Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If a WordPress integration, application password, or remote-backup connection may have been exposed, treat the credential as compromised: inventory its use, create a replacement, switch the client, test the authenticated request over HTTPS, and then revoke the old credential. A suspected UpdraftCentral compromise requires an additional sweep of every connected site, including administrator accounts, plugins, and must-use plugins, followed by deletion of each site’s connection key and a controlled reconnection.
WordPress Application Passwords are separate from a user’s normal sign-in password, so you can disable one integration without changing the person’s interactive login. The procedure below preserves useful evidence, limits interruption, and rebuilds a recovery path if an attacker has reached the backup system.
What exactly are you rotating in WordPress?
For most WordPress REST integrations, the credential to rotate is an Application Password. WordPress introduced Application Passwords in version 5.6 in December 2020. They are credentials designed to avoid sharing a user’s main account password with third-party tools. Each one belongs to a specific WordPress user and can be revoked independently.
An Application Password is not a second browser login password. A client sends the username and Application Password with HTTP Basic Authentication when calling the REST API. Because Basic Authentication exposes the secret to anyone who can read the request, the connection must use HTTPS from the client to the site. Never test a replacement over plain HTTP, even temporarily.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The Application Passwords panel records a UUID, the label you assigned, creation time, last-used time, and (where available) the last IP address. The “Last Used” value is intentionally not real-time: WordPress documentation says it is accurate to within 24 hours because WordPress avoids writing to the database on every request. These fields are useful clues, not a complete incident timeline.
Remote-backup products can also have their own provider or connection keys. Those keys are separate from WordPress Application Passwords. If the remote-backup service is connected through UpdraftCentral and may have been stolen, revoke the connection key on every connected WordPress installation rather than only on the site where you first noticed suspicious activity.
What should you do before changing a key?
Start with an inventory and evidence snapshot. Rotating a secret before you know which clients use it can break scheduled backups, deployment jobs, monitoring, or synchronization and can erase clues about misuse.
Free tools Windows power users keep installed
One-click scans. No signup required.
- List every integration. Include backup jobs, hosting panels, deployment tools, uptime monitors, mobile or desktop clients, automation scripts, and custom code that calls the REST API. Record the site, WordPress user, integration name, environment, and owner.
- Review each user’s Application Passwords. In the WordPress dashboard, open Users → Profile for the user, or edit that user from the Users screen. In the Application Passwords section, record each label, creation date, last-used time, and last IP shown. Use a descriptive note to associate the UUID with the integration in your incident log.
- Capture evidence before deletion. Export or copy the credential metadata, note suspicious times and IP addresses, and retain relevant hosting, WordPress, web-server, and backup-service logs. The WordPress guidance supports reviewing this metadata but does not define a universal forensic-retention period; your legal, regulatory, or incident-response requirements may be stricter.
- Identify the blast radius. Determine whether the credential could write content, upload files, manage users, or only read data. Check whether the same secret was copied into other sites, scripts, tickets, chat messages, or configuration files.
Do not put a live password in the incident log. Store any replacement secret in an encrypted password manager or secrets vault, and restrict access to the people who operate the integration.
How do you rotate a WordPress Application Password without losing the integration?
Use a create–switch–test–revoke sequence. Creating the replacement first gives you a safe overlap window; revoking first creates avoidable downtime.
- Open the user’s profile. Sign in with an account allowed to manage the relevant user, then go to Users → Profile (or edit the user). Confirm that you are working on the correct site and user.
- Create a replacement. In Application Passwords, enter an integration-specific name such as
nightly-backup-production-2026orcrm-sync-staging. Avoid labels such as “API” that cannot identify an owner or environment. Generate the password. - Copy it immediately. WordPress displays the generated Application Password only once. Copy it directly into an encrypted secret store; do not paste it into a ticket, email, shell history, or a source-control file. If you lose it, generate another replacement rather than trying to recover the displayed value.
- Update the client. Replace the old credential in the backup plugin, integration settings, environment variable, deployment secret, or scheduled job. Keep the username unchanged unless you are deliberately moving the integration to another account. Check that the client is configured for the HTTPS URL of the site.
- Run an authenticated test. Trigger a harmless API operation appropriate to the client, such as listing the resource it normally reads. Confirm the HTTP response, the expected account, and a successful entry in the client’s logs. Also check the WordPress and web-server logs for the request. If the integration performs writes, test in a staging site first or use a non-destructive operation.
- Revoke the old password. After the client has succeeded with the replacement, return to the Application Passwords list and revoke the old entry. Revoke every credential you cannot identify, no longer need, or believe was copied. Keep the replacement’s label and owner documented so the next review is unambiguous.
Schedule the switch during a period when a missed job is acceptable, but do not leave the old credential active indefinitely. If a backup job runs continuously, pause it only for the short interval needed to change the secret and confirm the next authenticated request.
How can you revoke an Application Password from the WordPress dashboard?
The dashboard is appropriate when you have administrative access and only a manageable number of credentials.
- Open Users → Profile, or edit the relevant user.
