GOMAX ULTIMATE 5.68.0 lets you see every Application Password on your WordPress site — the API credentials that access your site without the main password — revoke any you don't recognise, review who has admin access with an access-security score, and list current login sessions, all from your own site. Application Passwords are powerful and easy to forget about; this gives you a single place to audit and clean them up.
If you've ever connected a tool, a GPT, or a mobile app to your site, it likely created an Application Password. This release makes those visible and revocable, alongside a broader review of who can get in.
Key takeaways
See every Application Password. Across all users: name, when it was created, when it was last used, and from which IP.
Revoke with one call. Remove a single Application Password, or all of a user's at once.
Access-security audit. Reviews admin accounts, the default "admin" username, open registration, and password hygiene — each with a severity and a fix, plus a score.
Live login sessions. See who is currently signed in, from what IP and browser, for one user or the whole site.
Self-hosted and safe. It reads from WordPress core, stays on your site, and never returns the secret itself.
Why Application Passwords need auditing
Application Passwords let an external app or service use your site's REST API without your real login. That's convenient — but each one is a standing key. If a tool is retired, a laptop is lost, or you're just not sure what created a credential, that key keeps working until someone revokes it. Most sites have no easy way to list them all. This feature does: every password, every user, with last-used and IP so you can spot the stale or unfamiliar ones and remove them.
A full access review
Beyond credentials, the access audit answers "who can get into this site, and is that safe?" It lists administrators with their last-active date so you can spot dormant admin accounts, flags the classic weak default username "admin", checks whether open registration is on and what role it grants, and reviews Application Password hygiene. Each finding comes with a plain fix, and the whole thing rolls up into a score you can track.
Seeing who's signed in
The login-sessions view reads WordPress's own session tokens to show current logins: the time, expiry, IP address and browser for each active session. An unexpected location or device is worth investigating — and changing that user's password clears their sessions immediately.
Frequently asked questions
What is an Application Password? It's a special credential WordPress issues so an app or service can use your REST API without your main password. Handy, but each one is a standing key that should be revoked when no longer needed.
Will revoking one break my site? It only stops the specific tool using that password from accessing the API. Your normal login and the site itself are unaffected. Revoke ones you don't recognise or no longer use.
Does this show me the actual passwords? No. Secrets are never returned — you see the name, creation date, last-used time and IP, which is what you need to decide whether to keep or revoke each one.
How is the access score calculated? From the findings: high-severity issues (like open registration granting a powerful role) weigh most, warnings less, and informational notes least. Clear the fixes to raise it.
Does any of this leave my server? No. It all reads from WordPress core on your own site. Nothing is sent to GOMAX or any third party.
