Application passwords missing in WordPress? On Hostinger, it’s probably not your security plugin.
Short version: if WordPress’s Application Passwords section has vanished completely — no form, no table, no error, on every account — and you’re on Hostinger, deactivate the bundled “Hostinger Tools” plugin. That was the entire fix.
Why I blamed Wordfence first
This site runs Wordfence, which genuinely does ship a “Disable WordPress application passwords” toggle (Wordfence → All Options → Brute Force Protection). When Wordfence is actually the cause, it says so right on the profile page: “Application passwords have been disabled by Wordfence.”
Mine showed no message at all — the section was just gone. I unchecked Wordfence’s toggle anyway. No change. Also ruled out: Wordfence Login Security, 2FA, the sitewide HTTPS requirement, the Authorization-header-reaching-PHP gotcha, and fully deactivating Wordfence itself. Still missing.
The actual cause
Hostinger auto-installs a plugin called Hostinger Tools on every WordPress site it hosts. Deactivating it brought the section back immediately, no other changes needed. No specific setting inside it was responsible — full deactivation was the fix.
The real lesson: Wordfence tells you when it’s the one blocking something. Total silence means look elsewhere.
You’re not the only one
A WordPress.org thread describes the same symptom — broken whether Wordfence’s toggle was on or off. The poster’s take: “another security-related service ALSO had an option to disable app passwords,” one that, unlike Wordfence, never said so. Wordfence support couldn’t reproduce it either, for the same reason: it wasn’t their plugin. Nobody there pinned down which plugin it actually was, but it’s the same shape of bug — something hosting-adjacent, quietly disabling the feature with no explanation.