# How To Limit Application Passwords With BetterShield?

Restrict a WordPress application password to REST route prefixes, an address range, or both.

In **[BetterShield](/)**, **BetterShield › Agents › Agent surface › Application passwords** lists credentials across site accounts and offers **Limit…** for eligible entries.

## What it does

A limit can restrict a credential to REST route prefixes, an address range, or both. Route prefixes are comma-separated, such as `/bettershield/v1/`. Leaving routes empty allows every route. The address field accepts the network range shown by the form. The default is no limit.

The list marks a credential **stale** after 90 days without use. The decoy credential cannot be limited because any attempted use is meant to be refused and reported.

<span id="set-it-up" aria-hidden="true"></span>

## Step 1: Limit Application Passwords

Find the credential, select **Limit…**, enter routes and/or an address range, then select **Save limit**. Use **Change limit** to edit it or **Remove limit** to remove it.

<figure class="doc-shot">
  <img src="/docs/screenshots/application-password-limits.png" alt="Application passwords section explaining where connected tools and agents sign in and showing current credential holders." width="1960" height="262" loading="lazy" decoding="async">
  <figcaption>The Surface brings application passwords into one site-wide review.</figcaption>
</figure>

## Recommended settings

Use the narrowest routes and network that match the connected tool. Test the tool before ending your administrative session.

## What it can break and how to undo

An incorrect limit can stop the tool's REST calls. Use **Remove limit** or the offered undo to restore unrestricted use. The credential itself remains the same.

<span id="check-it-is-working" aria-hidden="true"></span>

## Final Outcome

Make an allowed call and a call outside the limit. The allowed call should work and the other should be refused and recorded.

<figure class="doc-shot">
  <img src="/docs/screenshots/application-password-limits.png" alt="Application passwords section explaining where connected tools and agents sign in and showing current credential holders." width="1960" height="262" loading="lazy" decoding="async">
  <figcaption>Example Application password limits view. Check the saved values and status on your own site.</figcaption>
</figure>

## Related

- [Create, test and end assistant connections](/docs/assistant-connections/)
- [Retire unused application passwords](/docs/retire-unused-application-passwords/)
- [Filter and review agent activity](/docs/review-agent-activity/)

This is how you can limit application passwords with BetterShield.

Getting Stuck? Feel free to contact our [Dedicated Support Team](/support/).