WordPress Application Passwords (older connections)
New sites connect with the plugin instead. This is for sites connected the old way, and for testing the REST API.
You don't need this to connect a new site. WordPress now connects through our plugin, with no password to create or paste. See “Install the WordPress plugin”. Sites connected with an Application Password before the plugin existed keep working where the host allows it, and the WordPress card offers to move them to the plugin.
An Application Password is a dedicated credential for the WordPress REST API that you can revoke any time. It is also handy for testing whether your host passes the Authorization header. Never use your normal login password for API access.
- 1Log in to your WordPress admin at yoursite.com/wp-admin.
- 2Make sure the account is an Administrator (or Editor). A Subscriber cannot edit content and will be rejected.
- 3Go to Users → Profile and scroll to the Application Passwords section.
- 4Type a name like “RankNexus” and click Add New Application Password.
- 5Copy the generated password (it looks like: abcd EFGH ijkl MNOP qrst UVWX). You will not see it again.
The username is your WordPress user_login (shown in Users → Profile), not your email address. Email is unreliable for API auth.
To revoke one, return to Users → Profile → Application Passwords and click Revoke next to it.
Related guides
We’ll get back within one business day.