Title: BuildWithHumza Application Password Audit Author: Mohammad Humza Published: September 26, 2026 Last modified: September 26, 2026 --- Search plugins ![](https://ps.w.org/buildwithhumza-password-audit/assets/banner-772x250.png?rev =3714341) ![](https://ps.w.org/buildwithhumza-password-audit/assets/icon-256x256.png?rev=3714341) # BuildWithHumza Application Password Audit By [Mohammad Humza](https://profiles.wordpress.org/mohammadhumza/) [Download](https://downloads.wordpress.org/plugin/buildwithhumza-password-audit.1.0.0.zip) * [Details](https://wordpress.org/plugins/buildwithhumza-password-audit/#description) * [Reviews](https://wordpress.org/plugins/buildwithhumza-password-audit/#reviews) * [Installation](https://wordpress.org/plugins/buildwithhumza-password-audit/#installation) * [Development](https://wordpress.org/plugins/buildwithhumza-password-audit/#developers) [Support](https://wordpress.org/support/plugin/buildwithhumza-password-audit/) ## Description WordPress hides application passwords on each user’s own profile page. If your site has twenty users, checking them all means opening twenty profiles. There is no screen anywhere in WordPress that answers the obvious question: **Who, and what, can get into this site right now?** BuildWithHumza Application Password Audit adds that screen under **Tools**. It is read-only apart from two deliberate revoke buttons, and it never sends anything anywhere. #### Why application passwords matter An application password is a permanent key. It is created once for a script, a mobile app, a backup service or an integration, it works over the REST API, and **it never expires on its own**. Changing your WordPress password does not revoke it. Most site owners have no idea how many exist, who created them, or whether anything is still using them. This plugin lists every one of them, site-wide, with the date it was created, the date it was last used, and the IP address it was last used from. #### What the report shows * **Application passwords** for every user, with created date, last used date and last IP * **Active login sessions** per user, so you can see who is currently signed in somewhere * **Last login** for every user, recorded from the moment you activate the plugin * **Roles**, with accounts that can fully control the site clearly marked * **Remote management tools** that hold standing access: MainWP, UpdraftCentral, ManageWP and Wordfence * **Warning flags** on anything that looks abandoned #### The flags are the point A list of twenty application passwords tells you nothing. The plugin marks the ones worth acting on: * Application passwords that have **never been used at all** * Application passwords **unused for over 90 days** * Administrators who have **not logged in for over 90 days** * Administrators with **no recorded login** since tracking began Flagged rows sort to the top, so you read the risk first instead of scrolling. #### What you can do from the screen * Sign a user out of every device at once * Revoke a single application password without disturbing the others * Export the whole report as CSV for a handover document or a security review #### Remote access detection A connected management dashboard is standing access just like a user account, and it survives a password change. The plugin reports whether MainWP Child, UpdraftPlus, ManageWP Worker and Wordfence are active, and where the pairing is readable it shows whether the site is connected and **which WordPress user connected it**. Where a connection genuinely cannot be read, the plugin says so and explains why rather than guessing. Wordfence Central keeps its state in its own database table, so that one is reported as undetermined on purpose. #### Who this is for * **Freelancers and agencies** finishing a project or inheriting a site. Export the report and you have written evidence of exactly what access existed. * **Site owners** checking that no former contractor, old staff account or forgotten integration still has a way in. * **Anyone who has ever created an application password** and then forgotten about it. #### Honest limitations WordPress does not store login history, so no plugin can show you logins from before it was installed. This one starts recording when you activate it and displays “Not seen since [date]” rather than claiming a long-standing user has never logged in. Give it a few weeks before the login warnings mean much. Application password data is read from WordPress core and is accurate immediately. The report loads the first 500 users by default because it is meant to be read by a person. Larger sites can raise that with the `bwh_apa_user_limit` filter. #### Privacy This plugin makes no external requests, loads no remote scripts and includes no tracking or analytics. It stores one timestamp per user and one option recording when tracking began. Uninstalling deletes both. ## Screenshots [⌊The report under Tools: summary tiles, then the flagged accounts sorted to the top with the application passwords each one holds.⌉⌊The report under Tools: summary tiles, then the flagged accounts sorted to the top with the application passwords each one holds.