WordPress connection keys, explained: how TrustedLogin replaces the admin password
WordPress calls three different things a connection key; only one of them is ciphertext that authenticates nothing on its own.
-
-
How to scope an MCP server’s WordPress access (so an agent can’t do everything an admin can)
Scoping an AI agent’s WordPress access, layer by layer: the Abilities API permission callback, the MCP transport gate, and the one user account every check runs against.
-
Temporary admin access for WordPress: the right way to grant it
Four ways to grant temporary admin access to a WordPress site, scored against the same five criteria — including the free plugin that wins for one-off access.
-
How to revoke admin access from someone who no longer needs it
The ticket closed weeks ago and the Administrator account is still there — how to find and remove leftover WordPress access, account and Application Password both.
-
How to give your support team access to a customer’s WordPress site (without emailing a password)
A customer pasted their admin password into a ticket. Here’s what to ask for instead — Application Passwords, a temporary-login plugin, or scoped access.