There’s a small change coming in WordPress 7.2 that I’m really glad about.
Whenever a new application password is created on your account, you get an email.
Application passwords are the special keys you create so a tool or app can use the WordPress REST API without you handing over your main login password. You can revoke one later without changing the password you actually type in. They’re handy, and they’re also easy to forget about. Until now, one could be added to your account and you might never hear about it.
That matters more than it used to. More of us are giving AI tools and agents access to our sites, and that often means creating a new application password and leaving it sitting there. These keys can do a lot through the REST API, so if someone else created one, or a tool made one you didn’t expect, you’d want to know straight away.
From WordPress 7.2, you will. The moment a new key appears, WordPress emails the account it belongs to. The email includes the name of the application password and the site, so you’ve got something to go on.
If you get an email you don’t recognise, don’t ignore it. Go to Users > Profile > Application Passwords, find the one you don’t remember creating, and revoke it. That cuts off access immediately.
This is coming in WordPress 7.2, which is in beta now. The official WordPress 7.2 Beta 5 announcement mentions it, and the work itself is tracked in Trac ticket 63927.
A small change, but a useful one, especially as we let more tools talk to our sites.
Leave a Reply