Password problems are still the single largest source of WordPress compromises. The bots that crawl the public web run brute force attacks every minute of every day, drawing on billions of leaked credentials from past breaches. If your password has appeared in any breach anywhere, it is on a list. If your password is weak, it can be guessed. If your password is reused across services, the breach of one site exposes the rest.
This article is a practical checklist for getting password hygiene right on a WordPress site, especially when more than one person uses the site.
Use a password manager. Genuinely.
This is the single most important step. Pick a reputable password manager and use it for every account, not just WordPress. 1Password, Bitwarden, Dashlane, and KeePassXC are all good choices, with trade offs between cloud sync convenience and self hosted control.
A password manager lets you use unique, long, random passwords for every service without ever needing to remember them. It also fills in passwords automatically, which means you stop typing them, which means phishing pages cannot trick you by impersonating a real login form. The autofill quietly refuses to fill on a fake domain.
Make every password unique
The biggest single mistake is reusing the same password across multiple services. When one of those services gets breached, the leaked password gets tried against every other service it might unlock. Your WordPress admin can be compromised because of a breach at a completely unrelated site.
With a password manager, this is easy. Generate a fresh random password for every account. Save it. Move on. You never type it, you never reuse it, you never see it.
Length over complexity
For a password you do have to remember, like your master password for the password manager, prioritise length over special characters. A passphrase of four to six unrelated words is far stronger than a short string of mixed symbols, and far easier to remember. Modern recommendations from organisations like NIST and the Australian Cyber Security Centre have moved away from complexity rules toward length and uniqueness.
Check passwords against breach databases
Services like Have I Been Pwned maintain a public database of passwords that have appeared in leaks. Many password managers integrate this check directly. If a password you are using has already been exposed, the manager will flag it. Replace it.
This is especially important for older passwords, which may have been compromised in a breach you never heard about.
Rename the default admin username
WordPress brute force attacks usually pair common usernames with common passwords. If your administrator account is called admin, administrator, your business name, or your first name, the attacker has already guessed half the credential. Pick a username that is not guessable.
WordPress does not let you rename a user, but you can create a new administrator with a non guessable name and demote or delete the old one. Be careful to assign content authorship before deleting.
Limit who has administrator access
Every administrator account is another credential that can be compromised. Audit the list. Anyone who only needs to publish posts should be an editor, not an administrator. Anyone who only needs to view stats does not need admin at all. The fewer admin accounts you have, the less surface area you have to defend.
Remove users when they leave
When a staff member or contractor finishes their work, remove their WordPress account immediately. Not in a week, not at the end of the project, the same day. Their password may still be reused on services that get breached later, or their device may still hold a current session, or they may simply log back in for reasons you would rather they did not.
The same logic applies to API keys and application passwords associated with their account. Revoke them all.
Rotate the WordPress salts and keys
WordPress uses a set of secret keys and salts in wp-config.php to sign cookies and protect session data. Rotating these once or twice a year invalidates every existing session, which is a clean reset against any session token that may have been captured. After any incident or any staff change, this is essential.
The WordPress.org secret key generator produces a fresh set in seconds. Paste them into wp-config.php and the rotation is done.
Enable 2FA on every administrator account
Even with all of the above, a password alone is not enough. Two factor authentication closes the gap when something does leak. We covered the practical setup in detail in a previous article. Treat it as non negotiable for any account with administrator or editor role.
Train the team
Password hygiene is not a one person discipline. If anyone on the team falls for a phishing email, reuses a password across services, or writes a password on a sticky note, the rest of the policy collapses. A short, friendly training session every six months keeps the basics fresh.
Cover the password manager, what phishing looks like, why uniqueness matters, and what to do if you suspect a credential has leaked. Most people are willing to follow good practice once it is explained. The friction is usually awareness, not motivation.
Need a hand?
If you would like Smart Coding to audit your WordPress users, set up password manager workflows for the team, enable 2FA across every administrator account, and rotate the keys, get in touch. This is a single afternoon of work that closes most of the password related risk on a WordPress site.
