25% off ProSNIPC25OFF

Disable Application Passwords

Turns off WordPress's built-in application password feature to reduce the API attack surface.

PHPby SnipCraft
php
<?php
// Disable the application passwords feature entirely.
add_filter( 'wp_is_application_passwords_available', '__return_false' );

// Remove the application passwords section from user profile screens.
add_action( 'admin_init', 'scseed_remove_app_passwords_ui' );
function scseed_remove_app_passwords_ui() {
    if ( class_exists( 'WP_Application_Passwords' ) ) {
        remove_action(
            'show_user_security_settings',
            array( 'WP_Application_Passwords', 'show_user_profile_fields' )
        );
    }
}
#authentication#hardening#rest-api#security