diff --git a/libs/fluxc/src/main/java/org/wordpress/android/fluxc/network/rest/wpapi/applicationpasswords/ApplicationPasswordsManager.kt b/libs/fluxc/src/main/java/org/wordpress/android/fluxc/network/rest/wpapi/applicationpasswords/ApplicationPasswordsManager.kt
index ea38e1403a6a..174c586bfbc5 100644
--- a/libs/fluxc/src/main/java/org/wordpress/android/fluxc/network/rest/wpapi/applicationpasswords/ApplicationPasswordsManager.kt
+++ b/libs/fluxc/src/main/java/org/wordpress/android/fluxc/network/rest/wpapi/applicationpasswords/ApplicationPasswordsManager.kt
@@ -74,7 +74,20 @@ internal class ApplicationPasswordsManager @Inject constructor(
         return if (site.origin == SiteModel.ORIGIN_WPCOM_REST) {
             jetpackApplicationPasswordsRestClient.fetchWPAdminUsername(site)
         } else {
-            UsernameFetchPayload(site.username)
+            val username = site.username
+            if (username.isNullOrEmpty()) {
+                UsernameFetchPayload(
+                    WPAPINetworkError(
+                        BaseNetworkError(
+                            GenericErrorType.NOT_AUTHENTICATED,
+                            "Site username is missing. " +
+                                "The application password was probably authorized using the Web flow"
+                        )
+                    )
+                )
+            } else {
+                UsernameFetchPayload(username)
+            }
         }
     }
 
@@ -83,7 +96,7 @@ internal class ApplicationPasswordsManager @Inject constructor(
         username: String
     ): ApplicationPasswordCreationResult {
         if (!site.supportsApplicationPasswordsGeneration) {
-            ApplicationPasswordCreationResult.Failure(
+            return ApplicationPasswordCreationResult.Failure(
                 WPAPINetworkError(
                     BaseNetworkError(
                         GenericErrorType.NOT_AUTHENTICATED,
diff --git a/libs/fluxc/src/test/java/org/wordpress/android/fluxc/network/rest/wpapi/applicationpasswords/ApplicationPasswordManagerTests.kt b/libs/fluxc/src/test/java/org/wordpress/android/fluxc/network/rest/wpapi/applicationpasswords/ApplicationPasswordManagerTests.kt
index 99c91d22991f..b5de2191d79b 100644
--- a/libs/fluxc/src/test/java/org/wordpress/android/fluxc/network/rest/wpapi/applicationpasswords/ApplicationPasswordManagerTests.kt
+++ b/libs/fluxc/src/test/java/org/wordpress/android/fluxc/network/rest/wpapi/applicationpasswords/ApplicationPasswordManagerTests.kt
@@ -9,6 +9,7 @@ import org.junit.Before
 import org.junit.Test
 import org.mockito.kotlin.mock
 import org.mockito.kotlin.verify
+import org.mockito.kotlin.verifyNoInteractions
 import org.mockito.kotlin.whenever
 import org.wordpress.android.fluxc.model.SiteModel
 import org.wordpress.android.fluxc.network.BaseRequest.BaseNetworkError
@@ -159,6 +160,47 @@ class ApplicationPasswordManagerTests {
             assertEquals(ApplicationPasswordCreationResult.Created(testCredentials), result)
         }
 
+    @Test
+    fun `given a non-jetpack site with no username, when we ask for a password, then return Failure`() =
+        runTest {
+            val site = SiteModel().apply {
+                origin = SiteModel.ORIGIN_XMLRPC
+                url = "http://test-site.com"
+                username = null
+            }
+            whenever(applicationPasswordsStore.getCredentials(site)).thenReturn(null)
+
+            val result = mApplicationPasswordsManager.getApplicationCredentials(site)
+
+            Assert.assertTrue(result is ApplicationPasswordCreationResult.Failure)
+            assertEquals(
+                GenericErrorType.NOT_AUTHENTICATED,
+                (result as ApplicationPasswordCreationResult.Failure).error.type
+            )
+            verifyNoInteractions(mWpApiApplicationPasswordsRestClient)
+        }
+
+    @Test
+    fun `given a non-jetpack site with no password, when we ask for a password, then return Failure`() =
+        runTest {
+            val site = SiteModel().apply {
+                origin = SiteModel.ORIGIN_XMLRPC
+                url = "http://test-site.com"
+                username = "username"
+                password = null
+            }
+            whenever(applicationPasswordsStore.getCredentials(site)).thenReturn(null)
+
+            val result = mApplicationPasswordsManager.getApplicationCredentials(site)
+
+            Assert.assertTrue(result is ApplicationPasswordCreationResult.Failure)
+            assertEquals(
+                GenericErrorType.NOT_AUTHENTICATED,
+                (result as ApplicationPasswordCreationResult.Failure).error.type
+            )
+            verifyNoInteractions(mWpApiApplicationPasswordsRestClient)
+        }
+
     @Test
     fun `when a jetpack site returns 404, then return feature not available`() =
         runTest {