BuildWithHumza Application Password Audit
The report under Tools: summary tiles, then the flagged accounts sorted to the top with the application passwords each one holds.
WordPress hides application passwords on each user’s own profile page. If your site has twenty users, checking them all means opening twenty profiles. There is no screen anywhere in WordPress that answers the obvious question:
Who, and what, can get into this site right now?
BuildWithHumza Application Password Audit adds that screen under Tools. It is read-only apart from two deliberate revoke buttons, and it never sends anything anywhere.
Why application passwords matter
An application password is a permanent key. It is created once for a script, a mobile app, a backup service or an integration, it works over the REST API, and it never expires on its own. Changing your WordPress password does not revoke it. Most site owners have no idea how many exist, who created them, or whether anything is still using them.
This plugin lists every one of them, site-wide, with the date it was created, the date it was last used, and the IP address it was last used from.
What the report shows
- Application passwords for every user, with created date, last used date and last IP
- Active login sessions per user, so you can see who is currently signed in somewhere
- Last login for every user, recorded from the moment you activate the plugin
- Roles, with accounts that can fully control the site clearly marked
- Remote management tools that hold standing access: MainWP, UpdraftCentral, ManageWP and Wordfence
- Warning flags on anything that looks abandoned
The flags are the point
A list of twenty application passwords tells you nothing. The plugin marks the ones worth acting on:
- Application passwords that have never been used at all
- Application passwords unused for over 90 days
- Administrators who have not logged in for over 90 days
- Administrators with no recorded login since tracking began
Flagged rows sort to the top, so you read the risk first instead of scrolling.
What you can do from the screen
- Sign a user out of every device at once
- Revoke a single application password without disturbing the others
- Export the whole report as CSV for a handover document or a security review
Remote access detection
A connected management dashboard is standing access just like a user account, and it survives a password change. The plugin reports whether MainWP Child, UpdraftPlus, ManageWP Worker and Wordfence are active, and where the pairing is readable it shows whether the site is connected and which WordPress user connected it.
Where a connection genuinely cannot be read, the plugin says so and explains why rather than guessing. Wordfence Central keeps its state in its own database table, so that one is reported as undetermined on purpose.
Who this is for
- Freelancers and agencies finishing a project or inheriting a site. Export the report and you have written evidence of exactly what access existed.
- Site owners checking that no former contractor, old staff account or forgotten integration still has a way in.
- Anyone who has ever created an application password and then forgotten about it.
Honest limitations
WordPress does not store login history, so no plugin can show you logins from before it was installed. This one starts recording when you activate it and displays “Not seen since [date]” rather than claiming a long-standing user has never logged in. Give it a few weeks before the login warnings mean much. Application password data is read from WordPress core and is accurate immediately.
The report loads the first 500 users by default because it is meant to be read by a person. Larger sites can raise that with the bwh_apa_user_limit filter.
Privacy
This plugin makes no external requests, loads no remote scripts and includes no tracking or analytics. It stores one timestamp per user and one option recording when tracking began. Uninstalling deletes both.