diff --git a/src/wp-admin/user-edit.php b/src/wp-admin/user-edit.php
index 30bc5c8e46..101ac5269c 100644
--- a/src/wp-admin/user-edit.php
+++ b/src/wp-admin/user-edit.php
@@ -733,11 +733,10 @@ endif;
 
 	</table>
 
-
-		<?php if ( wp_is_application_passwords_available_for_user( $user_id ) ) : ?>
 	<div class="application-passwords hide-if-no-js" id="application-passwords-section">
 		<h2><?php _e( 'Application Passwords' ); ?></h2>
 		<p><?php _e( 'Application passwords allow authentication via non-interactive systems, such as XML-RPC or the REST API, without providing your actual password. Application passwords can be easily revoked. They cannot be used for traditional logins to your website.' ); ?></p>
+		<?php if ( wp_is_application_passwords_available_for_user( $user_id ) ) : ?>
 			<?php
 			if ( is_multisite() ) {
 				$blogs       = get_blogs_of_user( $user_id, true );
@@ -797,8 +796,16 @@ endif;
 			$application_passwords_list_table->display();
 			?>
 		</div>
+		<?php else: ?>
+			<p><?php esc_html_e( 'The application password feature requires HTTPS, which is not enabled on this site.' ); ?></p>
+			<p><?php
+			printf(
+				__( 'If this is a development website you can <a href="%s" target="_blank">set the environment type accordingly</a> to enable application passwords.' ),
+				__( 'https://wordpress.org/support/article/editing-wp-config-php/#wp_environment_type' )
+			);
+			?></p>
+		<?php endif; ?>
 	</div>
-<?php endif; ?>
 
 		<?php
 		if ( IS_PROFILE_PAGE ) {