BuildWithHumza Application Password Audit

What you can do from the screen

• Sign a user out of every device at once
• Revoke a single application password without disturbing the others
• Export the whole report as CSV for a handover document or a security review

Remote access detection

A connected management dashboard is standing access just like a user account, and it survives a password change. The plugin reports whether MainWP Child, UpdraftPlus, ManageWP Worker and Wordfence are active, and where the pairing is readable it shows whether the site is connected and which WordPress user connected it .

Where a connection genuinely cannot be read, the plugin says so and explains why rather than guessing. Wordfence Central keeps its state in its own database table, so that one is reported as undetermined on purpose.

Who this is for

• Freelancers and agencies finishing a project or inheriting a site. Export the report and you have written evidence of exactly what access existed.
• Site owners checking that no former contractor, old staff account or forgotten integration still has a way in.
• Anyone who has ever created an application password and then forgotten about it.

Honest limitations

WordPress does not store login history, so no plugin can show you logins from before it was installed. This one starts recording when you activate it and displays “Not seen since [date]” rather than claiming a long-standing user has never logged in. Give it a few weeks before the login warnings mean much. Application password data is read from WordPress core and is accurate immediately.

The report loads the first 500 users by default because it is meant to be read by a person. Larger sites can raise that with the bwh_apa_user_limit filter.

Privacy

This plugin makes no external requests, loads no remote scripts and includes no tracking or analytics. It stores one timestamp per user and one option recording when tracking began. Uninstalling deletes both.