How to connect a WordPress site

• WordPress 5.6 or newer (Application Passwords are built into WordPress)
• A site reachable over HTTPS — WordPress only allows Application Passwords over a secure connection
• An account with administrator rights, so we can read plugins, themes, versions and server status

1. Log in to the site's wp-admin.
2. Go to Users → Profile.
3. Scroll down to Application Passwords.
4. Enter a recognisable name, for example Securepress, and click Add New Application Password.
5. Copy the 24-character password that appears. WordPress only shows it once; the spaces may stay.

1. In the dashboard, click Connect site.
2. Enter a name (for example the client name) and the full site URL, starting with https://.
3. Enter the WordPress username (not the email address) and paste the Application Password.
4. Click Connect. We test the connection right away and run the first scan.

• No main password: you never share your regular WordPress password. An Application Password only works for the API, not for logging in to wp-admin.
• Stored encrypted: the password is encrypted with AES-GCM before it is stored. The key is kept separately as a server secret.
• Never in the browser: the password is only decrypted on our server at scan time, and is never sent back to your browser or shown in the dashboard.
• Isolated per account: credentials live in separate, locked storage that even signed-in users cannot access.
• Encrypted connections only: we only connect over HTTPS.
• Instantly revocable: in WordPress you revoke the Application Password with one click. The connection stops immediately.
• No plugin: no extra code on the site, so no extra attack surface.

Tip: create a separate Application Password per site with a clear name. That way you can revoke one connection without affecting the rest.

• Wrong username or password: make sure you use the username (not the email address) and the Application Password, not your regular password.
• Access denied: a security plugin (such as Wordfence, iThemes or All-In-One Security) or the host may block the REST API or Application Passwords. Allow them in the settings.
• No Application Passwords visible: the site doesn't run over HTTPS, or a plugin has disabled the feature.
• Firewall or Cloudflare: a strict firewall can block our requests. Lower any bot blocking for /wp-json/ or add an exception.