TransferForge
Log in Sign up

Menu

Account

Log in Sign up for free

WordPress Application Passwords Guide

To connect a WordPress site to the TransferForge dashboard, you need to use WordPress Application Passwords. This is a core WordPress authentication system that allows external applications to securely interact with the WordPress REST API.

Note: Application Passwords are separate, revocable credentials. They are completely different from the regular login password you use to sign in to your WordPress dashboard (wp-admin). Using your standard admin password will not work and is not secure.

How to Create an Application Password

Creating an application password takes less than a minute and is done entirely within your WordPress dashboard:

  1. Log in to your WordPress admin panel (/wp-admin).
  2. Navigate to Users → Profile in the sidebar. (If you are logged in as an administrator editing your own account, you can also go to Users → Your Profile).
  3. Scroll down to the Application Passwords section.
  4. In the New Application Password Name input field, enter a recognizable name (e.g., TransferForge).
  5. Click the Add New Application Password button.
  6. WordPress will generate a unique 24-character password (usually formatted in blocks of four, e.g., xxxx xxxx xxxx xxxx xxxx xxxx).
  7. Copy this password immediately. It will only be shown once. If you close the page or navigate away, you will have to revoke it and generate a new one.

Why Does TransferForge Need This?

TransferForge is a SaaS platform. To pull your templates and pages, convert their page builder structures, and push the converted layouts back to your target site, our system must authenticate requests made to your WordPress site's REST API. The TransferForge Bridge plugin works in tandem with the standard WordPress REST API, using this Application Password to verify that the incoming requests are authorized and secure.

Hosting & Firewall Troubleshooting

Connecting external applications to WordPress can sometimes run into security restrictions enforced by your hosting provider or security plugins. Here are the most common host-specific issues and how to bypass them:

WP Engine (WAF / Firewall Blocks)

WP Engine enforces aggressive firewall (WAF) rules that block REST API traffic originating from cloud application platforms (such as the Vercel servers powering TransferForge's conversion engine).

  • The Symptom: You get a "Connection failed" or "403 Forbidden" error when trying to connect your site, even though you entered the correct username and Application Password.
  • The Solution: Instead of entering your production custom domain (e.g., https://mycustomsite.com), use the default WP Engine internal domain (e.g., https://mycustomsite.wpengine.com or https://mycustomsite.wpstagecoach.com for staging).
  • Why this works: WP Engine's default WAF blocks public API requests to custom domains but allows authenticated REST API traffic on the default internal WP Engine domain. Connecting via the internal URL bypasses the firewall and allows the migration to proceed smoothly.
  • Note on plugins: If you are using plugins that restrict XML-RPC or REST API traffic (e.g., Wordfence, SG Security), you may also need to temporarily disable these options during the migration.

Cloudways & Custom VPS (CORS Blocked)

When you click "Connect Site" in TransferForge, the dashboard first tries to verify connectivity directly from your web browser (client-side) to bypass server-side firewall blocks. This direct browser call requires Cross-Origin Resource Sharing (CORS) to be enabled on your WordPress server.

  • The Symptom: Browser console shows CORS errors, or the connection page reports that direct verification failed due to CORS.
  • The Solution: TransferForge has a built-in automatic fallback that routes the connection check through our secure backend proxy if the browser-side check fails. However, if your server also blocks backend traffic, you may need to enable CORS on your host.
  • How to enable CORS on Cloudways: In the Cloudways Platform, go to your Application Settings, or add the following headers to your site's Nginx configuration (or via your .htaccess file if using Apache): 
    Header set Access-Control-Allow-Origin "https://app.transferforge.com"
Header set Access-Control-Allow-Methods "POST, GET, OPTIONS, PUT, DELETE"
Header set Access-Control-Allow-Headers "Content-Type, Authorization"

Security Plugins (Wordfence, Sucuri, iThemes)

Many WordPress security plugins disable Application Passwords or block REST API endpoints by default to prevent brute-force attacks.

  • Wordfence: Go to Wordfence → All Options → Login Security and ensure that "Disable XML-RPC" or REST API restrictions do not block application passwords.
  • SiteGround Security / SG Security: If you use SiteGround, check the SG Security plugin's "Disable XML-RPC" or "Restrict REST API" options. Temporarily toggle them off during the migration.
  • Direct REST API Blocks: If you use a plugin that blocks all non-logged-in REST API calls, you will need to whitelist our API or temporarily disable the restriction while TransferForge is connected.

Requirements & Prerequisites

  • WordPress Version: Application Passwords require WordPress 5.6 or higher.
  • HTTPS/SSL: WordPress core disables Application Passwords on insecure HTTP connections. Your site must have a valid SSL certificate (HTTPS) active.