Security

Disable application passwords in WordPress

BY WPreveal Editorial
Last edited:
 October 29, 2023
Reading time:
 3 mins

/

Blog

/

Security

/

Disable application passw...

đź’ˇWe may earn a commision if you subscribe to a service from a link on this page.

WordPress, known for its versatility and user-friendly interface, constantly evolves to enhance security and functionality. One feature introduced in recent versions is Application Passwords. While this feature offers advantages in specific scenarios, it’s essential to understand what they are, where they are needed, and why disabling them when not in use is a prudent security practice. In this article, we’ll explore Application Passwords in WordPress, their relevance, and why it’s advisable to close them when not actively utilized.

Understanding Application Passwords:

Application Passwords are a WordPress authentication method introduced to improve security and streamline integration with third-party applications. They function as unique tokens generated for specific applications or services, allowing them to access your WordPress site securely without sharing your primary login credentials. This can be particularly useful for plugins, mobile apps, and external services that require access to your site’s data.

Where Are Application Passwords Needed:

Application Passwords are valuable in scenarios where you need to grant external entities, such as plugins or mobile apps, access to your WordPress site’s functionality and data without exposing your main username and password. Here are a few common use cases:

  1. Third-party Plugins: Some plugins, like WooCommerce, may use Application Passwords to connect your store to external services or applications, enhancing functionality and providing real-time updates.
  2. WordPress Mobile Apps: If you use the official WordPress mobile apps for content management, Application Passwords can ensure secure authentication without exposing your admin credentials.

Why Disable Application Passwords When Not in Use:

While Application Passwords offer security benefits, it’s prudent to disable them when not actively used. Here’s why:

  1. Reduced Attack Surface: Keeping Application Passwords enabled increases your site’s attack surface. Unused tokens can potentially be exploited if not managed or monitored correctly.
  2. Mitigating Vulnerabilities: If a plugin or application using Application Passwords becomes outdated or develops vulnerabilities, disabling these passwords can mitigate potential risks.
  3. Performance Optimization: Certain applications, such as WooCommerce and WordPress mobile apps, may utilize server resources even when not actively in use. Disabling unused Application Passwords can help optimize your site’s performance.

Examples of Plugins Using Application Passwords:

  1. WooCommerce: WooCommerce, a popular e-commerce plugin, can utilize Application Passwords to connect your online store to external payment gateways or services for real-time order processing.
  2. WordPress Official Apps: The official WordPress mobile apps for iOS and Android use Application Passwords to enable users to manage their WordPress sites on the go securely.

How to Disable Application Passwords:

To completely disable Application Passwords in WordPress, you can add the following code to your theme’s functions.php file or within a custom plugin:

// Disable Application Passwords
function disable_application_passwords() {
add_filter('wp_is_application_passwords_available', '__return_false');
}
add_action('init', 'disable_application_passwords');

Here’s an explanation of the code:

We define a custom function named disable_application_passwords. Within this function, we use the add_filter function to hook into wp_is_application_passwords_available. We return false using the __return_false function, effectively disabling Application Passwords. Finally, we use the add_action function to execute our custom function on the init hook, ensuring that Application Passwords are disabled when WordPress initializes.

By adding this code snippet to your WordPress site, you can completely disable the use of Application Passwords, providing an additional layer of security. Make sure to save your theme’s functions.php file or use a custom plugin to implement this code. Above all, make sure you haven’t disrupted the functionality of any active plugin using the application passwords.

Keep calm and close doors!

Application Passwords in WordPress serve a valuable purpose by enhancing security and enabling seamless integration with third-party applications. However, it’s essential to exercise caution and disable them when not actively used to minimize potential security risks and optimize your site’s performance. By staying vigilant and managing Application Passwords effectively, you can strike a balance between convenience and security in your WordPress-powered website.

WPReveal