⌉[ The report under Tools: summary tiles, then the flagged accounts sorted to the top with the application passwords each one holds. [⌊Every flag spelled out on the row it belongs to, with an administrator marked critical and an editor marked review.⌉⌊Every flag spelled out on the row it belongs to, with an administrator marked critical and an editor marked review.⌉[ Every flag spelled out on the row it belongs to, with an administrator marked critical and an editor marked review. [⌊The remote access section showing which management dashboards are connected and who connected them.⌉⌊The remote access section showing which management dashboards are connected and who connected them.⌉[ The remote access section showing which management dashboards are connected and who connected them. ## Installation 1. Install through **Plugins > Add New**, or upload the folder to `/wp-content/plugins/`. 2. Activate it. 3. Go to **Tools > Access Audit**. Viewing the report requires the `list_users` capability. Revoking a session or an application password additionally requires permission to edit that particular user, so an editor cannot revoke an administrator’s access. ## FAQ ### What is a WordPress application password? It is a separate password used by apps and scripts to reach your site over the REST API, added in WordPress 5.6. It bypasses the normal login form, it does not expire, and changing your account password does not revoke it. That combination is why they are worth auditing. ### How do I see all application passwords in WordPress? WordPress core only shows them on each user’s individual profile screen. This plugin collects them from every user onto one page under Tools, along with when each was last used. ### Why does a user show “Not seen since” a date? WordPress does not record login times, so the plugin collects them itself from the moment you activate it. Anyone who has not logged in since then shows that message until they next log in. It is not a claim that they have never logged in. ### Is it safe to revoke an application password? Revoking one stops whatever was using it, so an integration relying on it will begin to fail. That is usually the intent. Check the last used column first: a password that has never been used is almost always safe to remove. ### Does this slow down my site? No. The only thing running on the front end is one timestamp write when somebody logs in. The report is built on demand when you open the page. ### How is this different from an activity log plugin? An activity log answers “what happened?” This answers “what is true right now?” They complement each other. An activity log will not tell you that an application password created eight months ago has never once been used. ### Can I change the 90 day threshold? Yes. Use the `bwh_apa_stale_login_days` and `bwh_apa_unused_password_days` filters. ### Does it work on multisite? It reports on the site you run it from. Network-wide reporting is not in this version. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “BuildWithHumza Application Password Audit” is open source software. The following people have contributed to this plugin. Contributors * [ Mohammad Humza ](https://profiles.wordpress.org/mohammadhumza/) [Translate “BuildWithHumza Application Password Audit” into your language.](https://translate.wordpress.org/projects/wp-plugins/buildwithhumza-password-audit) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/buildwithhumza-password-audit/), check out the [SVN repository](https://plugins.svn.wordpress.org/buildwithhumza-password-audit/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/buildwithhumza-password-audit/) by [RSS](https://plugins.trac.wordpress.org/log/buildwithhumza-password-audit/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.0 * First release. * Site-wide application password report with created date, last used date and last IP. * Active session counts per user, with sign out everywhere. * Last login tracking and stale access flags. * Remote management detection for MainWP, UpdraftPlus, ManageWP and Wordfence. * CSV export. ## Meta * Version **1.0.0** * Last updated **18 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.0 or higher ** * Tested up to **7.1.2** * PHP version ** 7.4 or higher ** * Tags * [application-passwords](https://wordpress.org/plugins/tags/application-passwords/) [last login](https://wordpress.org/plugins/tags/last-login/)[security audit](https://wordpress.org/plugins/tags/security-audit/) [sessions](https://wordpress.org/plugins/tags/sessions/)[user management](https://wordpress.org/plugins/tags/user-management/) * [Advanced View](https://wordpress.org/plugins/buildwithhumza-password-audit/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/buildwithhumza-password-audit/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/buildwithhumza-password-audit/reviews/) ## Contributors * [ Mohammad Humza ](https://profiles.wordpress.org/mohammadhumza/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/buildwithhumza-password-audit/)