Disable Application Passwords

77 Quality Score

Active Installs

15/30

With only 2,000 active installs, adoption is very narrow, reflecting the specialised nature of the plugin rather than any quality issue.

Update Freshness

25/25

Last updated April 2026 and tested against WordPress 7.0, the plugin is clearly and consistently maintained despite its tiny footprint.

User Rating

15/15

A perfect 100 from 9 ratings suggests strong satisfaction among the small audience that has tried it, though the sample size limits how much weight that carries.

Support Health

8/15

Zero support threads means either no users have run into problems or problems are going undocumented, which is a minor concern given the low install base.

WP Compatibility

15/15

Officially tested with WordPress 7.0 and requiring only PHP 5.6.20, compatibility is broad and modern.

Scores higher than 58% of indexed plugins

About

Activate this plugin to disable the Application Passwords feature that was added in WP v5.6.

Active Installs 2k+

Rating ★★★★★ 5/5

Last Updated 2026-07-17 5:58pm GMT

Requires WordPress 5.6+

Tested Up To 7.1

Requires PHP 5.6.20+

✓ No known vulnerabilities

What It Does

This plugin removes the Application Passwords feature introduced in WordPress 5.6, which allows external applications to authenticate via dedicated passwords. Once activated, the feature is disabled site-wide and no application passwords can be generated or used.

Who It's For

This is a niche security hardening tool aimed at administrators of regulated or high-security environments such as healthcare, finance, legal, and government sites where unused authentication surfaces must be eliminated to satisfy compliance auditors. It suits IT teams who want to lock down WordPress to only the authentication methods they explicitly permit.

Who Should Skip It

If you rely on integrations such as Zapier, mobile apps, Jetpack, or any third-party tool that uses Application Passwords to connect to your site, do not install this plugin, as it will break those connections. Small blogs and standard business sites with no compliance pressure have little reason to disable a feature they are not actively using.

The Bottom Line

Disable Application Passwords does one thing and does it well, earning a 77.28 overall quality score driven by flawless maintenance and ratings. It is a sensible addition to compliance-focused hardening stacks but is unnecessary and potentially harmful for sites that depend on Application Password integrations.

Related Plugins

Classic Widgets 89/100

Pick this instead if your goal is to restore the classic widget UI rather than harden authentication surfaces.

Disable Emojis (GDPR friendly) 84/100

Choose this for a similar minimalist disable-style plugin if your concern is performance and GDPR cleanup from emoji scripts.

Disable Everything 83/100

Select this if you want a broader toolkit that disables multiple WordPress features from a single interface, not just Application Passwords.

Disable Comments 81/100

Pick this if comments are your unused attack surface rather than Application Passwords, especially on brochure or intranet sites.

Disable WP REST API 81/100

Choose this if you want to restrict another authentication-adjacent surface, the REST API, for similar compliance-driven hardening.