Create a WordPress application password for Searkin
Searkin connects to your WordPress site with an application password. It takes two minutes to create, is used only by Searkin and can be revoked in one click.
Last updated: 2 November 2026What it is for
An application password is a dedicated access key created in your WordPress profile. It is not your login password. It cannot open the admin dashboard: it only works with the WordPress REST API.
With this access, Searkin can:
- write the SEO titles and meta descriptions of your pages and posts;
- create redirects, for example to a page that has moved;
- read your content for a more accurate audit.
Nothing changes without your approval. Every fix waits for your go-ahead in Searkin before it is written to the site.
The Searkin app is in French: interface labels are quoted in French below, with their English meaning in brackets.
Requirements
- WordPress 5.6 or later. Application passwords have been built into WordPress since that version, no plugin needed.
- An administrator or editor account. An editor is enough for titles and descriptions. For redirects, use an administrator.
- A site on HTTPS. Without HTTPS, WordPress hides the feature.
If the feature is turned off
Some security plugins and some hosts turn application passwords off. The section then does not show in the profile. To turn it back on:
- Wordfence: open Wordfence › Login Security › Settings and untick “Disable WordPress application passwords”. Save.
- Other security plugins (Solid Security, All-In-One Security…): look for an “Application Passwords” or “REST API” setting and allow them.
- Host: some block them with a mandatory plugin. Ask their support to turn WordPress application passwords back on for your site.
Create the password in WordPress
- Log in to WordPressUse an administrator account, or an editor account if you don’t need redirects. The application password gets the same permissions as this account.
- Open your profileIn the left-hand menu, click Users › Profile.
- Find the “Application Passwords” sectionIt is at the bottom of the profile page. If it is missing, see Requirements above.
- Name the password “Searkin”Type Searkin in the “New Application Password Name” field. The name helps you find it later if you want to revoke it.
- Click “Add New Application Password”WordPress generates a 24-character password, shown in groups of four.
- Copy the passwordIt is shown only once. Copy it right away, with or without the spaces: both work. If you lose it, revoke it and create a new one.
Paste it into Searkin
- Open the site connection in SearkinFor a site you have already added: Site settings › Site connection (“Réglages du site › Connexion au site”). For a new site: the “Corrections” step of the “Connecter un site” (Connect a site) flow.
- Choose WordPress and check the site addressUse the HTTPS address of the site, for example https://www.example.com.
- Enter the WordPress usernameThis is the account’s login name, shown at the top of Users › Profile (“Username” field). Not the email address, if it is different.
- Paste the application passwordIn the “Mot de passe d’application” (Application password) field. Not your WordPress login password.
- Click “Tester et enregistrer” (Test and save)In the site settings, the button reads “Enregistrer et tester” (Save and test). Searkin checks access, saves the connection and shows which SEO plugin it found.
If the test fails, Searkin shows the error returned by WordPress. Common cases are covered in Troubleshooting.
Supported plugins
Searkin writes titles and descriptions into the fields of your SEO plugin. It supports:
- Yoast SEO
- Rank Math
- SEOPress
- All in One SEO
The installed plugin is detected during the connection test. Nothing to set up on your side.
Redirects: Searkin uses the free Redirection plugin. Install and activate it from the Plugins menu if you want Searkin to apply the redirects you approve.
Troubleshooting
Searkin shows a 401 error. What should I do?
Access is denied. First check the username: it is the WordPress username, not the email address. Then make sure you pasted the application password, not your login password, and that it has not been revoked.
If everything is right, your host may be stripping the Authorization header (common on Apache with CGI or FastCGI). Add this line at the top of your .htaccess file, before the WordPress rules, then test again:
SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
There is no “Application Passwords” section in my profile.
Three possible causes: the site is not on HTTPS, WordPress is older than 5.6, or a security plugin or your host has turned the feature off. Move the site to HTTPS, update WordPress, then turn application passwords back on in the plugin concerned (Wordfence, for example) or ask your host to.
The test fails with a 403 error, a timeout or a block page.
A firewall is blocking the WordPress REST API (/wp-json). It can be a security plugin (Wordfence, Solid Security, a plugin that disables the REST API), a web application firewall such as Cloudflare, or your host’s firewall. Allow authenticated requests to /wp-json/, or ask your host to, then test again.
The connection works but redirects are not applied.
Searkin creates redirects with the free Redirection plugin. Install and activate it, then run the connection test again. By default the plugin requires an administrator account: an editor account is not enough.
Revoke access
You can cut off Searkin’s access at any time, without touching the rest of the site:
- in WordPress, open Users › Profile, “Application Passwords” section;
- on the Searkin row, click “Revoke”.
Access stops immediately. Searkin can no longer write anything to the site and the connection test fails. To restore it, create a new password and follow the steps again.
Changing your WordPress login password does not revoke application passwords. To cut off access, use “Revoke”.