WordPress connection keys, explained: how TrustedLogin replaces the admin password
WordPress calls three different things a connection key; only one of them is ciphertext that authenticates nothing on its own.
-
-
TrustedLogin vs. sharing your admin password in a password manager
A shared vault holds a WordPress admin password nothing can expire — what a password manager solves, where it stops, and what a TrustedLogin grant replaces.
-
What the Essential Plugin backdoor teaches about who has access to your site’s code
A WordPress plugin portfolio changed hands on Flippa and shipped a backdoor eight months before it woke up. What that says about developer access and commit rights.
-
How to scope an MCP server’s WordPress access (so an agent can’t do everything an admin can)
Scoping an AI agent’s WordPress access, layer by layer: the Abilities API permission callback, the MCP transport gate, and the one user account every check runs against.
-
A one-hour master key is still a master key: WPForms, Rank Math, and the pattern underneath
Two plugin releases six weeks apart shipped support access without a request the customer could answer — read against their own changelogs and the disclosures.
-
Temporary admin access for WordPress: the right way to grant it
Four ways to grant temporary admin access to a WordPress site, scored against the same five criteria — including the free plugin that wins for one-off access.