If you’ve ever tried to connect an external app or service to your WordPress site—maybe a mobile app, Zapier, or a publishing tool—you might’ve run into the dreaded Application Passwords Disabled message.
“Application passwords have been disabled by Wordfence.”
And if you’re anything like most site owners, your first reaction was probably:
“Umm… okay? But why?”
Don’t worry, this isn’t a bug, and your site isn’t broken. Wordfence is being extra protective because Application Passwords can open a door to your site if not managed carefully.
Let’s chat about what this actually means and, more importantly, how to fix it.
So… What Are Application Passwords Again?
Application Passwords were introduced in WordPress 5.6 as a convenient way for external apps to authenticate without using your main login password.
Basically, it’s like giving a guest pass to an app instead of handing over your master key.
Pretty handy, right?
But here’s the catch: allowing outside tools to connect to your site can increase risk if not configured properly. And that’s where Wordfence steps in.
Also Read: 10 Tried-and-Tested AI Tools for Smarter Social Media Management
Why Wordfence Disables Application Passwords
Wordfence’s job is to protect your site like a big, overly cautious security guard. In this case, it sees Application Passwords as something that could be abused if your site isn’t fully secure.
So, Wordfence automatically disables them when:
- Your site doesn’t force HTTPS (SSL)
- You’re using specific Wordfence settings (particularly Login Security)
- The plugin detects something unusual about your authentication setup
It isn’t trying to block you from using your tools; it just wants to keep the bad guys out.
Also Read: rtMedia Review: Why WordPress Users Are Switching to This Media Plugin
How to Re-Enable Application Passwords Safely
Good news: you can absolutely turn Application Passwords back on. You need to ensure your site meets Wordfence’s security requirements.
1. Make sure your site uses HTTPS- Application Passwords Disabled
Wordfence will not allow Application Passwords on plain HTTP.
If your site still shows “Not Secure”, install an SSL certificate. Most hosting providers offer one-click free SSL via Let’s Encrypt.
Once HTTPS is active, Wordfence will chill out.
2. Check your Wordfence Login Security settings- Application Passwords Disabled
In your dashboard, go to:
Wordfence → Login Security → Settings
Scroll to the section “Application Passwords”
Ensure “Enable Application Passwords” is turned ON.
If the toggle is greyed out, the site likely isn’t using HTTPS.
3. Verify your WordPress user role- Application Passwords Disabled
Application Passwords only work for:
- Administrators
- Editors
- Authors
- Users with REST API access
Subscribers typically can’t use them.
Also Read: Best Employee Management Software for Smarter Workplaces
4. Test generating a new Application Password
Go to:
Users → Profile → Application Passwords
Try generating a new one. If it succeeds, great. If not, verify your HTTPS setup.
What If You Still Can’t Enable Application Passwords?
Here are a few things that can still block them:
- A security plugin conflict, such as iThemes, Sucuri, or Shield Security
- Cloudflare is forcing HTTPS improperly
- Server-level security rules, such as ModSecurity
If you need help debugging those, I’d be happy to assist.
The “Application Passwords disabled by Wordfence” message might look alarming, but it’s really just Wordfence being extra vigilant.
Once your site uses proper HTTPS and your settings are aligned, you’ll be able to use Application Passwords safely and without headaches.
Interesting Reads:
WP Notification Bars vs NotificationX vs WPFront Notification: Best Notification Bar Plugins
Top 10 AI Tools for YouTube Influencers to Master Content Creation
Best AI Personal Assistants and Productivity Tools for Smarter Workflows