- Scroll to Application Passwords and match the label and metadata to your inventory.
- Use the revoke or delete control for the old, unknown, unused, or suspected-leaked entry.
- Refresh the page and verify that the entry no longer appears as an active credential.
- Check the integration’s next run. A failed request after revocation is expected for any client that still has the old secret; update that client rather than restoring the revoked password.
Revoking an Application Password does not require changing the user’s normal WordPress login password. Change the main password as well when you suspect the user’s interactive credentials, session, or recovery email may also be compromised.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How do you rotate and revoke keys with WP-CLI?
WP-CLI is useful for repeatable audits and for sites where dashboard access is unavailable. Run it as the WordPress system user or through your hosting provider’s approved command environment, and protect terminal history and output.
wp user application-password list <user> --fields=uuid,name,created,last_used,last_ipThe list command exposes the UUID, label, creation date, last-used value, and last IP for the specified user. Save the output in a restricted incident record before deleting anything.
wp user application-password delete <user> <uuid>Replace <user> with the WordPress login or user ID accepted by your WP-CLI installation and <uuid> with the exact credential UUID. Confirm the deletion prompt, then run the list command again to verify that the old entry is gone. Generate replacement credentials through the WordPress profile interface or your approved automation, update the dependent client, and test it before deleting the old UUID.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What should you do if UpdraftCentral remote-backup access is compromised?
Treat a suspected UpdraftCentral compromise as a multi-site incident. Deleting one WordPress Application Password does not revoke the provider connection keys held by other connected installations.
1. Map every connected installation
Use the UpdraftCentral administration records and your backup inventory to enumerate every connected WordPress site, including staging, development, and less frequently maintained sites. Record the connection owner and the last successful backup so you can distinguish an inactive site from an overlooked one.
2. Delete each site’s existing connection key
On every connected installation, remove the existing UpdraftCentral connection key using that site’s approved administrative procedure. Do this even when its Application Password list looks clean; the provider key is a separate trust relationship.
3. Inspect administrators and code
Review administrator accounts for newly created users, unexpected role changes, unfamiliar email addresses, and suspicious login activity. Inspect installed plugins and must-use plugins for additions, altered files, or code that could recreate access. Disable or remove anything you cannot verify, preserving a copy for investigation before destructive cleanup when appropriate.
4. Change administrator passwords
Change the passwords of administrators who may have been exposed, beginning with accounts that can manage plugins, users, or backups. Use unique passwords stored in an encrypted vault. If the same password was reused elsewhere, change it at those services too.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
5. Consider a pre-17 October restore
If compromise timing is uncertain, consider restoring from backups created before 17 October, as advised in the relevant security guidance. The date should be interpreted in the context of the incident year and your available restore points; verify that the selected backup predates suspicious changes and is complete before using it.
6. Reconnect only after the site is clean
Once administrator access, plugins, and files have been checked, generate new connection keys and reconnect each installation deliberately. Re-enable sites one at a time, perform a test backup, and verify that the remote copy is readable before resuming the normal schedule.
How do you preserve evidence while stopping access?
Containment and evidence collection can conflict, so separate the two deliberately. Capture Application Password metadata, connection-key identifiers, suspicious IP addresses and times, administrator lists, plugin inventories, and relevant logs before deleting credentials where doing so will not prolong active abuse.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Export web-server and hosting access logs covering the period around the first suspicious event.
- Keep WordPress security, authentication, backup, and remote-storage logs in read-only or access-controlled storage.
- Record who performed each revocation, on which site, at what time, and what verification followed.
- Hash or otherwise protect exported files if your incident process requires chain-of-custody controls.
- Do not infer an exact attack timeline from the Application Password “Last Used” field; its documented precision is within 24 hours and it does not capture every action taken with a credential.
If you need a formal forensic investigation, involve your hosting provider or incident-response specialist before wiping files or rebuilding servers. The immediate objective is to stop unauthorized access without destroying the records needed to understand it.
How do you rebuild a safe remote-backup system?
A backup is useful only if an attacker cannot erase or alter the recovery copy along with the live site. Keep backups in a remote location separate from the web server, and encrypt database backups.
Back up the complete site
Include the database, themes, plugins, uploads, and any other files required to restore the site. Document the retention period, schedule, encryption method, and the credentials or keys needed for decryption. Test that a restore can be performed without relying on the compromised connection.
Separate backup administration
Use a dedicated backup account or integration identity with the minimum permissions required. Keep its secret in encrypted storage, limit who can retrieve it, and avoid embedding it in publicly readable configuration or repositories.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteVerify restore capability
After reconnecting with new keys, run a test backup and confirm that the remote copy is complete and downloadable. Perform periodic test restores to a quarantined site so that a green backup status reflects an actual recovery path rather than only a successful upload.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How should you harden administrator access after rotation?
Credential revocation closes the known path; administrator hardening reduces the chance that a stolen password opens another one.
