Gravity Forms recommends one dedicated WordPress user and one application password per MCP agent. During an access review, the WordPress profile may show a blank Last Used value even though a client was configured, or show an address that belongs to a proxy rather than the operator. Revoking from that column alone can break a live workflow or leave an unused credential active.
Use this for Gravity Forms MCP clients, dedicated agent users, WordPress application passwords, reverse proxies, staging clones, rotated credentials, and quarterly access reviews.
Quick answer
Build a read-only credential inventory with user ID, role, application password name and UUID, creation time, Last Used time, Last IP, client owner, environment, MCP endpoint, allowed tools, capabilities, and expected schedule. Correlate the profile row with Gravity Forms MCP execution logs, WordPress authentication logs, reverse-proxy requests, and one harmless read-only tool call. If Last Used remains blank but the call succeeds, record the metadata limitation and rely on the correlated logs. If the credential is unowned, stale, duplicated, or fails the read-only test, create a replacement for the correct dedicated user, switch the named client, verify, then revoke the old password.
Test scenarios to run
Run the same controlled fixture across these branches. Write down the expected result before testing so a surprising response is easy to identify.
| Scenario | Fixture | Expected result |
|---|
| Blank Last Used | Read-only call succeeds | Log limitation documented |
| Blank Last Used | 401 and no logs | Unconfigured or stale |
| Old timestamp | Scheduled client still expected | Investigate before revoke |
| Rotation | New succeeds, old fails | Close credential |
Diagnostic table
Use this table to connect the observed behavior to evidence and a verification step.
| Action | Evidence | Verification |
|---|
| Inventory credential metadata | Export dedicated MCP users, roles, capabilities, application password names and UUIDs, created time, Last Used, Last IP, environment, owner, client, and rotation date without exporting secret values. | Every MCP application password has one owner and client. |
| Correlate MCP and proxy logs | Compare the WordPress profile row with Gravity Forms MCP logs, permission denials, proxy access logs, security-plugin logs, and the client's expected execution schedule. | The read-only canary correlates across client, proxy, and MCP logs. |
| Run one read-only canary | Run one harmless read-only call such as Get Gravity Forms Info or Count Entries for a synthetic form, using the exact named client and UTC timestamp. | Replacement credentials work before old UUIDs are revoked. |
| Rotate the named client | Distinguish never used, metadata not updated, proxy address, stale clone, wrong username, wrong endpoint, failed authentication, and a client still using an older password. | Revoked credentials fail and no active client still uses them. |
What to check first
- Export dedicated MCP users, roles, capabilities, application password names and UUIDs, created time, Last Used, Last IP, environment, owner, client, and rotation date without exporting secret values.
- Compare the WordPress profile row with Gravity Forms MCP logs, permission denials, proxy access logs, security-plugin logs, and the client's expected execution schedule.
- Run one harmless read-only call such as Get Gravity Forms Info or Count Entries for a synthetic form, using the exact named client and UTC timestamp.
- Distinguish never used, metadata not updated, proxy address, stale clone, wrong username, wrong endpoint, failed authentication, and a client still using an older password.
- Rotate one client at a time, verify the replacement, revoke the old UUID, test that the old credential fails, and retain a redacted audit row.
Field notes
- Write the expected result before changing anything and keep one repeatable synthetic fixture for the full test window.
- Record exact versions and UTC timestamps because caches, retries, scheduled actions, and deployments can change the evidence between checks.
- Test the public path and the stored server-side result, not only an admin preview, isolated command, or API response.
- Review the result again after the relevant cache, queue, cron, webhook, and observation window has completed.
Useful command or data shape
Adapt paths, IDs, and privacy handling to the site before running commands or storing data on production.
credential_id,client,environment,last_used,last_ip,mcp_log,decision
7f21...,reporting-agent,production,null,unknown,read-test-pass,document
91ac...,old-client,staging,2026-05-01,proxy-ip,no-recent-log,revoke-after-check
Why this usually happens
- The MCP client was configured but never completed a successful authenticated call.
- A proxy or authentication path prevents the expected application-password metadata update.
- A staging clone contains a credential name but the original client points elsewhere.
- A client silently continued using a previous password after rotation.
Decision rule
Revoke or retain based on a named owner, expected use, successful read-only canary, and correlated logs. A blank profile field by itself is not enough evidence.
Production verification checklist
- Every MCP application password has one owner and client.
- The read-only canary correlates across client, proxy, and MCP logs.
- Replacement credentials work before old UUIDs are revoked.
- Revoked credentials fail and no active client still uses them.
Safe fix order
Use a sequence that makes each result easy to prove. Stop when new evidence changes the scope or owner of the problem.
- Inventory credential metadata
- Correlate MCP and proxy logs
- Run one read-only canary
- Rotate the named client
- Prove old access is revoked
Mistakes to avoid
- Changing production before recording exact versions, UTC timestamps, a stable fixture, the expected result, and a tested rollback point.
- Treating one successful screen as proof while logs, stored records, background jobs, caches, emails, APIs, and downstream systems remain unchecked.
- Testing only as an administrator instead of using the role, device, locale, cache state, request path, and failure branch that users actually reach.
- Leaving debug output, temporary exclusions, helper accounts, duplicate hooks, broad permissions, or relaxed firewall rules active after verification.
Questions teams ask during testing
Can I test this directly in production?
Start with read-only evidence. Use staging for package, code, checkout, form, permission, or cache changes. If a production canary is necessary, make it identifiable, reversible, monitored, and unable to expose personal data or charge a customer.
How do I avoid a false positive?
Repeat the same fixture with the same versions, URL, role, locale, cache state, and downstream integration. Compare the browser result, stored result, and logs instead of relying on one successful screen.
What evidence should I retain?
Keep UTC time, exact versions, request or record ID, expected result, actual result, relevant log lines, change made, rollback point, owner, and final verification. Redact credentials, tokens, and personal data.
When is the work complete?
Close it when the primary path passes, failure branches are understood, stored and downstream records reconcile, temporary changes are removed, monitoring is active, and the owner has the evidence packet.
What to tell the client or owner
Give the owner a concise packet with the affected workflow, exact versions, UTC test time, synthetic fixture ID, expected result, actual result, key logs, change made, rollback point, final result, unresolved risks, owner, and next review date. Remove credentials and personal data before sharing it.
When HandL WP should help
Bring in help when this affects leads, checkout, search visibility, security, paid media reporting, or a client production site. HandL WP can trace the issue through WordPress, hosting, cache, tracking, and Search Console, then verify the workflow after the technical fix.
If this is active on a production site, have HandL WP audit Gravity Forms MCP access.
Related HandL WP guides
Use these related guides when the same issue touches tracking, security, checkout, or crawler visibility.
Helpful references