by /
Having to log in each time for Claude to work on websites is annoying.
Claude won’t use your real password or 2FA for security reasons. Good. You don’t want it to. One failed login on a shared host trips Wordfence and blocks every site on the server, not just yours.
So here’s the fix. WordPress has a built-in feature called Application Passwords, available since version 5.6. It’s already on your site. You just need to turn one on.
As WordPress itself explains, Application Passwords allow authentication via non-interactive systems, such as the REST API, without providing your actual password. They can be easily revoked and cannot be used for traditional logins to your website.
In plain terms, it’s a separate 24-character key that works over the API only. Never touches the login screen. Never triggers your firewall. Never sees your 2FA. And you can kill it in one click without affecting your real login.
Think of it this way. You’re handing the agent a key you can take back, instead of a password you can’t un-share.
How to create one
Takes about 60 seconds.
1. Log in to your website dashboard (/wp-admin/).
2. Go to Users → Profile.
3. Scroll to the bottom to Application Passwords.
4. Type a label (e.g., agent-publish).
5. Click Add New Application Password.
6. Copy the 24-character key right away. It only shows once.
Hand that key to your agent. Done. The agent connects over the REST API and publishes without ever needing you to log in again.
If you forgot to copy the key, just delete that entry and mint a new one. No harm done.
Even easier: let the agent mint its own key
If you’re logged into wp-admin, your agent can create its own Application Password through the WordPress REST API using your active session. You don’t copy or paste anything. The agent mints the key, stores it, and works independently from that point on.
You log in once. The agent handles everything after that.
How to revoke it
Go back to Users → Profile → Application Passwords, find the label, click Revoke. Dead instantly. Your real login is untouched. Mint a fresh one whenever you want the agent back in.
This is the model for every site we manage. Humans don’t log in every day. Agents do. You log in once, hand over the key, and get out of the way.
Dennis Yu
Dennis Yu is the CEO of Local Service Spotlight, a platform that amplifies the reputations of contractors and local service businesses using the Content Factory process. He is a former search engine engineer who has spent a billion dollars on Google and Facebook ads for Nike, Quiznos, Ashley Furniture, Red Bull, State Farm, and other brands.
Dennis has achieved 25% of his goal of creating a million digital marketing jobs by partnering with universities, professional organizations, and agencies. Through Local Service Spotlight, he teaches the Dollar a Day strategy and Content Factory training to help local service businesses enhance their existing local reputation and make the phone ring.
Dennis coaches young adult agency owners serving plumbers, AC technicians, landscapers, roofers, electricians, and believes there should be a standard in measuring local marketing efforts, much like doctors and plumbers must be certified.