Use phishing-resistant authenticators
WordPress recommends passkeys or security keys. Passkeys provide phishing-resistant, passwordless login through platform authenticators such as Face ID, Touch ID, Windows Hello, or a hardware security key. Enroll at least two authenticators for each administrator so a lost device does not lock out the account. Store a spare hardware key securely and document its custodian.
Review XML-RPC exposure
Disable XML-RPC when no site feature requires it. If Jetpack or another client needs XML-RPC, restrict access to the required services and apply rate limits. Removing an unused endpoint reduces attack surface, but disabling it without checking dependencies can break legitimate publishing or synchronization.
Recommended Free Tools
Reduce standing privilege
Remove administrator roles that are no longer needed, use separate accounts for administration and everyday publishing, and review recovery email addresses and session activity. These controls complement Application Password rotation; they do not replace it.
Which response option fits your situation?
The right scope depends on what is known about the exposure and how much interruption the business can tolerate. Use the following comparison to choose a response, then document why you selected it.
| Response | Scope | Downtime | Evidence quality | Recovery confidence | Administrator assurance |
|---|---|---|---|---|---|
| Single integration rotation | One identified Application Password | Usually limited to the client switch and one test run | Metadata for that credential plus available logs | Depends on existing backups | Unchanged unless you also harden the account |
| Credential-wide cleanup | Every unknown, unused, or suspected-leaked Application Password for the affected users | Higher; several clients may need coordinated updates | Broader metadata and log review | Depends on whether clean remote copies exist | Improved only when administrator controls are reviewed |
| Remote-backup compromise response | Every UpdraftCentral-connected installation, its connection key, administrators, plugins, and must-use plugins | Potentially substantial during inspection and controlled reconnection | Requires cross-site, hosting, WordPress, and backup logs | Highest when pre-incident remote backups are verified and restorable | Requires password changes plus passkeys or security keys |
| Full rebuild or pre-17 October restore | Sites and data affected by suspected persistence or uncertain integrity | Longest; plan a maintenance window and validation | Best when images, logs, and clean restore points are preserved | Strong only after a successful clean restore and test backup | Re-enroll authenticators and recreate integrations from scratch |
What can go wrong during rotation?
The new password was not saved
WordPress does not redisplay a generated Application Password. Create another one, store it immediately in encrypted storage, and update the integration with that new value.
The client still reports authentication failures
Check for a copied character, an outdated environment variable, the correct WordPress username, and an HTTPS endpoint. Confirm that the client is not reading a second configuration file or cached secret. Review the WordPress and client logs before revoking additional credentials.
Backups stopped after revocation
Identify which job still uses the old credential, update it, and run a manual test. Do not reactivate a credential that was revoked because it was unknown or suspected to be leaked; issue a new one with a distinct label.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
A connected site cannot be re-added
Verify that its old UpdraftCentral connection key was deleted, administrator access is intact, and the site can reach the provider over HTTPS. Inspect must-use plugins and firewall or rate-limit rules that could block the new connection. Reconnect one site at a time and confirm a completed remote backup.
Logs disagree about the timing
Normalize timestamps to UTC, account for the Application Password metadata’s 24-hour precision, and compare web-server, hosting, WordPress, and backup-service records. Treat the earliest reliable log entry as evidence of activity, not proof that it was the first access.
How often should you review and rotate credentials?
Rotate immediately when a credential is exposed, an owner leaves, an integration changes hands, or logs show suspicious use. For long-lived integrations, set an internal review interval based on risk and the provider’s capabilities rather than relying on a password’s age alone.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →At each review, remove abandoned entries, confirm that labels still identify an owner and environment, check last-used metadata, verify that backups are remote and encrypted, and test a restore on a schedule appropriate to the site’s importance. Keep two administrator authenticators enrolled and verify that the spare still works before it is needed.
Frequently Asked Questions
Can I rotate a WordPress API credential without changing the user’s login password?
Yes. An Application Password is independent of the user’s interactive password, so you can replace or revoke it without changing normal dashboard sign-in credentials. Change the main password too if you suspect the administrator account or its recovery channels were exposed.
Does the Application Password last-used IP prove that an attacker accessed my site?
No. It shows a recorded use associated with that credential, but the value may be up to 24 hours behind and does not describe every API action. Correlate it with web-server, hosting, WordPress, and backup logs before drawing conclusions.
How long can the old and new credentials overlap?
Keep the overlap only for the time needed to update the client and verify a successful HTTPS request. Leaving both active longer increases the number of valid secrets and makes it harder to know which one generated later activity.
What should I check before trusting a restored WordPress backup?
Confirm that the restore point predates the suspected compromise, includes the database and required site files, and can be opened in an isolated environment. Change administrator credentials and recreate integrations after the restore instead of carrying potentially exposed secrets into the clean site.
Is a remote backup safe if it uses the same administrator account as WordPress?
It is weaker than a dedicated, least-privileged integration identity because compromise of the administrator account can affect both the site and its recovery path. Separate backup administration, encrypt database backups, and keep the remote copy outside the web server so one intrusion is less likely to destroy both.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
