Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11To limit Claude’s access to WordPress, connect it through a dedicated user account with only the capabilities needed for the task, then expose only the necessary actions in your MCP server. An Application Password authenticates as that user; it does not create a separate role or give Claude administrator privileges by itself.
How WordPress access controls limit Claude
There are two related controls to consider: the WordPress user’s capabilities and, when you use MCP, the actions the server makes available. WordPress roles bundle capabilities such as reading, editing, publishing, and managing site settings. Authenticated API requests are limited by the capabilities of the user whose credentials are being used. Plugins and custom code can change the default capabilities, so a role label alone does not prove what the account can do. WordPress documents roles and capabilities.
As an Amazon Associate I earn from qualifying purchases.
An Application Password is a per-application API credential associated with a WordPress user. It does not create a new WordPress user, role, or independent permission set. In an MCP setup, the server’s exposed abilities are another boundary: each ability should check the minimum capability it needs, and you should not expose powerful or destructive operations without appropriate checks. WordPress’s MCP Adapter guidance recommends a specific user with limited capabilities, especially in production.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose a role based on the work Claude must do
Start by listing the exact tasks: read existing content, draft or edit posts, publish, upload media, or perform another discrete operation. Do not assume that an integration needs Administrator access simply because it connects to the site.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Default role | Relevant default access |
|---|---|
| Super Admin | Network administration access in WordPress Multisite. |
| Administrator | Access to administration features on a single site. |
| Editor | Can publish and manage posts, including posts written by others. |
| Author | Can publish and manage their own posts. |
| Contributor | Can write and manage their own posts, but cannot publish them. |
| Subscriber | Has only the read capability in the documented defaults. |
These are WordPress’s documented default role descriptions, not guarantees for every site. Multisite network permissions differ, and plugins or custom code may add or remove capabilities. If the built-in roles do not fit the task, have a site administrator assess a custom role rather than granting broad permissions as a shortcut. See Roles and Capabilities.
Create a dedicated WordPress user and Application Password
- Make a task list. Decide whether the connection needs read-only access, the ability to edit its own content, access to other users’ content, publishing, media uploads, or another operation. Omit tasks it does not need.
- Create or select a dedicated user. In WordPress administration, create or select an account used for this integration rather than reusing a personal administrator account. Assign a role whose capabilities cover the approved tasks.
- Review the account’s actual capabilities. Account for capabilities added or changed by plugins, custom code, or Multisite configuration. If you are building an MCP integration, check that each exposed ability enforces the minimum required capability.
- Open the user profile. In wp-admin, open the dedicated user’s profile and find the Application Passwords section. The exact surrounding profile navigation can vary by WordPress version and site configuration.
- Generate a named credential. Enter a name that identifies the integration, then generate the Application Password. WordPress displays the generated secret only once; copy it immediately into the client’s secure configuration.
- Configure the client. Use the WordPress username and generated Application Password for API authentication, along with the endpoint and settings required by the selected MCP server and Claude client. Follow that server’s current setup instructions; do not assume every MCP implementation uses the same configuration.
- Test both sides of the boundary. Confirm the integration can complete its intended task and cannot perform actions outside the approved capabilities or exposed abilities. If it can do too much, narrow the user’s capabilities or remove MCP abilities rather than relying on the secret alone.
Protect and revoke the credential
Application Passwords are intended for programmatic API access, not interactive sign-in at wp-login.php. WordPress stores them hashed, shows each generated value only once, and lets an administrator revoke credentials individually. They were introduced in WordPress 5.6 in December 2020. Availability is normally tied to HTTPS, but site filters or other code can disable or alter it. Details are in the Application Passwords documentation, last updated January 28, 2026.
Rank #2
- HARDWARE 2FA AND MFA: FIDO Alliance Certified FIDO2 v2.1 with CTAP2 plus legacy U2F and CTAP1 for strong two-factor login and passwordless sign-in on services that support security keys
- BUILDING ACCESS ON ONE CARD: MIFARE DESFire EV2 4K applet with AES encryption adds office door and physical access control alongside digital authentication
- CERTIFIED SECURE ELEMENT: An NXP Common Criteria EAL6+ certified secure controller and Java Card platform protects your keys on a tamper-resistant chip
- DUAL INTERFACE SMART CARD: Contactless NFC ISO 14443 plus ISO 7816 contact reader support in an ISO 7810 ID-1 format that is passive and needs no battery
- SWISS ENGINEERED DESIGN: Built by Cryptnox as a single card for authentication and access control and backed by a 2 year warranty
- Use HTTPS. WordPress describes Application Password authentication using HTTP Basic Authentication and warns that credentials can be intercepted if sent without encryption. Do not send them over an unencrypted connection.
- Keep the secret private. Store it in the client’s secure configuration. Do not put it in published examples, public repositories, or other places where someone else could use it.
- Revoke when access is no longer needed. Return to the user’s Application Passwords section and revoke that integration’s credential when retiring the connection or if you suspect exposure. Revoking the credential ends that credential’s access; review the user’s other credentials separately if needed.
Troubleshoot authentication without granting more access
If Claude or the MCP client cannot authenticate, first check the connection and credential path before assigning a more powerful role. WordPress notes that proxies or clients may strip the Authorization header, which can prevent HTTP Basic Authentication from reaching WordPress.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →- Verify that the site is being accessed over HTTPS and that Application Passwords are enabled for the site.
- Check that the client is sending the WordPress username and the generated Application Password, rather than the account’s normal login password.
- Check whether a proxy or client is removing the
Authorizationheader. - If authentication succeeds but an action is denied, inspect the user’s capabilities and, for MCP, the ability’s permission check. Do not broaden permissions unless the task genuinely requires them.
Use the right MCP server for your site
Do not confuse a connector for an independently hosted WordPress site with the WordPress.org MCP Server described in the Plugin Handbook. The documented WordPress.org MCP Server is for tasks involving the WordPress.org Plugin Directory, not a general connection to an arbitrary site. Check the selected server’s purpose, compatibility, endpoint, and current configuration instructions before supplying credentials. See Using the WordPress.org MCP Server, last updated March 20, 2026.
Quick Recap
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Rank #3
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
