Rank Math Faces Admin Access Claims

Rank Math, one of the most widely used SEO plugins for WordPress, is facing criticism following claims that it can create administrator-level access to a website without clearly asking the site owner for permission.

The allegations centre on a feature connected to Rank Math’s Help & Support section. According to a developer from The SEO Framework, opening this section while a website is linked to a free Rank Math account can trigger the creation of a WordPress Application Password.

If the person accessing the Help & Support area has administrator permissions, the new application password can also carry those same administrator-level privileges.

Application Password Created Without Clear Consent

Sybre Waaijer, developer of The SEO Framework, raised concerns about the way the feature works.

He claims that Rank Math automatically creates an Application Password when an administrator opens the plugin’s Help & Support section. The credentials are then reportedly sent to servers operated by Group One, the company behind Rank Math and WP Rocket.

The concern is not necessarily about Application Passwords themselves. They are a legitimate WordPress feature designed to allow external applications and services to connect to a website without using the user’s main password.

The issue being raised is how the password is created and whether the website owner has given clear permission for the connection.

Waaijer described the behaviour as particularly concerning because the password may be generated and transferred before the user has actively agreed to the terms presented within the plugin.

How WordPress Application Passwords Normally Work

Application Passwords are built into WordPress and are intended to provide controlled access for individual applications or integrations.

Under WordPress’s recommended process, users should be shown an authorisation screen explaining the connection before credentials are provided. This gives the user an opportunity to approve or reject the request.

WordPress also states that Application Passwords should be revocable, allowing users to remove access for an individual application without changing their main WordPress password.

The allegations against Rank Math therefore raise questions about whether its implementation follows the expected consent process.

WordPress Requires User Consent

WordPress’s plugin guidelines also place restrictions on plugins communicating with external servers.

Plugins are generally expected to obtain explicit and authorised consent before sending information to external services. This is commonly handled through an opt-in option, such as a checkbox or service registration.

The criticism surrounding Rank Math is that users may not realise an Application Password is being generated and transmitted when they open the Help & Support section.

This has led to concerns that website administrators could unknowingly provide an external service with significant access to their WordPress installation.

What Should Rank Math Users Do?

Users who have opened the Help & Support section while their site was connected to a Rank Math account may want to check their WordPress profile for any newly created Application Passwords.

According to Waaijer’s advice, administrators should go to:

WP Admin → Users → Profile → Application Passwords

Users should look for credentials labelled “WAP – Rank Math Support Agent” or other unfamiliar Application Passwords and revoke them if they do not want the integration to have access.

Simply closing the Help & Support window may not remove the credential, so checking the Application Passwords section is important.

Users Voice Their Concerns

The allegations have prompted a strong reaction from some WordPress users, with several questioning why administrator-level access could be created without a more obvious approval process.

Some users have also claimed that discussions about the issue were removed from Rank Math’s support forum, although these claims are allegations and have not been independently established.

Other website owners have said they are considering moving away from Rank Math and looking for alternative SEO plugins.

The controversy is particularly notable given Rank Math’s widespread use across millions of WordPress websites. Any concerns surrounding how the plugin handles administrator credentials could therefore have implications for a large number of site owners.

Rank Math’s Security History

The latest controversy also comes amid previous security concerns involving the plugin.

Search Engine Journal has previously highlighted vulnerabilities affecting Rank Math, including several reported issues over recent years. According to the report, seven vulnerabilities were identified in 2024, four in 2025 and three so far in 2026, including an unauthenticated stored cross-site scripting vulnerability.

Security issues do not necessarily mean that a plugin is unsafe to use, particularly when vulnerabilities are identified and patched. However, the latest allegations are likely to renew questions about how WordPress users should assess the security and permissions of third-party plugins.

What This Means for WordPress Site Owners

The situation is a useful reminder that website owners should regularly review which plugins and services have access to their WordPress sites.

Administrators should keep plugins updated, remove software they no longer use and periodically check their user accounts and Application Passwords for unfamiliar credentials.

For Rank Math users specifically, checking whether a “WAP – Rank Math Support Agent” Application Password has been created could be a sensible precaution while questions around the feature are being addressed.