Disable Application Passwords
Turns off WordPress's built-in application password feature to reduce the API attack surface.
PHPby SnipCraft
php
<?php
// Disable the application passwords feature entirely.
add_filter( 'wp_is_application_passwords_available', '__return_false' );
// Remove the application passwords section from user profile screens.
add_action( 'admin_init', 'scseed_remove_app_passwords_ui' );
function scseed_remove_app_passwords_ui() {
if ( class_exists( 'WP_Application_Passwords' ) ) {
remove_action(
'show_user_security_settings',
array( 'WP_Application_Passwords', 'show_user_profile_fields' )
);
}
}#authentication#hardening#rest-api#security