应用密码是 WordPress 的一项功能，允许为程序化访问（如移动应用、集成或脚本）生成可撤销的、针对特定应用的凭证，旨在避免与第三方工具共享主账户密码。该功能自 WordPress 5.6（2020年12月）引入，适用于 API 认证，而非交互式浏览器登录。
# 使用 curl 通过应用密码进行 REST API 请求示例
curl --user "USERNAME:APPLICATION_PASSWORD" https://example.com/wp-json/wp/v2/users/me
# WP-CLI 命令示例
# 为用户 ID 123 创建应用密码
wp user application-password create 123 "myapp"
# 仅输出密码（适用于脚本）
wp user application-password create 123 "myapp" --porcelain
# 列出用户 ID 123 的应用密码
wp user application-password list 123 --fields=uuid,name,created,last_used,last_ip
# 删除特定应用密码
wp user application-password delete 123 <uuid>Application Passwords are a WordPress feature that lets you generate revocable, per-application credentials for programmatic access (for example, a mobile app, an integration, or a script). They are designed to avoid sharing your main account password with third-party tools.
Application Passwords were introduced in WordPress 5.6 (December 2020). See: Application Passwords: Integration Guide.
An Application Password is:
Application Passwords cannot be used to log into wp-admin via wp-login.php. They are meant for applications and scripts, not humans typing credentials into a login form.
Use Application Passwords when you need a tool to authenticate as a WordPress user without giving it that user’s main password, for example:
If the use-case is interactive logins in a browser, use a strong password and consider enabling Two-Step Authentication (also known as two-factor authentication, or 2FA): Two-Step Authentication.
CI deploy bot, My iPhone app, Reporting integration).WordPress displays Application Passwords in grouped chunks for readability. They can be used with or without the spaces (spaces are stripped before validation).
Application Passwords are typically used via HTTP Basic Authentication (RFC 7617). With Basic Auth, your client sends credentials in an Authorization HTTP header.
The header value is constructed by Base64-encoding the string username:password:
Authorization: Basic BASE64_ENCODED_CREDENTIALS
When using Application Passwords:
Because Basic Auth credentials can be intercepted on the network if sent unencrypted, you should always use HTTPS. See: HTTPS.
Example (REST API request with curl):
curl --user "USERNAME:APPLICATION_PASSWORD" https://example.com/wp-json/wp/v2/users/me
In the same Application Passwords section on the user profile, you can:
Operational best practice is to treat Application Passwords like secrets:
If you manage WordPress via SSH, WP-CLI can create, list, update, and revoke Application Passwords.
Examples:
# Create an application password for user ID 123 (prints the password once).
wp user application-password create 123 "myapp"
# Create and output just the password for user ID 123 (useful for scripts/CI).
wp user application-password create 123 "myapp" --porcelain
# List passwords for user ID 123 and show common fields.
wp user application-password list 123 --fields=uuid,name,created,last_used,last_ip
# Delete a specific application password by UUID for user ID 123.
wp user application-password delete 123 <uuid>
Official command reference: wp user application-password.
By default, Application Passwords are available when requests are served over HTTPS. Availability can be customized (or disabled) with filters.
If you do not want to allow Application Passwords on a site, you can disable them via code (for example, in a must-use plugin) using the wp_is_application_passwords_available filter. For more granular control (for example, only allow specific users/roles), use wp_is_application_passwords_available_for_user.
If authentication fails (401/403) or Application Passwords don’t appear in the user profile:
Authorization headers unless explicitly configured.