Hide the Application Passwords menu item on Simple sites

Modules/Sources/WordPressData/Swift/Blog+Features.swift

@@ -54,6 +54,7 @@ import Foundation
     case publicize
     case shareButtons
     case jetpackNewsletter
+    case applicationPasswords
 }
 
 extension Blog {
@@ -137,6 +138,9 @@ extension Blog {
             return supportsShareButtons
         case .jetpackNewsletter:
             return supportsJetpackNewsletter
+        case .applicationPasswords:
+            // Simple sites have no site-level REST API; the app reaches them through the WordPress.com account.
+            return !isHostedAtWPcom || isAtomic
         }
     }
 

Modules/Tests/WordPressDataTests/BlogTests.swift

@@ -347,6 +347,46 @@ struct BlogTests {
         #expect(!blog.supports(.shareButtons))
     }
 
+    // MARK: - Blog Feature: Application Passwords
+
+    @Test func applicationPasswordsNotSupportedForSimpleSites() {
+        let blog = BlogBuilder(mainContext)
+            .isHostedAtWPcom()
+            .with(atomic: false)
+            .build()
+
+        #expect(!blog.supports(.applicationPasswords))
+    }
+
+    @Test func applicationPasswordsSupportedForAtomicSites() {
+        let blog = BlogBuilder(mainContext)
+            .isHostedAtWPcom()
+            .with(atomic: true)
+            .build()
+
+        #expect(blog.supports(.applicationPasswords))
+    }
+
+    @Test func applicationPasswordsSupportedForJetpackSites() {
+        let blog = BlogBuilder(mainContext)
+            .withAccount()
+            .withJetpack(version: "5.6", username: "test_user", email: "user@example.com")
+            .with(isHostedAtWPCom: false)
+            .build()
+
+        #expect(blog.supports(.applicationPasswords))
+    }
+
+    @Test func applicationPasswordsSupportedForSelfHostedSites() {
+        let blog = BlogBuilder(mainContext)
+            .isNotHostedAtWPcom()
+            .with(username: "test_username")
+            .with(password: "test_password")
+            .build()
+
+        #expect(blog.supports(.applicationPasswords))
+    }
+
     // MARK: - Blog Feature: Domains
 
     @Test func blogSupportsDomainsHostedAtWPcom() {

RELEASE-NOTES.txt

@@ -5,6 +5,7 @@
 * [*] [internal] Stop donating screen activities as Siri predictions now that App Shortcuts cover them [#25757]
 * [*] Fix an issue where the Reader tab and Me tab show incorrect state after logging out [#25952]
 * [*] Stats: Open the latest post when tapping the Latest Post Summary card in the Insights tab [#25896]
+* [*] Site menu: Hide Application Passwords for WordPress.com sites that don't support them
 
 27.2
 -----

WordPress/Classes/Login/ApplicationPasswordRequiredView.swift

@@ -165,8 +165,9 @@ struct ApplicationPasswordRequiredView<Content: View>: View {
         static var unsupported: String {
             NSLocalizedString(
                 "applicationPasswordMigration.error.unsupported",
-                value: "This site does not support Application Passwords.",
-                comment: "Error message shown when the site doesn't support Application Passwords feature"
+                value:
+                    "WordPress.com sites are managed through your WordPress.com account, so application passwords aren't available.",
+                comment: "Message shown when a WordPress.com site can't use Application Passwords"
             )
         }
     }

WordPress/Classes/ViewRelated/Blog/Blog Details/BlogDetailsTableViewModel.swift

@@ -849,7 +849,9 @@ private extension BlogDetailsTableViewModel {
             secondSectionRows.append(Row.domains(viewController: viewController))
         }
 
-        secondSectionRows.append(Row.applicationPasswords(viewController: viewController))
+        if blog.supports(.applicationPasswords) {
+            secondSectionRows.append(Row.applicationPasswords(viewController: viewController))
+        }
 
         // Site Settings (always included)
         secondSectionRows.append(Row.siteSettings(viewController: viewController))