Wordpress Mobile Issue

[google662]

Description

WordPress Android App - "The provided site does not support Application Password authentication" Error

Error Message

"The provided site does not support Application Password authentication."

Issue Summary

The WordPress Android app has suddenly stopped allowing websites to be added. After entering a website URL, the app immediately displays the above error and never proceeds to the username/password login screen.

This issue started suddenly after previously working normally for at least two days. No deliberate changes were made to the affected websites, Android devices, or network configurations immediately before the issue occurred.

The issue initially appeared on one Android device and later appeared on a second Android device, suggesting this is not device-specific.

Environment

• WordPress Android App
• Multiple Android devices affected
• Multiple independent Wi-Fi networks affected (Vodafone Broadband and BeFibre)
• Mobile data connections continue to work correctly
• WordPress iOS/iPad app continues to work correctly
• Jetpack Android app continues to work correctly

Observed Behaviour

On Android Wi-Fi connections:

1. Open WordPress app
2. Add Site
3. Enter site URL
4. App immediately displays:

"The provided site does not support Application Password authentication."

The app never reaches the username/password login screen.

Troubleshooting Performed

The following tests have been completed:

Android App

• Cleared WordPress app cache
• Cleared WordPress app data
• Uninstalled and reinstalled the WordPress app
• Removed and re-added sites
• Tested on multiple Android devices

No change.

Website Validation

Multiple websites were tested, including:

• shmotorswaterside.co.uk
• Other self-hosted WordPress sites
• https://wordpress.org/news

All produce the same error within the Android WordPress app.

Authentication Checks

Confirmed that Application Passwords are available and working:

• Application Passwords section exists in user profiles
• REST API is operational
• /wp-json/ accessible
• /wp-json/wp/v2 accessible
• REST API advertises Application Password support
• authorize-application.php endpoint exists and is accessible
• Browser access to WordPress admin works normally

Network Testing

Results are consistent across devices:

Device / Connection | Result -- | -- Android + Wi-Fi | Fails Android + Mobile Data | Works iPad + Same Wi-Fi | Works Android Browser + Same Wi-Fi | Works Jetpack Android App + Same Wi-Fi | Works

This indicates that:

• The websites themselves are accessible
• Authentication endpoints are accessible
• Browsers can authenticate correctly
• Jetpack can authenticate correctly
• Only the WordPress Android app fails

Additional Notes

The most confusing aspect is that the WordPress Android app previously worked correctly on these same devices and networks, then suddenly began reporting that sites do not support Application Password authentication.

The websites clearly advertise Application Password support via the REST API, and the same sites continue to work in browsers, the Jetpack Android app, and the WordPress iOS/iPad app.

This appears to be either:

• A regression in the WordPress Android app
• An issue with the Android app's site discovery process
• An issue with the Android app's Application Password capability detection logic

Any assistance or confirmation of a known issue would be appreciated.

Step-by-step reproduction instructions

Just logging onto app, you can choose any website

Screenshots, screen recording, code snippet

Environment info

Wordpress ver 7.0, mobile version 26.7

Please confirm that you have searched existing issues in the repo.

• Yes

[dangermattic]

🚫 Please add a type label (e.g. [Type] Enhancement) and a feature label (e.g. Stats) to this issue.

[google662]

I have now tested using IPVanish VPN on the affected Android device while connected to the same Wi-Fi network.

With VPN disabled:

WordPress Android app fails immediately with:
“The provided site does not support Application Password authentication.”

With VPN enabled:

The WordPress Android app proceeds correctly and logs in straight away.

This strongly suggests the issue may be related to routing, DNS, IPv6, ISP-level handling, or the Android app’s discovery/authentication request path over normal Wi-Fi.

It does not appear to be a problem with the WordPress sites themselves.

[google662]

Further update / likely cause

I tested again using IPVanish VPN together with Android Private DNS set to:

dns.google

With this combination enabled, the WordPress Android app logs in successfully.

This suggests the issue is likely related to DNS resolution, ISP DNS handling, IPv6 routing, or the Android app’s pre-login discovery request path when using the default Wi-Fi DNS/network route.

It does not appear to be caused by the WordPress sites themselves, as the same sites work when DNS/routing is changed.

[google662]

Additional Network Testing

Further testing has been completed since the original report:

IPv6 Testing

IPv6 was disabled on a Vodafone broadband router.
The issue remained unchanged.
The WordPress Android app continued to report:
"The provided site does not support Application Password authentication."

This suggests the issue is not solely caused by IPv6 connectivity.

DNS Testing

Android Private DNS was changed to:
dns.google
The issue remained unchanged.

This suggests the issue is not solely caused by DNS resolution.

VPN Testing

When connected to the same Wi-Fi network using IPVanish VPN, the WordPress Android app successfully proceeded with login and site addition.

This indicates that changing the network path appears to affect the behaviour, although the exact mechanism is unclear.

The combination of:

Multiple Android devices affected
Multiple Wi-Fi networks affected
Mobile data working correctly
iOS working correctly
Browser access working correctly
Jetpack Android working correctly
IPv6 disabled with no change
DNS changed with no change
VPN changing behaviour

suggests the issue may lie within the WordPress Android app's site discovery, authentication capability detection, or network handling logic rather than with the WordPress sites themselves.