary, and name them clearly so you can identify what each is for. Regularly audit your existing application passwords under Users > Profile; revoke any that are no longer needed or appear suspicious. Never share an integration password across multiple sites or services. For extra security, consider using unique passwords for each integration and rotating them periodically – for example, every 90 days. Always use HTTPS on your site to prevent credentials from being intercepted in transit. UK businesses should also maintain a register of who has access to these passwords as part of their internal security policies, especially if handling customer data.
Troubleshooting Common Integration Password Issues
If an integration password isn't working, first check that the username you're using is correct, and that you've copied the full password without extra spaces. Ensure your WordPress version is 5.6 or later and that your site is not configured to block application passwords (some security plugins like Wordfence or iThemes Security may disable them). Also, verify that the external service supports Basic Auth with application passwords – some services may require a specific endpoint or headers. If you're still having issues, try revoking and re-generating a fresh password. Remember that application passwords will fail if your site is using a static caching system that doesn't process REST API requests correctly. Finally, check your server's PHP error logs for clues.
UK-Specific Considerations: GDPR and Compliance
For WordPress site owners in the UK, integration passwords are more than just a convenience – they're part of your data protection toolkit. Under GDPR, you must ensure that any third-party service accessing personal data via the API does so with proper authorisation. Integration passwords allow you to control and revoke access instantly, which is essential when responding to data subject requests or contract terminations. Remember to include details of these integrations in your privacy policy, as required by the ICO. Also, the UK Data Protection Act 2018 complements GDPR, and using application passwords helps demonstrate 'security by design' – a key principle. Always document why and how each integration access is used, and keep your audit logs.
FAQ
A normal password is used to log into your WordPress dashboard and gives full access to everything your user account can do. An application password is a separate, randomly generated token designed specifically for external services or integrations. It cannot be used to log into the dashboard. You can revoke it without changing your main password, and it typically only grants access to the REST API.