Repository navigation
Wordpress Mobile Issue #22965
Description
Description
WordPress Android App - "The provided site does not support Application Password authentication" Error
Error Message
"The provided site does not support Application Password authentication."
Issue Summary
The WordPress Android app has suddenly stopped allowing websites to be added. After entering a website URL, the app immediately displays the above error and never proceeds to the username/password login screen.
This issue started suddenly after previously working normally for at least two days. No deliberate changes were made to the affected websites, Android devices, or network configurations immediately before the issue occurred.
The issue initially appeared on one Android device and later appeared on a second Android device, suggesting this is not device-specific.
Environment
- WordPress Android App
- Multiple Android devices affected
- Multiple independent Wi-Fi networks affected (Vodafone Broadband and BeFibre)
- Mobile data connections continue to work correctly
- WordPress iOS/iPad app continues to work correctly
- Jetpack Android app continues to work correctly
Observed Behaviour
On Android Wi-Fi connections:
- Open WordPress app
- Add Site
- Enter site URL
- App immediately displays:
"The provided site does not support Application Password authentication."
The app never reaches the username/password login screen.
Troubleshooting Performed
The following tests have been completed:
Android App
- Cleared WordPress app cache
- Cleared WordPress app data
- Uninstalled and reinstalled the WordPress app
- Removed and re-added sites
- Tested on multiple Android devices
No change.
Website Validation
Multiple websites were tested, including:
- shmotorswaterside.co.uk
- Other self-hosted WordPress sites
- https://wordpress.org/news
All produce the same error within the Android WordPress app.
Authentication Checks
Confirmed that Application Passwords are available and working:
- Application Passwords section exists in user profiles
- REST API is operational
/wp-json/accessible/wp-json/wp/v2accessible- REST API advertises Application Password support
authorize-application.phpendpoint exists and is accessible- Browser access to WordPress admin works normally
Network Testing
Results are consistent across devices:
Device / Connection | Result -- | -- Android + Wi-Fi | Fails Android + Mobile Data | Works iPad + Same Wi-Fi | Works Android Browser + Same Wi-Fi | Works Jetpack Android App + Same Wi-Fi | WorksThis indicates that:
- The websites themselves are accessible
- Authentication endpoints are accessible
- Browsers can authenticate correctly
- Jetpack can authenticate correctly
- Only the WordPress Android app fails
Additional Notes
The most confusing aspect is that the WordPress Android app previously worked correctly on these same devices and networks, then suddenly began reporting that sites do not support Application Password authentication.
The websites clearly advertise Application Password support via the REST API, and the same sites continue to work in browsers, the Jetpack Android app, and the WordPress iOS/iPad app.
This appears to be either:
- A regression in the WordPress Android app
- An issue with the Android app's site discovery process
- An issue with the Android app's Application Password capability detection logic
Any assistance or confirmation of a known issue would be appreciated.
Step-by-step reproduction instructions
Just logging onto app, you can choose any website
Screenshots, screen recording, code snippet
Environment info
Wordpress ver 7.0, mobile version 26.7
Please confirm that you have searched existing issues in the repo.
- Yes
Activity
dangermattic commentedon Jun 9, 2026
🚫 Please add a type label (e.g. [Type] Enhancement) and a feature label (e.g. Stats) to this issue.
google662 commentedon Jun 9, 2026
I have now tested using IPVanish VPN on the affected Android device while connected to the same Wi-Fi network.
With VPN disabled:
WordPress Android app fails immediately with:
“The provided site does not support Application Password authentication.”
With VPN enabled:
The WordPress Android app proceeds correctly and logs in straight away.
This strongly suggests the issue may be related to routing, DNS, IPv6, ISP-level handling, or the Android app’s discovery/authentication request path over normal Wi-Fi.
It does not appear to be a problem with the WordPress sites themselves.
google662 commentedon Jun 9, 2026
Further update / likely cause
I tested again using IPVanish VPN together with Android Private DNS set to:
dns.google
With this combination enabled, the WordPress Android app logs in successfully.
This suggests the issue is likely related to DNS resolution, ISP DNS handling, IPv6 routing, or the Android app’s pre-login discovery request path when using the default Wi-Fi DNS/network route.
It does not appear to be caused by the WordPress sites themselves, as the same sites work when DNS/routing is changed.
google662 commentedon Jun 9, 2026
Additional Network Testing
Further testing has been completed since the original report:
IPv6 Testing
IPv6 was disabled on a Vodafone broadband router.
The issue remained unchanged.
The WordPress Android app continued to report:
"The provided site does not support Application Password authentication."
This suggests the issue is not solely caused by IPv6 connectivity.
DNS Testing
Android Private DNS was changed to:
dns.google
The issue remained unchanged.
This suggests the issue is not solely caused by DNS resolution.
VPN Testing
When connected to the same Wi-Fi network using IPVanish VPN, the WordPress Android app successfully proceeded with login and site addition.
This indicates that changing the network path appears to affect the behaviour, although the exact mechanism is unclear.
The combination of:
Multiple Android devices affected
Multiple Wi-Fi networks affected
Mobile data working correctly
iOS working correctly
Browser access working correctly
Jetpack Android working correctly
IPv6 disabled with no change
DNS changed with no change
VPN changing behaviour
suggests the issue may lie within the WordPress Android app's site discovery, authentication capability detection, or network handling logic rather than with the WordPress sites themselves.
google662 commentedon Jun 10, 2026
Important Update – IPv6 Finding
Additional testing has identified a strong correlation with IPv6.
On a BeFibre broadband connection:
With IPv6 enabled, the WordPress Android app reports:
"The provided site does not support Application Password authentication."
After disabling IPv6 on the router, the WordPress Android app immediately began working correctly and allowed sites to be added.
However, the behaviour is not fully consistent across all networks:
IPv6 was also disabled on a Vodafone broadband connection, but the issue remained.
This suggests the Android app may be encountering an IPv6-related connectivity, routing, or endpoint discovery issue under certain network conditions rather than a problem with the WordPress sites themselves.
It is worth noting that these same sites previously worked correctly over IPv6 before the issue began.
jkmassel commentedon Aug 31, 2026
@google662 thanks for the detailed notes! It's interesting that IPv6 would affect this, as both transports are HTTP – I wonder if the hosting company flags IPv6+the WordPress REST API as a higher security threat? It might be worth checking if they're flagging anything on their side?