How to Generate App Password
Step-by-step guide to creating WordPress application passwords
Application passwords provide a secure way for WP Automator to connect to your WordPress site without exposing your main account password.
What are Application Passwords?
Application passwords are:
- Secure: 24-character passwords specifically for API access
- Revocable: Can be deleted anytime without affecting your main password
- Isolated: Each app gets its own password
- WordPress Native: Built into WordPress 5.6+
Compatibility: Application passwords require WordPress 5.6 or higher. If you're on an older version, consider updating WordPress first.
Prerequisites
Before generating an app password, ensure:
- WordPress 5.6 or higher installed
- Admin or Editor access to WordPress
- HTTPS enabled on your site (recommended)
- Two-factor authentication disabled (or configured to allow app passwords)
Step-by-Step Guide
Login to WordPress Admin
- Navigate to your WordPress admin URL:
https://yoursite.com/wp-admin - Enter your username and password
- Click "Log In"
Navigate to Your Profile
Once logged in:
- Click on Users in the left sidebar
- Select Profile (or Your Profile)
- Scroll down to find the Application Passwords section
Create New Application Password
- In the New Application Password Name field, enter:
WP Automator - Click the Add New Application Password button
- WordPress will generate a 24-character password
Important: Copy this password immediately! WordPress will only show it once. You cannot retrieve it later.
Copy and Save the Password
The generated password will look like:
xxxx xxxx xxxx xxxx xxxx xxxx- Click the password to select it
- Copy it to your clipboard (Ctrl+C or Cmd+C)
- Store it securely (password manager recommended)
Add to WP Automator
- Go to WP Automator dashboard
- Navigate to Sites → Add New Site
- Paste the app password in the App Password field
- Complete the site setup
Managing Application Passwords
View Existing Passwords
In your WordPress profile, you'll see a list of all application passwords:
- Name: The application name you provided
- Created: When the password was generated
- Last Used: Last time the password was used
- Last IP: IP address that last used the password
Revoke a Password
To remove an application password:
- Find the password in the list
- Click Revoke next to it
- Confirm the action
The application will immediately lose access to your site.
Revoke All Passwords
In case of security concerns:
- Click Revoke All Application Passwords
- Confirm the action
- All applications will lose access
- Generate new passwords as needed
Security Best Practices
Do's
- Use HTTPS: Always use SSL/TLS for your WordPress site
- Unique Names: Give each application a descriptive name
- Regular Audits: Review active passwords monthly
- Immediate Revocation: Remove passwords for unused applications
- Secure Storage: Use a password manager to store app passwords
Don'ts
- Don't Share: Never share application passwords
- Don't Reuse: Generate unique passwords for each application
- Don't Expose: Never commit passwords to version control
- Don't Ignore: Act on suspicious "Last Used" entries
- Don't Use Main Password: Never use your main WordPress password
Troubleshooting
Application Passwords Section Missing
Possible causes:
- WordPress version below 5.6
- Feature disabled by hosting provider
- Plugin conflict
Solutions:
- Update WordPress to latest version
- Contact hosting support
- Check if security plugins are blocking the feature
- Verify your hosting environment supports application passwords
Password Not Working
Check these:
- Correct username (not email)
- Password copied completely (all 24 characters)
- No extra spaces before/after password
- Site URL includes correct protocol (https://)
- User has appropriate permissions
Two-Factor Authentication Issues
If you use 2FA:
- Some 2FA plugins block app passwords
- Check plugin settings for app password support
- Consider using a 2FA plugin that supports app passwords
- Temporarily disable 2FA to test
Alternative Authentication Methods
If application passwords aren't available:
Basic Authentication Plugin
- Install a Basic Auth plugin
- Configure credentials
- Not recommended for production
JWT Authentication
- Install JWT Auth plugin
- More complex setup
- Good for advanced users
OAuth 2.0
- Most secure option
- Complex implementation
- Best for enterprise
Recommendation: Application passwords are the best balance of security and ease of use for WP Automator.
Frequently Asked Questions
Q: Are application passwords secure? A: Yes, they're specifically designed for API access and can be revoked anytime without affecting your main account.
Q: Can I use the same app password for multiple sites? A: No, each WordPress site needs its own app password. Generate unique passwords for each site.
Q: What permissions does WP Automator need? A: WP Automator needs Editor or Administrator level permissions to create and publish content.
Q: How often should I rotate app passwords? A: We recommend rotating passwords every 90 days or immediately if you suspect any security issues.
Next: Learn about Setting Permalinks for optimal compatibility.
Last updated on