Turn off application passwords

Removes application passwords (logins for apps and scripts through the REST API) if you don’t use them.

Type PHP
Runs Everywhere (runs as WordPress loads)
Tested with WordPress 7.1

PHP

<?php

add_filter( 'wp_is_application_passwords_available', '__return_false' );

Good to know

Some services connect this way: the WordPress mobile app, Zapier, some backup and deploy tools, and AI assistants using Snipfire’s abilities. Leave this off if you use any of them.

In these packs

Harden WordPress: Close the doors attackers try first: XML-RPC, user name discovery, the file editors, revealing login errors.

Install it in one click

It's already in the Snipfire plugin's library. Enter your site's address and it opens there, ready to install. It arrives switched off, and Snipfire checks the code and test-loads your site before you switch it on.

Needs Snipfire on that site and you logged in as an administrator. Your address stays in this browser; we don't see it. Get Snipfire free

Or add it by hand

Click + New and choose PHP.
Paste the code and give it a name.
Where: Everywhere (runs as WordPress loads).
Save and switch it on.

Works in any snippet plugin, or a child theme's functions.php. Without the safety net, though.

Good to know

In these packs

More from this pack

Move your snippets over this afternoon.