WordPress Application Password for MCP Clients
Create a WordPress application password for MCP clients: a dedicated least-privilege user, safe storage, rotation and revocation for GoBuildWP.
An Application Password is a WordPress feature, not a GoBuildWP one, which is why it works the same way for every tool that uses it. It carries exactly the capabilities of the user it belongs to, which is the reason to create a dedicated user for the connection rather than issuing one against your own account. Revoking it is instant and affects nothing else, and that property is what makes it a good first credential.
What you will do 6 steps
Create a dedicated WordPress user
Open the user profile
Add an Application Password
Copy it once
Paste it into the client config
Verify, then rotate on a schedule
Create the user before you create the password
An Application Password inherits the WordPress user's capabilities. GoBuildWP's connection permission requires manage_options on a single site or super-admin access on multisite, so a dedicated identity separates attribution and revocation rather than automatically granting a smaller role. Narrow actual access with Read Only and per-ability controls, or use a scoped GoBuildWP token where the client supports one.
Create a dedicated WordPress user for the connection and check the capabilities required by its actual abilities. A generic Editor role is not a guarantee that a GoBuildWP workflow is available. Managing Connect requires manage_options on a single site or super-admin access on multisite; individual abilities have their own checks. Use Read Only, scoped credentials and per-ability controls to narrow the connection's authority, and verify both an allowed read and a refused operation.
- A dedicated WordPress user exists for this connection
- Its role is the minimum the workflow needs
- It has a real, monitored email address
- You know which safety profile will apply to it
Generate the password
Application Passwords are a WordPress core feature, not a GoBuildWP one. Sign in as the dedicated user, open Users → Profile, scroll to Application Passwords, enter a name that identifies the client and machine, for example "Cursor on the build laptop", and generate it.
WordPress displays the password exactly once, as a spaced 24-character string. Copy it immediately. The spaces are part of the display format; most clients accept it either with or without them, and GoBuildWP's generated configuration handles the formatting for you.
WordPress normally enables Application Passwords on HTTPS sites, with exceptions for local development. A missing section does not by itself prove HTTPS is absent: security plugins such as Wordfence and WordPress availability filters can disable it. Check HTTPS detection, the user's permissions and Application Password availability in GoBuildWP diagnostics. Remote hosted clients still need a publicly reachable HTTPS endpoint.
Put it into the client
Open the GoBuildWP Connect screen, choose your exact client, and switch to the Application Password route. GoBuildWP generates the configuration for that client's format, with your real endpoint at /wp-json/mcp/wppilot already filled in.
Store the result the way you would store any other production credential. Keep it out of source control, out of shared documents, and out of chat messages. A client configuration file that lands in a public repository is a live administrator credential if the user behind it is an administrator.
The Claude Desktop .mcpb bundle is a special case: it embeds the plaintext Application Password so the connector installs without prompts. That file is equivalent to the password itself. Do not share it, and delete it once the connector is installed.
- The configuration is stored in a secret manager or a gitignored path
- No credential has been pasted into a chat, ticket or shared doc
- Any downloaded .mcpb bundle has been deleted after installation
- The endpoint in the config matches your site exactly
Verify the connection
Keep the safety profile on Read Only for the first test. Ask the client to report the active profile, list the abilities it can see, inspect one schema, and read one non-sensitive object.
Then compare the actual credential identity with the intended dedicated user in the available connection or activity evidence. Unexpected attribution is a reason to inspect the loaded credential and user mapping; the displayed name alone does not prove the password was created on the wrong account. Ordinary reads do not create change-ledger entries.
- The client reports the MCP server as connected
- Discovery returns abilities
- Activity is attributed to the dedicated user
- A write is correctly refused while Read Only is active
Rotate and revoke
Application Passwords do not expire. They remain valid until someone revokes them, which is the main reason to prefer OAuth where the client supports it.
Revoke a password when the machine it was issued to is retired, when a team member leaves, when a credential may have been exposed, or when the task it was created for is finished. Revocation is immediate and is done from the same Users → Profile screen.
Name each password after the client and machine so that revoking the right one is unambiguous months later. A list of four passwords all called "MCP" is a list you cannot safely prune.
