How To Limit Application Passwords With BetterShield?
Restrict a WordPress application password to REST route prefixes, an address range, or both.
In BetterShield, BetterShield › Agents › Agent surface › Application passwords lists credentials across site accounts and offers Limit… for eligible entries.
What it does
A limit can restrict a credential to REST route prefixes, an address range, or both. Route prefixes are comma-separated, such as /bettershield/v1/. Leaving routes empty allows every route. The address field accepts the network range shown by the form. The default is no limit.
The list marks a credential stale after 90 days without use. The decoy credential cannot be limited because any attempted use is meant to be refused and reported.
Step 1: Limit Application Passwords
Find the credential, select Limit…, enter routes and/or an address range, then select Save limit. Use Change limit to edit it or Remove limit to remove it.
Recommended settings
Use the narrowest routes and network that match the connected tool. Test the tool before ending your administrative session.
What it can break and how to undo
An incorrect limit can stop the tool’s REST calls. Use Remove limit or the offered undo to restore unrestricted use. The credential itself remains the same.
Final Outcome
Make an allowed call and a call outside the limit. The allowed call should work and the other should be refused and recorded.
Related
- Create, test and end assistant connections
- Retire unused application passwords
- Filter and review agent activity
This is how you can limit application passwords with BetterShield.
Getting Stuck? Feel free to contact our Dedicated Support Team.