Two places to create one, and how to tell them apart
Create a WordPress application password from GoBuildWP's Connect screen
There are two ways to make the password, and they differ in whose account it lands on. The quicker one is inside GoBuildWP. On Connect a client, Step 1, choose Application password, optionally fill in Customize password name, and select Generate application password. GoBuildWP creates it on the account you are signed in with, names it GoBuildWP, or GoBuildWP followed by your text, adds a number if that name is already taken, and drops the value straight into the configuration Step 2 shows for your client. Copy password only copies just the value if you need it elsewhere.
Because it uses the signed-in account, this route only fits when the account that will act for the agent is also allowed to manage GoBuildWP, since the Connect screen requires that. Sign out of your own administrator account and in as the dedicated user first, or the password and every change made with it will belong to you.
Creating it on the user profile, then pasting it into GoBuildWP
You can also create the password through WordPress's user profile. The identity still needs GoBuildWP's connection authority: manage_options on a single site or super-admin access on multisite. A password for an ordinary Editor does not bypass that gate. Sign in as the intended authorized user, name the password and copy the value shown once.
Then an administrator who can manage GoBuildWP opens Connect a client, chooses Application password, selects I already have an application password, pastes the value into Paste the password value and selects Use this password. Step 2 then generates the client configuration with that password, but the username it fills in is the login of whoever is signed in to wp-admin, because that is the account the screen knows. Replace it with the dedicated user's login before saving the configuration; a password paired with the wrong username fails with 401.
- Dedicated user can manage GoBuildWP: generate from Connect a client while signed in as that user
- User-profile route: verify the owner's GoBuildWP connection authority before using its password
- Either way: edit the username in the configuration so it matches the password's owner
Auditing the passwords you have issued
Connect a client lists the passwords GoBuildWP created for your account, with when each was created and when it was last used, and a revoke control that warns any client using it will lose access. It lists only passwords whose name starts with GoBuildWP, so a password created on a profile under another name will not appear there; the full list lives on that user's profile, which also shows the last use and the address it came from.
Use the last-used column as a pruning signal. A password never used since it was created belongs to a setup that was abandoned; one unused for months belongs to a machine or a person that has moved on. Revoke both. A password used yesterday from an address you do not recognise is a different matter: revoke it first, then look at Changes, filtered to that user, for anything it did.
Signs the password is fine and something else is wrong
A 401 is not proof of a bad password. If the same password worked yesterday and nothing was revoked, the usual culprit is between the client and PHP: a proxy, a staging HTTP Basic password or a security plugin removing or rewriting the Authorization header. GoBuildWP's Diagnostics screen tests exactly that, along with whether WordPress currently accepts Application Passwords at all, and the troubleshooting guide lists what each result means. Fix the layer it names before issuing another password, or you will end up with several credentials and the same fault.
Questions this guide answers
The Application Passwords option is missing from my profile.
Check HTTPS detection and Application Password availability. WordPress normally requires HTTPS, with local-development exceptions, but security plugins, user permissions and availability filters can also hide the section. Its absence alone does not identify the cause; check GoBuildWP diagnostics and the relevant security settings.
I lost the password. Can I read it back?
No. WordPress displays it exactly once, at creation. Revoke it and create another rather than looking for a way to retrieve it.
Do Application Passwords expire?
No. They remain valid until someone revokes them, which is the main reason to prefer OAuth where the client supports it. Revoke when the machine is retired, when a team member leaves, when a credential may have been exposed, or when the task is finished.
Is the Claude Desktop .mcpb bundle safe to share?
No. It embeds the plaintext Application Password so the connector installs without prompts, which makes the file equivalent to the password itself. Do not share it, and delete it once the connector is installed.
How do I check the password was created on the right account?
Run one authorized read in Read Only and compare the actual credential identity with the intended user in available connection or activity evidence. Inspect the loaded configuration if attribution is unexpected; a displayed name alone does not prove a wrong-user credential. Ordinary reads do not create change-ledger entries.
Review noteRequirements and credential methods follow the shipped GoBuildWP source (WordPress 6.9+, PHP 8.0+). Client menus, account plans and third-party behaviour can change; use the installed version and live schema. Our evidence standard.